diff --git a/apps/presentation/dashboard/smoke/workspace-scope-browser-smoke.mjs b/apps/presentation/dashboard/smoke/workspace-scope-browser-smoke.mjs
index 34a295e7fc..909bfc2df3 100644
--- a/apps/presentation/dashboard/smoke/workspace-scope-browser-smoke.mjs
+++ b/apps/presentation/dashboard/smoke/workspace-scope-browser-smoke.mjs
@@ -54,7 +54,7 @@ try {
   await page.getByRole("navigation", { name: "管家视图" }).getByRole("button", { name: "对话" }).click();
   await scope.click();
   await page.getByRole("option", { name: "notes" }).click();
-  await page.getByText("工作区对话 · 只读").waitFor();
+  await page.getByText("工作区对话 · 读写").waitFor();
   const workspaceUrl = page.url();
   assert.match(workspaceUrl, /[?&]workspace=[0-9a-f]{24}(?:&|$)/u);
   const question = "整理一下最近的素材";
diff --git a/apps/presentation/dashboard/src/data/chat-model.ts b/apps/presentation/dashboard/src/data/chat-model.ts
index e39d350406..66bb18b38e 100644
--- a/apps/presentation/dashboard/src/data/chat-model.ts
+++ b/apps/presentation/dashboard/src/data/chat-model.ts
@@ -1,7 +1,7 @@
 import type { GoalDraft } from "../../../../../loopx/control_plane/collaboration/goal_draft.js";
 export type LoopXModeSettings = { agent_id: string; token_budget: number };
 /** A host-granted workspace an ordinary conversation may be scoped to. */
-export type ChatProject = { project_ref: string; title: string; grant: "workspace_read" };
+export type ChatProject = { project_ref: string; title: string; grant: "workspace_read" | "workspace_write" };
 
 export type ChatTodo = {
   todo_id: string | null;
diff --git a/apps/presentation/dashboard/src/data/chat.ts b/apps/presentation/dashboard/src/data/chat.ts
index cc4a4a62c6..ceb46c31dd 100644
--- a/apps/presentation/dashboard/src/data/chat.ts
+++ b/apps/presentation/dashboard/src/data/chat.ts
@@ -2377,3 +2377,37 @@ export async function updateGoalOwnership(body: { goal_id: string; mode: Executi
     throw error;
   }
 }
+
+
+const privateAgentSessionSchema = z.object({session_id: z.string(), goal_id: z.string(), agent_id: z.string(), executor_endpoint_id: z.string()});
+const privateAgentTargetSchema = privateAgentSessionSchema.extend({target_ref: z.string(), host_ref: z.string(), goal_instance_id: z.string().nullable()});
+const privateConversationSchema = z.object({
+  binding_id: z.string(), app_ref: z.string(), context_kind: z.enum(["project", "steward"]),
+  project_ref: z.string(), project_title: z.string(), context_available: z.boolean(), executor_endpoint_id: z.string(),
+  grant: z.enum(["workspace_read", "workspace_write", "portfolio_read"]), goal_count: z.number().int().default(0), listener_status: z.string(),
+  pending_count: z.number().int(), recovery_count: z.number().int(),
+  agent_candidates: z.array(privateAgentSessionSchema).default([]), agent_targets: z.array(privateAgentTargetSchema).default([]),
+});
+const privateConversationsSchema = z.object({ok: z.literal(true), revision: z.number().int(),
+  connections: z.array(privateConversationSchema)});
+export type PrivateConversation = z.infer<typeof privateConversationSchema>;
+export async function fetchPrivateConversations() {
+  return privateConversationsSchema.parse(await requestJson<unknown>("/api/chat/lark/private-conversations"));
+}
+export async function connectPrivateConversation(appRef: string, projectRef: string, executor: string, contextKind: "project" | "steward" = "project", projectGrant: "workspace_read" | "workspace_write" = "workspace_write") {
+  return privateConversationsSchema.parse(await requestJson<unknown>("/api/chat/lark/private-conversations", {
+    method: "POST", headers: {"Content-Type": "application/json"},
+    body: JSON.stringify({app_ref: appRef, project_ref: projectRef, executor_endpoint_id: executor, context_kind: contextKind, project_grant: projectGrant}),
+  }));
+}
+export async function disconnectPrivateConversation(bindingId: string, revision: number) {
+  return privateConversationsSchema.parse(await requestJson<unknown>("/api/chat/lark/private-conversations", {
+    method: "DELETE", headers: {"Content-Type": "application/json"}, body: JSON.stringify({binding_id: bindingId, revision}),
+  }));
+}
+
+export async function changePrivateAgentTarget(bindingId: string, revision: number, target: {session_id: string} | {target_ref: string}) {
+  return privateConversationsSchema.parse(await requestJson<unknown>("/api/chat/lark/private-conversations/agent-targets", {
+    method: "POST", headers: {"Content-Type": "application/json"}, body: JSON.stringify({binding_id: bindingId, revision, ...target}),
+  }));
+}
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/i18n.tsx b/apps/presentation/dashboard/src/features/personal-workspace/i18n.tsx
index 3f7eaec907..07b8a9c84a 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/i18n.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/i18n.tsx
@@ -1154,6 +1154,7 @@ const en = {
   "header.scopeWorkspacesUnavailable": "Workspaces could not be read",
   "workspace.conversation": "Workspace conversation · {grant}",
   "workspace.grantRead": "read-only",
+  "workspace.grantWrite": "read and write",
   "workspace.grantRevoked": "no longer authorized",
   "workspace.unknownTitle": "Unavailable workspace",
   "workspace.unavailable": "This host no longer authorizes this workspace. The history is kept; new messages will be rejected until it is authorized again.",
@@ -2443,6 +2444,7 @@ const zhCN: Record<WorkspaceMessageKey, string> = {
   "header.scopeWorkspacesUnavailable": "暂时无法读取工作区",
   "workspace.conversation": "工作区对话 · {grant}",
   "workspace.grantRead": "只读",
+  "workspace.grantWrite": "读写",
   "workspace.grantRevoked": "已不再授权",
   "workspace.unknownTitle": "不可用的工作区",
   "workspace.unavailable": "此宿主已不再授权这个工作区。历史记录会保留；重新授权前，新消息会被拒绝。",
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/lark-settings-page.tsx b/apps/presentation/dashboard/src/features/personal-workspace/lark-settings-page.tsx
index 07ef1c6b8a..cade2c603e 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/lark-settings-page.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/lark-settings-page.tsx
@@ -1,3 +1,4 @@
+import {PrivateConversationPanel} from "./private-conversation-panel";
 import { useEffect, useMemo, useRef, useState } from "react";
 import {
   Bot,
@@ -539,6 +540,7 @@ export function LarkSettingsPage({
         </header>
       )}
 
+      <PrivateConversationPanel />
       <nav className="personal-lark-tabs" aria-label={t("lark.management")}>
         <button aria-current={tab === "apps" ? "page" : undefined} onClick={() => setTab("apps")} type="button">{t("lark.apps")} <span>{loading ? "…" : apps.length}</span></button>
         <button aria-current={tab === "connections" ? "page" : undefined} onClick={() => setTab("connections")} type="button">{t("lark.connections")} <span>{loading ? "…" : connections.length}</span></button>
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-page.tsx b/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-page.tsx
index bf97621982..48e95d3fb7 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-page.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-page.tsx
@@ -1877,7 +1877,7 @@ export function PersonalWorkspacePage({
               ],
               value: selectedWorkspaceRef ?? stewardScopeValue,
             } : null}
-            workspaceGrantLabel={selectedWorkspaceRef ? t(workspaceUnavailable ? "workspace.grantRevoked" : "workspace.grantRead") : null}
+            workspaceGrantLabel={selectedWorkspaceRef ? t(workspaceUnavailable ? "workspace.grantRevoked" : selectedWorkspaceProject?.grant === "workspace_write" ? "workspace.grantWrite" : "workspace.grantRead") : null}
             managerChatOpen={managerChatOpen}
             managerChannelBinding={managerChannelBinding}
             managerRuntime={managerRuntime}
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/private-conversation-panel.tsx b/apps/presentation/dashboard/src/features/personal-workspace/private-conversation-panel.tsx
new file mode 100644
index 0000000000..7b60b191e8
--- /dev/null
+++ b/apps/presentation/dashboard/src/features/personal-workspace/private-conversation-panel.tsx
@@ -0,0 +1,124 @@
+import {useEffect, useState} from "react";
+import {connectPrivateConversation, disconnectPrivateConversation, fetchPrivateConversations,
+  changePrivateAgentTarget, fetchChatProjects, fetchChatCapabilities, fetchLarkApps, type PrivateConversation,
+  type ChatProject, type LarkApp} from "../../data/chat";
+import {useWorkspaceI18n} from "./i18n";
+import "./private-conversation.css";
+
+export function PrivateConversationPanel() {
+  const {locale} = useWorkspaceI18n();
+  const zh = locale === "zh-CN";
+  const [apps, setApps] = useState<LarkApp[]>([]);
+  const [projects, setProjects] = useState<ChatProject[]>([]);
+  const [executors, setExecutors] = useState<string[]>([]);
+  const [rows, setRows] = useState<PrivateConversation[]>([]);
+  const [revision, setRevision] = useState(0);
+  const [app, setApp] = useState("");
+  const [project, setProject] = useState("");
+  const [executor, setExecutor] = useState("");
+  const [role, setRole] = useState<"project" | "steward">("project");
+  const [projectGrant, setProjectGrant] = useState<"workspace_read" | "workspace_write">("workspace_write");
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  async function refresh() {
+    const state = await fetchPrivateConversations();
+    setRows(state.connections); setRevision(state.revision);
+  }
+  useEffect(() => {
+    let active = true;
+    Promise.all([fetchLarkApps(), fetchChatProjects(), fetchChatCapabilities(), fetchPrivateConversations()])
+      .then(([apps, projects, capabilities, state]) => {
+        if (!active) return;
+        setApps(apps.filter(app => app.ready && app.app_ref !== "default"));
+        setProjects(projects.projects);
+        const choices = (capabilities.adapters ?? []).filter(row => row.available).map(row => row.agent_id);
+        setExecutors(choices); setExecutor(choices.includes("codex") ? "codex" : choices[0] ?? "");
+        if (projects.projects.length === 1) setProject(projects.projects[0].project_ref);
+        setRows(state.connections); setRevision(state.revision);
+      }).catch(error => {if (active) setError(String(error));});
+    const timer = setInterval(() => {fetchPrivateConversations().then(state => {
+      if (active) {setRows(state.connections); setRevision(state.revision);}
+    }).catch(() => {});}, 5000);
+    return () => {active = false; clearInterval(timer);};
+  }, []);
+
+  function listenerLabel(state: string) {
+    const labels: Record<string, [string, string]> = {starting: ["启动中", "Starting"], listening: ["实时连接就绪", "Live connection ready"],
+      standby: ["等待已有监听服务", "Waiting for the existing listener"], retrying: ["重连中", "Reconnecting"],
+      stopped: ["已停止", "Stopped"], inactive: ["配置未启用", "Inactive"]};
+    return labels[state]?.[zh ? 0 : 1] ?? (zh ? "连接尚未确认" : "Connection unconfirmed");
+  }
+
+  async function act(operation: () => Promise<unknown>) {
+    setBusy(true); setError("");
+    try {await operation(); await refresh();} catch (error) {setError(String(error));}
+    finally {setBusy(false);}
+  }
+  function selectApp(appRef: string) {
+    setApp(appRef);
+    const saved = rows.find(row => row.app_ref === appRef);
+    if (saved) {
+      setProject(saved.project_ref); setExecutor(saved.executor_endpoint_id); setRole(saved.context_kind);
+      setProjectGrant(saved.grant === "workspace_write" ? "workspace_write" : "workspace_read");
+    } else setProjectGrant("workspace_write");
+  }
+  return <section className="personal-detail-card personal-private-conversation" aria-label={zh ? "本人飞书私聊" : "Owner private Chat"}>
+    <h3>{zh ? "本人私聊 · 项目助手与管家" : "Owner private Chat · Project assistant and steward"}</h3>
+    <p>{zh ? "每个 App 单独核验本人。项目助手默认支持工作区读写，按项目规则与 skills 执行编辑；可选只读。普通聊天不创建隐藏 Goal。管家从空 portfolio 开始，只管理在此入口明确确认的新委托。" : "Verify the owner independently for each App. Project Chat defaults to workspace writes under project rules and skills; read-only remains available without hidden Goals. A steward starts with an empty portfolio and manages only new commissions explicitly confirmed here."}</p>
+    {rows.map(row => <article key={row.binding_id}>
+      <strong>{row.app_ref} · {row.context_available ? row.project_title : (zh ? "工作区不可用" : "Workspace unavailable")}</strong>
+      <p>{row.context_kind === "steward" ? (zh ? `LoopX 管家 · ${row.goal_count === 0 ? "暂无已授权的新委托；没有继承旧目标。" : `${row.goal_count} 个已确认的新委托`}` : `LoopX steward · ${row.goal_count} new confirmed commissions; no inherited Goals.`) : (row.grant === "workspace_write" ? (zh ? "普通项目助手 · 已授权工作区读写" : "Project assistant · Workspace writes authorized") : (zh ? "普通项目助手 · 只读对话" : "Project assistant · Read-only Chat"))}</p>
+      <p>{row.executor_endpoint_id} · {zh ? "监听状态" : "Listener"}: {listenerLabel(row.listener_status)}</p>
+      <p>{zh ? `待处理或回复：${row.pending_count}` : `Pending execution or reply: ${row.pending_count}`}</p>
+      {row.recovery_count > 0 ? <p role="status">{zh ? "存在尚未确认的发送回执。服务会读取原回执恢复；不要重新发送同一任务。检查 App 登录、权限和原会话后刷新状态。" : "A send receipt is unconfirmed. The service reads the original receipt to recover; avoid resending the same task. Check this App login, permissions and original Session, then refresh status."}</p> : null}
+      {!row.context_available ? <p role="alert">{zh ? "工作区授权已失效；请恢复原工作区或重新选择。旧会话不会移到其它工作区。" : "The workspace grant is unavailable. Restore the original workspace or select a new one; the old Session will not move."}</p> : null}
+      {row.context_kind === "project" ? <PrivateAgentTargets row={row} revision={revision} zh={zh} busy={busy} act={act}/> : null}
+      <button disabled={busy} onClick={() => void act(() => disconnectPrivateConversation(row.binding_id, revision))} type="button">{zh ? "解绑" : "Disconnect"}</button>
+    </article>)}
+    {rows.length === 0 ? <p>{zh ? "尚未连接本人私聊。" : "No owner private Chat connected."}</p> : null}
+    <label>App<select aria-label={zh ? "私聊 App" : "Private Chat App"} value={app} disabled={busy} onChange={event => selectApp(event.target.value)}>
+      <option value="">{zh ? "选择已验证 App" : "Select a verified App"}</option>
+      {apps.map(app => <option key={app.app_ref} value={app.app_ref}>{app.label} · {app.app_ref}</option>)}
+    </select></label>
+    <label>{zh ? "角色" : "Role"}<select aria-label={zh ? "私聊角色" : "Private Chat role"} value={role} disabled={busy} onChange={event => setRole(event.target.value as "project" | "steward")}>
+      <option value="project">{zh ? "普通项目助手" : "Project assistant"}</option><option value="steward">{zh ? "LoopX 管家（新委托）" : "LoopX steward (new commissions)"}</option>
+    </select></label>
+    <label>{zh ? "工作区" : "Workspace"}<select aria-label={zh ? "私聊工作区" : "Private Chat workspace"} value={project} disabled={busy} onChange={event => setProject(event.target.value)}>
+      <option value="">{zh ? "选择授权工作区" : "Select an authorized workspace"}</option>
+      {projects.map(project => <option key={project.project_ref} value={project.project_ref}>{project.title}</option>)}
+    </select></label>
+    <label>{zh ? "执行器" : "Executor"}<select aria-label={zh ? "私聊执行器" : "Private Chat executor"} value={executor} disabled={busy} onChange={event => setExecutor(event.target.value)}>
+      {executors.map(executor => <option key={executor} value={executor}>{executor}</option>)}
+    </select></label>
+    {role === "project" ? <label>{zh ? "工作区权限" : "Workspace access"}<select aria-label={zh ? "私聊工作区权限" : "Private Chat workspace access"} value={executor === "codex" ? projectGrant : "workspace_read"} disabled={busy || executor !== "codex"} onChange={event => setProjectGrant(event.target.value as "workspace_read" | "workspace_write")}>
+      <option value="workspace_read">{zh ? "只读" : "Read-only"}</option>
+      <option value="workspace_write" disabled={projects.find(item => item.project_ref === project)?.grant === "workspace_read"}>{zh ? "工作区读写（默认）" : "Workspace writes (default)"}</option>
+    </select></label> : null}
+    {role === "project" && executor === "codex" && projectGrant === "workspace_write" ? <p role="status">{zh ? "此 App 可按你的指令编辑选定工作区；不提高已直连 Agent 的原宿主权限。更改权限会建立新绑定和新会话，旧会话不会自动提升权限，已有 Agent 直连需重新授权。" : "This App may edit the selected workspace on your instruction; attached Agents retain their original host permissions. Changing access creates a new binding and Session. Existing Chat does not gain access and Agent targets require new authorization."}</p> : null}
+    <div className="personal-detail-actions"><button disabled={busy || !app || !project || !executor || (role === "project" && executor === "codex" && projectGrant === "workspace_write" && projects.find(item => item.project_ref === project)?.grant === "workspace_read")} onClick={() => void act(() => connectPrivateConversation(app, project, executor, role, role === "project" && executor === "codex" ? projectGrant : "workspace_read"))} type="button">
+      {busy ? (zh ? "正在核验" : "Verifying") : (zh ? "连接本人私聊" : "Connect owner private Chat")}</button>
+      <button disabled={busy} onClick={() => void act(refresh)} type="button">{zh ? "刷新状态" : "Refresh status"}</button></div>
+    <p>{zh ? "从手机发送文字开始；后续消息进入原会话队列。/status 查看工作区、角色与持久排队状态，/help 查看用法与解绑入口，/stop 停止当前聊天执行，/new 开启新会话。图片、文件会明确提示暂不支持。" : "Send text from your phone to begin; follow-ups queue in the same Session. /status shows the workspace, role and durable queue, /help explains commands and where to unbind, /stop stops the current Chat Turn, /new starts a new conversation. Images and files receive an explicit unsupported response."}</p>
+    <p>{zh ? "管家新委托：/delegate --tokens N 具体目标。先读预览，再用原私聊的完整 /confirm 命令确认；15 分钟过期。原生执行保持只读，总 token 上限可能被运行中的请求超过；没有默认定时调度。回执提供 /stop-commission 停止和 /resume-commission 恢复命令；恢复保留原线程及累计用量。" : "Steward commission: /delegate --tokens N objective. Read the preview, then use its full /confirm command in the original private Chat within 15 minutes. Native execution remains read-only; in-flight requests can exceed the total token allowance. No default schedule. Receipts provide /stop-commission and /resume-commission commands; recovery retains the original thread and cumulative usage."}</p>
+    {error ? <p role="alert">{error}</p> : null}
+  </section>;
+}
+
+function PrivateAgentTargets({row, revision, zh, busy, act}: {row: PrivateConversation; revision: number; zh: boolean;
+  busy: boolean; act: (operation: () => Promise<unknown>) => Promise<void>}) {
+  const [session, setSession] = useState("");
+  const candidates = row.agent_candidates.filter(item => !row.agent_targets.some(target => target.session_id === item.session_id));
+  return <div>
+    <p>{zh ? "直连注册 Agent：只授权确切的已有 attached Session。消息进入原宿主队列；此处不创建 Agent、不继承其它目标或提高宿主权限。一个 Session 的 App 受众固定，撤销后也不能换给另一 App。" : "Direct registered Agent: grant an exact existing attached Session. Messages enter its original host queue; this creates no Agent, inherits no other Goals and raises no host permission. The Session audience remains fixed even after revocation."}</p>
+    {row.agent_targets.map(target => <p key={target.target_ref}>{target.agent_id} · {target.goal_id}<br/>
+      <code>/agent {target.target_ref}</code> <button type="button" disabled={busy} onClick={() => void act(() => changePrivateAgentTarget(row.binding_id, revision, {target_ref: target.target_ref}))}>{zh ? "撤销直连授权" : "Revoke direct access"}</button></p>)}
+    <label>{zh ? "已有 Agent 会话" : "Existing Agent Session"}<select value={session} disabled={busy} onChange={event => setSession(event.target.value)}>
+      <option value="">{zh ? "选择确切会话" : "Select exact Session"}</option>
+      {candidates.map(item => <option key={item.session_id} value={item.session_id}>{item.agent_id} · {item.goal_id} · {item.session_id.slice(-6)}</option>)}
+    </select></label>
+    <button type="button" disabled={busy || !candidates.some(item => item.session_id === session)} onClick={() => void act(() => changePrivateAgentTarget(row.binding_id, revision, {session_id: session}))}>{zh ? "授权此 App 直连" : "Grant this App direct access"}</button>
+    {row.agent_candidates.length === 0 ? <p>{zh ? "暂无此工作区的可用 attached Agent 会话。请先在原宿主完成注册和 attached-session-bind；普通聊天仍可直接使用，不需要创建 Goal。" : "No eligible attached Agent Session in this workspace. Register and bind it in its original host first; ordinary Chat remains available without a Goal."}</p> : null}
+    <p>{zh ? "私聊 /agents 查看当前可用授权，复制完整 /agent 命令选择；/project 返回原项目对话。实时停止或新建 Agent 会话请在原宿主处理。" : "Use /agents to list usable grants, select with the full /agent command, and /project to return to project Chat. Stop or create Agent Sessions in their original host."}</p>
+  </div>;
+}
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/private-conversation.css b/apps/presentation/dashboard/src/features/personal-workspace/private-conversation.css
new file mode 100644
index 0000000000..30670e9a36
--- /dev/null
+++ b/apps/presentation/dashboard/src/features/personal-workspace/private-conversation.css
@@ -0,0 +1,20 @@
+.personal-private-conversation { display: grid; gap: 18px; }
+.personal-private-conversation > p { margin: 0; }
+.personal-private-conversation label { display: grid; gap: 8px; font-size: 13px; }
+.personal-private-conversation select {
+  width: 100%; min-height: 40px; padding: 10px 12px;
+  border: 1px solid var(--pw-line-strong); border-radius: 8px;
+  background: var(--pw-card); color: var(--pw-text); font: inherit;
+}
+.personal-private-conversation .personal-detail-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.personal-private-conversation button {
+  justify-self: start; min-height: 36px; padding: 8px 12px;
+  border: 1px solid var(--pw-line-strong); border-radius: 8px;
+  background: var(--pw-card); color: var(--pw-text); cursor: pointer; font-size: 13px;
+}
+.personal-private-conversation button:disabled { color: var(--pw-muted); cursor: default; opacity: .6; }
+.personal-private-conversation :is(button, select):focus-visible { outline: 2px solid var(--pw-blue); outline-offset: 2px; }
+.personal-private-conversation form { display: grid; gap: 12px; }
+.personal-private-conversation form button[type="submit"] { background: var(--pw-text); color: var(--pw-card); }
+.personal-private-conversation [role="alert"] { color: var(--pw-red); }
+.personal-private-conversation [role="status"]:empty { display: none; }
diff --git a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md
index 06ce03f170..eb6c8c8532 100644
--- a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md
+++ b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md
@@ -30,11 +30,188 @@ the TypeScript owner decides context identity and scope. Native Codex resume ret
 the original upstream thread and workspace. HTTP/protocol fixtures qualify that
 continuity and denial behavior; they do not establish real model adoption.
 
-The initial grant is workspace reading for the local owner. Lark audience grants,
-ordinary private-message selection, durable inbound admission independent of
-terminal delivery, and installed/mobile acceptance remain open work in this RFC.
-The App scope does not qualify those journeys or authorize edits; a revoked grant
-keeps the history readable and blocks new messages until the host grants it again.
+The App grant is workspace reading for the local owner. The App scope alone does
+not qualify Lark private-message admission, installed or mobile journeys, or
+authorize edits. A revoked grant keeps the history readable and blocks new
+messages until the host grants it again. The independent Lark checkpoint below
+qualifies its source implementation separately.
+
+The source implementation also has an explicit owner-only Lark private-message
+binding. Settings → Lark selects an independently verified non-default App,
+a current host workspace and executor. Core owns the App-scoped owner/source
+identity, Session context and revocation; the provider stores no separate
+conversation authority. One machine/App lease covers both profile aliases and
+existing group listeners. Replies recheck the original source under that App;
+they do not require group-member scopes for private messages.
+
+Text admission persists the canonical Core Turn without waiting for its terminal
+answer. The existing bounded Session queue keeps follow-ups in FIFO order; another
+App can continue independently. Explicit `/status`, `/stop` and `/new` use the
+shared request owner, and a replay retains the original Session/Turn target.
+A lost admission correlation cannot move a request to a newer Session. Admission
+feedback and final delivery use separate durable provider intents; an ambiguous
+write is read back without blind resend. Unsupported media receives an explicit
+notice. The workspace grant grants neither Goal, portfolio nor peer execution authority.
+
+The packaged settings journey, source revocation/recovery, duplicate events,
+native queue/stop and two-App isolation have synthetic-provider regression and
+browser coverage. A native Codex source canary separately qualifies distinct
+upstream threads with independently observed real App identities. Neither is a
+live Lark/model/mobile result. Installed service qualification, phone journeys,
+registered Agent selection, real incremental/media/permission interactions and
+broader long-running coordination remain open acceptance. Runtime and
+permission-boundary changes require maintainer review before promotion.
+
+The private setup UI composes within Settings → Lark; the App workspace scope
+remains the sole ordinary local conversation entry. Legacy group profiles without
+a stored App identity retain their original profile-hash consumer lease. Requests
+without private bindings do not add provider authentication; configured aliases
+reuse one request-scoped verified identity observation. Lark HTTP composition
+resides in the extension, while the typed binding owner remains provider-neutral.
+
+Synthetic product previews: [desktop](../../assets/personal-workspace/private-project-conversations.png),
+[narrow](../../assets/personal-workspace/private-project-conversations-narrow.png),
+[revoked workspace](../../assets/personal-workspace/private-project-workspace-revoked.png).
+
+## Ordinary workspace writes: default and revocation checkpoint
+
+Ordinary project Chat defaults to `workspace_write` for host-declared roots. The
+Core context owner derives the actual Codex `workspace-write` sandbox on start
+and exact-thread resume; this is conversational work, without Task/Goal mode or
+manager permissions. The project prompt follows workspace `AGENTS.md` and skills,
+permits requested bounded edits, and keeps durable operations with their existing
+owners. A write grant does not activate Material Lifecycle or certify a project
+adapter's intake/ranking workflow.
+
+`loopx chat --project-workspace-grant workspace_read` restricts the host to
+read-only, including Lark bindings. Settings → Lark defaults a Codex project App
+to workspace writes within that host grant and exposes an explicit read-only
+choice. Other executors remain read-only until their host policy is qualified.
+The readback, `/status` and `/help` show the effective grant. Selecting an existing
+App restores its persisted setting. Changing a binding's grant requires a new
+identity and Session, invalidates the old Session for new work, and requires new
+Agent target grants; it cannot silently elevate an attached host or another App.
+Host grant removal or downgrade is rechecked before admission and resume.
+
+Typed Core/HTTP/native-host regressions qualify default writes, explicit read-only,
+workspace identity, independent App grants, old-Session rejection and exact-thread
+resume. A real Codex canary edited and read back a synthetic note under project
+rules while preserving prior text and creating no Goal. It is a host/filesystem
+result, not live Lark write-workflow, material intake or release qualification.
+Maintainer review, installed/Lark journeys and broader IM interactions remain open.
+
+## Bound steward private Chat: explicit new commissions
+
+Settings → Lark can now select a steward role independently of ordinary project
+Chat. The existing typed conversation binding owns its App, verified owner,
+source, workspace and bounded portfolio. A verified empty scope is distinct from
+an unavailable authorization; it contains no inherited Goals and does not certify
+global inventory coverage. Ordinary Chat still has no Goal or manager identity.
+
+Only an explicit `/delegate --tokens N objective` prepares a `goal.create`
+preview. Confirmation must arrive from that exact owner/App/source within fifteen
+minutes. The immutable preview shows the read-only boundary, total native token
+allowance and absence of automatic scheduling. Existing canonical Chat actions
+create the Goal and return their receipt; Core adopts only that exact new creation
+in the configured workspace. Existing Goal and single-workspace fallbacks cannot
+redirect it. Neither normal conversation nor model prose creates a commission.
+
+The existing service worker advances the durable Core request without blocking
+inbound admission. Codex native Goal continuation performs the read-only work;
+its result returns through the original private-source delivery journal.
+`/stop-commission` freezes the execution target at admission, while an explicit
+`/resume-commission ... --tokens N` retains the original Session, native thread,
+objective and cumulative usage. Native completion is host execution evidence,
+not canonical Goal/Todo acceptance. An allowance includes previous usage and
+context; an in-flight request can exceed it. No default heartbeat is enabled.
+
+Portfolio extension refreshes scoped evidence/tools in the same steward thread.
+After creation commits, the existing request journal saves its exact resource
+receipt before attempting portfolio adoption. An adoption or readback failure
+keeps that operation queued for recovery. Recovery rechecks the original
+binding and canonical receipt, adopts the same resources, and returns their
+result without creating another Goal or model thread. Notification cannot
+settle an operation whose adoption is pending. Fault journeys cover adoption
+failure, lost adoption readback, an interrupted creation-owner call and revoked
+binding; they qualify provider/Core IO recovery, not a full host restart.
+App, owner, source and workspace identity remain frozen and rechecked. A silent
+native event reader cannot block the control RPC receipt needed to pause work.
+The provider-specific setup companion belongs to the Lark extension; the
+conversation, request, scope and creation semantics remain in their typed owners.
+
+Regression journeys cover independently verified empty versus missing scope,
+wrong App/source confirmation, expiry, creation/adoption, native result return,
+stop, duplicate events and same-thread recovery. A local actual Codex source
+canary separately exercised a budget-limited synthetic commission and resumed it
+in the same native thread to return verified fixture findings. It did not prove
+real Lark inbound or phone acceptance. Multi-Agent coordination, actual media /
+permission interactions, installed login recovery and mobile journeys remain
+open; runtime/authority promotion still requires maintainer review.
+
+Synthetic product previews: [empty steward and project assistant](../../assets/personal-workspace/private-steward-empty.png),
+[narrow](../../assets/personal-workspace/private-steward-empty-narrow.png).
+
+## Private Chat status and help: scoped observations
+
+`/status` and `/help` use the existing typed bound-request owner to report the
+authorized role, workspace, executor endpoint, native Session/active Turn and
+durable queued-Turn count. Steward status counts only that binding's freshly
+authorized commissions. An executor endpoint is not a selected registered Agent;
+native execution ending is not Goal acceptance or proof of result delivery.
+
+The Core request persists a timestamped observation before provider delivery.
+Duplicate events retain that snapshot instead of switching to a newer Session.
+Missing execution evidence and unknown states stay explicitly unavailable.
+These commands open no Session, invoke no model and create no Goal. `/help`
+shows role-specific commands and the existing Settings → Lark entry for workspace,
+executor and revocation, including the text-only attachment boundary.
+
+Regression coverage uses the production native filesystem store, durable queue,
+bound request and provider admission/reconciliation paths with a synthetic
+provider and protocol executor. It qualifies queue/stop/readback and duplicate
+delivery, not live provider, mobile or installed-service acceptance of this delta.
+The explicit attached-target selection checkpoint below is source-qualified; broader coordination and live acceptance remain open.
+
+## Explicit registered Agent selection: original attached host
+
+Settings → Lark can grant a project App access to an exact existing registered
+Agent's attached Session in that authorized workspace. The typed binding owner
+checks Goal, Agent, Session, executor, Goal lifetime and exact host identity,
+with an independently verified App/owner and revision-fenced publication. Up to
+sixteen explicit target grants fit in one App binding. Executor names alone do
+not select a registered Agent. This creates no Agent or Goal and imports no
+host history, prior bindings or portfolio.
+
+In private Chat, `/agents` lists only currently usable grants. Copy its complete
+`/agent <target-ref>` command to select one; subsequent text enters the original
+canonical Session queue for that existing host to claim and complete.
+`/project` returns to the original ordinary project Session. Accepted messages
+and their replies retain their original target and App/source even after that
+switch or a crash. No model adapter is started or resumed for an attached target.
+The host must already consume its [native attached broker](../../integrations/attached-agent-session-broker.md).
+
+The queue stores its frozen audience and exact target. Host claim revalidates
+the local grant, current registration, workspace, lifetime and host under the
+grant/queue fences. Revocation prevents pending claims and private result
+return; a previously claimed execution still belongs to its host. Session and
+host audience stamps prohibit assigning the same ongoing host conversation to
+another App, including after grant revocation. Inbound and outbound provider
+checks independently verify that App's owner/source. Granting message delivery
+preserves the original host's permissions and claim/completion authority.
+
+`/status` names the actual registered recipient and durable queue. The current
+attached broker has no push interrupt or new-session capability: `/stop` and
+`/new` return an explicit unavailable response and preserve the original host.
+Handle those actions at that host, or use `/project` for ordinary Chat. Settings
+can revoke a target or disconnect the App; stale roots/grants remain unavailable.
+An empty candidate list does not bootstrap roles or fabricate a Goal.
+
+Synthetic provider/native-store journeys qualify selection, follow-up, original
+result return, replay/recovery, revoked pending claims, exact registration and
+cross-App/host refusal. Source type checks and packaged Settings build qualify
+the companion. Live attached-host automation, mobile acceptance, incremental
+media/permission interactions and broader steward coordination remain open.
+This source delta requires maintainer review before installed promotion.
 
 ## Decision: make the App the place where work conversations continue
 
diff --git a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md
index fac2387a73..6be8eb4247 100644
--- a/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md
+++ b/docs/architecture/rfcs/app-conversation-and-async-inbox-v0.zh-CN.md
@@ -25,10 +25,118 @@ grant 授权 peer delegation。
 store，TypeScript 负责上下文身份及范围。原生 Codex 恢复保留原 upstream thread
 和工作区；HTTP/协议 fixture 验证连续性与拒绝行为，不证明真实模型采用了上下文。
 
-首个 grant 仅面向本机 owner 的工作区读取。Lark 受众授权、普通私聊选择、独立于
-terminal delivery 的 durable 入站 admission，以及安装/手机验收仍是本 RFC 的未完成项。
-App 范围入口不代表这些旅程已通过，也不授权修改文件；grant 撤销后历史仍可读，
-新消息在宿主重新授权前被阻止。
+App grant 仅面向本机 owner 的工作区读取。App 范围入口本身不证明 Lark 私聊
+admission、安装或手机旅程已通过，也不授权修改文件；grant 撤销后历史仍可读，
+新消息在宿主重新授权前被阻止。下方独立检查点说明 Lark 的源码实现资格。
+
+本机 owner 的只读工作区入口现已接入独立核验的 Lark App 私聊绑定。既有设置 →
+Lark 页面选择一个非默认 App、当前可用工作区和宿主 executor，读回监听状态、待回复
+数量及恢复缺口；重新绑定不会把旧 Session 移到其它工作区。
+
+共享 typed Core 核验 App、本人、受众和当前工作区 grant，拥有稳定 Session、原生
+Turn FIFO 和确切 stop/new/status 目标。传输层保存独立的受理与最终投递意图，通过
+provider 读回确认回复；发生没有 receipt 的不确定写入时不盲目重发。两 App 复用
+现有服务及按 App 获取的 listener lease，不创建第二套队列、模型 runner 或隐藏 Goal。
+
+源码 canary 已验证打包页面的桌面/窄屏、撤权拒绝与恢复、慢会话期间另一 App 完成、
+后续消息持久排队、exact stop，以及重启后原会话恢复和已确认回复不重复发送。
+这些是合成 provider/协议验收；真实原生 Codex 另行验证独立线程与上下文隔离。
+真实 Lark 收发、安装候选、手机旅程、注册 Agent 选择、媒体/增量/权限回调，以及
+更广的长期协调仍未验收。这一普通项目绑定保持只读，新增管家入口见下一检查点。
+
+私聊配置复用设置 → Lark；App 范围仍是本机普通对话的唯一入口。未存储 App 身份
+的旧群聊 profile 保留原 profile-hash 监听锁键。没有私聊绑定时不增加鉴权；有绑定
+时，同一请求内的别名检查与连接共用一次已验证身份观测。飞书 HTTP 组合位于
+extension，typed binding owner 继续保持 provider-neutral。
+
+![合成私聊工作区设置](../../assets/personal-workspace/private-project-conversations.png)
+![窄屏私聊设置](../../assets/personal-workspace/private-project-conversations-narrow.png)
+![工作区撤权读回](../../assets/personal-workspace/private-project-workspace-revoked.png)
+
+## 本人私聊管家：明确的新委托
+
+设置 → Lark 可为独立 App 选择管家角色。既有 typed conversation binding
+固定 App、独立核验的本人、来源、工作区和有界 portfolio。已核验的空范围与授权
+不可用分开：新管家没有继承旧 Goal；空范围也不证明全局 inventory 覆盖完整。
+普通项目聊天仍没有 Goal 或管家身份。
+
+只有显式 `/delegate --tokens N 具体目标` 会准备既有 `goal.create` 预览。
+确认必须在十五分钟内从原本人、App 和私聊来源进入。预览固定只读边界、原生总
+token 上限和不启用默认调度的事实。既有 canonical Chat action 创建 Goal 并返回
+回执，Core 仅把该确切新创建加入此管家范围。已有 Goal 或单一工作区 fallback
+不能重定向委托；普通聊天和模型文字不能创建委托。
+
+既有服务 worker 推进已持久受理的 Core 操作，入站不等终态。只读工作由 Codex
+原生 Goal continuation 执行，结果经原私聊 delivery journal 返回。
+`/stop-commission` 在受理时固定确切执行目标；显式
+`/resume-commission ... --tokens N` 保留原 Session、原生线程、目标和累计用量。
+原生完成是宿主执行证据，不是 canonical Goal/Todo 验收。总上限包含历史用量与
+上下文，运行中的请求可能超过上限；没有默认 heartbeat。
+
+新委托扩展 portfolio 时，在原管家线程刷新有界证据和工具。创建提交后，既有
+请求日志先保存确切资源回执，再尝试加入管家范围。加入或读回失败时，操作保持
+排队以供恢复。恢复重新核验原 binding 与 canonical 回执，采用同一批资源并
+返回结果，不再创建 Goal 或模型线程。范围加入仍待恢复时，通知回执不能结算
+该操作。故障旅程覆盖加入失败、加入后读回丢失、创建 owner 调用中断及 binding
+撤权；验证的是 provider/Core IO 恢复，不是完整宿主重启。App、本人、来源和
+工作区仍固定并重新核验。原生事件读取在没有输出时，也不能卡住停止所需的控制
+RPC 回执。Lark 专属设置 companion 归 extension；会话、请求、范围和创建语义
+仍由现有 typed owner 持有。
+
+回归覆盖独立空态与无授权、另一 App/来源确认拒绝、过期、创建与 scope adoption、
+原生结果返回、停止、重复事件和同线程恢复。本地真实 Codex 源码 canary 另验证
+合成委托遇到额度限制后，沿用原生线程恢复并返回可核验的 fixture 结果。
+这不证明真实飞书入站或手机验收。多 Agent 协调、真实媒体/权限交互、正式安装与
+登录恢复、手机旅程仍开放；runtime/authority 发布继续等待维护者审核。
+
+合成产品预览：[空管家与项目助手](../../assets/personal-workspace/private-steward-empty.png)、
+[窄视口](../../assets/personal-workspace/private-steward-empty-narrow.png)。
+
+## 私聊状态与帮助：授权范围内的观测
+
+`/status` 与 `/help` 复用既有 typed bound-request owner，展示已授权角色、工作区、
+executor endpoint、原生 Session/active Turn 与已持久排队数量。管家只统计此 binding
+当前获授权的新委托。executor endpoint 不代表已经选择注册 Agent；原生执行结束
+不代表 Goal 验收，也不证明结果已经投递。
+
+Core request 在 provider 投递前保存带时间的观测。重复事件保留原快照，不切换到
+较新的 Session；执行证据缺失和未知状态明确显示不可判定。这两个命令不会打开
+Session、调用模型或创建 Goal。`/help` 按角色列出命令、既有设置 → Lark 的工作区、
+执行器与解绑入口，以及目前仅支持文字的附件边界。
+
+回归使用生产原生文件 store、持久队列、bound request 与 provider 受理/投递路径，
+provider 和协议执行器为合成 fixture。它验证排队、停止、读回和重复投递，不证明
+本增量的真实 provider、手机或正式安装验收。注册 Agent 选择及更广协调仍开放。
+
+## 显式注册 Agent 选择：沿用原 attached 宿主
+
+设置 → Lark 可以为项目 App 授权确切的已有注册 Agent attached Session。
+共享类型化 binding owner 核验工作区、Goal、Agent、Session、执行器、Goal lifetime
+和确切宿主；App/本人独立核验，配置通过 revision fence 发布。每个 App 最多
+16 个明确目标授权；执行器名称不等于注册 Agent 身份。此操作不创建 Agent 或
+Goal，不导入宿主历史、旧绑定或 portfolio。
+
+私聊 `/agents` 只列当前可用授权；复制完整 `/agent <target-ref>` 选择后，后续
+文字进入原 canonical Session 持久队列，由已有宿主领取并写回。`/project`
+返回原普通项目会话。切换或崩溃后，已受理消息仍保持原目标与 App/source，结果
+返回原私聊；不启动或恢复另一 model adapter。原宿主须已接入
+[原生 attached broker](../../integrations/attached-agent-session-broker.md)。
+
+队列保存冻结受众与确切目标。宿主领取前在 grant/queue fences 内重新核验本地
+授权、注册、工作区、lifetime 与宿主；撤销拒绝尚未领取的消息和私聊结果回传，
+已被领取的执行仍归原宿主。Session 与宿主受众 stamp 阻止将同一持续对话分给
+另一 App，包括撤销后重新授权。入站与出站另行核验原 App 的本人/source。
+消息授权保留原宿主的执行策略与领取/完成 authority。
+
+`/status` 展示真实 Agent 接收者与持久队列。当前 attached broker 不支持 push
+interrupt 或新建原宿主会话：`/stop`、`/new` 明确回应不可用，保留原执行；
+请在原宿主处理，或 `/project` 回到普通聊天。设置可撤销目标或解绑 App；
+缺失工作区与失效授权保持不可用。候选空态不会自动建立角色或虚构 Goal。
+
+合成 provider/native-store 旅程覆盖选择、追问、原结果回传、重放/恢复、撤销后
+领取拒绝、确切注册和跨 App/宿主隔离；类型检查与 Settings 打包覆盖产品伴随面。
+真实 attached 宿主自动领取、手机验收、增量媒体/权限交互和更广的管家协调仍开放。
+本源码增量经维护者评审后才能进入正式安装。
 
 ## 决策：让 App 成为工作会话持续进行的地方
 
@@ -413,3 +521,23 @@ Turn HTTP 预算包含既有附件额度的 base64 编码：最多四张图片
 源码验收覆盖 HTTP 准入、会话持久化读回和合成 Codex 协议进程，以及打包后的桌面/窄屏
 图片发送、历史操作卡与拒绝后的草稿恢复。该证据只证明传输和界面行为，不证明真实模型质量、
 公开发布或已安装宿主验收。GQ06 的材料入口及 GQ07–09 的连续性仍须完成各自的交付与恢复验收。
+
+## 普通工作区读写：默认值与撤权检查点
+
+普通项目 Chat 对宿主声明的工作区默认使用 `workspace_write`。Core context owner
+在启动和原线程恢复时导出真实 Codex `workspace-write` 沙箱；仍是普通对话，不借
+Task/Goal 模式或 manager 权限。项目 prompt 要求读取工作区 AGENTS.md 与适用 skills，
+执行明确请求所需的有界编辑；持久状态继续走既有 owner。读写 grant 本身不激活
+Material Lifecycle，也不证明项目 adapter 的 intake/ranking 已接通。
+
+`loopx chat --project-workspace-grant workspace_read` 将宿主及 Lark 项目绑定限制为
+只读。设置 → Lark 的 Codex 项目 App 默认读写，并保留只读选项；其它 executor 在
+宿主策略完成验收前保持只读。设置读回、/status 和 /help 显示实际 grant，重新选择
+已配置 App 会恢复持久配置。改变 grant 会创建新绑定及 Session，拒绝旧会话的新工作，
+直连 Agent 必须重新授权；不能偷偷提高 attached 宿主或另一 App 的权限。宿主撤权或
+降为只读后，入站受理及恢复重新核验授权。
+
+typed Core、HTTP 与原生宿主回归覆盖默认读写、明确只读、工作区身份、App 独立授权、
+旧会话拒绝和原线程恢复。真实 Codex canary 按项目规则编辑并读回合成笔记，保留原文、
+不创建 Goal；这只是宿主/文件系统结果，不代表真实 Lark 写入、素材 intake 或发布完成。
+维护者 review、安装与 Lark 旅程、更多 IM 交互仍未关闭。
diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
index 4908390f4a..3d64f9bccf 100644
--- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
+++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
@@ -410,6 +410,14 @@ Chat, session, collaboration and presentation owners as R2/R3 integration work.
 Do not call a candidate catalog, spinner or queued inbox receipt a completed
 worker handoff. This checkpoint does not lower R1–R3 or G1 gates.
 
+The [ordinary workspace write checkpoint](app-conversation-and-async-inbox-v0.md#ordinary-workspace-writes-default-and-revocation-checkpoint)
+adds default project writes under the host grant, explicit read-only launch/App
+settings and actual Codex sandbox enforcement on start/resume. It reuses the typed
+conversation owner and has no hidden Goal or manager permissions. Synthetic
+Core/HTTP cases and a real host note-edit canary do not establish installed Lark
+workflow readiness or activate a project's Material Lifecycle adapter. R3/S5
+still require original-audience write/readback, revoke/recovery and IM qualification.
+
 ### Attention-cost acceptance: create, connect, collaborate, understand
 
 The [public-safe golden-query pack](../../product/use-cases/steward/golden-queries.md)
diff --git a/docs/assets/personal-workspace/private-project-conversations-narrow.png b/docs/assets/personal-workspace/private-project-conversations-narrow.png
new file mode 100644
index 0000000000..550edff047
Binary files /dev/null and b/docs/assets/personal-workspace/private-project-conversations-narrow.png differ
diff --git a/docs/assets/personal-workspace/private-project-conversations.png b/docs/assets/personal-workspace/private-project-conversations.png
new file mode 100644
index 0000000000..f5a9f9acd4
Binary files /dev/null and b/docs/assets/personal-workspace/private-project-conversations.png differ
diff --git a/docs/assets/personal-workspace/private-project-workspace-revoked.png b/docs/assets/personal-workspace/private-project-workspace-revoked.png
new file mode 100644
index 0000000000..a7ce17a66b
Binary files /dev/null and b/docs/assets/personal-workspace/private-project-workspace-revoked.png differ
diff --git a/docs/assets/personal-workspace/private-steward-empty-narrow.png b/docs/assets/personal-workspace/private-steward-empty-narrow.png
new file mode 100644
index 0000000000..16e0e17b62
Binary files /dev/null and b/docs/assets/personal-workspace/private-steward-empty-narrow.png differ
diff --git a/docs/assets/personal-workspace/private-steward-empty.png b/docs/assets/personal-workspace/private-steward-empty.png
new file mode 100644
index 0000000000..b2162ea7e4
Binary files /dev/null and b/docs/assets/personal-workspace/private-steward-empty.png differ
diff --git a/loopx/attached_session.py b/loopx/attached_session.py
index 2b537ebc28..ec9833403c 100644
--- a/loopx/attached_session.py
+++ b/loopx/attached_session.py
@@ -646,7 +646,7 @@ def resume_attached_agent_session(
         )
 
 
-def enqueue_attached_agent_turn(
+def _enqueue_attached_agent_turn_under_grant(
     *,
     store: ChatSessionStore,
     registry_path: Path | None,
@@ -654,6 +654,7 @@ def enqueue_attached_agent_turn(
     client_turn_id: str,
     message: str,
     origin: str,
+    external_agent_target: dict[str, Any] | None = None,
 ) -> tuple[dict[str, Any], bool]:
     """Enqueue work while the exact attached Session is current."""
 
@@ -662,12 +663,20 @@ def enqueue_attached_agent_turn(
         registry_path=registry_path,
         session_id=session_id,
     ) as (session, registry, current_ref):
+        if external_agent_target is not None:
+            from .registry import load_registry
+            from .capabilities.native_chat.conversation_bindings import validate_external_agent_turn
+            observed_registry = registry or (load_registry(registry_path) if registry_path else {})
+            validate_external_agent_turn(store=store, session=session,
+                goal=find_registry_goal(observed_registry, session["goal_id"]),
+                turn={"origin": origin, "external_agent_target": external_agent_target})
         if registry is None or current_ref is None:
             return store.create_queued_turn(
                 session_id,
                 client_turn_id=client_turn_id,
                 message=message,
                 origin=origin,
+                external_agent_target=external_agent_target,
             )
         decision = _lifecycle_decision(
             operation="admit",
@@ -684,10 +693,23 @@ def enqueue_attached_agent_turn(
             message=message,
             goal_instance_id=str(goal_ref["goal_instance_id"]),
             origin=origin,
+            external_agent_target=external_agent_target,
         )
 
 
-def _claim_attached_turn_once(
+def enqueue_attached_agent_turn(*, store: ChatSessionStore, registry_path: Path | None,
+                                session_id: str, client_turn_id: str, message: str, origin: str,
+                                external_agent_target: dict[str, Any] | None = None) -> tuple[dict[str, Any], bool]:
+    kwargs = dict(store=store, registry_path=registry_path, session_id=session_id,
+                  client_turn_id=client_turn_id, message=message, origin=origin,
+                  external_agent_target=external_agent_target)
+    if external_agent_target is None:
+        return _enqueue_attached_agent_turn_under_grant(**kwargs)
+    with exclusive_file_lock(store.root / "conversation-bindings.json", operation="admit_attached_audience"):
+        return _enqueue_attached_agent_turn_under_grant(**kwargs)
+
+
+def _claim_attached_turn_under_grant(
     *,
     store: ChatSessionStore,
     registry_path: Path | None,
@@ -713,10 +735,17 @@ def _claim_attached_turn_once(
             host_surface=host_surface,
             host_session_id=host_session_id,
         )
+        from .registry import load_registry
+        from .capabilities.native_chat.conversation_bindings import validate_external_agent_turn
+        observed_registry = registry or (load_registry(registry_path) if registry_path and registry_path.exists() else {})
+        goal = find_registry_goal(observed_registry, session["goal_id"])
+        def validate(turn: dict[str, Any]) -> None:
+            validate_external_agent_turn(store=store, session=session, goal=goal, turn=turn)
         if registry is None or current_ref is None:
             return store.claim_next_queued_turn(
                 session_id,
                 host_claim_id=claim_id,
+                admission_validator=validate,
             )
         active_turn_id = str(session.get("active_turn_id") or "")
         active_turn = (
@@ -741,9 +770,18 @@ def _claim_attached_turn_once(
             session_id,
             host_claim_id=claim_id,
             admitted_goal_instance_id=str(goal_ref["goal_instance_id"]),
+            admission_validator=validate,
         )
 
 
+def _claim_attached_turn_once(**kwargs: Any) -> dict[str, Any] | None:
+    # Lock order: audience grants -> source Goal lifetime -> canonical queue.
+    # A revocation cannot race a not-yet-claimed private message into execution.
+    store = kwargs["store"]
+    with exclusive_file_lock(store.root / "conversation-bindings.json", operation="claim_attached_audience"):
+        return _claim_attached_turn_under_grant(**kwargs)
+
+
 def claim_attached_agent_turn(
     *,
     store: ChatSessionStore,
@@ -796,6 +834,7 @@ def claim_attached_agent_turn(
                 "client_turn_id": str(turn.get("client_turn_id") or ""),
                 "claim_id": str(turn.get("host_claim_id") or ""),
                 "origin": str(turn.get("origin") or "external"),
+                **({"external_audience": turn["external_agent_target"]["context"]} if turn.get("external_agent_target") else {}),
                 "message": str(turn.get("message") or ""),
                 "created_at": turn.get("created_at"),
                 "expires_at": turn.get("expires_at"),
diff --git a/loopx/capabilities/native_chat/conversation_bindings.py b/loopx/capabilities/native_chat/conversation_bindings.py
new file mode 100644
index 0000000000..d54c932999
--- /dev/null
+++ b/loopx/capabilities/native_chat/conversation_bindings.py
@@ -0,0 +1,254 @@
+"""Private IO for Core-owned conversation context and audience grants.
+
+Provider observations contain opaque App/owner references, not credentials.
+The typed owner validates configuration, replacement, revocation, and use.
+This file stores no conversation text and creates no Goal or model thread.
+"""
+from __future__ import annotations
+
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+import uuid
+import hashlib
+
+from ...chat_store import _atomic_write_json, _read_json
+from ...control_plane.effect_runtime import EffectRuntimeRejected, effect_runtime_result
+from ...file_lock import exclusive_file_lock
+
+
+class ChatConversationBindings:
+    def __init__(self, *, root: Path, project_contexts: Any,
+                 observe: Callable[[str], dict[str, Any]]) -> None:
+        self.path = root / "conversation-bindings.json"
+        self.projects = project_contexts
+        self.observe = observe
+        self.controller: Any | None = None
+
+    def read(self) -> dict[str, Any]:
+        if not self.path.exists():
+            return {"schema_version": "loopx_chat_conversation_bindings_v0", "revision": 0, "bindings": []}
+        # An unreadable existing grant is not an empty configuration to overwrite.
+        return _read_json(self.path)
+
+    @staticmethod
+    def _core(operation: str, params: dict[str, Any]) -> dict[str, Any]:
+        try:
+            result = effect_runtime_result(operation, params)
+        except EffectRuntimeRejected as exc:
+            raise ValueError(str(exc)) from exc
+        if not isinstance(result, dict):
+            raise ValueError("conversation authority returned an invalid result")
+        return result
+
+    def configure(self, *, transport_ref: str, project_ref: str,
+                  executor_endpoint_id: str, context_kind: str = "project",
+                  project_grant: str | None = None) -> dict[str, Any]:
+        if project_grant is None:
+            project_grant = self.projects.workspace_grant if context_kind == "project" and executor_endpoint_id == "codex" else "workspace_read"
+        if project_grant not in {"workspace_read", "workspace_write"} or (context_kind != "project" and project_grant != "workspace_read"):
+            raise ValueError("workspace write authorization is only available for project Chat")
+        observation = self.observe(transport_ref)
+        candidate = {
+            "schema_version": "loopx_chat_conversation_binding_v0",
+            "binding_id": uuid.uuid4().hex[:24], "transport_ref": transport_ref,
+            "provider_ref": observation["provider_ref"], "operator_ref": observation["operator_ref"],
+            "context_kind": context_kind, "project_ref": project_ref,
+            "executor_endpoint_id": executor_endpoint_id,
+            "grant": project_grant if context_kind == "project" else "portfolio_read", "enabled": True,
+            **({"goal_ids": []} if context_kind == "steward" else {}),
+        }
+        with exclusive_file_lock(self.path, operation="configure_chat_conversation_binding"):
+            current = self.read()
+            previous = next((row for row in current["bindings"] if row["transport_ref"] == transport_ref), None)
+            if previous and all(previous.get(key) == candidate.get(key) for key in ["context_kind", "project_ref", "executor_endpoint_id", "provider_ref", "operator_ref", "grant"]):
+                if previous.get("agent_targets"):
+                    candidate["agent_targets"] = previous["agent_targets"]
+            if (context_kind == "steward" and previous and all(previous.get(key) == candidate.get(key)
+                    for key in ["context_kind", "project_ref", "executor_endpoint_id", "provider_ref", "operator_ref"])):
+                candidate["goal_ids"] = previous["goal_ids"]
+            result = self._core("collaboration.conversation.binding", {
+                "current": current, "expected_revision": current.get("revision"), "operation": "configure",
+                "binding": candidate, "observation": observation, "available_projects": self.projects.available(),
+            })
+            if result["changed"]:
+                _atomic_write_json(self.path, result["state"])
+            readback = self.read()
+            if readback != result["state"]:
+                raise OSError("conversation binding publication did not verify")
+            return next(row for row in readback["bindings"] if row["transport_ref"] == transport_ref)
+
+    def disconnect(self, binding_id: str, *, expected_revision: int) -> dict[str, Any]:
+        with exclusive_file_lock(self.path, operation="disconnect_chat_conversation_binding"):
+            result = self._core("collaboration.conversation.binding", {
+                "current": self.read(), "expected_revision": expected_revision,
+                "operation": "disconnect", "binding_id": binding_id,
+            })
+            if result["changed"]:
+                _atomic_write_json(self.path, result["state"])
+            if self.read() != result["state"]:
+                raise OSError("conversation binding revocation did not verify")
+            return dict(result["state"])
+
+    def resolve(self, *, binding_id: str, source_ref: str, sender_ref: str,
+                private_human_message: bool, session_context: dict[str, Any] | None = None) -> dict[str, Any]:
+        current = self.read()
+        row = next((item for item in current.get("bindings", []) if item.get("binding_id") == binding_id), None)
+        if row is None:
+            raise ValueError("conversation binding is no longer authorized")
+        return self._core("collaboration.conversation.bound_context", {
+            "current": current, "binding_id": binding_id, "source_ref": source_ref, "sender_ref": sender_ref,
+            "private_human_message": private_human_message, "observation": self.observe(row["transport_ref"]),
+            "available_projects": self.projects.available(),
+            **({"session_context": session_context} if session_context is not None else {}),
+        })
+
+    def session_context(self, saved: dict[str, Any]) -> dict[str, Any]:
+        return self.resolve(binding_id=saved["binding_id"], source_ref=saved["source_ref"],
+                            sender_ref=saved["operator_ref"], private_human_message=True, session_context=saved)
+
+    def steward_scope(self, session: dict[str, Any]) -> list[str] | None:
+        saved = session.get("steward_context")
+        if not isinstance(saved, dict):
+            return None
+        selected = self.session_context(saved)
+        if session.get("goal_id") != "loopx-manager" or session.get("channel_id") != selected["channel_id"]:
+            raise ValueError("bound steward audience changed")
+        return list(selected["context"]["goal_ids"])
+
+    def adopt_created_goal(self, *, binding_id: str, source: dict[str, Any], proposal: dict[str, Any],
+                          goal: dict[str, Any]) -> None:
+        selected = self.resolve(binding_id=binding_id, **source)
+        with exclusive_file_lock(self.path, operation="adopt_steward_created_goal"):
+            current = self.read()
+            result = self._core("collaboration.conversation.binding", {
+                "current": current, "expected_revision": current["revision"], "operation": "adopt_created_goal",
+                "binding_id": binding_id, "context": selected["context"], "proposal": proposal,
+                "goal": {"goal_id": goal["id"], "workspace_path": str(Path(goal["repo"]).resolve()),
+                         "creation_operation_id": goal.get("creation_operation_id")},
+            })
+            if result["changed"]:
+                _atomic_write_json(self.path, result["state"])
+            if self.read() != result["state"]:
+                raise OSError("steward scope publication did not verify")
+
+    def agent_observation(self, session_id: str) -> dict[str, Any]:
+        """Read only the explicitly selected canonical attached Session/Goal.
+
+        No host history, remote thread database or prior identity is discovered.
+        """
+        from ...attached_session import require_current_attached_session, _require_bound_host
+        from ...registry import find_registry_goal, load_registry
+        if self.controller is None or self.controller.registry_path is None:
+            raise ValueError("the attached Session registry is unavailable")
+        session = require_current_attached_session(store=self.controller.store,
+            registry_path=self.controller.registry_path, session_id=session_id)
+        registry = load_registry(self.controller.registry_path)
+        goal = find_registry_goal(registry, str(session.get("goal_id") or ""))
+        if goal is None or not goal.get("repo"):
+            raise ValueError("the exact Agent workspace is unavailable")
+        _require_bound_host(goal=goal, agent_id=session["agent_id"], host_surface=session["host_surface"],
+                            host_session_id=session["upstream_thread_id"])
+        return {"session": {key: session.get(key) for key in ["session_id", "goal_id", "goal_instance_id",
+                    "agent_id", "executor_endpoint_id", "session_mode", "status", "external_conversation_binding_id"]},
+                "goal": {"goal_id": goal["id"], "workspace_path": str(Path(goal["repo"]).resolve()),
+                    "registered_agents": (goal.get("coordination") or {}).get("registered_agents", [])},
+                "host_binding_verified": True, "host_ref": _host_ref(session),
+                "host_audience_binding_ids": _host_audiences(self.controller.store, session)}
+
+    def agent_candidates(self, binding_id: str) -> list[dict[str, Any]]:
+        row = next(item for item in self.read()["bindings"] if item["binding_id"] == binding_id)
+        if row["context_kind"] != "project" or self.controller is None:
+            return []
+        project = next((item for item in self.projects.available() if item["project_ref"] == row["project_ref"]), None)
+        if project is None:
+            return []
+        candidates = []
+        for session in self.controller.store.list_sessions():
+            if session.get("session_mode") != "attached_host" or session.get("status") == "closed":
+                continue
+            try:
+                observed = self.agent_observation(session["session_id"])
+                if (observed["session"]["status"] in {"ready", "busy"}
+                        and observed["goal"]["workspace_path"] == project["workspace_path"]
+                        and observed["session"].get("external_conversation_binding_id") in {None, binding_id}
+                        and all(owner == binding_id for owner in observed["host_audience_binding_ids"])):
+                    candidates.append(observed["session"])
+            except (ValueError, OSError, KeyError):
+                continue
+        return candidates[:16]
+
+    def change_agent_target(self, *, binding_id: str, expected_revision: int,
+                            session_id: str | None = None, target_ref: str | None = None) -> dict[str, Any]:
+        with exclusive_file_lock(self.path, operation="configure_conversation_agent_target"):
+            current = self.read()
+            row = next(item for item in current["bindings"] if item["binding_id"] == binding_id)
+            params = {"current": current, "expected_revision": expected_revision, "binding_id": binding_id,
+                      "observation": self.observe(row["transport_ref"]), "available_projects": self.projects.available()}
+            if session_id is not None:
+                observed = self.agent_observation(session_id)
+                target = {key: observed["session"].get(key) for key in ["session_id", "goal_id", "goal_instance_id",
+                    "agent_id", "executor_endpoint_id"]}
+                params.update(operation="grant_agent_target", target={"target_ref": uuid.uuid4().hex[:24], "host_ref": observed["host_ref"], **target},
+                              target_observation=observed)
+            else:
+                params.update(operation="revoke_agent_target", target_ref=target_ref)
+            result = self._core("collaboration.conversation.binding", params)
+            if result["changed"]:
+                if session_id is not None:
+                    self.controller.store.update_session(session_id, external_conversation_binding_id=binding_id)
+                _atomic_write_json(self.path, result["state"])
+            if self.read() != result["state"]:
+                raise OSError("Agent target grant publication did not verify")
+            return result["state"]
+
+    def resolve_agent_target(self, selected: dict[str, Any], target: dict[str, Any]) -> dict[str, Any]:
+        return self._core("collaboration.conversation.agent_target", {"binding": selected["binding"],
+            "context": selected["context"], "target": target,
+            "target_observation": self.agent_observation(target["session_id"])})
+
+
+def validate_external_agent_turn(*, store: Any, session: dict[str, Any],
+                                 goal: dict[str, Any] | None, turn: dict[str, Any]) -> None:
+    """Called under the grant and canonical queue fences before host claim.
+
+    The owner-local grant persists independently of a live provider connection.
+    Admission and result delivery also verify the App/owner with the provider.
+    """
+    saved = turn.get("external_agent_target")
+    if saved is None:
+        return
+    from ...attached_session import _require_bound_host
+    if not isinstance(saved, dict) or turn.get("origin") != "lark" or goal is None:
+        raise ValueError("the attached external audience is unavailable")
+    context, target = saved["context"], saved["target"]
+    if not Path(goal["repo"]).is_dir():
+        raise ValueError("the attached Agent workspace is unavailable")
+    state = _read_json(store.root / "conversation-bindings.json")
+    selected = next((row for row in state["bindings"] if row["binding_id"] == context["binding_id"]), None)
+    if selected is None:
+        raise ValueError("the Agent audience grant was revoked")
+    _require_bound_host(goal=goal, agent_id=session["agent_id"], host_surface=session["host_surface"],
+                        host_session_id=session["upstream_thread_id"])
+    ChatConversationBindings._core("collaboration.conversation.agent_target", {"binding": selected,
+        "context": context, "target": target, "target_observation": {"session": session,
+            "goal": {"goal_id": goal["id"], "workspace_path": str(Path(goal["repo"]).resolve()),
+                     "registered_agents": (goal.get("coordination") or {}).get("registered_agents", [])},
+            "host_binding_verified": True, "host_ref": _host_ref(session),
+            "host_audience_binding_ids": _host_audiences(store, session)}})
+
+
+def _host_ref(session: dict[str, Any]) -> str:
+    return hashlib.sha256(f"{session['host_surface']}\0{session['upstream_thread_id']}".encode()).hexdigest()[:24]
+
+
+def _host_audiences(store: Any, session: dict[str, Any]) -> list[str]:
+    """Content-free stamps in this canonical store, including closed Sessions."""
+    owners = set()
+    for row in store.list_sessions():
+        candidate = store.load_session(row["session_id"])
+        if (candidate and candidate.get("host_surface") == session["host_surface"]
+                and candidate.get("upstream_thread_id") == session["upstream_thread_id"]
+                and candidate.get("external_conversation_binding_id")):
+            owners.add(candidate["external_conversation_binding_id"])
+    return sorted(owners)
diff --git a/loopx/capabilities/native_chat/external_conversations.py b/loopx/capabilities/native_chat/external_conversations.py
new file mode 100644
index 0000000000..2af86d8265
--- /dev/null
+++ b/loopx/capabilities/native_chat/external_conversations.py
@@ -0,0 +1,359 @@
+"""Native Chat admission/recovery IO for explicitly bound external sources.
+
+Sessions and Turns remain in ChatSessionStore. This journal only correlates a
+provider request with those canonical objects; it is not a second queue or model
+runner. Write it before admission so a crash can replay the same client identity.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from datetime import datetime, timedelta, timezone
+import hashlib
+from typing import Any
+
+from ...chat_store import _atomic_write_json, _read_json
+from ...file_lock import exclusive_file_lock
+
+
+class ChatExternalConversations:
+    def __init__(self, controller: Any) -> None:
+        self.controller = controller
+        self.bindings = controller.project_contexts.conversation_bindings
+        self.bindings.controller = controller
+        self.root = controller.store.root / "external-requests"
+        self.actions: Any | None = None
+
+    def admit(self, *, binding_id: str, source: dict[str, Any], request_ref: str,
+              message: str, command: str | None = None) -> dict[str, Any]:
+        import re
+        if not re.fullmatch(r"[a-f0-9]{24}", request_ref):
+            raise ValueError("invalid external request reference")
+        if command not in {None, "agents", "select_agent", "select_project", "status", "help", "new", "stop", "unsupported", "commission", "confirm_commission", "cancel_commission", "stop_commission", "resume_commission"}:
+            raise ValueError("unsupported external conversation command")
+        selected = self.bindings.resolve(binding_id=binding_id, **source)
+        path = self.root / f"{request_ref}.json"
+        with exclusive_file_lock(self.root / "source-fences" / f"{binding_id}.{source['source_ref']}.json", operation="route_external_chat_request"), exclusive_file_lock(path, operation="admit_external_chat_request"):
+            selected = self.bindings.resolve(binding_id=binding_id, **source)
+            expected = {"binding_id": binding_id, "source": source, "message": message, "command": command}
+            if path.exists():
+                row = _read_json(path)
+                if any(row.get(key) != value for key, value in expected.items()):
+                    raise ValueError("external request identity was reused with different content")
+                if row.get("status") != "prepared":
+                    return row
+            else:
+                row = {"schema_version": "loopx_chat_external_request_v0", "request_ref": request_ref,
+                       **expected, "status": "prepared", "session_id": None, "turn_id": None,
+                       "created_at": datetime.now(timezone.utc).isoformat()}
+                _atomic_write_json(path, row)
+            try:
+                return self._admit_prepared(path, row, selected)
+            except ValueError:
+                # Invalid commands and definitive grant denials are terminal
+                # admission outcomes; recovery must not retry them forever.
+                row.update(status="rejected", response="原授权或命令格式不可用，本条未进入执行队列；请用 /agents 或 /project 查看可用入口。")
+                _atomic_write_json(path, row)
+                raise
+
+    def _admit_prepared(self, path: Path, row: dict[str, Any], selected: dict[str, Any]) -> dict[str, Any]:
+        controller = self.controller
+        if not row.get("routing_recorded"):
+            choices = [item for item in self.pending() if item["binding_id"] == row["binding_id"]
+                and item["source"]["source_ref"] == row["source"]["source_ref"]
+                and item.get("selection_recorded")]
+            previous = max(choices, key=lambda item: item.get("selection_order", 0)) if choices else None
+            row.update(routing_recorded=True, agent_target=previous.get("selection_target") if previous else None)
+            _atomic_write_json(path, row)
+        if row["command"] in {"agents", "select_agent", "select_project"}:
+            row["agent_target"] = None
+        target = row.get("agent_target")
+        if target:
+            authority = self.bindings.resolve_agent_target(selected, target)
+            row["agent_audience"] = authority["audience"]
+            current = controller.store.load_session(target["session_id"])
+        else:
+            current = controller.store.latest_session(goal_id=None,
+            agent_id=selected["binding"]["executor_endpoint_id"], channel_id=selected["channel_id"])
+        if row.get("session_id") and row["command"] is None:
+            current = controller.store.load_session(row["session_id"])
+            if current is None:
+                raise ValueError("the original request Session is unavailable")
+            client_id = f"external-{row['request_ref']}"
+            if controller.store.turn_for_client(current["session_id"], client_id) is not None:
+                # The canonical store validates exact replay before its closed
+                # Session check. Never move an accepted request to a new Session.
+                turn, _ = controller.store.create_queued_turn(current["session_id"],
+                    client_turn_id=client_id, message=row["message"], origin="lark",
+                    external_agent_target={"target": target, "context": selected["context"]} if target else None)
+                row.update(status="accepted", turn_id=turn["turn_id"])
+                _atomic_write_json(path, row)
+                return row
+        from ...control_plane.effect_runtime import effect_runtime_result
+        observations = {}
+        if row["command"] in {"status", "help"}:
+            active_id = current.get("active_turn_id") if current else None
+            observations = {"context": selected["context"],
+                "observed_at": datetime.now(timezone.utc).isoformat(),
+                "queued_count": len(controller.store.queued_turns(current["session_id"])) if current else 0,
+                "active_turn": controller.store.load_turn(current["session_id"], active_id) if active_id else None}
+        plan = effect_runtime_result("collaboration.conversation.request", {
+            "request": row, "current_session": current, "binding": selected["binding"],
+            "agent_target": target, **observations})
+        operation = plan["operation"]
+        if operation == "select_recipient":
+            if selected["binding"]["context_kind"] != "project":
+                raise ValueError("Agent selection requires the project assistant")
+            granted = selected["binding"].get("agent_targets", [])
+            choices = []
+            for candidate in granted:
+                try:
+                    self.bindings.resolve_agent_target(selected, candidate)
+                    choices.append(candidate)
+                except (ValueError, OSError, KeyError):
+                    continue
+            if row["command"] == "select_agent":
+                import re
+                match = re.fullmatch(r"/agent ([a-f0-9]{24})", row["message"].strip())
+                chosen = next((item for item in choices if match and item["target_ref"] == match[1]), None)
+                if chosen is None:
+                    raise ValueError("select the exact currently authorized Agent reference")
+                row.update(selection_recorded=True, selection_target=chosen, response=f"已选择 Agent：{chosen['agent_id']}。后续文字进入原宿主持久队列；/project 返回普通项目对话。")
+            elif row["command"] == "select_project":
+                row.update(selection_recorded=True, selection_target=None, response="已返回普通项目对话；保留原项目会话。此前受理的 Agent 消息仍返回原私聊。")
+            else:
+                row["response"] = "当前没有已授权且可用的 Agent。请在本机 Chat → 设置 → Lark，为此 App 明确授权已有 attached Session；名称相似不会获得授权。" if not choices else "可选 Agent（使用确切命令）：\n" + "\n".join(f"{item['agent_id']} · {item['goal_id']}\n/agent {item['target_ref']}" for item in choices)
+            if row.get("selection_recorded"):
+                row["selection_order"] = 1 + max((item.get("selection_order", 0) for item in self.pending()
+                    if item["binding_id"] == row["binding_id"] and item["source"]["source_ref"] == row["source"]["source_ref"]), default=0)
+            row.update(status="command_completed", session_id=None, turn_id=None)
+        elif operation == "steward_action":
+            parsed = self.bindings._core("collaboration.steward.command", {"command": row["command"], "message": row["message"]})
+            if row["command"] in {"stop_commission", "resume_commission"} and not row.get("target_recorded"):
+                if self.actions is None:
+                    raise ValueError("the native commission owner is unavailable")
+                proposal = self.actions.load(parsed["argument"])
+                self.bindings._core("collaboration.steward.authorize_creation", {"context": selected["context"],
+                    "proposal": proposal, "operation": "stop" if row["command"] == "stop_commission" else "resume"})
+                resources = proposal["receipt"]["resource_ids"]
+                target = controller.store.load_session(resources["session_id"])
+                if not target or target["goal_id"] != resources["goal_id"]:
+                    raise ValueError("the exact commission Session is unavailable")
+                row.update(target_recorded=True, target_session_id=target["session_id"],
+                           target_turn_id=target.get("active_turn_id"), target_goal_id=resources["goal_id"])
+                _atomic_write_json(path, row)
+            row.update(status="command_queued", command_argument=parsed, session_id=plan["session_id"],
+                       response="已持久受理此管家操作；正在核验原生操作与回执。")
+        elif operation == "reply":
+            row.update(status="command_completed", session_id=plan["session_id"], response_code=plan["response_code"])
+            if "status_snapshot" in plan:
+                row["status_snapshot"] = plan["status_snapshot"]
+        elif operation in {"new", "stop"}:
+            row.update(target_recorded=True, session_id=plan["session_id"], turn_id=plan["turn_id"])
+            _atomic_write_json(path, row)
+            if operation == "stop" and row["session_id"] and row["turn_id"]:
+                controller.interrupt_turn(session_id=row["session_id"], turn_id=row["turn_id"])
+            elif operation == "new" and row["session_id"]:
+                controller.close_session(row["session_id"])
+            row.update(status="command_completed", response_code=plan["response_code"])
+        else:
+            # Opening uses the shared route fence, canonical grant and native
+            # adapter. It never creates a Goal or waits for a terminal answer.
+            if current is None:
+                current, _ = controller.open_session(goal_id=None,
+                    agent_id=selected["binding"]["executor_endpoint_id"], work_dir=Path("."), objective="",
+                    mode="resume_latest", conversation_binding_id=row["binding_id"], source_context=row["source"])
+            row["session_id"] = current["session_id"]
+            _atomic_write_json(path, row)
+            try:
+                turn, _ = controller.enqueue_turn(session_id=current["session_id"],
+                    client_turn_id=plan["client_turn_id"], message=row["message"],
+                    work_dir=Path("."), objective="", origin="lark",
+                    external_agent_target={"target": target, "context": selected["context"]} if target else None)
+                row.update(status="accepted", turn_id=turn["turn_id"])
+            except RuntimeError as exc:
+                if str(exc) != "session_queue_full":
+                    raise
+                row.update(status="rejected", response="队列已满，本条没有被受理；请稍后重新发送。")
+        _atomic_write_json(path, row)
+        return row
+
+    def pending(self) -> list[dict[str, Any]]:
+        return [_read_json(path) for path in sorted(self.root.glob("*.json"))]
+
+    def read_request(self, request_ref: str) -> dict[str, Any]:
+        return _read_json(self.root / f"{request_ref}.json")
+
+    def commission_evidence(self, session: dict[str, Any]) -> list[dict[str, Any]]:
+        """Read original Core execution facts for this exact bound audience.
+
+        Native terminal status/result delivery is separate from Goal/Todo
+        acceptance. A portfolio reader must not infer one from the other.
+        """
+        saved = session["steward_context"]
+        allowed = set(self.bindings.steward_scope(session) or [])
+        latest: dict[str, dict[str, Any]] = {}
+        for row in sorted(self.pending(), key=lambda row: row.get("created_at", "")):
+            resources = row.get("commission_resources") or {}
+            if (row["binding_id"] == saved["binding_id"] and row["source"]["source_ref"] == saved["source_ref"]
+                    and resources.get("goal_id") in allowed):
+                latest[resources["goal_id"]] = row
+        facts = []
+        for goal_id, row in latest.items():
+            resources = row["commission_resources"]
+            current = self.controller.store.load_session(resources["session_id"])
+            turn = self.controller.store.load_turn(resources["session_id"], resources["turn_id"])
+            if not current or not turn or current.get("goal_id") != goal_id:
+                continue
+            facts.append({"goal_id": goal_id, "turn_status": turn["status"],
+                "native_execution": current.get("native_goal"),
+                "result_delivery_verified": row.get("delivery_verified") is True,
+                "result_excerpt": str((turn.get("response") or {}).get("message") or "")[:500],
+                "canonical_acceptance_attested": False})
+        return facts
+
+    def _run_steward_action(self, row: dict[str, Any]) -> None:
+        """The existing service worker advances a journaled native operation.
+
+        No provider owns Goal authority or a second scheduler. Confirmation is
+        persisted before the canonical action service performs any write.
+        """
+        if self.actions is None:
+            return
+        path = self.root / f"{row['request_ref']}.json"
+        with exclusive_file_lock(path, operation="advance_steward_action"):
+            row = _read_json(path)
+            if row["status"] != "command_queued":
+                return
+            try:
+                selected = self.bindings.resolve(binding_id=row["binding_id"], **row["source"])
+                context = selected["context"]
+                argument = row["command_argument"]["argument"]
+                if row.get("commission_adoption_pending"):
+                    applied = self.actions.load(row["proposal_id"])
+                    self.bindings._core("collaboration.steward.authorize_creation", {
+                        "context": context, "proposal": applied, "now": row["created_at"], "operation": "confirm"})
+                    if (applied.get("status") != "applied"
+                            or applied["receipt"]["resource_ids"] != row["commission_resources"]):
+                        raise ValueError("the applied commission receipt changed")
+                    self._adopt_commission(row, applied)
+                elif row["command"] == "commission":
+                    key = f"steward-commission-{row['request_ref']}"
+                    existing = next((p for p in self.actions.store.list() if p["idempotency_key"] == key), None)
+                    workspace = context["workspace_path"]
+                    expiry = (datetime.fromisoformat(row["created_at"]) + timedelta(minutes=15)).isoformat()
+                    audience = {key: context[key] for key in ["binding_id", "source_ref", "provider_ref", "operator_ref", "project_ref"]}
+                    proposal = existing or self.actions.preview({"action_kind": "goal.create",
+                        "summary": f"新管家委托：{argument[:180]}", "idempotency_key": key,
+                        "context": {"kind": "manager", "goal_id": "loopx-manager", **audience, "expires_at": expiry},
+                        "normalized_parameters": {"goal_id": f"steward-{row['request_ref']}", "title": argument[:180],
+                            "objective": argument, "completion_criteria": "按明确委托返回可核验结果；原生执行结束不代表 LoopX 验收。",
+                            "execution_boundary": "只读所选工作区；不继承旧目标，不自动调度，不扩大宿主策略。",
+                            "agent_id": selected["binding"]["executor_endpoint_id"],
+                            "workspace_ref": "workspace-" + hashlib.sha256(workspace.encode()).hexdigest()[:12],
+                            "heartbeat": {"enabled": False},
+                            "native_token_budget": row["command_argument"]["native_token_budget"]}})
+                    row.update(proposal_id=proposal["proposal_id"], response=(
+                        f"待确认的新委托：{argument}\n只读执行；总 token 上限 {row['command_argument']['native_token_budget']}，运行中请求可能超过该上限。"
+                        "不自动设置长期调度；未继承旧目标。确认后创建 Goal 并启动原生持续执行；其完成状态不等于 LoopX 验收。"
+                        f"\n15 分钟内发送 /confirm {proposal['proposal_id']}；取消请发送 /cancel {proposal['proposal_id']}。"))
+                else:
+                    proposal = self.actions.load(argument)
+                    if proposal is None:
+                        raise ValueError("the exact commission preview is unavailable")
+                    from ...control_plane.effect_runtime import effect_runtime_result
+                    effect_runtime_result("collaboration.steward.authorize_creation", {
+                        "context": context, "proposal": proposal, "now": row["created_at"],
+                        "operation": "stop" if row["command"] == "stop_commission" else
+                                     "resume" if row["command"] == "resume_commission" else "confirm"})
+                    # An authenticated, canonical source selected this exact
+                    # preview; crash replay retains the same confirmation.
+                    row.update(proposal_id=argument, confirmation_recorded=True)
+                    _atomic_write_json(path, row)
+                    if row["command"] == "stop_commission":
+                        if row.get("target_turn_id"):
+                            self.controller.interrupt_turn(session_id=row["target_session_id"], turn_id=row["target_turn_id"])
+                        row["response"] = "已对受理时记录的确切执行请求停止；没有停止其它委托或改变 Goal 验收状态。" if row.get("target_turn_id") else "受理此停止请求时，该委托没有正在执行的消息。"
+                    elif row["command"] == "resume_commission":
+                        goal = self.actions._goal(row["target_goal_id"])
+                        turn, _ = self.controller.submit_turn(session_id=row["target_session_id"],
+                            client_turn_id=f"commission-resume-{row['request_ref']}",
+                            message=f"/goal resume --tokens {row['command_argument']['native_token_budget']}",
+                            work_dir=Path(goal["repo"]), objective=str(goal.get("objective") or ""))
+                        row.update(commission_resources={"goal_id": row["target_goal_id"], "session_id": row["target_session_id"],
+                            "turn_id": turn["turn_id"]}, response=f"已受理原委托的恢复，保留原生线程、目标及累计用量。总 token 上限 {row['command_argument']['native_token_budget']}；结果会返回此私聊。\n停止：/stop-commission {argument}")
+                    elif row["command"] == "cancel_commission":
+                        self.actions.cancel(argument)
+                        row["response"] = "已取消这份新委托预览；没有创建或启动 Goal。"
+                    else:
+                        result = self.actions.apply(argument, steward_context=context, steward_confirmed_at=row["created_at"])
+                        applied = result["proposal"]
+                        if applied.get("status") != "applied":
+                            raise ValueError("the creation preview became stale; prepare a new /delegate request")
+                        resources = applied["receipt"]["resource_ids"]
+                        # Canonical creation has committed. Retain its exact
+                        # receipt before fallible adoption or notification.
+                        row.update(commission_resources=resources, commission_adoption_pending=True,
+                                   commission_gate=bool(result.get("gate")))
+                        _atomic_write_json(path, row)
+                        self._adopt_commission(row, applied)
+                row["status"] = "command_completed"
+            except (OSError, ValueError, KeyError, RuntimeError) as exc:
+                # No automatic wider permission, regenerated preview or new
+                # native thread is used to hide an unavailable operation.
+                if row["command"] == "confirm_commission" and row.get("commission_resources"):
+                    row.update(status="command_queued", commission_adoption_pending=True,
+                               failure_kind=type(exc).__name__,
+                               response="已持久受理此管家操作；正在核验原生操作与回执。")
+                else:
+                    row.update(status="command_completed", failure_kind=type(exc).__name__,
+                        response="管家操作未完成：原工作区、授权、预览有效期或原生执行入口没有通过核验。原操作已保留；请在本机核对回执后再决定是否重试。")
+            _atomic_write_json(path, row)
+
+    def _adopt_commission(self, row: dict[str, Any], applied: dict[str, Any]) -> None:
+        if self.actions is None:
+            raise ValueError("the native commission owner is unavailable")
+        resources = row["commission_resources"]
+        goal = self.actions._goal(resources["goal_id"])
+        self.bindings.adopt_created_goal(binding_id=row["binding_id"], source=row["source"], proposal=applied, goal=goal)
+        row.update(commission_adoption_pending=False, response=(
+            f"原生委托已创建：{resources['goal_id']}。操作回执已读回；处理结果会回到此私聊。没有自动设置调度。"
+            f"\n停止此执行：/stop-commission {row['proposal_id']}"))
+        row.pop("failure_kind", None)
+        if row.get("commission_gate"):
+            row["response"] += "首轮执行有待处理 Gate；请在本机查看该 Goal 的操作回执。"
+
+    def record_delivery(self, request_ref: str, *, session_id: str | None, turn_id: str | None) -> None:
+        # This transport receipt does not alter a canonical Turn or grant.
+        path = self.root / f"{request_ref}.json"
+        with exclusive_file_lock(path, operation="record_external_chat_delivery"):
+            row = _read_json(path)
+            if row.get("commission_adoption_pending"):
+                raise ValueError("commission adoption is pending; notification cannot settle the effect")
+            if (row.get("session_id"), row.get("turn_id")) != (session_id, turn_id):
+                raise ValueError("delivery correlation changed")
+            row["delivery_verified"] = True
+            _atomic_write_json(path, row)
+
+    def recover(self) -> None:
+        for row in self.pending():
+            try:
+                if row.get("delivery_verified") and not row.get("commission_adoption_pending"):
+                    continue
+                self.bindings.resolve(binding_id=row["binding_id"], **row["source"])
+                if row["status"] == "prepared":
+                    self.admit(binding_id=row["binding_id"], source=row["source"], request_ref=row["request_ref"],
+                               message=row["message"], command=row["command"])
+                elif row["status"] == "command_queued":
+                    self._run_steward_action(row)
+                elif row["status"] == "accepted":
+                    if row.get("agent_target"):
+                        self.bindings.resolve_agent_target(self.bindings.resolve(binding_id=row["binding_id"], **row["source"]), row["agent_target"])
+                        continue  # Existing host owns claim and completion; no adapter is resumed.
+                    session = self.controller.store.load_session(row["session_id"])
+                    if session and session.get("status") != "closed":
+                        context = self.controller.project_contexts.session_context(session)
+                        self.controller.resume_session_queue(session_id=row["session_id"],
+                            work_dir=context["project"], objective=context["objective"])
+            except (KeyError, ValueError, RuntimeError, OSError):
+                # Revoked/missing grants never fall back to a new model thread.
+                continue
diff --git a/loopx/capabilities/native_chat/project_context.py b/loopx/capabilities/native_chat/project_context.py
index 83dfed5fbe..a0a4b7364b 100644
--- a/loopx/capabilities/native_chat/project_context.py
+++ b/loopx/capabilities/native_chat/project_context.py
@@ -21,12 +21,26 @@
     "Do not create an implicit Goal or borrow the global manager identity."
 )
 
+PROJECT_WORK_OBJECTIVE = (
+    "Carry out the owner's explicit requests in the selected workspace, preserving "
+    "this Session's context. The explicit workspace write grant permits bounded "
+    "file edits and project workflows. Read and follow the workspace AGENTS.md "
+    "and applicable project skills. Use existing typed owners for durable state; "
+    "do not bypass material authority, intake, ranking or readback gates. The grant "
+    "does not create a LoopX Goal, scheduling, delegation or portfolio access. "
+    "Do not create an implicit Goal or borrow the global manager identity."
+)
+
 
 class ChatProjectContexts:
-    def __init__(self, roots: list[Path]) -> None:
+    def __init__(self, roots: list[Path], *, workspace_grant: str = "workspace_write") -> None:
+        if workspace_grant not in {"workspace_read", "workspace_write"}:
+            raise ValueError("unsupported project workspace grant")
+        self.workspace_grant = workspace_grant
         # Remember the owner's spelling as well as its initial canonical target.
         # A later symlink retarget must not redirect an accepted Session.
         self.roots = [(root.expanduser().absolute(), root.expanduser().resolve()) for root in roots]
+        self.conversation_bindings: Any | None = None
 
     def available(self) -> list[dict[str, str]]:
         contexts = {}
@@ -36,7 +50,7 @@ def available(self) -> list[dict[str, str]]:
             ref = hashlib.sha256(str(canonical).encode("utf-8")).hexdigest()[:24]
             contexts[ref] = {"kind": "project_workspace", "project_ref": ref,
                              "workspace_path": str(canonical), "audience": "local_owner",
-                             "grant": "workspace_read"}
+                             "grant": self.workspace_grant}
         return list(contexts.values())
 
     def resolve(self, project_ref: str, *, session_context: dict[str, Any] | None = None) -> dict[str, Any]:
@@ -49,12 +63,50 @@ def resolve(self, project_ref: str, *, session_context: dict[str, Any] | None =
             raise ValueError(str(exc)) from exc
 
     def session_context(self, session: dict[str, Any]) -> dict[str, Any]:
+        steward = session.get("steward_context")
+        if isinstance(steward, dict):
+            if self.conversation_bindings is None:
+                raise ValueError("bound steward authority is unavailable")
+            selected = self.conversation_bindings.session_context(steward)
+            if session.get("goal_id") != "loopx-manager" or session.get("channel_id") != selected["channel_id"]:
+                raise ValueError("steward audience mismatch")
+            from ...chat_manager import MANAGER_AGENT_OBJECTIVE
+            return {"project": Path(selected["context"]["workspace_path"]), "objective": MANAGER_AGENT_OBJECTIVE,
+                    "title": "Steward"}
         saved = session.get("project_context")
         if not isinstance(saved, dict) or session.get("goal_id") is not None:
             raise ValueError("invalid ordinary project Session")
-        selected = self.resolve(str(saved.get("project_ref") or ""), session_context=saved)
+        if saved.get("audience") == "bound_owner":
+            if self.conversation_bindings is None:
+                raise ValueError("bound project conversation authority is unavailable")
+            selected = self.conversation_bindings.session_context(saved)
+        else:
+            selected = self.resolve(str(saved.get("project_ref") or ""), session_context=saved)
         if session.get("channel_id") != selected["channel_id"]:
             raise ValueError("project conversation channel mismatch")
         return {"project": Path(selected["context"]["workspace_path"]),
-                "objective": PROJECT_CONVERSATION_OBJECTIVE,
+                "objective": PROJECT_WORK_OBJECTIVE if selected["context"]["grant"] == "workspace_write" else PROJECT_CONVERSATION_OBJECTIVE,
                 "title": Path(selected["context"]["workspace_path"]).name}
+
+    def open_bound(self, binding_id: str, source: dict[str, Any], *, executor: str, channel_id: str | None) -> dict[str, Any]:
+        if self.conversation_bindings is None:
+            raise ValueError("bound conversation authority is unavailable")
+        selected = self.conversation_bindings.resolve(binding_id=binding_id, **source)
+        if selected["binding"]["executor_endpoint_id"] != executor:
+            raise ValueError("executor does not match the conversation grant")
+        if channel_id is not None and channel_id != selected["channel_id"]:
+            raise ValueError("bound conversation channel mismatch")
+        steward = selected["binding"]["context_kind"] == "steward"
+        session = {"goal_id": "loopx-manager" if steward else None, "channel_id": selected["channel_id"],
+                   "project_context": None if steward else selected["context"],
+                   "steward_context": selected["context"] if steward else None}
+        return {**session, **self.session_context(session)}
+
+    @staticmethod
+    def initialize_bound_scope(store, session):
+        steward = session.get("steward_context")
+        if not steward:
+            return session
+        from ...chat_manager_context import manager_authorization_scope_id
+        return store.update_session(session["session_id"], manager_authorization_scope_id=manager_authorization_scope_id(
+            steward["goal_ids"], runtime_root=store.root.parent, channel_id=session["channel_id"]))
diff --git a/loopx/chat_action_normalization.py b/loopx/chat_action_normalization.py
index 0a9dcdff85..2d2727d229 100644
--- a/loopx/chat_action_normalization.py
+++ b/loopx/chat_action_normalization.py
@@ -496,6 +496,7 @@ def _normalize(
                     "heartbeat",
                     "stop_condition",
                     "initial_todos",
+                    "native_token_budget",
                 },
             )
             goal_id = _opaque(values.get("goal_id"), field="goal_id")
@@ -508,6 +509,13 @@ def _normalize(
                 "goal_id": goal_id,
                 "title": _text(values.get("title"), field="title", limit=200),
             }
+            if values.get("native_token_budget") is not None:
+                budget = values["native_token_budget"]
+                if type(budget) is not int or not 1 <= budget <= 999_999_999:
+                    raise ValueError("native_token_budget must be an explicit positive token allowance")
+                if values.get("agent_id") != "codex":
+                    raise ValueError("native continuation requires the Codex endpoint")
+                result["native_token_budget"] = budget
             for field in (
                 "objective",
                 "completion_criteria",
diff --git a/loopx/chat_actions.py b/loopx/chat_actions.py
index 1e85e8cdd2..18c8bf341f 100644
--- a/loopx/chat_actions.py
+++ b/loopx/chat_actions.py
@@ -440,6 +440,15 @@ def _project_for_goal_create(
         if not isinstance(parameters, Mapping) or not isinstance(context, Mapping):
             raise ValueError("typed Chat action proposal is malformed")
         workspace_ref = str(parameters.get("workspace_ref") or "current")
+        if context.get("binding_id"):
+            # The native steward freezes its configured workspace. Existing
+            # Goals and the single-Goal fallback cannot redirect a commission.
+            candidates = [root for root in self.workspace_roots if root.is_dir() and (root / ".git").exists()
+                          and workspace_ref == f"workspace-{hashlib.sha256(str(root).encode('utf-8')).hexdigest()[:12]}"]
+            if len(candidates) != 1:
+                raise ValueError("the bound steward workspace is unavailable")
+            return candidates[0], {"id": "", "repo": str(candidates[0]), "domain": "project-goal-control-plane",
+                                  "adapter": {"kind": "generic_project_goal_v0"}}
         goals = registry_goals(self._registry())
         context_goal_id = str(context.get("goal_id") or "").strip()
         source_goal = next(
@@ -750,11 +759,12 @@ def _apply_goal_create(
             first_turn, created = self.runtime_controller.submit_turn(
                 session_id=session_id,
                 client_turn_id=f"goal-start-{proposal_id}",
-                message=(
+                message=(f"/goal start --tokens {parameters['native_token_budget']} {objective}"
+                    if parameters.get("native_token_budget") else (
                     f"开始推进 Goal {goal_id}。先核对目标边界和现有 Todo，"
                     f"首个 Todo：{'；'.join(str(item) for item in (parameters.get('initial_todos') or [])[:3]) or '按目标边界建立首个可验证进展'}。"
                     "然后直接推进并报告可验证结果；遇到权限边界时停止并提出明确 Gate。"
-                ),
+                )),
                 work_dir=project,
                 objective=objective,
             )
@@ -1309,7 +1319,8 @@ def regenerate(self, proposal_id: str) -> dict[str, Any]:
             str(regenerated["proposal_id"]), regenerated_from=proposal_id
         )
 
-    def apply(self, proposal_id: str) -> dict[str, Any]:
+    def apply(self, proposal_id: str, *, steward_context: dict[str, Any] | None = None,
+              steward_confirmed_at: str | None = None) -> dict[str, Any]:
         proposal = self.store.load(proposal_id)
         if proposal is None:
             raise KeyError("typed Chat action proposal was not found")
@@ -1318,6 +1329,14 @@ def apply(self, proposal_id: str) -> dict[str, Any]:
                 "proposal": proposal,
                 "turn": self._turn_from_receipt(proposal.get("receipt")),
             }
+        if (proposal.get("context") or {}).get("binding_id"):
+            if steward_context is None:
+                raise ProtectedActionGate("goal.create", gate={"kind": "authenticated_steward_confirmation_required",
+                    "summary": "Confirm this commission from its original owner private conversation.",
+                    "next_action": "Use the exact /confirm command in the originating Bot before it expires."})
+            from .control_plane.effect_runtime import effect_runtime_result
+            effect_runtime_result("collaboration.steward.authorize_creation", {
+                "context": steward_context, "proposal": proposal, "now": steward_confirmed_at or now_utc().isoformat()})
         if proposal.get("action_kind") == "operation.execute":
             raise ProtectedActionGate(
                 "operation.execute",
diff --git a/loopx/chat_agent.py b/loopx/chat_agent.py
index 096d33578c..902b8e9bc9 100644
--- a/loopx/chat_agent.py
+++ b/loopx/chat_agent.py
@@ -325,6 +325,7 @@ def _turn_prompt(
     context_summary: str = "",
     execution_mode: bool = False,
     runtime_profile: str = "restricted",
+    project_work: bool = False,
 ) -> str:
     envelope = {
         "schema_version": CHAT_AGENT_RESPONSE_SCHEMA_VERSION,
@@ -341,6 +342,8 @@ def _turn_prompt(
         "Use the existing branch and worktree. Commit or push only when the operator task explicitly requests it. "
         "Keep changes bounded to the confirmed Task and stop at any permission, identity, or destructive-operation gate. "
         if execution_mode
+        else "You are the project assistant inside LoopX Chat. Execute the owner's explicit workspace requests using the project's AGENTS.md and applicable skills. "
+        if project_work
         else "You are the planning agent inside LoopX Chat. Work only from the project root. "
     )
     trusted_manager_limits = (
@@ -353,9 +356,17 @@ def _turn_prompt(
         "Use read-only repository commands only when the operator explicitly asks for repository facts or when evidence is required to answer accurately. "
         "Do not use tools for ordinary conversation, exact-wording requests, or status questions that can be answered from the supplied LoopX context. "
         "Do not edit files, mutate LoopX state, create commits, send messages, or request elevated access. "
-        if not execution_mode and runtime_profile != "trusted_owner"
+        if not execution_mode and runtime_profile != "trusted_owner" and not project_work
         else ""
     )
+    if project_work:
+        planning_limits = (
+            "The owner explicitly authorized workspace writes for this App. Perform bounded reversible edits and validation required by the current request. "
+            "This is ordinary project work without a Goal: do not create a hidden Goal, schedule work, discover a portfolio, or assume manager authority. "
+            "Use existing typed owners for durable state and obey project material lifecycle and public/private rules. "
+            "Read skill instructions before using them; a missing authority or source is a concrete gap, never permission to invent a store or import history. "
+            "Commit, publish or send external messages only when the owner explicitly requests them. "
+        )
     protected_action_contract = (
         "For a protected operation (merge, release, deploy, delete, or payment), interpret the operator's semantic intent. "
         "Set protected_action only when the dominant request is to perform exactly one operation now and the operator supplied a concrete target. "
@@ -474,6 +485,7 @@ def start(
         isolate_process_tree: bool = False,
         runtime_profile: str = "restricted",
         sandbox: str | None = None,
+        project_context: dict[str, str] | None = None,
         codex_home: Path | None = None,
         model: str | None = None,
         reasoning_effort: str | None = None,
@@ -493,7 +505,18 @@ def start(
         root = work_dir.resolve()
         if runtime_profile not in {"restricted", "trusted_owner"}:
             raise ValueError("unsupported Codex Chat runtime profile")
-        if execution_mode:
+        if project_context is not None:
+            from .control_plane.effect_runtime import effect_runtime_result
+
+            if execution_mode or goal_id is not None or runtime_profile != "restricted":
+                raise ValueError("ordinary project runtime cannot borrow Goal or manager authority")
+            policy = effect_runtime_result("collaboration.project.session_identity", {"context": project_context})
+            if Path(policy["context"]["workspace_path"]).resolve() != root:
+                raise ValueError("project runtime workspace does not match its context")
+            selected_sandbox = policy["sandbox"]
+            if sandbox is not None and sandbox != selected_sandbox:
+                raise ValueError("project sandbox does not match its workspace grant")
+        elif execution_mode:
             if runtime_profile != "restricted":
                 raise ValueError(
                     "trusted_owner is only valid for the non-execution manager runtime"
@@ -671,6 +694,7 @@ def start(
                     isolate_process_tree=isolate_process_tree,
                     runtime_profile=runtime_profile,
                     sandbox=selected_sandbox,
+                    project_context=project_context,
                     codex_home=runtime_home,
                     model=model,
                     reasoning_effort=reasoning_effort,
@@ -809,7 +833,7 @@ def _check_server_gate(self, message: dict[str, Any]) -> bool:
             raise CodexChatAgentError(
                 "Codex app-server requested host approval",
                 gate=_approval_gate(
-                    "Codex requested host approval during a read-only chat turn."
+                    "Codex requested host approval beyond this Chat session's configured grant."
                 ),
             )
         return False
@@ -835,7 +859,11 @@ def _request(
                 try:
                     message = waiter.get_nowait()
                 except queue.Empty:
-                    with self._message_dispatch_lock:
+                    # A streaming reader can route this RPC response while holding
+                    # the fence. Recheck our waiter instead of waiting for an event.
+                    if not self._message_dispatch_lock.acquire(timeout=0.1):
+                        continue
+                    try:
                         try:
                             message = waiter.get_nowait()
                         except queue.Empty:
@@ -870,6 +898,8 @@ def _request(
                                     continue
                                 self._pending_events.put(message)
                                 continue
+                    finally:
+                        self._message_dispatch_lock.release()
                 if message.get("id") == request_id:
                     if message.get("error"):
                         if method in {
@@ -953,6 +983,7 @@ def send(
                     context_summary=self.context_summary,
                     execution_mode=self.execution_mode,
                     runtime_profile=self.runtime_profile,
+                    project_work=not self.execution_mode and self.sandbox == "workspace-write",
                 ),
             }
         ]
diff --git a/loopx/chat_coordination.py b/loopx/chat_coordination.py
index 9c994256a7..909e688d65 100644
--- a/loopx/chat_coordination.py
+++ b/loopx/chat_coordination.py
@@ -50,6 +50,9 @@ def prepare_turn_context(controller, adapter, session, turn_id, event_sink, *, s
         # so it gets the bounded read inline.
         remote_evidence=not isinstance(adapter, CodexAppServerAdapter),
     )
+    if scope.get("bound_steward") is True and isinstance(context.get("bound_steward"), dict):
+        from .capabilities.native_chat.external_conversations import ChatExternalConversations
+        context["bound_steward"]["executions"] = ChatExternalConversations(controller).commission_evidence(session)
     controller.store.append_event(session_id, turn_id, kind="manager.context", payload=context)
     if scope["kind"] == "external_audience":
         scope_id = str(context.get("authorization_scope_id") or "")
@@ -63,7 +66,11 @@ def prepare_turn_context(controller, adapter, session, turn_id, event_sink, *, s
                     "next_action": "Reconnect the manager to the intended Goal and retry the same message.",
                 },
             )
-        if session.get("manager_authorization_scope_id") != scope_id:
+        if scope.get("bound_steward") is True:
+            # A new, explicitly confirmed commission extends this same owner's
+            # scope. Refresh tools/evidence without manufacturing a new thread.
+            controller.store.update_session(session_id, manager_authorization_scope_id=scope_id)
+        elif session.get("manager_authorization_scope_id") != scope_id:
             adapter.close_session()
             with controller.lock:
                 if controller.adapters.get(session_id) is adapter:
diff --git a/loopx/chat_lark_api.py b/loopx/chat_lark_api.py
index caca356ed5..15b3834263 100644
--- a/loopx/chat_lark_api.py
+++ b/loopx/chat_lark_api.py
@@ -633,6 +633,29 @@ def _lark_connect(self) -> None:
             # setting -- not a stored connection field or a request field --
             # decides which endpoint this connection runs on and which Session
             # it binds. The connection write below records the resolution.
+            private = getattr(getattr(getattr(self.server, "runtime_controller", None), "project_contexts", None), "conversation_bindings", None)
+            selected_profiles = [app_ref] if app_ref else [str(row.get("app_ref") or "") for row in body.get("agent_bindings", [])]
+            provider_runner = self._lark_runner()
+            if private is not None:
+                from .extensions.lark.conversation_identity import identity_ref
+                configured = private.read()["bindings"]
+                # Only active private bindings require the collision check.
+                if configured:
+                    cached_auth = {}
+                    original_runner = provider_runner
+                    def provider_runner(args, cwd, timeout):
+                        key = tuple(args)
+                        if tuple(args[-4:]) != ("auth", "status", "--verify", "--json"):
+                            return original_runner(args, cwd, timeout)
+                        if key not in cached_auth:
+                            cached_auth[key] = original_runner(args, cwd, timeout)
+                        return cached_auth[key]
+                for profile in selected_profiles if configured else []:
+                    if any(row["transport_ref"] == profile for row in configured):
+                        raise ValueError("this App owns a private listener; disconnect it first")
+                    identity = _app_identity_for_private_guard(profile, provider_runner, cli_bin)
+                    if identity and any(row["provider_ref"] == identity_ref(identity) for row in configured):
+                        raise ValueError("this App alias owns a private listener; disconnect it first")
             executor_endpoint_id = (
                 manager_executor_endpoint_default(
                     machine_defaults=steward_machine_defaults(
@@ -733,7 +756,7 @@ def _lark_connect(self) -> None:
                     getattr(self.server, "runtime_controller", None)
                 ),
                 "execute": body.get("execute") is True,
-                "runner": self._lark_runner(),
+                "runner": provider_runner,
                 "cli_bin": cli_bin,
             }
             if app_refs_by_agent is not None:
@@ -806,3 +829,16 @@ def _lark_disconnect(self) -> None:
             return
         self._refresh_lark_goal_topic_runtime()
         self._send_json(packet)
+
+
+def _app_identity_for_private_guard(profile: str, runner: Any, cli_bin: str) -> str:
+    from .extensions.lark.goal_channel_transport import APP_ID_PATTERN, call, json_payload, lark_args
+    result = call(runner, lark_args(cli_bin=cli_bin, profile=profile, tail=["auth", "status", "--verify", "--json"]))
+    payload = json_payload(result)
+    app_id = str(payload.get("appId") or "")
+    identities = payload.get("identities")
+    bot = identities.get("bot") if isinstance(identities, Mapping) else None
+    if (result.get("returncode") != 0 or not APP_ID_PATTERN.fullmatch(app_id)
+            or not isinstance(bot, Mapping) or bot.get("available") is not True or bot.get("verified") is not True):
+        raise ValueError("the App identity could not be verified")
+    return app_id
diff --git a/loopx/chat_manager_context.py b/loopx/chat_manager_context.py
index 38e1595b40..78000bede5 100644
--- a/loopx/chat_manager_context.py
+++ b/loopx/chat_manager_context.py
@@ -425,7 +425,7 @@ def manager_turn_context(
     }
     owner_scope = conversation["private_conversation"]
     scope = conversation["goal_ids"] if owner_scope else authorized_goal_ids
-    if not owner_scope and not scope:
+    if not owner_scope and not scope and not (conversation.get("bound_steward") is True and scope == []):
         return unavailable_manager_context(
             "external_authorization_unavailable",
             evidence_window=_evidence_window(
@@ -583,6 +583,8 @@ def manager_turn_context(
     ).hexdigest()
     if not owner_scope:
         result["authorization_scope_id"] = manager_authorization_scope_id(scope or [], runtime_root=runtime_root, channel_id=session.get("channel_id"))
+    if conversation.get("bound_steward") is True:
+        result["bound_steward"] = {"authorized": True, "goal_count": len(scope or []), "empty": scope == []}
     return result
 
 
diff --git a/loopx/chat_runtime.py b/loopx/chat_runtime.py
index 69d238e0d1..276ca4d5e6 100644
--- a/loopx/chat_runtime.py
+++ b/loopx/chat_runtime.py
@@ -112,7 +112,7 @@ def start(
         *,
         codex_bin: str,
         work_dir: Path,
-        goal_id: str,
+        goal_id: str | None,
         objective: str,
         resume_thread_id: str | None = None,
         startup_timeout_sec: float = 30.0,
@@ -121,6 +121,7 @@ def start(
         execution_mode: bool = False,
         runtime_profile: str = "restricted",
         sandbox: str | None = None,
+        project_context: dict[str, str] | None = None,
         codex_home: Path | None = None,
         model: str | None = None,
         reasoning_effort: str | None = None,
@@ -138,6 +139,7 @@ def start(
                 execution_mode=execution_mode,
                 runtime_profile=runtime_profile,
                 sandbox=sandbox,
+                project_context=project_context,
                 resume_thread_id=resume_thread_id,
                 codex_home=codex_home,
                 model=model,
@@ -373,7 +375,7 @@ def _managed_upstream_mode(session: dict[str, Any]) -> str:
     @staticmethod
     def _session_objective(
         *,
-        goal_id: str,
+        goal_id: str | None,
         objective: str,
         history: list[dict[str, Any]] | None,
         project_coordination: bool = False,
@@ -410,7 +412,10 @@ def _start_adapter(
         project_coordination: bool = False,
         loopx_tools: bool = False,
         executor_model: Mapping[str, str | None] | None = None,
+        project_context: dict[str, str] | None = None,
     ) -> ChatRuntimeAdapter:
+        if project_context is not None and project_context.get("grant") == "workspace_write" and agent_id != "codex":
+            raise ValueError("the selected executor cannot enforce workspace write authorization")
         if (
             manager_runtime is not None
             and manager_runtime.get("runtime_profile") == "trusted_owner"
@@ -439,9 +444,7 @@ def _start_adapter(
                 else None
             )
             if manager_profile is not None:
-                objective = manager_agent_objective(
-                    str(manager_profile["runtime_profile"])
-                )
+                objective = manager_agent_objective(str(manager_profile["runtime_profile"]))
             model_config = (
                 executor_model or manager_model_config(
                     endpoint=agent_id,
@@ -474,6 +477,7 @@ def _start_adapter(
                     if manager_profile is not None
                     else None
                 ),
+                project_context=project_context,
                 model=model_config.get("model"),
                 reasoning_effort=model_config.get("reasoning_effort"),
                 dynamic_tools=(
@@ -562,13 +566,25 @@ def open_session(
         agent_goal_id: str | None = None,
         manager_executor_allocation: Mapping[str, Any] | None = None,
         project_ref: str | None = None,
+        conversation_binding_id: str | None = None,
+        source_context: dict[str, Any] | None = None,
     ) -> tuple[dict[str, Any], bool]:
         capability = next((item for item in self.capabilities() if item["agent_id"] == agent_id), None)
         if mode not in {"resume_latest", "new"}:
             raise ValueError("mode must be resume_latest or new")
         selected_channel = channel_id or f"goal.{goal_id}"
         project_context = None
-        if project_ref is not None:
+        steward_context = None
+        if conversation_binding_id is not None:
+            if goal_id is not None or agent_goal_id is not None or project_ref is not None:
+                raise ValueError("bound project Chat cannot substitute a Goal or workspace")
+            if source_context is None:
+                raise ValueError("bound conversation authority is unavailable")
+            context = self.project_contexts.open_bound(conversation_binding_id, source_context, executor=agent_id, channel_id=channel_id)
+            goal_id, selected_channel = context["goal_id"], context["channel_id"]
+            project_context, steward_context = context["project_context"], context["steward_context"]
+            work_dir, objective = context["project"], context["objective"]
+        elif project_ref is not None:
             if goal_id is not None or agent_goal_id is not None:
                 raise ValueError("ordinary project conversations cannot carry a Goal")
             selected = self.project_contexts.resolve(project_ref)
@@ -649,6 +665,7 @@ def open_session(
                 execution_mode=selected_channel.startswith("task."),
                 project_coordination=conversation_scope({"channel_id": selected_channel, "goal_id": goal_id})["kind"] == "owner_goal",
                 manager_runtime=manager_runtime,
+                project_context=project_context,
                 executor_model=alloc.manager_executor_model(manager_executor_allocation),
             )
             persisted = self.store.create_session(
@@ -661,7 +678,9 @@ def open_session(
                 channel_id=selected_channel,
                 codex_home=str(self.codex_home) if agent_id == "codex" else None,
                 project_context=project_context,
+                steward_context=steward_context,
             )
+            persisted = self.project_contexts.initialize_bound_scope(self.store, persisted)
             if is_manager_channel(selected_channel):
                 assert manager_runtime is not None
                 persisted = self.store.update_session(
@@ -722,6 +741,8 @@ def _ensure_adapter_locked(
         if current_session is None or current_session.get("status") == "closed":
             raise KeyError("chat session was not found")
         session = current_session
+        if session.get("steward_context") is not None:
+            self.project_contexts.session_context(session)
         if session.get("project_context") is not None:
             context = self.project_contexts.session_context(session)
             work_dir, objective = context["project"], context["objective"]
@@ -896,6 +917,7 @@ def _ensure_adapter_locked(
                 executor_model=(alloc.manager_executor_model(model_allocation)
                     if model_allocation is not None else alloc.restored_executor_model(session)),
                 manager_runtime=manager_runtime,
+                project_context=session.get("project_context"),
             )
             if session.get("upstream_mode") == CODEX_GOAL_CHAT_MODE:
                 try:
@@ -976,7 +998,11 @@ def submit_turn(
         session = self.store.load_session(session_id)
         if session is None:
             raise KeyError("chat session was not found")
+        if session.get("steward_context") is not None:
+            raise ValueError("bound steward Chat requires its external source admission")
         if session.get("project_context") is not None:
+            if session["project_context"].get("audience") == "bound_owner":
+                raise ValueError("bound project Chat requires its external source admission")
             context = self.project_contexts.session_context(session)
             work_dir, objective = context["project"], context["objective"]
             if loopx_execution:
@@ -1103,6 +1129,12 @@ def steer_active_turn(
         session = self.store.load_session(session_id)
         if session is None or session.get("status") == "closed":
             raise KeyError("chat session was not found")
+        if session.get("steward_context") is not None:
+            raise ValueError("bound steward Chat requires its external source admission")
+        if session.get("project_context") is not None:
+            if session["project_context"].get("audience") == "bound_owner":
+                raise ValueError("bound project steering requires its external source admission")
+            self.project_contexts.session_context(session)
         if session.get("session_mode") == CHAT_SESSION_MODE_ATTACHED:
             session = require_current_attached_session(
                 store=self.store,
@@ -1230,15 +1262,20 @@ def enqueue_turn(
         work_dir: Path,
         objective: str,
         origin: str = "external",
+        external_agent_target: dict[str, Any] | None = None,
     ) -> tuple[dict[str, Any], bool]:
         """Persist a bounded same-Session Turn and dispatch it in FIFO order."""
 
         session = self.store.load_session(session_id)
         if session is None or session.get("status") == "closed":
             raise KeyError("chat session was not found")
+        if session.get("steward_context") is not None:
+            if origin != "lark":
+                raise ValueError("bound steward Chat requires its external source admission")
+            self.project_contexts.session_context(session)
         if session.get("project_context") is not None:
-            if origin != "web":
-                raise ValueError("local project grant does not authorize an external audience")
+            if conversation_scope(session, origin=origin)["kind"] != "project_workspace":
+                raise ValueError("project grant does not authorize this external audience or source")
             context = self.project_contexts.session_context(session)
             work_dir, objective = context["project"], context["objective"]
         if session.get("session_mode") == CHAT_SESSION_MODE_ATTACHED:
@@ -1249,8 +1286,11 @@ def enqueue_turn(
                 client_turn_id=client_turn_id,
                 message=message,
                 origin=origin,
+                external_agent_target=external_agent_target,
             )
         else:
+            if external_agent_target is not None:
+                raise ValueError("Agent target requires its original attached Session")
             turn, created = self.store.create_queued_turn(
                 session_id,
                 client_turn_id=client_turn_id,
diff --git a/loopx/chat_server.py b/loopx/chat_server.py
index 3be6c84016..a06d195b86 100644
--- a/loopx/chat_server.py
+++ b/loopx/chat_server.py
@@ -48,6 +48,10 @@
 from .chat_session_open import open_chat_session
 from .chat_ssh_source_api import SshSourceRequestMixin
 from .chat_store import ChatSessionStore
+from .capabilities.native_chat.conversation_bindings import ChatConversationBindings
+from .extensions.lark.private_conversation_api import PrivateConversationRequestMixin, PRIVATE_CONVERSATIONS_PATH
+from .extensions.lark.conversation_identity import observe_lark_conversation_identity
+from .extensions.lark.private_conversations import LarkPrivateConversations
 from .chat_loopx_mode import handle_loopx_request
 from .capabilities.manager_context.roundtrip import project_chat_session_snapshot
 from .control_plane.goals.active_state_metadata import active_state_section_text
@@ -416,6 +420,7 @@ class ChatHTTPServer(ThreadingHTTPServer):
     lark_cli_resolution: LarkCliResolution
     lark_app_setup_manager: LarkAppSetupManager
     lark_goal_topic_runtime: LarkGoalTopicRuntimeService
+    lark_private_conversations: LarkPrivateConversations
     ssh_config_path: Path | None
     goal_subagent_configuration_enabled: bool
 
@@ -438,6 +443,7 @@ def server_close(self) -> None:
 
 
 class ChatRequestHandler(
+    PrivateConversationRequestMixin,
     CompletedTodoRequestMixin,
     AttachedSessionRequestMixin,
     SshSourceRequestMixin,
@@ -1409,6 +1415,7 @@ def do_GET(self) -> None:
             CHAT_LARK_APPS_PATH: self._lark_apps,
             CHAT_LARK_CHATS_PATH: self._lark_chats,
             CHAT_LARK_CONNECTIONS_PATH: self._lark_connections,
+            PRIVATE_CONVERSATIONS_PATH: self._private_conversations,
             CHAT_GOAL_CHANNEL_TARGETS_PATH: self._goal_channel_targets,
             **self._configuration_get_routes(),
             DEFAULT_CHAT_STATUS_PATH: self._status,
@@ -1456,6 +1463,8 @@ def do_POST(self) -> None:
             CHAT_GOAL_CHANNEL_CONFIGURE_PATH: self._goal_channel_configure,
             CHAT_LARK_APP_SETUPS_PATH: self._lark_setup_start,
             CHAT_LARK_CONNECTIONS_PATH: self._lark_connect,
+            PRIVATE_CONVERSATIONS_PATH: self._private_conversation_connect,
+            PRIVATE_CONVERSATIONS_PATH + "/agent-targets": self._private_conversation_agent_target,
             **self._configuration_post_routes(),
             **self._ssh_source_post_routes(),
         }
@@ -1500,6 +1509,8 @@ def do_DELETE(self) -> None:
             return self._lark_setup_cancel(setup_parts[4])
         if path == CHAT_LARK_CONNECTIONS_PATH:
             return self._lark_disconnect()
+        if path == PRIVATE_CONVERSATIONS_PATH:
+            return self._private_conversation_disconnect()
         prefix = f"{CHAT_SESSIONS_PATH}/"
         if not path.startswith(prefix):
             return self._send_error("unknown path", status=404)
@@ -1531,6 +1542,7 @@ def serve_chat(
     open_browser: bool = False,
     verbose: bool = False,
     enable_goal_subagent_configuration: bool = False,
+    project_workspace_grant: str = "workspace_write",
 ) -> None:
     if not is_loopback_host(host):
         raise ValueError("loopx chat requires a loopback --host such as 127.0.0.1")
@@ -1584,12 +1596,14 @@ def serve_chat(
     server.runtime_controller = ChatRuntimeController(
         store=server.chat_store,
         registry_path=resolved_registry_path,
-        project_contexts=ChatProjectContexts(resolved_scan_roots),
-        manager_scope_resolver=lambda session: authorized_manager_goal_ids(
+        project_contexts=ChatProjectContexts(resolved_scan_roots, workspace_grant=project_workspace_grant),
+        manager_scope_resolver=lambda session: (
+            server.runtime_controller.project_contexts.conversation_bindings.steward_scope(session)
+            if isinstance(session.get("steward_context"), dict) else authorized_manager_goal_ids(
             build_lark_goal_topic_runtime_snapshot(
                 registry_path=server.registry_path, runtime_root_override=server.runtime_root_override,
             ), session, runtime_root=runtime_root,
-        ),
+        )),
         codex_bin=codex_bin,
         claude_bin=claude_bin,
         kiro_cli_bin=kiro_cli_bin,
@@ -1597,6 +1611,21 @@ def serve_chat(
         idle_timeout_sec=idle_timeout_sec,
         hard_timeout_sec=hard_timeout_sec,
     )
+    server.runtime_controller.project_contexts.conversation_bindings = ChatConversationBindings(
+        root=server.chat_store.root, project_contexts=server.runtime_controller.project_contexts,
+        observe=lambda profile: observe_lark_conversation_identity(profile=profile, runner=server.lark_runner,
+            cli_bin=server.lark_cli_resolution.command or "lark-cli"))
+    private_transport = LarkPrivateConversations(controller=server.runtime_controller, runtime_root=runtime_root,
+        runner=server.lark_runner, cli_bin=server.lark_cli_resolution.command or "lark-cli")
+
+    server.lark_private_conversations = private_transport
+
+    def _lark_snapshot():
+        snapshot = build_lark_goal_topic_runtime_snapshot(registry_path=server.registry_path,
+            runtime_root_override=server.runtime_root_override)
+        snapshot["private_profiles"] = private_transport.profiles()
+        return snapshot
+
     server.action_service = ChatActionService(
         store=server.action_store,
         registry_path=resolved_registry_path,
@@ -1604,6 +1633,7 @@ def serve_chat(
         runtime_controller=server.runtime_controller,
         workspace_roots=resolved_scan_roots,
     )
+    private_transport.core.actions = server.action_service
     # An admitted steward team preview is projected into the typed action store,
     # because that store is what the product surfaces list: the chat action
     # service owns it, so the channel hands the preview to that owner instead of
@@ -1612,10 +1642,8 @@ def serve_chat(
         server.action_service.project_team_plan_preview
     )
     server.lark_goal_topic_runtime = LarkGoalTopicRuntimeService(
-        snapshot_provider=lambda: build_lark_goal_topic_runtime_snapshot(
-            registry_path=server.registry_path,
-            runtime_root_override=server.runtime_root_override,
-        ),
+        snapshot_provider=_lark_snapshot,
+        private_conversations=private_transport,
         runtime_root=runtime_root,
         runtime_controller=server.runtime_controller,
         action_service=server.action_service,
diff --git a/loopx/chat_store.py b/loopx/chat_store.py
index 0315537612..4aadc882e2 100644
--- a/loopx/chat_store.py
+++ b/loopx/chat_store.py
@@ -246,6 +246,7 @@ def create_session(
         attached_capabilities: dict[str, bool] | None = None,
         codex_home: str | None = None,
         project_context: dict[str, Any] | None = None,
+        steward_context: dict[str, Any] | None = None,
     ) -> dict[str, Any]:
         now = utc_now()
         token = _opaque_id(session_id or uuid.uuid4().hex, field="session_id")
@@ -273,12 +274,17 @@ def create_session(
         }
         if project_context is not None:
             from .control_plane.effect_runtime import effect_runtime_result
-            selected = effect_runtime_result("collaboration.project.context", {
-                "project_ref": project_context.get("project_ref"), "available": [project_context],
-            })
+            selected = effect_runtime_result("collaboration.project.session_identity", {"context": project_context})
             if goal_id is not None or goal_instance_id is not None or channel_id != selected["channel_id"] or normalized_mode != CHAT_SESSION_MODE_MANAGED:
                 raise ValueError("ordinary project Sessions require their exact channel and no Goal")
             project_context = selected["context"]
+        if steward_context is not None:
+            from .control_plane.effect_runtime import effect_runtime_result
+            selected = effect_runtime_result("collaboration.steward.session_identity", {"context": steward_context})
+            if (project_context is not None or goal_id != "loopx-manager" or goal_instance_id is not None
+                    or channel_id != selected["channel_id"] or normalized_mode != CHAT_SESSION_MODE_MANAGED):
+                raise ValueError("bound steward Sessions require their exact role and audience")
+            steward_context = selected["context"]
         normalized_goal_id = _opaque_id(goal_id, field="goal_id") if goal_id is not None else None
         if normalized_goal_id is None and project_context is None:
             raise ValueError("goal_id is required outside ordinary project Sessions")
@@ -302,6 +308,7 @@ def create_session(
             "session_id": token,
             "goal_id": normalized_goal_id,
             **({"project_context": project_context} if project_context is not None else {}),
+            **({"steward_context": steward_context} if steward_context is not None else {}),
             **(
                 {
                     "goal_instance_id": _opaque_id(
@@ -358,6 +365,7 @@ def update_session(self, session_id: str, **changes: Any) -> dict[str, Any]:
                     "codex_home",
                     "manager_context_version",
                     "coordination_context_version",
+                    "external_conversation_binding_id",
                     "loopx_mode",
                     "loopx_tools", "loopx_executor",
                     "loopx_deliveries",
@@ -375,6 +383,11 @@ def update_session(self, session_id: str, **changes: Any) -> dict[str, Any]:
                 unknown = set(changes) - allowed
                 if unknown:
                     raise ValueError(f"unsupported chat session fields: {sorted(unknown)}")
+                if "external_conversation_binding_id" in changes:
+                    identity = _opaque_id(changes["external_conversation_binding_id"], field="external_conversation_binding_id")
+                    if payload.get("session_mode") != CHAT_SESSION_MODE_ATTACHED or payload.get("external_conversation_binding_id") not in {None, identity}:
+                        raise ValueError("an attached Session cannot change its external audience")
+                    changes["external_conversation_binding_id"] = identity
                 if "coordination_context_version" in changes:
                     version = changes["coordination_context_version"]
                     if type(version) is not int or version < 1:
@@ -1019,6 +1032,7 @@ def create_queued_turn(
         goal_instance_id: str | None = None,
         ttl_seconds: int = SESSION_QUEUE_TTL_SECONDS,
         origin: str = "external",
+        external_agent_target: dict[str, Any] | None = None,
     ) -> tuple[dict[str, Any], bool]:
         """Persist one bounded follow-up without replacing the active Turn."""
 
@@ -1038,6 +1052,7 @@ def create_queued_turn(
                         request={
                             "message": str(message),
                             "origin": _opaque_id(origin, field="origin"),
+                            "external_agent_target": external_agent_target,
                         },
                     )
                     return existing, False
@@ -1070,6 +1085,7 @@ def create_queued_turn(
                     ),
                     "client_turn_id": client_id,
                     "status": "queued",
+                    **({"external_agent_target": external_agent_target} if external_agent_target is not None else {}),
                     "message": str(message),
                     "origin": _opaque_id(origin, field="origin"),
                     "upstream_turn_id": None,
@@ -1181,6 +1197,7 @@ def claim_next_queued_turn(
         *,
         host_claim_id: str | None = None,
         admitted_goal_instance_id: str | None = None,
+        admission_validator: Any | None = None,
     ) -> dict[str, Any] | None:
         """Atomically make the oldest live queued Turn active for its Session."""
 
@@ -1213,6 +1230,8 @@ def claim_next_queued_turn(
                             raise ValueError(
                                 "active Turn Goal instance admission is invalid"
                             )
+                        if admission_validator is not None:
+                            admission_validator(active)
                         return active
                     return None
                 for turn in self._settle_expired_queued_turns(
@@ -1220,6 +1239,12 @@ def claim_next_queued_turn(
                     now=datetime.now(timezone.utc),
                 ):
                     turn_id = str(turn["turn_id"])
+                    if admission_validator is not None:
+                        try:
+                            admission_validator(turn)
+                        except (ValueError, OSError, KeyError):
+                            self.update_turn(session_id, turn_id, status="failed", error_code="external_agent_grant_unavailable", completed_at=utc_now())
+                            continue
                     if admitted_goal_instance_id is not None and (
                         turn.get("goal_instance_id") != admitted_goal_instance_id
                     ):
diff --git a/loopx/cli_commands/support_control.py b/loopx/cli_commands/support_control.py
index 8559c5758a..43852e338d 100644
--- a/loopx/cli_commands/support_control.py
+++ b/loopx/cli_commands/support_control.py
@@ -622,6 +622,7 @@ def handle_support_control_command(
             if bool(getattr(args, "replace_existing_loopx_chat", False)):
                 replace_existing_loopx_chat(args.host, args.port)
             serve_chat(
+                project_workspace_grant=args.project_workspace_grant,
                 registry_path=chat_registry_path,
                 runtime_root_override=args.runtime_root,
                 scan_roots=scan_roots,
diff --git a/loopx/cli_commands/support_control_chat.py b/loopx/cli_commands/support_control_chat.py
index fbbed1408a..8af58a7869 100644
--- a/loopx/cli_commands/support_control_chat.py
+++ b/loopx/cli_commands/support_control_chat.py
@@ -67,6 +67,12 @@ def register_chat_and_dashboard_commands(
         help="Specific public file or directory to scan. Repeatable.",
     )
     chat_parser.add_argument("--limit", type=int, default=20)
+    chat_parser.add_argument(
+        "--project-workspace-grant",
+        choices=("workspace_read", "workspace_write"),
+        default="workspace_write",
+        help="Ordinary project Chat workspace access. Defaults to workspace_write; workspace_read prevents App write grants.",
+    )
     chat_parser.add_argument(
         "--global-registry",
         action="store_true",
diff --git a/loopx/control_plane/collaboration/__init__.py b/loopx/control_plane/collaboration/__init__.py
index 7c0dbed96f..b471b9d8ce 100644
--- a/loopx/control_plane/collaboration/__init__.py
+++ b/loopx/control_plane/collaboration/__init__.py
@@ -19,7 +19,7 @@ def conversation_trigger(mode: str | None = None, **evidence: bool) -> dict[str,
 def conversation_scope(session: dict[str, Any], *, origin: str | None = None) -> dict[str, Any]:
     return effect_runtime_result("collaboration.conversation.scope", {
         "channel_id": session.get("channel_id"), "goal_id": session.get("goal_id"),
-        "project_context": session.get("project_context"),
+        "project_context": session.get("project_context"), "steward_context": session.get("steward_context"),
         **({"origin": origin} if origin is not None else {}),
     })
 
diff --git a/loopx/control_plane/collaboration/conversation_binding.ts b/loopx/control_plane/collaboration/conversation_binding.ts
new file mode 100644
index 0000000000..6743e9d380
--- /dev/null
+++ b/loopx/control_plane/collaboration/conversation_binding.ts
@@ -0,0 +1,396 @@
+import type {JsonObject} from "../effect_program.ts";
+import {EffectRuntimeRequestError} from "../effect_runtime_errors.ts";
+import {requireJsonObject, requireNonEmptyString} from "../runtime_decode.ts";
+import {normalizeProjectContext, normalizeStewardContext, normalizeStewardGoalScope} from "./conversation_scope.ts";
+
+/** Core owns the context and audience grant. A provider supplies verified,
+ * opaque identity observations; neither a message nor a model selects them.
+ * Ordinary project bindings carry no Goal. A steward adopts only newly
+ * confirmed creation receipts, never an existing or global portfolio.
+ */
+const BINDING_SCHEMA = "loopx_chat_conversation_binding_v0";
+const SET_SCHEMA = "loopx_chat_conversation_bindings_v0";
+
+function ref(value: unknown, label: string): string {
+  const result = requireNonEmptyString(value, label);
+  if (!/^[a-f0-9]{24}$/.test(result)) throw new EffectRuntimeRequestError(`${label} is invalid`);
+  return result;
+}
+
+function token(value: unknown, label: string): string {
+  const result = requireNonEmptyString(value, label);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(result)) throw new EffectRuntimeRequestError(`${label} is invalid`);
+  return result;
+}
+
+/** Mirror the canonical Chat store opaque-id boundary, including legacy Goals. */
+function sessionIdentity(value: unknown, label: string): string {
+  const result = requireNonEmptyString(value, label);
+  if (!/^[A-Za-z0-9._-]{1,160}$/.test(result)) throw new EffectRuntimeRequestError(`${label} is invalid`);
+  return result;
+}
+
+function agentTarget(value: unknown): JsonObject {
+  const row = requireJsonObject(value, "attached Agent target grant");
+  return {target_ref: ref(row.target_ref, "Agent target reference"), host_ref: ref(row.host_ref, "attached host reference"),
+    session_id: sessionIdentity(row.session_id, "attached Session identity"),
+    goal_id: sessionIdentity(row.goal_id, "Agent Goal identity"),
+    goal_instance_id: row.goal_instance_id === null ? null : sessionIdentity(row.goal_instance_id, "Goal lifetime"),
+    agent_id: sessionIdentity(row.agent_id, "registered Agent identity"),
+    executor_endpoint_id: token(row.executor_endpoint_id, "Agent executor")};
+}
+
+/** A configured target names an existing attached Session, not an executor
+ * label. Its host retains claim, completion and permission authority. */
+export function resolveConversationAgentTarget(params: JsonObject): JsonObject {
+  const selected = binding(params.binding);
+  const target = agentTarget(params.target);
+  const granted = (selected.agent_targets as JsonObject[] | undefined)?.find(row => row.target_ref === target.target_ref);
+  if (!granted || JSON.stringify(granted) !== JSON.stringify(target)) {
+    throw new EffectRuntimeRequestError("the exact Agent target grant is unavailable");
+  }
+  const context = normalizeProjectContext(params.context);
+  if (selected.context_kind !== "project" || context.binding_id !== selected.binding_id
+      || context.project_ref !== selected.project_ref || context.provider_ref !== selected.provider_ref
+      || context.operator_ref !== selected.operator_ref || context.audience !== "bound_owner") {
+    throw new EffectRuntimeRequestError("Agent target belongs to another audience");
+  }
+  validateAgentTargetObservation(target, params.target_observation, context.workspace_path, selected.binding_id);
+  return {target, audience: {binding_id: selected.binding_id, source_ref: ref(context.source_ref, "Agent source"),
+    provider_ref: selected.provider_ref, operator_ref: selected.operator_ref, project_ref: selected.project_ref}};
+}
+
+function validateAgentTargetObservation(target: JsonObject, value: unknown, workspace: unknown, bindingId: unknown): void {
+  const observation = requireJsonObject(value, "attached Agent observation");
+  const session = requireJsonObject(observation.session, "attached Session observation");
+  const goal = requireJsonObject(observation.goal, "registered Agent Goal observation");
+  if (session.external_conversation_binding_id != null && session.external_conversation_binding_id !== bindingId) {
+    throw new EffectRuntimeRequestError("the attached Session previously belonged to another App audience");
+  }
+  if (observation.host_binding_verified !== true || session.session_mode !== "attached_host"
+      || !["ready", "busy"].includes(String(session.status))
+      || observation.host_ref !== target.host_ref
+      || !Array.isArray(observation.host_audience_binding_ids)
+      || observation.host_audience_binding_ids.some(owner => owner !== bindingId)
+      || goal.workspace_path !== workspace || goal.goal_id !== target.goal_id
+      || !Array.isArray(goal.registered_agents) || !goal.registered_agents.includes(target.agent_id)) {
+    throw new EffectRuntimeRequestError("Agent target is not an available registered host in this workspace");
+  }
+  for (const field of ["session_id", "goal_id", "agent_id", "executor_endpoint_id"]) {
+    if (session[field] !== target[field]) throw new EffectRuntimeRequestError("Agent Session identity changed");
+  }
+  if ((session.goal_instance_id ?? null) !== target.goal_instance_id) {
+    throw new EffectRuntimeRequestError("Agent Goal lifetime changed");
+  }
+}
+
+function binding(value: unknown): JsonObject {
+  const row = requireJsonObject(value, "conversation binding");
+  if (row.schema_version !== BINDING_SCHEMA || !["project", "steward"].includes(String(row.context_kind))
+      || (row.context_kind === "project" ? !["workspace_read", "workspace_write"].includes(String(row.grant)) : row.grant !== "portfolio_read")
+      || (row.grant === "workspace_write" && row.executor_endpoint_id !== "codex") || row.enabled !== true) {
+    throw new EffectRuntimeRequestError("unsupported conversation binding");
+  }
+  const targets = row.agent_targets === undefined ? [] : row.agent_targets;
+  if (!Array.isArray(targets) || targets.length > 16
+      || (row.context_kind !== "project" && targets.length !== 0)) {
+    throw new EffectRuntimeRequestError("invalid Agent target grant set");
+  }
+  const agents = targets.map(agentTarget);
+  for (const field of ["target_ref", "session_id"]) {
+    if (new Set(agents.map(row => row[field])).size !== agents.length) {
+      throw new EffectRuntimeRequestError("ambiguous Agent target grant");
+    }
+  }
+  return {
+    schema_version: BINDING_SCHEMA, binding_id: ref(row.binding_id, "binding identity"),
+    transport_ref: token(row.transport_ref, "transport reference"),
+    provider_ref: ref(row.provider_ref, "provider identity"),
+    operator_ref: ref(row.operator_ref, "verified operator identity"),
+    context_kind: row.context_kind, project_ref: ref(row.project_ref, "workspace reference"),
+    executor_endpoint_id: token(row.executor_endpoint_id, "executor endpoint"),
+    grant: row.grant, enabled: true,
+    ...(row.context_kind === "steward" ? {goal_ids: normalizeStewardGoalScope(row.goal_ids)} : {}),
+    ...(agents.length ? {agent_targets: agents} : {}),
+  };
+}
+
+function state(value: unknown): {schema_version: string; revision: number; bindings: JsonObject[]} {
+  const row = requireJsonObject(value, "conversation bindings");
+  if (row.schema_version !== SET_SCHEMA || !Number.isSafeInteger(row.revision)
+      || Number(row.revision) < 0 || !Array.isArray(row.bindings)) {
+    throw new EffectRuntimeRequestError("invalid conversation bindings state");
+  }
+  const bindings = row.bindings.map(binding);
+  for (const field of ["binding_id", "transport_ref", "provider_ref"]) {
+    if (new Set(bindings.map(row => row[field])).size !== bindings.length) {
+      throw new EffectRuntimeRequestError("conversation listener ownership is ambiguous");
+    }
+  }
+  const sessions = bindings.flatMap(row => (row.agent_targets as JsonObject[] | undefined ?? []).map(target => target.session_id));
+  const hosts = new Map<unknown, unknown>();
+  for (const row of bindings) for (const target of row.agent_targets as JsonObject[] | undefined ?? []) {
+    if (hosts.has(target.host_ref) && hosts.get(target.host_ref) !== row.binding_id) {
+      throw new EffectRuntimeRequestError("an attached host cannot share two App audiences");
+    }
+    hosts.set(target.host_ref, row.binding_id);
+  }
+  if (new Set(sessions).size !== sessions.length) {
+    throw new EffectRuntimeRequestError("an attached Session cannot share two App audiences");
+  }
+  return {schema_version: SET_SCHEMA, revision: Number(row.revision), bindings};
+}
+
+function observed(row: JsonObject, value: unknown): void {
+  const observation = requireJsonObject(value, "provider identity observation");
+  if (observation.verified !== true || observation.transport_ref !== row.transport_ref
+      || observation.provider_ref !== row.provider_ref || observation.operator_ref !== row.operator_ref) {
+    throw new EffectRuntimeRequestError("provider or operator identity is not independently verified");
+  }
+}
+
+export function planConversationBinding(params: JsonObject): JsonObject {
+  const current = state(params.current);
+  if (params.expected_revision !== current.revision) throw new EffectRuntimeRequestError("conversation binding revision changed");
+  let rows: JsonObject[];
+  if (params.operation === "configure") {
+    const candidate = binding(params.binding);
+    observed(candidate, params.observation);
+    const project = Array.isArray(params.available_projects)
+      ? params.available_projects.map(normalizeProjectContext).find(row => row.project_ref === candidate.project_ref) : undefined;
+    if (!project || (candidate.grant === "workspace_write" && project.grant !== "workspace_write")) {
+      throw new EffectRuntimeRequestError("workspace grant is unavailable");
+    }
+    const previous = current.bindings.find(row => row.transport_ref === candidate.transport_ref);
+    // An exact repeat is idempotent. A changed context receives a new binding
+    // identity, so an existing Session can never silently move workspaces.
+    if (previous && JSON.stringify({...previous, binding_id: null}) === JSON.stringify({...candidate, binding_id: null})) {
+      return {changed: false, state: current};
+    }
+    if (previous?.binding_id === candidate.binding_id) throw new EffectRuntimeRequestError("changed context requires a new binding identity");
+    rows = [...current.bindings.filter(row => row.transport_ref !== candidate.transport_ref), candidate];
+  } else if (params.operation === "grant_agent_target" || params.operation === "revoke_agent_target") {
+    const id = ref(params.binding_id, "binding identity");
+    const previous = current.bindings.find(row => row.binding_id === id);
+    if (!previous || previous.context_kind !== "project") throw new EffectRuntimeRequestError("Agent selection requires a project binding");
+    observed(previous, params.observation);
+    const existing = previous.agent_targets as JsonObject[] | undefined ?? [];
+    let targets: JsonObject[];
+    if (params.operation === "grant_agent_target") {
+      const target = agentTarget(params.target);
+      if (!Array.isArray(params.available_projects)) throw new EffectRuntimeRequestError("workspace grants unavailable");
+      const project = params.available_projects.map(normalizeProjectContext).find(row => row.project_ref === previous.project_ref);
+      if (!project) throw new EffectRuntimeRequestError("workspace grant unavailable");
+      validateAgentTargetObservation(target, params.target_observation, project.workspace_path, previous.binding_id);
+      if (existing.some(row => row.session_id === target.session_id)) throw new EffectRuntimeRequestError("this Agent Session is already granted");
+      targets = [...existing, target];
+    } else targets = existing.filter(row => row.target_ref !== ref(params.target_ref, "Agent target reference"));
+    rows = current.bindings.map(row => row.binding_id === id ? {...row, agent_targets: targets} : row);
+  } else if (params.operation === "adopt_created_goal") {
+    const id = ref(params.binding_id, "binding identity");
+    const previous = current.bindings.find(row => row.binding_id === id);
+    const context = normalizeStewardContext(params.context);
+    const proposal = requireJsonObject(params.proposal, "creation proposal");
+    const principal = requireJsonObject(proposal.context, "creation audience");
+    const receipt = requireJsonObject(proposal.receipt, "creation receipt");
+    const resources = requireJsonObject(receipt.resource_ids, "creation resources");
+    const goal = requireJsonObject(params.goal, "created Goal observation");
+    if (!previous || previous.context_kind !== "steward" || previous.project_ref !== context.project_ref
+        || proposal.action_kind !== "goal.create" || proposal.status !== "applied"
+        || receipt.outcome !== "goal_created" || receipt.projection_verified !== true
+        || goal.goal_id !== resources.goal_id || goal.creation_operation_id !== proposal.proposal_id
+        || goal.workspace_path !== context.workspace_path) throw new EffectRuntimeRequestError("steward adoption requires its exact creation receipt");
+    for (const key of ["binding_id", "source_ref", "provider_ref", "operator_ref"]) {
+      if (principal[key] !== context[key] || (key !== "source_ref" && previous[key] !== context[key])) {
+        throw new EffectRuntimeRequestError("creation receipt belongs to another audience");
+      }
+    }
+    const goals = normalizeStewardGoalScope([...(previous.goal_ids as string[]), goal.goal_id]);
+    if (JSON.stringify(goals) === JSON.stringify(previous.goal_ids)) return {changed: false, state: current};
+    rows = current.bindings.map(row => row.binding_id === id ? {...row, goal_ids: goals} : row);
+  } else if (params.operation === "disconnect") {
+    const id = ref(params.binding_id, "binding identity");
+    rows = current.bindings.filter(row => row.binding_id !== id);
+    if (rows.length === current.bindings.length) return {changed: false, state: current};
+  } else throw new EffectRuntimeRequestError("unsupported conversation binding operation");
+  const next = state({...current, revision: current.revision + 1, bindings: rows});
+  return {changed: true, state: next};
+}
+
+export function resolveBoundConversation(params: JsonObject): JsonObject {
+  const current = state(params.current);
+  const id = ref(params.binding_id, "binding identity");
+  const row = current.bindings.find(row => row.binding_id === id);
+  if (!row) throw new EffectRuntimeRequestError("conversation binding is no longer authorized");
+  observed(row, params.observation);
+  const source = ref(params.source_ref, "source conversation identity");
+  if (params.sender_ref !== row.operator_ref || params.private_human_message !== true) {
+    throw new EffectRuntimeRequestError("message audience is outside the binding grant");
+  }
+  if (!Array.isArray(params.available_projects)) throw new EffectRuntimeRequestError("workspace grants unavailable");
+  const projects = params.available_projects.map(normalizeProjectContext).filter(project => project.project_ref === row.project_ref);
+  if (projects.length !== 1) throw new EffectRuntimeRequestError("workspace grant is unavailable or ambiguous");
+  if (row.grant === "workspace_write" && projects[0].grant !== "workspace_write") {
+    throw new EffectRuntimeRequestError("workspace write grant is no longer available");
+  }
+  const context = {...projects[0], audience: "bound_owner", binding_id: id, source_ref: source,
+    provider_ref: row.provider_ref, operator_ref: row.operator_ref, grant: row.grant,
+    ...(row.context_kind === "steward" ? {kind: "bound_steward", grant: "portfolio_read", goal_ids: row.goal_ids} : {})};
+  if (params.session_context !== undefined) {
+    const saved = requireJsonObject(params.session_context, "bound Session context");
+    // New commissions may extend the same owner's scope. Workspace, role and
+    // audience remain frozen; all evidence reads use the fresh binding scope.
+    const matches = row.context_kind === "steward"
+      ? JSON.stringify({...saved, goal_ids: []}) === JSON.stringify({...context, goal_ids: []})
+        && normalizeStewardGoalScope(saved.goal_ids).every(g => (row.goal_ids as string[]).includes(g))
+      : JSON.stringify(saved) === JSON.stringify(context);
+    if (!matches) throw new EffectRuntimeRequestError("bound Session context changed");
+  }
+  return {binding: row, context, channel_id: row.context_kind === "steward"
+    ? `manager.external.native.${id}.${source}` : `project.external.${id}.${source}`};
+}
+
+/** Shared native command projection. Provider grammar carries the explicit
+ * command; Core binds its exact target before IO. Replays retain that target.
+ */
+export function planBoundConversationRequest(params: JsonObject): JsonObject {
+  const row = requireJsonObject(params.request, "external request");
+  const request = ref(row.request_ref, "external request identity");
+  const command = row.command;
+  if (![null, "agents", "select_agent", "select_project", "status", "help", "new", "stop", "unsupported", "commission", "confirm_commission", "cancel_commission", "stop_commission", "resume_commission"].includes(command as null | string)) {
+    throw new EffectRuntimeRequestError("unsupported external conversation command");
+  }
+  const current = params.current_session === null ? null : requireJsonObject(params.current_session, "current Session");
+  const target = row.target_recorded === true ? row : current;
+  const session = target?.session_id ?? null;
+  const turn = row.target_recorded === true ? row.turn_id ?? null : current?.active_turn_id ?? null;
+  if (["agents", "select_agent", "select_project"].includes(String(command))) {
+    return {operation: "select_recipient", session_id: null, turn_id: null};
+  }
+  if (params.agent_target !== undefined && params.agent_target !== null) {
+    const target = agentTarget(params.agent_target);
+    if (!current || current.session_id !== target.session_id || current.goal_id !== target.goal_id
+        || current.agent_id !== target.agent_id || current.session_mode !== "attached_host") {
+      throw new EffectRuntimeRequestError("the selected Agent Session is unavailable");
+    }
+    if (command === "new" || command === "stop") {
+      return {operation: "reply", session_id: current.session_id, turn_id: null, response_code: "attached_control_unavailable"};
+    }
+  }
+  if (["commission", "confirm_commission", "cancel_commission", "stop_commission", "resume_commission"].includes(String(command))) {
+    const selected = requireJsonObject(params.binding, "steward binding");
+    if (selected.context_kind !== "steward") throw new EffectRuntimeRequestError("explicit commissions require a selected steward");
+    return {operation: "steward_action", session_id: session, turn_id: null};
+  }
+  if (command === "status" || command === "help") {
+    return {operation: "reply", session_id: session, turn_id: null,
+      response_code: command === "help" ? "conversation_help" : !current ? "no_session"
+        : current.active_turn_id ? "active_session" : "ready_session",
+      status_snapshot: boundConversationStatus(params, current)};
+  }
+  if (command === "unsupported") {
+    return {operation: "reply", session_id: session, turn_id: null,
+      response_code: "unsupported_attachment"};
+  }
+  if (command === "stop" || command === "new") {
+    return {operation: command, session_id: session, turn_id: turn,
+      response_code: command === "new" ? "new_session" : turn ? "stop_requested" : "no_active_turn"};
+  }
+  return {operation: "admit_turn", client_turn_id: `external-${request}`, session_id: session, turn_id: null};
+}
+
+/** A labelled observation of the same authorized context and canonical queue.
+ * It neither creates a Session nor certifies execution or result delivery.
+ * The external request persists this snapshot so duplicate delivery cannot
+ * silently substitute a later Session or another binding's current state.
+ */
+function boundConversationStatus(params: JsonObject, current: JsonObject | null): JsonObject {
+  const selected = binding(params.binding);
+  const steward = selected.context_kind === "steward";
+  const context = steward ? normalizeStewardContext(params.context) : normalizeProjectContext(params.context);
+  for (const key of ["binding_id", "project_ref", "provider_ref", "operator_ref"]) {
+    if (context[key] !== selected[key]) throw new EffectRuntimeRequestError("status context belongs to another binding");
+  }
+  const source = ref(context.source_ref, "status source identity");
+  const channel = steward ? `manager.external.native.${selected.binding_id}.${source}`
+    : `project.external.${selected.binding_id}.${source}`;
+  const recipient = params.agent_target ? agentTarget(params.agent_target) : null;
+  if (recipient) {
+    if (!current || current.session_id !== recipient.session_id || current.goal_id !== recipient.goal_id
+        || current.agent_id !== recipient.agent_id || current.session_mode !== "attached_host") {
+      throw new EffectRuntimeRequestError("status Agent Session changed");
+    }
+  } else if (current) {
+    const saved = steward ? normalizeStewardContext(current.steward_context) : normalizeProjectContext(current.project_context);
+    if (current.channel_id !== channel || current.goal_id !== (steward ? "loopx-manager" : null)
+        || JSON.stringify({...saved, goal_ids: []}) !== JSON.stringify({...context, goal_ids: []})) {
+      throw new EffectRuntimeRequestError("status Session context changed");
+    }
+  }
+  if (!Number.isSafeInteger(params.queued_count) || Number(params.queued_count) < 0
+      || (!current && params.queued_count !== 0)) throw new EffectRuntimeRequestError("invalid canonical queue observation");
+  const instant = requireNonEmptyString(params.observed_at, "status observation time");
+  if (instant.length > 64 || !Number.isFinite(Date.parse(instant))) throw new EffectRuntimeRequestError("invalid status observation time");
+  const turn = params.active_turn === null ? null : requireJsonObject(params.active_turn, "observed active Turn");
+  if (turn && (!current || turn.session_id !== current.session_id || turn.turn_id !== current.active_turn_id)) {
+    throw new EffectRuntimeRequestError("status Turn belongs to another Session");
+  }
+  for (const item of [current, turn]) {
+    if (item && (typeof item.status !== "string" || !/^[a-z][a-z0-9_]{0,63}$/.test(item.status))) {
+      throw new EffectRuntimeRequestError("invalid canonical status observation");
+    }
+  }
+  return {schema_version: "loopx_chat_bound_status_v0", observed_at: instant,
+    context_kind: selected.context_kind, workspace_path: context.workspace_path,
+    executor_endpoint_id: recipient?.executor_endpoint_id ?? selected.executor_endpoint_id, grant: selected.grant,
+    ...(recipient ? {recipient_agent_id: recipient.agent_id, recipient_goal_id: recipient.goal_id, recipient_mode: "attached_host"} : {}),
+    authorized_commission_count: steward ? (selected.goal_ids as string[]).length : 0,
+    session_status: current?.status ?? null, active_turn_status: turn?.status ?? null,
+    active_turn_observation_available: !current?.active_turn_id || turn !== null,
+    queued_count: params.queued_count};
+}
+
+/** Explicit text grammar selects one existing typed Goal operation. Normal
+ * conversation and model prose never grant creation or scheduling authority. */
+export function stewardCommand(params: JsonObject): JsonObject {
+  const command = params.command;
+  const message = requireNonEmptyString(params.message, "steward command").trim();
+  const patterns: Record<string, RegExp> = {commission: /^\/(?:delegate|委托)\s+--tokens\s+([1-9][0-9]{0,8})\s+([\s\S]+)$/,
+    confirm_commission: /^\/confirm\s+(proposal-[a-f0-9]{32})$/,
+    cancel_commission: /^\/cancel\s+(proposal-[a-f0-9]{32})$/,
+    stop_commission: /^\/stop-commission\s+(proposal-[a-f0-9]{32})$/,
+    resume_commission: /^\/resume-commission\s+(proposal-[a-f0-9]{32})\s+--tokens\s+([1-9][0-9]{0,8})$/};
+  const match = patterns[String(command)]?.exec(message);
+  const argument = command === "commission" ? match?.[2] : match?.[1];
+  if (!match || !argument?.trim() || Array.from(argument).length > 1000) {
+    throw new EffectRuntimeRequestError("invalid explicit steward command");
+  }
+  return {argument: argument.trim(), ...(command === "commission" ? {native_token_budget: Number(match[1])}
+    : command === "resume_commission" ? {native_token_budget: Number(match[2])} : {})};
+}
+
+export function authorizeStewardCreation(params: JsonObject): JsonObject {
+  const selected = normalizeStewardContext(params.context);
+  const proposal = requireJsonObject(params.proposal, "creation proposal");
+  const audience = requireJsonObject(proposal.context, "creation audience");
+  if (proposal.action_kind !== "goal.create" || audience.kind !== "manager"
+      || audience.goal_id !== "loopx-manager") throw new EffectRuntimeRequestError("not a steward creation preview");
+  for (const field of ["binding_id", "source_ref", "provider_ref", "operator_ref", "project_ref"]) {
+    if (audience[field] !== selected[field]) throw new EffectRuntimeRequestError("confirmation audience changed");
+  }
+  if (["stop", "resume"].includes(String(params.operation))) {
+    const receipt = requireJsonObject(proposal.receipt, "commission receipt");
+    const resources = requireJsonObject(receipt.resource_ids, "commission resources");
+    if (proposal.status !== "applied" || !(selected.goal_ids as string[]).includes(String(resources.goal_id))) {
+      throw new EffectRuntimeRequestError("execution control requires the exact adopted commission");
+    }
+    return {authorized: true};
+  }
+  const expiry = Date.parse(String(audience.expires_at));
+  const now = Date.parse(String(params.now));
+  if (!Number.isFinite(expiry) || !Number.isFinite(now) || now > expiry
+      || now < Date.parse(String(proposal.created_at)) - 300_000) {
+    throw new EffectRuntimeRequestError("steward confirmation expired or timestamp invalid");
+  }
+  return {authorized: true};
+}
diff --git a/loopx/control_plane/collaboration/conversation_scope.ts b/loopx/control_plane/collaboration/conversation_scope.ts
index ac706997ee..eb59413be9 100644
--- a/loopx/control_plane/collaboration/conversation_scope.ts
+++ b/loopx/control_plane/collaboration/conversation_scope.ts
@@ -6,18 +6,58 @@ export function normalizeProjectContext(value: unknown): Record<string, string>
   const ref = context.project_ref, workspace = context.workspace_path;
   if (typeof ref !== "string" || !/^[a-f0-9]{24}$/.test(ref)
       || typeof workspace !== "string" || !workspace || context.kind !== "project_workspace"
-      || context.audience !== "local_owner" || context.grant !== "workspace_read"
+      || !["local_owner", "bound_owner"].includes(String(context.audience))
+      || !["workspace_read", "workspace_write"].includes(String(context.grant))
       || (workspace[0] !== "/" && !/^[A-Za-z]:[\\/]/.test(workspace))) {
     throw new Error("invalid project conversation context");
   }
-  return {kind: "project_workspace", project_ref: ref, workspace_path: workspace,
-    audience: "local_owner", grant: "workspace_read"};
+  const normalized: Record<string, string> = {kind: "project_workspace", project_ref: ref, workspace_path: workspace,
+    audience: String(context.audience), grant: String(context.grant)};
+  if (context.audience === "bound_owner") {
+    for (const field of ["binding_id", "source_ref", "provider_ref", "operator_ref"]) {
+      const value = context[field];
+      if (typeof value !== "string" || !/^[a-f0-9]{24}$/.test(value)) throw new Error("incomplete bound project identity");
+      normalized[field] = value;
+    }
+  }
+  return normalized;
+}
+
+export function projectConversationIdentity(input: Record<string, unknown>): Record<string, unknown> {
+  const context = normalizeProjectContext(input.context);
+  return {context, sandbox: context.grant === "workspace_write" ? "workspace-write" : "read-only",
+    channel_id: context.audience === "local_owner"
+    ? `project.${context.project_ref}` : `project.external.${context.binding_id}.${context.source_ref}`};
+}
+
+export function normalizeStewardGoalScope(value: unknown): string[] {
+  if (!Array.isArray(value) || value.length > 128
+      || value.some(g => typeof g !== "string" || !/^[A-Za-z0-9._-]{1,160}$/.test(g)
+        || [".", "..", "loopx-manager"].includes(g))) throw new Error("invalid steward Goal scope");
+  return [...new Set(value as string[])].sort();
+}
+
+/** An explicitly selected steward has a bounded portfolio, including an honest
+ * empty one. Identity is persisted by Core; message text cannot select it.
+ */
+export function normalizeStewardContext(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("steward context unavailable");
+  const row = value as Record<string, unknown>;
+  const workspace = normalizeProjectContext({...row, kind: "project_workspace", grant: "workspace_read"});
+  if (row.kind !== "bound_steward" || row.audience !== "bound_owner" || row.grant !== "portfolio_read"
+      ) throw new Error("invalid bounded steward context");
+  return {...workspace, kind: "bound_steward", grant: "portfolio_read", goal_ids: normalizeStewardGoalScope(row.goal_ids)};
+}
+
+export function stewardConversationIdentity(input: Record<string, unknown>): Record<string, unknown> {
+  const context = normalizeStewardContext(input.context);
+  return {context, channel_id: `manager.external.native.${context.binding_id}.${context.source_ref}`};
 }
 
 type ConversationScope = Record<string, unknown> & (
   | {kind: "owner_portfolio"; goal_ids: null; private_conversation: true}
   | {kind: "owner_goal"; goal_ids: [string]; private_conversation: true}
-  | {kind: "project_workspace"; goal_ids: []; private_conversation: true}
+  | {kind: "project_workspace"; goal_ids: []; private_conversation: boolean}
   | {kind: "external_audience" | "unavailable"; goal_ids: []; private_conversation: false}
 );
 
@@ -27,14 +67,27 @@ type ConversationScope = Record<string, unknown> & (
 export function resolveConversationScope(input: Record<string, unknown>): ConversationScope {
   const channel = input.channel_id;
   const goal = input.goal_id;
-  if (goal === null && (input.origin === undefined || input.origin === "web")) {
+  if (goal === null) {
     try {
       const context = normalizeProjectContext(input.project_context);
-      if (channel === `project.${context.project_ref}`) {
+      if (context.audience === "local_owner" && (input.origin === undefined || input.origin === "web")
+          && channel === `project.${context.project_ref}`) {
         return {kind: "project_workspace", goal_ids: [], private_conversation: true};
       }
+      if (context.audience === "bound_owner" && (input.origin === undefined || input.origin === "lark")
+          && channel === `project.external.${context.binding_id}.${context.source_ref}`) {
+        return {kind: "project_workspace", goal_ids: [], private_conversation: false};
+      }
     } catch { /* Incomplete host identity grants no context. */ }
   }
+  if (goal === "loopx-manager" && (input.origin === undefined || input.origin === "lark")) {
+    try {
+      const selected = stewardConversationIdentity({context: input.steward_context});
+      if (channel === selected.channel_id) {
+        return {kind: "external_audience", goal_ids: [], private_conversation: false, bound_steward: true};
+      }
+    } catch { /* An incomplete steward identity cannot authorize a portfolio. */ }
+  }
   if (channel === "manager") {
     return {kind: "owner_portfolio", goal_ids: null, private_conversation: true};
   }
diff --git a/loopx/control_plane/collaboration/project_conversation.ts b/loopx/control_plane/collaboration/project_conversation.ts
index 8e20bd7fbb..3ae6c40bf8 100644
--- a/loopx/control_plane/collaboration/project_conversation.ts
+++ b/loopx/control_plane/collaboration/project_conversation.ts
@@ -4,7 +4,7 @@ import { requireNonEmptyString } from "../runtime_decode.ts";
 import {normalizeProjectContext} from "./conversation_scope.ts";
 
 /** A workspace observation is supplied by the host, never by a model or transport.
- * Its read grant does not enroll a Goal, discover a portfolio or authorize work.
+ * Its workspace grant does not enroll a Goal, discover a portfolio or authorize peer work.
  */
 function normalized(value: unknown): JsonObject {
   try {return normalizeProjectContext(value);}
diff --git a/loopx/control_plane/effect_runtime_handlers.ts b/loopx/control_plane/effect_runtime_handlers.ts
index 5d3346197c..88ad5d52da 100644
--- a/loopx/control_plane/effect_runtime_handlers.ts
+++ b/loopx/control_plane/effect_runtime_handlers.ts
@@ -577,6 +577,14 @@ export function createEffectRuntimeHandlers(
     ["collaboration.conversation.trigger", lazyHandler(() => import("./collaboration/conversation_trigger.ts"), ({resolveConversationTrigger}) => resolveConversationTrigger)],
     ["collaboration.conversation.scope", lazyHandler(() => import("./collaboration/conversation_scope.ts"), ({resolveConversationScope}) => resolveConversationScope)],
     ["collaboration.project.context", lazyHandler(() => import("./collaboration/project_conversation.ts"), ({resolveProjectConversation}) => resolveProjectConversation)],
+    ["collaboration.project.session_identity", lazyHandler(() => import("./collaboration/conversation_scope.ts"), ({projectConversationIdentity}) => projectConversationIdentity)],
+    ["collaboration.steward.session_identity", lazyHandler(() => import("./collaboration/conversation_scope.ts"), ({stewardConversationIdentity}) => stewardConversationIdentity)],
+    ["collaboration.steward.command", lazyHandler(() => import("./collaboration/conversation_binding.ts"), ({stewardCommand}) => stewardCommand)],
+    ["collaboration.steward.authorize_creation", lazyHandler(() => import("./collaboration/conversation_binding.ts"), ({authorizeStewardCreation}) => authorizeStewardCreation)],
+    ["collaboration.conversation.binding", lazyHandler(() => import("./collaboration/conversation_binding.ts"), ({planConversationBinding}) => planConversationBinding)],
+    ["collaboration.conversation.bound_context", lazyHandler(() => import("./collaboration/conversation_binding.ts"), ({resolveBoundConversation}) => resolveBoundConversation)],
+    ["collaboration.conversation.request", lazyHandler(() => import("./collaboration/conversation_binding.ts"), ({planBoundConversationRequest}) => planBoundConversationRequest)],
+    ["collaboration.conversation.agent_target", lazyHandler(() => import("./collaboration/conversation_binding.ts"), ({resolveConversationAgentTarget}) => resolveConversationAgentTarget)],
     ["collaboration.peer.context_access", lazyHandler(() => import("./collaboration/peer_context.ts"), ({requirePeerContextAccess}) => requirePeerContextAccess)],
     ["collaboration.source.recipients", lazyHandler(() => import("./collaboration/source_grants.ts"), ({resolveSourceRecipients}) => resolveSourceRecipients)],
     ["collaboration.source.configure_recipient", lazyHandler(() => import("./collaboration/source_grants.ts"), ({configureSourceRecipient}) => configureSourceRecipient)],
diff --git a/loopx/extensions/lark/conversation_identity.py b/loopx/extensions/lark/conversation_identity.py
new file mode 100644
index 0000000000..71db018cf4
--- /dev/null
+++ b/loopx/extensions/lark/conversation_identity.py
@@ -0,0 +1,61 @@
+"""Lark-specific identity observation for a Core-owned private conversation.
+
+Each non-default profile independently verifies its App and logged-in owner.
+Core receives only opaque, App-scoped references. Tokens remain in lark-cli.
+"""
+from __future__ import annotations
+
+import hashlib
+import re
+from collections.abc import Mapping
+from typing import Any
+
+from .goal_channel_transport import APP_ID_PATTERN, call, json_payload, lark_args
+from .identity_shapes import LARK_OPEN_ID_PATTERN as OPEN_ID_PATTERN
+from .goal_topic_connections import _profile_ref
+from .presentation.kanban import CommandRunner
+
+
+def identity_ref(*values: str) -> str:
+    return hashlib.sha256("\0".join(values).encode("utf-8")).hexdigest()[:24]
+
+
+def observe_lark_conversation_identity(*, profile: str, runner: CommandRunner,
+                                       cli_bin: str) -> dict[str, Any]:
+    profile = _profile_ref(profile)
+    if profile.casefold() == "default":
+        raise ValueError("private conversations require an explicit non-default App profile")
+    result = call(runner, lark_args(cli_bin=cli_bin, profile=profile,
+                                  tail=["auth", "status", "--verify", "--json"]))
+    payload = json_payload(result)
+    identities = payload.get("identities")
+    identities = identities if isinstance(identities, Mapping) else {}
+    bot, owner = identities.get("bot"), identities.get("user")
+    app_id = str(payload.get("appId") or "")
+    if result.get("returncode") != 0 or not APP_ID_PATTERN.fullmatch(app_id):
+        raise ValueError("the selected App identity could not be verified")
+    if not isinstance(bot, Mapping) or not isinstance(owner, Mapping):
+        raise ValueError("verify this App and its owner independently before binding private Chat")
+    if not all(row.get("available") is True and row.get("verified") is True
+               for row in [bot, owner]):
+        raise ValueError("verify this App and its owner independently before binding private Chat")
+    owner_id = str(owner.get("openId") or "")
+    if not OPEN_ID_PATTERN.fullmatch(owner_id):
+        raise ValueError("the selected App has no verified owner identity")
+    provider_ref = identity_ref(app_id)
+    return {"transport_ref": profile, "provider_ref": provider_ref,
+            "operator_ref": identity_ref(provider_ref, owner_id), "verified": True, "consumer_ref": hashlib.sha256(app_id.encode("utf-8")).hexdigest()[:32], "bot_display_name": str(bot.get("appName") or "")}
+
+
+def lark_private_source(*, provider_ref: str, event: Mapping[str, Any]) -> dict[str, Any]:
+    """Normalize provider provenance; Core still decides whether it is admitted."""
+    from .identity_shapes import LARK_CHAT_ID_PATTERN, LARK_MESSAGE_ID_PATTERN
+
+    chat = str(event.get("chat_id") or "")
+    sender = str(event.get("sender_id") or "")
+    message = str(event.get("message_id") or "")
+    if not (re.fullmatch(r"[a-f0-9]{24}", provider_ref) and LARK_CHAT_ID_PATTERN.fullmatch(chat)
+            and LARK_MESSAGE_ID_PATTERN.fullmatch(message) and OPEN_ID_PATTERN.fullmatch(sender)):
+        raise ValueError("incomplete private-message provenance")
+    return {"source_ref": identity_ref(provider_ref, chat, sender), "sender_ref": identity_ref(provider_ref, sender),
+            "private_human_message": event.get("chat_type") == "p2p" and event.get("sender_type") == "user"}
diff --git a/loopx/extensions/lark/goal_topic_runtime.py b/loopx/extensions/lark/goal_topic_runtime.py
index 51628b490a..4fba2c2507 100644
--- a/loopx/extensions/lark/goal_topic_runtime.py
+++ b/loopx/extensions/lark/goal_topic_runtime.py
@@ -105,13 +105,15 @@ def __init__(self, error_code: str, effect_receipt: Mapping[str, Any]) -> None:
 
 _EVENT_PROJECTION = (
     '{schema_version:"lark_event_inbox_event_v0",'
-    "event_id:(.event_id // .message_id // .id),"
-    "message_id:(.message_id // .id),"
-    "create_time:.create_time,content:.content,"
-    "sender_id:(.sender_id // .sender.id // .sender.sender_id "
-    "// .event.sender.sender_id // .event.sender.id),"
+    "event_id:(.event_id // .header.event_id // .message_id // .event.message.message_id // .id),"
+    "message_id:(.message_id // .message.message_id // .event.message.message_id // .id),"
+    "create_time:(.create_time // .message.create_time // .event.message.create_time),"
+    "content:(.content // .message.content // .event.message.content),"
+    "sender_id:(.sender_id.open_id? // .sender_id // .sender.id // .sender.sender_id.open_id? // .sender.sender_id "
+    "// .event.sender.sender_id.open_id? // .event.sender.sender_id // .event.sender.id),"
     "sender_type:(.sender_type // .sender.sender_type // .event.sender.sender_type),"
-    "chat_id:.chat_id,"
+    "chat_id:(.chat_id // .message.chat_id // .event.message.chat_id),chat_type:(.chat_type // .message.chat_type // .event.message.chat_type),"
+    "message_type:(.message_type // .msg_type // .message.message_type // .event.message.message_type),"
     "root_id:(.root_id // .message.root_id // .event.message.root_id),"
     "parent_id:(.parent_id // .reply_to // .message.parent_id // .message.reply_to "
     "// .event.message.parent_id // .event.message.reply_to),"
@@ -154,6 +156,10 @@ def _active_profile_configs(snapshot: Mapping[str, Any]) -> dict[str, dict[str,
                     "bot_app_id": str(identity.get("bot_app_id") or ""),
                 },
             )
+    for profile, config in dict(snapshot.get("private_profiles") or {}).items():
+        if profile in profiles:
+            raise ValueError("an App cannot own both private and group listeners")
+        profiles[profile] = dict(config)
     return profiles
 
 
@@ -403,6 +409,7 @@ def poll_lark_goal_topic_profile_once(
     provider_runner: Any = subprocess.run,
     reply_runner: CommandRunner = _default_simple_runner,
     proposal_deliverer: ProposalDeliverer | None = None,
+    private_admitter: Callable[[str, dict[str, object]], Mapping[str, object]] | None = None,
 ) -> dict[str, Any]:
     """Consume one bounded event batch for an App and reuse Inbox reply/ACK."""
 
@@ -443,6 +450,11 @@ def poll_lark_goal_topic_profile_once(
     event_statuses: list[str] = []
     event_reasons: list[str | None] = []
     for event in events:
+        if profile in dict(snapshot.get("private_profiles") or {}):
+            private_result = private_admitter(profile, dict(event)) if private_admitter else {"status": "private_admission_unavailable"}
+            event_statuses.append(str(private_result.get("status") or "unknown"))
+            event_reasons.append(None)
+            continue
         scoped, rejection = _profile_event_route(
             profile=profile,
             snapshot=snapshot,
@@ -498,6 +510,7 @@ def stream_lark_goal_topic_profile(
     reply_runner: CommandRunner = _default_simple_runner,
     health_sink: HealthSink | None = None,
     proposal_deliverer: ProposalDeliverer | None = None,
+    private_admitter: Callable[[str, dict[str, object]], Mapping[str, object]] | None = None,
     review_callback_handler: ReviewCallbackHandler | None = None,
 ) -> dict[str, Any]:
     """Keep one bounded long-lived CLI consumer attached between messages."""
@@ -606,6 +619,7 @@ def handle_event(line: str) -> None:
             provider_runner=provider_runner,
             reply_runner=reply_runner,
             proposal_deliverer=proposal_deliverer,
+            private_admitter=private_admitter,
         )
         with result_lock:
             if int(result.get("event_count") or 0) and not provider_ready:
diff --git a/loopx/extensions/lark/goal_topic_runtime_service.py b/loopx/extensions/lark/goal_topic_runtime_service.py
index 35faf20c42..0eadb6e3e6 100644
--- a/loopx/extensions/lark/goal_topic_runtime_service.py
+++ b/loopx/extensions/lark/goal_topic_runtime_service.py
@@ -38,6 +38,7 @@ def __init__(
         runtime_root: str | Path,
         runtime_controller: Any,
         action_service: Any | None = None,
+        private_conversations: Any | None = None,
         profile_poller: ProfilePoller | None = None,
         manager_route_reconciler: ManagerRouteReconciler | None = None,
     ) -> None:
@@ -45,6 +46,7 @@ def __init__(
         self.runtime_root = Path(runtime_root).expanduser().resolve()
         self.runtime_controller = runtime_controller
         self.action_service = action_service
+        self.private_conversations = private_conversations
         self._profile_poller = profile_poller or self._poll_profile
         self.manager_route_reconciler = manager_route_reconciler
         self._lock = threading.Lock()
@@ -52,6 +54,7 @@ def __init__(
         self._health: dict[str, dict[str, Any]] = {}
         self._closed = threading.Event()
         self._startup_thread: threading.Thread | None = None
+        self._delivery_thread: threading.Thread | None = None
 
     def start(self) -> None:
         """Discover existing bindings without blocking the HTTP readiness path."""
@@ -65,6 +68,17 @@ def start(self) -> None:
                 daemon=True,
             )
             self._startup_thread.start()
+            if self.private_conversations is not None:
+                self._delivery_thread = threading.Thread(target=self._reconcile_private, name="loopx-lark-private-delivery", daemon=True)
+                self._delivery_thread.start()
+
+    def _reconcile_private(self) -> None:
+        while not self._closed.is_set():
+            try:
+                self.private_conversations.reconcile()
+            except Exception:
+                logging.getLogger(__name__).warning("Private Chat delivery reconciliation is pending")
+            self._closed.wait(1)
 
     def _refresh_on_start(self) -> None:
         while not self._closed.is_set():
@@ -125,7 +139,7 @@ def _profile_worker_fingerprint(
         )
         return (
             str(profile_config.get("cli_bin") or "lark-cli"),
-            str(profile_config.get("bot_app_id") or ""),
+            str(profile_config.get("bot_app_id") or profile_config.get("binding_id") or ""),
             callback_chats,
         )
 
@@ -232,8 +246,12 @@ def handle_review_callback(
                     # A bot App can have several local profile aliases and Chat
                     # servers can use different runtime roots or ports. The
                     # consumer lease must therefore be machine/App scoped.
-                    app_id = str(profile_config.get("bot_app_id") or profile)
-                    digest = hashlib.sha256(app_id.encode("utf-8")).hexdigest()[:32]
+                    app_id = str(profile_config.get("bot_app_id") or "")
+                    # Both paths lease the same App-scoped digest, so aliases
+                    # or a second server cannot start another consumer.
+                    digest = (hashlib.sha256(app_id.encode("utf-8")).hexdigest()[:32]
+                              if app_id else str(profile_config.get("consumer_ref")
+                              or hashlib.sha256(profile.encode("utf-8")).hexdigest()[:32]))
                     lease = Path.home() / ".loopx" / "lark-consumers" / digest
                     with try_exclusive_file_lock(
                         lease, operation="lark_event_consumer"
@@ -252,10 +270,11 @@ def handle_review_callback(
                             stop=stop,
                             runtime_root=self.runtime_root,
                             answer=answer,
+                            private_admitter=(self.private_conversations.admit if self.private_conversations is not None else None),
                             proposal_deliverer=deliver_proposals,
                             review_callback_handler=(
                                 handle_review_callback
-                                if self.action_service is not None
+                                if self.action_service is not None and profile not in dict(self.snapshot_provider().get("private_profiles") or {})
                                 else None
                             ),
                             health_sink=lambda update: self._update_health(
@@ -431,6 +450,8 @@ def close(self) -> None:
             stop.set()
         for _stop, thread, _fingerprint in workers:
             thread.join(timeout=3)
+        if self._delivery_thread is not None:
+            self._delivery_thread.join(timeout=3)
 
 
 __all__ = ["LarkGoalTopicRuntimeService"]
diff --git a/loopx/extensions/lark/inbox_reply.py b/loopx/extensions/lark/inbox_reply.py
index 69773f604d..a1790f1a03 100644
--- a/loopx/extensions/lark/inbox_reply.py
+++ b/loopx/extensions/lark/inbox_reply.py
@@ -282,6 +282,7 @@ def _deliver_lark_inbox_outbound(
     execute: bool = False,
     provider_preflight: bool = False,
     runner: CommandRunner = _default_runner,
+    source_membership_verifier: Callable[[], bool] | None = None,
     before_send: Callable[[str], Mapping[str, Any]] | None = None,
     delivery_attempt_recorder: Callable[[Mapping[str, str | None]], None] | None = None,
     short_message_limit: int | None = DEFAULT_LARK_TEXT_LIMIT,
@@ -399,21 +400,24 @@ def _deliver_lark_inbox_outbound(
             format_preflight_passed=True,
         )
 
-    membership = _call(
-        runner,
-        base
-        + [
-            "im",
-            "chats",
-            "get",
-            "--chat-id",
-            chat_id,
-            "--as",
-            "bot",
-            "--format",
-            "json",
-        ],
-    )
+    if source_membership_verifier is not None:
+        membership = {"returncode": 0 if source_membership_verifier() else 1}
+    else:
+        membership = _call(
+            runner,
+            base
+            + [
+                "im",
+                "chats",
+                "get",
+                "--chat-id",
+                chat_id,
+                "--as",
+                "bot",
+                "--format",
+                "json",
+            ],
+        )
     if membership.get("returncode") != 0:
         return _result(
             status="gate_required",
@@ -514,6 +518,7 @@ def _deliver_lark_inbox_outbound(
                     project=project, config_path=config_path, message_id=message_id,
                     text=text, content_format="text", execute=execute,
                     provider_preflight=provider_preflight, runner=runner, before_send=before_send,
+                    source_membership_verifier=source_membership_verifier,
                     delivery_attempt_recorder=delivery_attempt_recorder,
                 )
                 result.update(content_format="text", format_fallback="post_size_limit")
@@ -738,6 +743,7 @@ def reply_lark_event_inbox(
     execute: bool = False,
     provider_preflight: bool = False,
     runner: CommandRunner = _default_runner,
+    source_membership_verifier: Callable[[], bool] | None = None,
     before_send: Callable[[str], Mapping[str, Any]] | None = None,
     delivery_attempt_recorder: Callable[[Mapping[str, str | None]], None] | None = None,
     short_message_limit: int | None = DEFAULT_LARK_TEXT_LIMIT,
@@ -758,6 +764,7 @@ def reply_lark_event_inbox(
         execute=execute,
         provider_preflight=provider_preflight,
         runner=runner,
+        source_membership_verifier=source_membership_verifier,
         before_send=before_send,
         delivery_attempt_recorder=delivery_attempt_recorder,
         short_message_limit=short_message_limit,
@@ -776,6 +783,7 @@ def verify_lark_inbox_reply(
     text: str,
     attempt: Mapping[str, Any],
     runner: CommandRunner = _default_runner,
+    source_membership_verifier: Callable[[], bool] | None = None,
 ) -> dict[str, Any]:
     """Read back one prior Lark reply without sending another message."""
 
@@ -839,21 +847,24 @@ def verify_lark_inbox_reply(
             "reply_verified": False,
             "blocker": "provider_verification_unavailable",
         }
-    membership = _call(
-        runner,
-        [
-            *base,
-            "im",
-            "chats",
-            "get",
-            "--chat-id",
-            chat_id,
-            "--as",
-            "bot",
-            "--format",
-            "json",
-        ],
-    )
+    if source_membership_verifier is not None:
+        membership = {"returncode": 0 if source_membership_verifier() else 1}
+    else:
+        membership = _call(
+            runner,
+            [
+                *base,
+                "im",
+                "chats",
+                "get",
+                "--chat-id",
+                chat_id,
+                "--as",
+                "bot",
+                "--format",
+                "json",
+            ],
+        )
     if membership.get("returncode") != 0:
         return {
             "ok": False,
diff --git a/loopx/extensions/lark/private_conversation_api.py b/loopx/extensions/lark/private_conversation_api.py
new file mode 100644
index 0000000000..641d653312
--- /dev/null
+++ b/loopx/extensions/lark/private_conversation_api.py
@@ -0,0 +1,86 @@
+"""Loopback setup companion for native, owner-only external project Chat."""
+from __future__ import annotations
+from pathlib import Path
+from typing import Any
+
+PRIVATE_CONVERSATIONS_PATH = "/api/chat/lark/private-conversations"
+
+
+class PrivateConversationRequestMixin:
+    server: Any
+
+    def _private_conversations(self) -> None:
+        bindings = self.server.runtime_controller.project_contexts.conversation_bindings
+        current = bindings.read()
+        titles = {row["project_ref"]: Path(row["workspace_path"]).name
+                  for row in self.server.runtime_controller.project_contexts.available()}
+        health = self.server.lark_goal_topic_runtime.health_snapshot()
+        deliveries = self.server.lark_private_conversations.health()
+        self._send_json({"ok": True, "revision": current["revision"], "connections": [
+            {"binding_id": row["binding_id"], "app_ref": row["transport_ref"], "context_kind": row["context_kind"],
+             "project_ref": row["project_ref"], "context_available": row["project_ref"] in titles, "project_title": titles.get(row["project_ref"], "Unavailable workspace"),
+             "executor_endpoint_id": row["executor_endpoint_id"], "grant": row["grant"],
+             "goal_count": len(row.get("goal_ids", [])),
+             "agent_candidates": [{key: item.get(key) for key in ["session_id", "goal_id", "agent_id", "executor_endpoint_id"]}
+                for item in bindings.agent_candidates(row["binding_id"])],
+             "agent_targets": row.get("agent_targets", []),
+             "listener_status": health.get(row["transport_ref"], {}).get("status", "starting"),
+             **deliveries.get(row["binding_id"], {"pending_count": 0, "recovery_count": 0})}
+            for row in current["bindings"]]})
+
+    def _private_conversation_connect(self) -> None:
+        from .goal_topic_runtime import _active_profile_configs
+        from ...chat_lark_api import build_lark_goal_topic_runtime_snapshot
+        try:
+            body = self._read_json()
+            if set(body) - {"context_kind", "project_grant"} != {"app_ref", "project_ref", "executor_endpoint_id"}:
+                raise ValueError("select an App, authorized workspace and executor")
+            profile = str(body["app_ref"])
+            existing = _active_profile_configs(build_lark_goal_topic_runtime_snapshot(
+                registry_path=self.server.registry_path, runtime_root_override=self.server.runtime_root_override))
+            from .conversation_identity import identity_ref
+            observed = self.server.runtime_controller.project_contexts.conversation_bindings.observe(profile)
+            from ...chat_lark_api import _app_identity_for_private_guard
+            group_apps = [str(config.get("bot_app_id") or _app_identity_for_private_guard(
+                other_profile, self._lark_runner(), self._require_lark_cli()))
+                for other_profile, config in existing.items()]
+            if profile in existing or any(identity_ref(app) == observed["provider_ref"] for app in group_apps):
+                raise ValueError("this App already owns a group listener; disconnect it first")
+            endpoint = str(body["executor_endpoint_id"])
+            if not any(row["agent_id"] == endpoint and row["available"] for row in self.server.runtime_controller.capabilities()):
+                raise ValueError("the selected executor is unavailable")
+            self.server.runtime_controller.project_contexts.conversation_bindings.configure(
+                transport_ref=profile, project_ref=str(body["project_ref"]), executor_endpoint_id=endpoint,
+                context_kind=str(body.get("context_kind", "project")),
+                project_grant=str(body["project_grant"]) if "project_grant" in body else None)
+            self.server.lark_goal_topic_runtime.refresh()
+        except (ValueError, OSError, KeyError) as exc:
+            self._send_error(str(exc), status=400)
+            return
+        self._private_conversations()
+
+    def _private_conversation_disconnect(self) -> None:
+        try:
+            body = self._read_json()
+            if set(body) != {"binding_id", "revision"}:
+                raise ValueError("disconnect the exact current binding revision")
+            self.server.runtime_controller.project_contexts.conversation_bindings.disconnect(
+                str(body["binding_id"]), expected_revision=body["revision"])
+            self.server.lark_goal_topic_runtime.refresh()
+        except (ValueError, OSError, KeyError) as exc:
+            self._send_error(str(exc), status=400)
+            return
+        self._private_conversations()
+
+    def _private_conversation_agent_target(self) -> None:
+        try:
+            body = self._read_json()
+            if set(body) not in [{"binding_id", "revision", "session_id"}, {"binding_id", "revision", "target_ref"}]:
+                raise ValueError("grant an exact existing Session or revoke an exact target revision")
+            bindings = self.server.runtime_controller.project_contexts.conversation_bindings
+            bindings.change_agent_target(binding_id=str(body["binding_id"]), expected_revision=body["revision"],
+                session_id=body.get("session_id"), target_ref=body.get("target_ref"))
+        except (ValueError, OSError, KeyError, StopIteration) as exc:
+            self._send_error(str(exc), status=400)
+            return
+        self._private_conversations()
diff --git a/loopx/extensions/lark/private_conversations.py b/loopx/extensions/lark/private_conversations.py
new file mode 100644
index 0000000000..a5105707eb
--- /dev/null
+++ b/loopx/extensions/lark/private_conversations.py
@@ -0,0 +1,342 @@
+"""Private-message transport for native, Core-bound project Chat.
+
+Only provider provenance, Inbox presentation and delivery receipts live here.
+Core owns audience grants, canonical Sessions, durable Turns and stop/recovery.
+"""
+from __future__ import annotations
+
+import json
+from collections.abc import Mapping
+from pathlib import Path
+from typing import Any
+
+from ...capabilities.native_chat.external_conversations import ChatExternalConversations
+from ...chat_store import _atomic_write_json, _read_json
+from ...file_lock import exclusive_file_lock
+from .conversation_identity import identity_ref, lark_private_source
+from .event_inbox import acknowledge_lark_event_inbox, ingest_lark_event_inbox
+from .goal_channel_transport import call, json_payload, lark_args
+from .inbox_reply import _message, reply_lark_event_inbox, verify_lark_inbox_reply
+
+
+class LarkPrivateConversations:
+    def __init__(self, *, controller: Any, runtime_root: Path, runner: Any, cli_bin: str) -> None:
+        self.core = ChatExternalConversations(controller)
+        self.bindings = self.core.bindings
+        self.runtime_root, self.runner, self.cli_bin = runtime_root, runner, cli_bin
+        self.root = controller.store.root / "lark-private-deliveries"
+
+    def profiles(self) -> dict[str, dict[str, str]]:
+        profiles = {}
+        for row in self.bindings.read()["bindings"]:
+            try:
+                observation = self.bindings.observe(row["transport_ref"])
+            except (ValueError, OSError):
+                # One App's expired login must not block the independently
+                # verified App from acquiring its own listener lease.
+                continue
+            if any(observation.get(field) != row[field] for field in ["provider_ref", "operator_ref"]):
+                continue
+            profiles[row["transport_ref"]] = {"cli_bin": self.cli_bin, "provider_ref": row["provider_ref"],
+                "binding_id": row["binding_id"], "consumer_ref": observation["consumer_ref"]}
+        return profiles
+
+    def health(self) -> dict[str, dict[str, int]]:
+        health: dict[str, dict[str, int]] = {}
+        for path in self.root.glob("*.json"):
+            row = _read_json(path)
+            entry = health.setdefault(row["binding_id"], {"pending_count": 0, "recovery_count": 0})
+            if row["status"] != "delivered":
+                entry["pending_count"] += 1
+                entry["recovery_count"] += int(any(phase.get("started") and not phase.get("verified")
+                                                   for phase in row["deliveries"].values()))
+        return health
+
+    def _binding(self, profile: str) -> dict[str, Any]:
+        return next(row for row in self.bindings.read()["bindings"] if row["transport_ref"] == profile)
+
+    def _source_message(self, record: dict[str, Any]) -> Mapping[str, Any] | None:
+        """Read the exact source under this App, then recheck the Core audience.
+
+        A p2p source read proves the destination without requiring group-member
+        scopes. A caller cannot opt into this path with an HTTP boolean.
+        """
+        event = record["event"]
+        try:
+            selected = self.bindings.resolve(binding_id=record["binding_id"], **record["source"])
+            native_path = self.core.root / f"{record['request_ref']}.json"
+            native = _read_json(native_path) if native_path.exists() else {}
+            if native.get("agent_target"):
+                self.bindings.resolve_agent_target(selected, native["agent_target"])
+            result = call(self.runner, lark_args(cli_bin=self.cli_bin, profile=record["profile"],
+                tail=["im", "+messages-mget", "--message-ids", event["message_id"],
+                      "--as", "bot", "--no-reactions", "--format", "json"]))
+            message = _message(json_payload(result), event["message_id"])
+            sender = message.get("sender") if isinstance(message, Mapping) else None
+            if (result.get("returncode") == 0 and message is not None
+                    and message.get("chat_id") == event["chat_id"] and isinstance(sender, Mapping)
+                    and sender.get("id") == event["sender_id"] and sender.get("sender_type") == "user"):
+                return message
+        except (KeyError, ValueError, OSError):
+            pass
+        return None
+
+    def _source_verified(self, record: dict[str, Any]) -> bool:
+        return self._source_message(record) is not None
+
+    def _inbox(self, record: dict[str, Any]) -> Path:
+        observation = self.bindings.observe(record["profile"])
+        scope = record["source"]["source_ref"]
+        path = self.runtime_root / ".loopx" / "config" / "private-chat" / f"{scope}.json"
+        _atomic_write_json(path, {
+            "schema_version": "lark_event_inbox_config_v0", "enabled": True,
+            "inbox_dir": f".loopx/inbox/private-chat/{scope}", "capture_scope": "configured_chat_all",
+            "reply": {"enabled": True, "sender_profile": record["profile"], "sender_identity": "bot",
+                "bot_display_name": observation["bot_display_name"], "chat_id": record["event"]["chat_id"],
+                "placement_policy": "source_context", "received_reaction_emoji": ""},
+        })
+        event = record["event"]
+        # Some unsupported attachment events have no rendered content. Keep a
+        # source-backed presentation placeholder so the explicit notice can reply.
+        content = event.get("content") or "附件（内容尚不支持）"
+        captured = ingest_lark_event_inbox(project=self.runtime_root, config_path=path,
+            events=[{**event, "content": content, "schema_version": "lark_event_inbox_event_v0"}], execute=True)
+        if captured["invalid_count"]:
+            raise ValueError("private source could not be captured")
+        return path
+
+    def admit(self, profile: str, event: dict[str, Any]) -> dict[str, Any]:
+        try:
+            binding = self._binding(profile)
+            source = lark_private_source(provider_ref=binding["provider_ref"], event=event)
+            self.bindings.resolve(binding_id=binding["binding_id"], **source)
+        except (KeyError, StopIteration, ValueError):
+            return {"status": "audience_rejected"}
+        request = identity_ref(binding["provider_ref"], event["message_id"])
+        path = self.root / f"{request}.json"
+        with exclusive_file_lock(path, operation="capture_private_chat_request"):
+            if path.exists():
+                record = _read_json(path)
+                # event_id can change on redelivery; canonical message content
+                # and audience cannot change underneath the stable message id.
+                if any(record["event"].get(key) != event.get(key) for key in
+                       ["message_id", "sender_id", "chat_id", "content", "message_type"]):
+                    return {"status": "source_conflict"}
+            else:
+                record = {"schema_version": "lark_private_chat_delivery_v0", "request_ref": request,
+                    "profile": profile, "binding_id": binding["binding_id"], "source": source,
+                    "event": event, "deliveries": {}, "status": "captured"}
+                _atomic_write_json(path, record)
+            source_message = self._source_message(record)
+            if source_message is None:
+                return {"status": "source_verification_failed"}
+            message_type = str(event.get("message_type") or "")
+            text = ""
+            if message_type == "text":
+                # lark-cli renders event and mget content as plain text. Read
+                # the full canonical message; do not decode a rendered event.
+                canonical_type = source_message.get("msg_type", source_message.get("message_type"))
+                if canonical_type != "text":
+                    return {"status": "source_conflict"}
+                content = source_message.get("content")
+                if isinstance(content, str):
+                    text = content
+                else:
+                    # Raw provider envelopes are supported by the existing
+                    # readback contract too; keep parsing isolated to body.
+                    try:
+                        raw = json.loads(source_message["body"]["content"])
+                        text = raw["text"]
+                    except (ValueError, KeyError, TypeError):
+                        return {"status": "invalid_text"}
+                    if not isinstance(text, str):
+                        return {"status": "invalid_text"}
+                if not text.strip():
+                    return {"status": "empty_text"}
+            command = {"/status": "status", "/help": "help", "/new": "new", "/stop": "stop"}.get(text.strip())
+            if text.strip() == "/agents":
+                command = "agents"
+            elif text.strip() == "/project":
+                command = "select_project"
+            elif text.strip() == "/agent" or text.strip().startswith("/agent "):
+                command = "select_agent"
+            if binding["context_kind"] == "steward":
+                for prefix, selected_command in [("/delegate", "commission"), ("/委托", "commission"),
+                                                  ("/confirm", "confirm_commission"), ("/cancel", "cancel_commission"),
+                                                  ("/stop-commission", "stop_commission"), ("/resume-commission", "resume_commission")]:
+                    if text.strip() == prefix or text.strip().startswith(prefix + " "):
+                        command = selected_command
+                        break
+            if message_type != "text":
+                command = "unsupported"
+            try:
+                admitted = self.core.admit(binding_id=binding["binding_id"], source=source,
+                    request_ref=request, message=text, command=command)
+            except ValueError:
+                record.update(status="rejected", response="操作或原授权不可用；Agent 请先用 /agents 查看确切命令，/project 返回项目对话。新委托请使用 /delegate --tokens N 具体目标，确认或取消请使用原预览中的完整命令。")
+                _atomic_write_json(path, record)
+                return {"status": "command_rejected"}
+            except RuntimeError as exc:
+                if str(exc) != "session_queue_full":
+                    raise
+                record.update(status="rejected", response="队列已满，本条没有被受理；请稍后重试。")
+                _atomic_write_json(path, record)
+                return {"status": "queue_rejected"}
+            record.update(status=admitted["status"], session_id=admitted["session_id"],
+                          turn_id=admitted["turn_id"], response=admitted.get("response"), response_code=admitted.get("response_code"))
+            _atomic_write_json(path, record)
+            status = "durably_accepted" if admitted["status"] == "accepted" else (
+                "queue_rejected" if admitted["status"] == "rejected" else "command_recorded")
+            return {"status": status}
+
+    def _reply_runner(self, args: list[str]) -> Any:
+        return self.runner([self.cli_bin, *args[1:]], None, 30)
+
+    def _deliver(self, path: Path, record: dict[str, Any], phase: str, text: str) -> bool:
+        if not text:
+            return False
+        phase_state = record["deliveries"].get(phase, {})
+        if phase_state.get("verified"):
+            return True
+        if phase_state.get("text") not in (None, text):
+            raise ValueError("delivery content changed after an attempt")
+        config = self._inbox(record)
+        kwargs = dict(project=self.runtime_root, config_path=config,
+            message_id=record["event"]["message_id"], text=text, runner=self._reply_runner,
+            source_membership_verifier=lambda: self._source_verified(record))
+        if phase_state.get("attempt"):
+            result = verify_lark_inbox_reply(**kwargs, attempt=phase_state["attempt"])
+        elif phase_state.get("started"):
+            # A crash between provider write and its receipt is ambiguous. Keep
+            # the original source recoverable; never resend blindly.
+            return False
+        else:
+            def before_send(_intent: str) -> dict[str, bool]:
+                phase_state.update(text=text, started=True)
+                record["deliveries"][phase] = phase_state
+                _atomic_write_json(path, record)
+                return {"continue_delivery": True}
+
+            def attempt(value: Any) -> None:
+                phase_state["attempt"] = dict(value)
+                _atomic_write_json(path, record)
+
+            result = reply_lark_event_inbox(**kwargs, execute=True, before_send=before_send,
+                                           delivery_attempt_recorder=attempt, short_message_limit=None)
+        phase_state["verified"] = result.get("reply_verified") is True
+        phase_state["blocker"] = result.get("blocker")
+        record["deliveries"][phase] = phase_state
+        _atomic_write_json(path, record)
+        return bool(phase_state["verified"])
+
+    def reconcile(self) -> int:
+        self.core.recover()
+        # A crash after Core admission but before the transport correlation
+        # record is repaired by replaying the same message identity.
+        for pending in sorted(self.root.glob("*.json")):
+            row = _read_json(pending)
+            if row["status"] == "captured":
+                self.admit(row["profile"], row["event"])
+        delivered = 0
+        for path in sorted(self.root.glob("*.json")):
+            with exclusive_file_lock(path, operation="deliver_private_chat_request"):
+                record = _read_json(path)
+                if record["status"] in {"captured", "delivered"}:
+                    continue
+                try:
+                    self.bindings.resolve(binding_id=record["binding_id"], **record["source"])
+                    if record["status"] in {"command_queued", "command_completed", "commission_running"}:
+                        native = self.core.read_request(record["request_ref"])
+                        if native["status"] == "command_queued":
+                            self._deliver(path, record, "admission", native["response"])
+                            continue
+                        record.update(status=native["status"], response=native.get("response"),
+                                      commission_resources=native.get("commission_resources"),
+                                      status_snapshot=native.get("status_snapshot"))
+                    if record["status"] == "accepted":
+                        native = self.core.read_request(record["request_ref"])
+                        if native.get("agent_target"):
+                            self.bindings.resolve_agent_target(self.bindings.resolve(binding_id=record["binding_id"], **record["source"]), native["agent_target"])
+                        # Receipt follows persistent Core admission and is
+                        # independent of terminal execution and reply delivery.
+                        self._deliver(path, record, "admission", "已持久受理到原 Agent 会话；等待原宿主领取。/status 查看持久队列，/project 返回普通项目对话。实时停止暂不支持，请在原宿主处理。" if native.get("agent_target") else "已持久受理；若已有执行，本条会排队。可发送 /status、/stop 或 /new。")
+                        turn = self.core.controller.store.load_turn(record["session_id"], record["turn_id"])
+                        if not turn or turn["status"] not in {"completed", "failed", "interrupted", "expired"}:
+                            continue
+                        response = str((turn.get("response") or {}).get("message") or "") if turn["status"] == "completed" else (
+                            "本次执行已停止。" if turn["status"] == "interrupted" else
+                            "本次执行失败或已过期，原会话已保留；请发送 /status 后再决定是否重试。")
+                    else:
+                        response = _command_text(str(record.get("response_code") or "")) or str(record.get("response") or "")
+                        if record.get("status_snapshot"):
+                            response = _status_text(record["status_snapshot"], help_requested=native.get("command") == "help")
+                    if self._deliver(path, record, "terminal", response):
+                        resources = record.get("commission_resources") or {}
+                        if resources.get("session_id") and resources.get("turn_id"):
+                            first_turn = self.core.controller.store.load_turn(resources["session_id"], resources["turn_id"])
+                            if not first_turn or first_turn["status"] not in {"completed", "failed", "interrupted", "expired"}:
+                                record["status"] = "commission_running"
+                                _atomic_write_json(path, record)
+                                continue
+                            result_text = str((first_turn.get("response") or {}).get("message") or "")
+                            result_text = "委托执行结果：\n" + result_text if first_turn["status"] == "completed" else "委托首轮执行未完成；原 Goal 和回执已保留，请查看状态后决定恢复。"
+                            proposal_id = native.get("proposal_id")
+                            if proposal_id:
+                                result_text += f"\n如需恢复暂停或额度受限的原执行：/resume-commission {proposal_id} --tokens N（N 为包含历史用量的总上限，须大于已用量；不会重开线程）。"
+                            if not self._deliver(path, record, "commission_result", result_text):
+                                continue
+                        config = self._inbox(record)
+                        acknowledge_lark_event_inbox(project=self.runtime_root, config_path=config,
+                            message_ids=[record["event"]["message_id"]], execute=True)
+                        self.core.record_delivery(record["request_ref"], session_id=record.get("session_id"), turn_id=record.get("turn_id"))
+                        record["status"] = "delivered"
+                        _atomic_write_json(path, record)
+                        delivered += 1
+                except (KeyError, ValueError, OSError):
+                    # Keep pending receipts available for actionable recovery.
+                    continue
+        return delivered
+
+
+def _command_text(code: str) -> str:
+    return {"unsupported_attachment": "此入口目前只支持文字；图片或文件没有交给模型。请发送文字描述。",
+        "no_session": "尚无会话；发送文字即可开始。", "active_session": "正在执行；后续文字会进入同一会话队列。",
+        "ready_session": "会话已就绪，可继续发送文字。", "new_session": "已关闭此前会话；下一条文字将开启新会话。",
+        "attached_control_unavailable": "原 Agent 宿主尚不支持此处的实时停止或新建会话；原执行没有被停止或替换。请在原宿主处理，/project 返回普通项目对话。",
+        "stop_requested": "已请求停止这条消息对应的执行。", "no_active_turn": "当前没有正在执行的消息。"}.get(code, "")
+
+
+def _status_text(snapshot: dict[str, Any], *, help_requested: bool) -> str:
+    """Localize Core facts; never infer an Agent, grant or model completion."""
+    steward = snapshot["context_kind"] == "steward"
+    phases = {"queued": "已受理等待执行", "starting": "正在启动", "running": "正在执行",
+        "completing": "正在收尾", "interrupting": "正在停止", "completed": "原生执行结束",
+        "interrupted": "已停止", "timed_out": "执行超时", "failed": "执行失败"}
+    if snapshot["session_status"] is None:
+        state = "尚无会话；发送文字即可开始。"
+    elif not snapshot["active_turn_observation_available"]:
+        state = "执行证据暂不可读；请在本机检查原会话。"
+    elif snapshot["active_turn_status"]:
+        state = phases.get(snapshot["active_turn_status"], "执行状态暂不可判定；请在本机检查原会话。")
+    else:
+        state = {"failed": "会话恢复失败；请在本机检查原会话。",
+            "resume_failed": "会话恢复失败；请在本机检查原会话。", "stale": "会话需要恢复。",
+            "starting": "会话正在启动。", "resuming": "会话正在恢复。",
+            "ready": "会话可继续。", "closed": "会话已关闭。"}.get(
+                snapshot["session_status"], "会话状态暂不可判定；请在本机检查原会话。")
+    text = (f"状态快照（{snapshot['observed_at']}）\n角色：{'长期管家' if steward else '普通项目对话'}"
+        f"\n工作区：{snapshot['workspace_path']}\n执行器：{snapshot['executor_endpoint_id']}"
+        f"\n{state}\n已持久排队：{snapshot['queued_count']} 条。")
+    if snapshot.get("recipient_agent_id"):
+        return text + f"\n已选择 Agent：{snapshot['recipient_agent_id']} · {snapshot['recipient_goal_id']}。等待原宿主领取队列；/agents 查看授权，/project 返回普通项目对话。实时停止或新建请在原宿主处理。"
+    text += (f"\n已授权新委托：{snapshot['authorized_commission_count']}；执行结束不代表委托验收。" if steward else
+        ("\n已明确授权此工作区读写，按项目规则和 skills 执行当前指令；没有自动选用注册 Agent 或创建 Goal。"
+         if snapshot["grant"] == "workspace_write" else "\n当前仅有工作区只读授权；没有自动选用注册 Agent 或创建 Goal。"))
+    text += "\n/status 查看状态；/stop 停止当前聊天执行；/new 关闭当前聊天并开启下次新会话；/help 查看用法。"
+    if not steward:
+        text += "\n/agents 查看本 App 已授权的 Agent；使用列表中的完整 /agent 命令选择，/project 返回此项目会话。"
+    if help_requested:
+        text += "\n工作区、执行器与解绑：本机 Chat → 设置 → Lark。变更或解绑会重新核验授权；已受理工作不会迁移到新会话。图片/文件目前未交给模型，请改用文字。"
+        if steward:
+            text += "\n新委托：/delegate --tokens N 具体目标；读完预览后从原私聊发送完整 /confirm。/cancel 取消预览；/stop-commission 和 /resume-commission 使用原回执中的完整命令。"
+    return text
diff --git a/loopx/semantics/project_registry_io_manifest_v1.json b/loopx/semantics/project_registry_io_manifest_v1.json
index 447353acd5..b1017ce774 100644
--- a/loopx/semantics/project_registry_io_manifest_v1.json
+++ b/loopx/semantics/project_registry_io_manifest_v1.json
@@ -53,6 +53,22 @@
       "api": "load_project_registry",
       "classification": "codec_api"
     },
+    {
+      "site": "loopx/attached_session.py::<module>._claim_attached_turn_under_grant::codec_read:load_registry#1",
+      "line": 740,
+      "column": 42,
+      "kind": "codec_read",
+      "api": "load_registry",
+      "classification": "codec_api"
+    },
+    {
+      "site": "loopx/attached_session.py::<module>._enqueue_attached_agent_turn_under_grant::codec_read:load_registry#1",
+      "line": 669,
+      "column": 46,
+      "kind": "codec_read",
+      "api": "load_registry",
+      "classification": "codec_api"
+    },
     {
       "site": "loopx/attached_session.py::<module>._strict_registry::codec_read:load_project_registry#1",
       "line": 143,
@@ -253,6 +269,14 @@
       "api": "load_project_registry",
       "classification": "codec_api"
     },
+    {
+      "site": "loopx/capabilities/native_chat/conversation_bindings.py::<module>.ChatConversationBindings.agent_observation::codec_read:load_registry#1",
+      "line": 146,
+      "column": 20,
+      "kind": "codec_read",
+      "api": "load_registry",
+      "classification": "codec_api"
+    },
     {
       "site": "loopx/capabilities/periodic_report/cadence_runtime.py::<module>.periodic_report_cadence_hooks::codec_read:load_registry#1",
       "line": 27,
@@ -431,7 +455,7 @@
     },
     {
       "site": "loopx/chat_server.py::<module>.ChatRequestHandler._goal_channel_extension_ready::codec_read:load_registry#1",
-      "line": 992,
+      "line": 998,
       "column": 24,
       "kind": "codec_read",
       "api": "load_registry",
@@ -439,7 +463,7 @@
     },
     {
       "site": "loopx/chat_server.py::<module>.ChatRequestHandler._registry_and_goal::codec_read:load_registry#1",
-      "line": 519,
+      "line": 525,
       "column": 20,
       "kind": "codec_read",
       "api": "load_registry",
@@ -447,7 +471,7 @@
     },
     {
       "site": "loopx/chat_server.py::<module>.serve_chat::codec_read:load_registry#1",
-      "line": 1546,
+      "line": 1558,
       "column": 16,
       "kind": "codec_read",
       "api": "load_registry",
@@ -455,7 +479,7 @@
     },
     {
       "site": "loopx/chat_server.py::<module>.serve_chat._wake_goal_context::codec_read:load_registry#1",
-      "line": 1635,
+      "line": 1663,
       "column": 20,
       "kind": "codec_read",
       "api": "load_registry",
diff --git a/tests/control_plane_ts/conversation_binding.test.ts b/tests/control_plane_ts/conversation_binding.test.ts
new file mode 100644
index 0000000000..dc5fc99862
--- /dev/null
+++ b/tests/control_plane_ts/conversation_binding.test.ts
@@ -0,0 +1,256 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {planConversationBinding, resolveBoundConversation, planBoundConversationRequest,
+  stewardCommand, authorizeStewardCreation, resolveConversationAgentTarget} from "../../loopx/control_plane/collaboration/conversation_binding.ts";
+import {resolveConversationScope, projectConversationIdentity} from "../../loopx/control_plane/collaboration/conversation_scope.ts";
+
+const project = {kind: "project_workspace", project_ref: "a".repeat(24), workspace_path: "/authorized/notes",
+  audience: "local_owner", grant: "workspace_read"};
+const row = {schema_version: "loopx_chat_conversation_binding_v0", binding_id: "b".repeat(24),
+  transport_ref: "notes-app", provider_ref: "c".repeat(24), operator_ref: "d".repeat(24),
+  context_kind: "project", project_ref: project.project_ref, executor_endpoint_id: "codex",
+  grant: "workspace_read", enabled: true};
+const observation = {transport_ref: row.transport_ref, provider_ref: row.provider_ref,
+  operator_ref: row.operator_ref, verified: true};
+const current = {schema_version: "loopx_chat_conversation_bindings_v0", revision: 0, bindings: []};
+const request = {current, expected_revision: 0, operation: "configure", binding: row, observation,
+  available_projects: [project]};
+
+test("explicit project writes remain App-bound and cannot exceed the host grant, another executor or an existing Session", () => {
+  const original = planConversationBinding(request).state as typeof current;
+  const use = {current: original, binding_id: row.binding_id, source_ref: "e".repeat(24),
+    sender_ref: row.operator_ref, private_human_message: true, observation, available_projects: [project]};
+  const read = resolveBoundConversation(use);
+  assert.equal(projectConversationIdentity({context: read.context}).sandbox, "read-only");
+  assert.equal(projectConversationIdentity({context: {...project, grant: "workspace_write"}}).sandbox, "workspace-write");
+  const writable = [{...project, grant: "workspace_write"}];
+  assert.throws(() => planConversationBinding({...request, current: original, expected_revision: 1,
+    binding: {...row, grant: "workspace_write"}, available_projects: writable}), /new binding identity/);
+  const write = {...row, binding_id: "f".repeat(24), grant: "workspace_write"};
+  const next = planConversationBinding({...request, current: original, expected_revision: 1, binding: write, available_projects: writable}).state;
+  assert.throws(() => planConversationBinding({...request, binding: write}), /workspace/);
+  assert.throws(() => resolveBoundConversation({...use, current: next, binding_id: write.binding_id}), /write grant/);
+  use.available_projects = writable;
+  const selected = resolveBoundConversation({...use, current: next, binding_id: write.binding_id});
+  assert.equal(projectConversationIdentity({context: selected.context}).sandbox, "workspace-write");
+  assert.deepEqual(resolveConversationScope({goal_id: null, channel_id: selected.channel_id,
+    project_context: selected.context, origin: "lark"}), {kind: "project_workspace", goal_ids: [], private_conversation: false});
+  assert.throws(() => resolveBoundConversation({...use, current: next}), /no longer authorized/);
+  assert.throws(() => resolveBoundConversation({...use, current: next, binding_id: write.binding_id,
+    session_context: read.context}), /context changed/);
+  for (const bad of [{...write, executor_endpoint_id: "claude-code"},
+    {...write, context_kind: "steward", goal_ids: []}, {...write, grant: "danger-full-access"}]) {
+    assert.throws(() => planConversationBinding({...request, binding: bad}), /unsupported/);
+  }
+  assert.throws(() => resolveBoundConversation({...use, current: next, binding_id: write.binding_id,
+    sender_ref: "c".repeat(24)}), /audience/);
+});
+
+test("binding independently verifies the owner and does not create a Goal", () => {
+  const result = planConversationBinding(request);
+  assert.equal(result.changed, true);
+  const next = result.state as typeof current;
+  assert.equal(next.revision, 1);
+  assert.equal("goal_id" in next.bindings[0], false);
+  const repeat = planConversationBinding({...request, current: next, expected_revision: 1,
+    binding: {...row, binding_id: "e".repeat(24)}});
+  assert.equal(repeat.changed, false);
+  for (const proof of [{...observation, verified: false}, {...observation, operator_ref: "f".repeat(24)},
+    {...observation, provider_ref: "e".repeat(24)}]) {
+    assert.throws(() => planConversationBinding({...request, observation: proof}), /independently verified/);
+  }
+  assert.throws(() => planConversationBinding({...request, available_projects: []}), /workspace/);
+  assert.throws(() => planConversationBinding({...request, expected_revision: 1}), /revision/);
+});
+
+test("a selected steward has a verified empty portfolio and adopts only its own exact new creation", () => {
+  const steward = {...row, context_kind: "steward", grant: "portfolio_read", goal_ids: []};
+  const next = planConversationBinding({...request, binding: steward}).state as typeof current;
+  const use = {current: next, binding_id: row.binding_id, source_ref: "e".repeat(24),
+    sender_ref: row.operator_ref, private_human_message: true, observation, available_projects: [project]};
+  const selected = resolveBoundConversation(use);
+  assert.equal(resolveConversationScope({channel_id: selected.channel_id, goal_id: "loopx-manager",
+    steward_context: selected.context, origin: "lark"}).bound_steward, true);
+  assert.equal(resolveConversationScope({channel_id: selected.channel_id, goal_id: "loopx-manager",
+    steward_context: selected.context, origin: "web"}).bound_steward, undefined);
+  const context = selected.context as Record<string, unknown>;
+  const proposal = {proposal_id: "proposal-" + "f".repeat(32), status: "applied", action_kind: "goal.create",
+    context, receipt: {outcome: "goal_created", projection_verified: true, resource_ids: {goal_id: "fresh-goal"}}};
+  const adoption = {current: next, expected_revision: 1, operation: "adopt_created_goal", binding_id: row.binding_id,
+    context, proposal, goal: {goal_id: "fresh-goal", workspace_path: project.workspace_path, creation_operation_id: proposal.proposal_id}};
+  const result = planConversationBinding(adoption).state as typeof current;
+  assert.deepEqual((result.bindings[0] as Record<string, unknown>).goal_ids, ["fresh-goal"]);
+  assert.deepEqual((resolveBoundConversation({...use, current: result, session_context: context}).context as Record<string, unknown>).goal_ids, ["fresh-goal"]);
+  for (const bad of [{...adoption, goal: {...adoption.goal, workspace_path: "/other/private"}},
+    {...adoption, proposal: {...proposal, status: "preview_ready"}},
+    {...adoption, proposal: {...proposal, context: {...context, source_ref: "f".repeat(24)}}},
+    {...adoption, proposal: {...proposal, receipt: {...proposal.receipt, projection_verified: false}}}]) {
+    assert.throws(() => planConversationBinding(bad));
+  }
+});
+
+test("a commission requires an explicit budget and confirmation stays within its audience and expiry", () => {
+  assert.deepEqual(stewardCommand({command: "commission", message: "/delegate --tokens 12000 Read README"}),
+    {argument: "Read README", native_token_budget: 12000});
+  for (const message of ["delegate work", "/delegate Read README", "/delegate --tokens 0 work", "/delegate --tokens 1000"])
+    assert.throws(() => stewardCommand({command: "commission", message}));
+  const context = {...project, kind: "bound_steward", audience: "bound_owner", grant: "portfolio_read", goal_ids: [],
+    binding_id: row.binding_id, source_ref: "e".repeat(24), provider_ref: row.provider_ref, operator_ref: row.operator_ref};
+  const proposal = {action_kind: "goal.create", created_at: "2026-01-01T10:00:00Z",
+    context: {...context, kind: "manager", goal_id: "loopx-manager", expires_at: "2026-01-01T10:15:00Z"}};
+  assert.equal(authorizeStewardCreation({context, proposal, now: "2026-01-01T10:01:00Z"}).authorized, true);
+  assert.throws(() => authorizeStewardCreation({context, proposal, now: "2026-01-01T10:16:00Z"}), /expired/);
+  assert.throws(() => authorizeStewardCreation({context: {...context, provider_ref: "f".repeat(24)}, proposal,
+    now: "2026-01-01T10:01:00Z"}), /audience/);
+  assert.throws(() => planBoundConversationRequest({binding: row, current_session: null,
+    request: {request_ref: "e".repeat(24), command: "commission"}}), /selected steward/);
+});
+
+test("one App has one binding owner, and a context change cannot move an existing Session", () => {
+  const next = planConversationBinding(request).state as typeof current;
+  const second = {...row, transport_ref: "other-app", binding_id: "e".repeat(24)};
+  assert.throws(() => planConversationBinding({...request, current: next, expected_revision: 1,
+    binding: second, observation: {...observation, transport_ref: "other-app"}}), /ownership/);
+  const other = {...project, project_ref: "f".repeat(24), workspace_path: "/authorized/other"};
+  assert.throws(() => planConversationBinding({...request, current: next, expected_revision: 1,
+    binding: {...row, project_ref: other.project_ref}, available_projects: [other]}), /new binding identity/);
+});
+
+test("external project audience has its own Session identity without portfolio or peer scope", () => {
+  const next = planConversationBinding(request).state;
+  const use = {current: next, binding_id: row.binding_id, source_ref: "e".repeat(24),
+    sender_ref: row.operator_ref, private_human_message: true, observation, available_projects: [project]};
+  const selected = resolveBoundConversation(use);
+  assert.equal(selected.channel_id, `project.external.${row.binding_id}.${use.source_ref}`);
+  assert.deepEqual(resolveConversationScope({channel_id: selected.channel_id, project_context: selected.context,
+    goal_id: null, origin: "lark"}), {kind: "project_workspace", goal_ids: [], private_conversation: false});
+  for (const bad of [{...use, sender_ref: "f".repeat(24)}, {...use, private_human_message: false},
+    {...use, available_projects: []}, {...use, observation: {...observation, provider_ref: "f".repeat(24)}}]) {
+    assert.throws(() => resolveBoundConversation(bad));
+  }
+  assert.throws(() => resolveBoundConversation({...use, source_ref: "f".repeat(24), session_context: selected.context}), /context changed/);
+  const revoked = planConversationBinding({current: next, expected_revision: 1,
+    operation: "disconnect", binding_id: row.binding_id}).state;
+  assert.throws(() => resolveBoundConversation({...use, current: revoked}), /no longer authorized/);
+});
+
+
+test("native commands retain their recorded target across a new Session and redelivery", () => {
+  const request = {request_ref: "e".repeat(24), command: "stop", target_recorded: true,
+    session_id: "original", turn_id: "original-turn"};
+  const current = {session_id: "replacement", active_turn_id: "different-turn"};
+  assert.deepEqual(planBoundConversationRequest({request, current_session: current}), {
+    operation: "stop", session_id: "original", turn_id: "original-turn", response_code: "stop_requested"});
+  assert.deepEqual(planBoundConversationRequest({request: {...request, command: null}, current_session: current}), {
+    operation: "admit_turn", client_turn_id: `external-${request.request_ref}`, session_id: "original", turn_id: null});
+  assert.equal(planBoundConversationRequest({request: {...request, command: "unsupported"},
+    current_session: null}).response_code, "unsupported_attachment");
+  assert.throws(() => planBoundConversationRequest({request: {...request, command: "grant"}, current_session: current}),
+    /unsupported/);
+});
+
+test("status and help project only the verified binding without opening a Session", () => {
+  const context = resolveBoundConversation({current: planConversationBinding(request).state,
+    binding_id: row.binding_id, source_ref: "e".repeat(24), sender_ref: row.operator_ref,
+    private_human_message: true, observation, available_projects: [project]}).context;
+  const input = {binding: row, context, current_session: null, queued_count: 0, active_turn: null,
+    observed_at: "2026-01-01T10:00:00Z", request: {request_ref: "f".repeat(24), command: "status"}};
+  const plan = planBoundConversationRequest(input);
+  assert.equal(plan.operation, "reply");
+  assert.equal(plan.session_id, null);
+  assert.equal(plan.response_code, "no_session");
+  assert.deepEqual(plan.status_snapshot, {schema_version: "loopx_chat_bound_status_v0",
+    observed_at: input.observed_at, context_kind: "project", workspace_path: project.workspace_path,
+    executor_endpoint_id: "codex", grant: "workspace_read", authorized_commission_count: 0,
+    session_status: null, active_turn_status: null, active_turn_observation_available: true, queued_count: 0});
+  assert.equal(planBoundConversationRequest({...input, request: {...input.request, command: "help"}}).response_code,
+    "conversation_help");
+  for (const bad of [{...input, binding: {...row, provider_ref: "a".repeat(24)}},
+    {...input, queued_count: -1}, {...input, queued_count: .5}, {...input, queued_count: 1},
+    {...input, observed_at: "unknown"}]) assert.throws(() => planBoundConversationRequest(bad));
+});
+
+test("status reads the canonical queue and exact active Turn, retaining unavailable evidence", () => {
+  const selected = resolveBoundConversation({current: planConversationBinding(request).state,
+    binding_id: row.binding_id, source_ref: "e".repeat(24), sender_ref: row.operator_ref,
+    private_human_message: true, observation, available_projects: [project]});
+  const session = {session_id: "original", channel_id: selected.channel_id, goal_id: null,
+    project_context: selected.context, status: "busy", active_turn_id: "original-turn"};
+  const turn = {session_id: session.session_id, turn_id: session.active_turn_id, status: "running"};
+  const input = {binding: row, context: selected.context, current_session: session, queued_count: 2,
+    active_turn: turn, observed_at: "2026-01-01T10:00:00Z",
+    request: {request_ref: "f".repeat(24), command: "status"}};
+  const snapshot = planBoundConversationRequest(input).status_snapshot as Record<string, unknown>;
+  assert.equal(snapshot.queued_count, 2);
+  assert.equal(snapshot.active_turn_status, "running");
+  assert.equal((planBoundConversationRequest({...input, active_turn: null}).status_snapshot as Record<string, unknown>)
+    .active_turn_observation_available, false);
+  for (const bad of [{...input, current_session: {...session, channel_id: "another-owner"}},
+    {...input, active_turn: {...turn, session_id: "another-session"}},
+    {...input, active_turn: {...turn, turn_id: "later-turn"}},
+    {...input, active_turn: {...turn, status: {pretend: "completed"}}}]) {
+    assert.throws(() => planBoundConversationRequest(bad));
+  }
+});
+
+test("steward status counts its fresh grant, not a global portfolio or old Session scope", () => {
+  const steward = {...row, context_kind: "steward", grant: "portfolio_read", goal_ids: ["fresh-goal"]};
+  const context = {...project, kind: "bound_steward", audience: "bound_owner", grant: "portfolio_read",
+    goal_ids: ["fresh-goal"], binding_id: row.binding_id, source_ref: "e".repeat(24),
+    provider_ref: row.provider_ref, operator_ref: row.operator_ref};
+  const plan = planBoundConversationRequest({binding: steward, context, queued_count: 0, active_turn: null,
+    observed_at: "2026-01-01T10:00:00Z", request: {request_ref: "f".repeat(24), command: "help"},
+    current_session: {session_id: "steward", channel_id: `manager.external.native.${row.binding_id}.${context.source_ref}`,
+      goal_id: "loopx-manager", steward_context: {...context, goal_ids: []}, status: "ready", active_turn_id: null}});
+  assert.equal((plan.status_snapshot as Record<string, unknown>).authorized_commission_count, 1);
+  assert.equal(JSON.stringify(plan).includes("fresh-goal"), false);
+});
+
+test("an exact registered attached Session needs its own App grant and workspace", () => {
+  const target = {target_ref: "f".repeat(24), host_ref: "a".repeat(24), session_id: "exact-session", goal_id: "sample-goal",
+    goal_instance_id: "lifetime-a", agent_id: "notes-worker", executor_endpoint_id: "codex"};
+  const observed = {session: {...target, session_mode: "attached_host", status: "ready"},
+    goal: {goal_id: target.goal_id, workspace_path: project.workspace_path, registered_agents: [target.agent_id]},
+    host_binding_verified: true, host_ref: target.host_ref, host_audience_binding_ids: []};
+  const configured = planConversationBinding(request).state as typeof current;
+  const grantInput = {current: configured, expected_revision: 1, operation: "grant_agent_target",
+    binding_id: row.binding_id, target, target_observation: observed, observation, available_projects: [project]};
+  const longGoal = "g".repeat(160);
+  assert.equal(planConversationBinding({...grantInput, target: {...target, goal_id: longGoal},
+    target_observation: {...observed, session: {...observed.session, goal_id: longGoal},
+      goal: {...observed.goal, goal_id: longGoal}}}).changed, true);
+  const granted = planConversationBinding(grantInput).state as typeof current;
+  const selected = resolveBoundConversation({current: granted, binding_id: row.binding_id, source_ref: "e".repeat(24),
+    sender_ref: row.operator_ref, private_human_message: true, observation, available_projects: [project]});
+  const input = {binding: (granted.bindings as unknown[])[0], context: selected.context, target, target_observation: observed};
+  assert.deepEqual(resolveConversationAgentTarget(input).target, target);
+  for (const bad of [{...input, target: {...target, agent_id: "codex"}},
+    {...input, context: {...selected.context as object, provider_ref: "e".repeat(24)}},
+    {...input, target_observation: {...observed, host_binding_verified: false}},
+    {...input, target_observation: {...observed, session: {...observed.session, goal_instance_id: "recreated"}}},
+    {...input, target_observation: {...observed, goal: {...observed.goal, registered_agents: []}}},
+    {...input, target_observation: {...observed, goal: {...observed.goal, workspace_path: "/other"}}},
+    {...input, target_observation: {...observed, session: {...observed.session, external_conversation_binding_id: "e".repeat(24)}}}]) {
+    assert.throws(() => resolveConversationAgentTarget(bad));
+  }
+  const revoked = planConversationBinding({current: granted, expected_revision: 2, operation: "revoke_agent_target",
+    binding_id: row.binding_id, target_ref: target.target_ref, observation}).state as typeof current;
+  assert.throws(() => resolveConversationAgentTarget({...input, binding: (revoked.bindings as unknown[])[0]}), /grant/);
+});
+
+test("attached status names the registered recipient and stop cannot pretend host push support", () => {
+  const target = {target_ref: "f".repeat(24), host_ref: "a".repeat(24), session_id: "original", goal_id: "sample-goal",
+    goal_instance_id: null, agent_id: "notes-worker", executor_endpoint_id: "codex"};
+  const context = resolveBoundConversation({current: planConversationBinding(request).state,
+    binding_id: row.binding_id, source_ref: "e".repeat(24), sender_ref: row.operator_ref,
+    private_human_message: true, observation, available_projects: [project]}).context;
+  const session = {...target, session_mode: "attached_host", status: "busy", active_turn_id: "original-turn"};
+  const input = {binding: {...row, agent_targets: [target]}, context, current_session: session, agent_target: target,
+    queued_count: 2, active_turn: {session_id: "original", turn_id: "original-turn", status: "running"},
+    observed_at: "2026-01-01T10:00:00Z", request: {request_ref: "e".repeat(24), command: "status"}};
+  const snapshot = planBoundConversationRequest(input).status_snapshot as Record<string, unknown>;
+  assert.equal(snapshot.recipient_agent_id, "notes-worker");
+  assert.equal(snapshot.queued_count, 2);
+  for (const command of ["stop", "new"]) assert.equal(planBoundConversationRequest({...input,
+    request: {...input.request, command}}).response_code, "attached_control_unavailable");
+});
diff --git a/tests/extensions/test_lark_goal_topic_runtime.py b/tests/extensions/test_lark_goal_topic_runtime.py
index 974cec8eb0..59082b8228 100644
--- a/tests/extensions/test_lark_goal_topic_runtime.py
+++ b/tests/extensions/test_lark_goal_topic_runtime.py
@@ -2064,11 +2064,11 @@ def provider_runner(
     assert state["consume_args"][:3] == ["fake-lark", "--profile", "mew"]
     assert "event" in state["consume_args"]
     projection = state["consume_args"][state["consume_args"].index("--jq") + 1]
-    assert "message_id:(.message_id // .id)" in projection
+    assert "message_id:(.message_id // .message.message_id // .event.message.message_id // .id)" in projection
     assert "root_id:(.root_id // .message.root_id" in projection
     assert "parent_id:(.parent_id // .reply_to" in projection
     assert "thread_id" in projection
-    assert "sender_id:(.sender_id // .sender.id // .sender.sender_id" in projection
+    assert ".event.sender.sender_id.open_id?" in projection
     assert state["reply_text"] == "当前运行的是 LoopX 开发版。"
 
 
@@ -3567,3 +3567,24 @@ def answer(route: Any, text: str):
     finally:
         for session in store.list_sessions():
             controller.close_session(session["session_id"])
+
+
+def test_message_event_projection_preserves_flat_cli_and_raw_provider_provenance():
+    import shutil
+    from loopx.extensions.lark.goal_topic_runtime import _EVENT_PROJECTION
+    jq = shutil.which("jq")
+    if jq is None:
+        pytest.skip("jq runtime is unavailable")
+    expected = {"event_id": "event_fixture", "message_id": "om_fixture", "sender_id": "ou_fixture",
+        "sender_type": "user", "chat_id": "oc_fixture", "chat_type": "p2p", "message_type": "text"}
+    flat = {**expected, "content": "plain rendered text", "create_time": "123"}
+    nested = {"header": {"event_id": expected["event_id"]}, "event": {
+        "sender": {"sender_id": {"open_id": expected["sender_id"]}, "sender_type": "user"},
+        "message": {key: value for key, value in flat.items() if key not in {"event_id", "sender_id", "sender_type"}}}}
+    for payload in [flat, nested]:
+        completed = subprocess.run([jq, "-c", _EVENT_PROJECTION], input=json.dumps(payload), text=True,
+                                   capture_output=True, check=True)
+        row = json.loads(completed.stdout)
+        for key, value in expected.items():
+            assert row[key] == value
+        assert row["content"] == "plain rendered text"
diff --git a/tests/test_chat_agent.py b/tests/test_chat_agent.py
index b918a7182b..9121289d75 100644
--- a/tests/test_chat_agent.py
+++ b/tests/test_chat_agent.py
@@ -3,6 +3,9 @@
 import io
 import json
 import queue
+import threading
+import time
+from types import SimpleNamespace
 from pathlib import Path
 
 import loopx.chat_agent as chat_agent
@@ -11,6 +14,34 @@
 import pytest
 
 
+def test_silent_event_reader_releases_dispatch_fence_for_control_receipt(tmp_path, monkeypatch):
+    session = chat_agent.CodexChatAgentSession(process=SimpleNamespace(poll=lambda: None),
+        messages=queue.Queue(), thread_id="synthetic-thread", work_dir=tmp_path)
+    arrived, errors = [], []
+
+    def events():
+        try:
+            arrived.append(session._next_event(deadline=time.monotonic() + 3))
+        except Exception as exc:
+            errors.append(exc)
+
+    # The response arrives without an agent event, just like a silent native
+    # Goal stop/read. It must reach its waiter before the event stream ends.
+    monkeypatch.setattr(session, "_write", lambda packet: session.messages.put(
+        {"id": packet["id"], "result": {"goal": {"status": "active"}}}))
+    reader = threading.Thread(target=events)
+    reader.start()
+    try:
+        time.sleep(.05)
+        started = time.monotonic()
+        assert session._request("thread/goal/get", {"threadId": session.thread_id})["goal"]["status"] == "active"
+        assert time.monotonic() - started < 1
+    finally:
+        session.messages.put({"method": "turn/completed", "params": {"turnId": "original"}})
+        reader.join(timeout=4)
+    assert not errors and arrived == [{"method": "turn/completed", "params": {"turnId": "original"}}]
+
+
 class _FakeAppServerProcess:
     def __init__(self) -> None:
         responses = [
diff --git a/tests/test_chat_conversation_bindings.py b/tests/test_chat_conversation_bindings.py
new file mode 100644
index 0000000000..fc9c3d2106
--- /dev/null
+++ b/tests/test_chat_conversation_bindings.py
@@ -0,0 +1,162 @@
+"""Bound external project Chat uses Core Session, queue, and exact stop."""
+import time
+import json
+
+import pytest
+
+from test_chat_ordinary_project import ordinary  # noqa: F401, F811
+from loopx.capabilities.native_chat.conversation_bindings import ChatConversationBindings
+
+
+def test_explicit_project_write_reaches_native_host_and_resume_without_goal_and_revokes_old_session(ordinary):  # noqa: F811
+    from loopx.chat_runtime import ChatRuntimeController
+    from loopx.chat_store import ChatSessionStore
+
+    store, runtime, contexts, _, capture, fake, workspace = ordinary
+    observations = {profile: {"transport_ref": profile, "provider_ref": provider * 24,
+        "operator_ref": operator * 24, "verified": True}
+        for profile, provider, operator in [("notes-app", "c", "d"), ("other-app", "e", "f")]}
+    bindings = ChatConversationBindings(root=store.root, project_contexts=contexts, observe=lambda p: observations[p])
+    contexts.conversation_bindings = bindings
+    ref = contexts.available()[0]["project_ref"]
+    def configure(profile, grant="workspace_read"):
+        return bindings.configure(transport_ref=profile, project_ref=ref, executor_endpoint_id="codex", project_grant=grant)
+    def open_bound(controller, row):
+        return controller.open_session(goal_id=None, agent_id="codex", work_dir=workspace, objective="untrusted",
+            mode="resume_latest", conversation_binding_id=row["binding_id"], source_context={
+                "source_ref": "a" * 24, "sender_ref": row["operator_ref"], "private_human_message": True})[0]
+    read = configure("notes-app")
+    old = open_bound(runtime, read)
+    other = open_bound(runtime, configure("other-app"))
+    contexts.workspace_grant = "workspace_write"
+    write = configure("notes-app", "workspace_write")
+    assert write["binding_id"] != read["binding_id"]
+    assert configure("notes-app", "workspace_write")["binding_id"] == write["binding_id"]
+    with pytest.raises(ValueError, match="no longer authorized"):
+        runtime.enqueue_turn(session_id=old["session_id"], client_turn_id="stale", message="edit",
+            work_dir=workspace, objective="ignored", origin="lark")
+    one = open_bound(runtime, write)
+    assert one["session_id"] != old["session_id"] and one["goal_id"] is None
+    assert one["project_context"]["grant"] == "workspace_write"
+    adapter = runtime.adapters[one["session_id"]]
+    assert not adapter.session.execution_mode and adapter.session.runtime_profile == "restricted"
+    assert adapter.session.sandbox == "workspace-write"
+    turn, _ = runtime.enqueue_turn(session_id=one["session_id"], client_turn_id="edit", message="整理笔记：更新明确指定的文件",
+        work_dir=workspace, objective="ignored", origin="lark")
+    assert runtime.wait_for_turn(session_id=one["session_id"], turn_id=turn["turn_id"], timeout_sec=10)["status"] == "completed"
+    original = one["upstream_thread_id"]
+    runtime.close()
+    restarted = ChatRuntimeController(store=ChatSessionStore(store.root.parent), codex_bin=str(fake),
+        project_contexts=contexts, registry_path=workspace / "no-registry.json")
+    try:
+        resumed = open_bound(restarted, write)
+        assert resumed["session_id"] == one["session_id"] and resumed["upstream_thread_id"] == original
+        requests = [json.loads(line) for line in capture.read_text().splitlines()]
+        starts = [r["params"] for r in requests if r.get("method") == "thread/start"]
+        assert [r["sandbox"] for r in starts] == ["read-only", "read-only", "workspace-write"]
+        resumes = [r["params"] for r in requests if r.get("method") == "thread/resume"]
+        assert resumes[-1]["sandbox"] == "workspace-write" and resumes[-1]["threadId"] == original
+        prompts = [r["params"]["input"][0]["text"] for r in requests if r.get("method") == "turn/start"]
+        assert "project assistant" in prompts[-1] and "Do not edit files" not in prompts[-1]
+        assert "AGENTS.md" in prompts[-1] and "hidden Goal" in prompts[-1]
+        assert other["project_context"]["grant"] == "workspace_read"
+        downgraded = configure("notes-app")
+        assert downgraded["binding_id"] != write["binding_id"]
+        with pytest.raises(ValueError, match="no longer authorized"):
+            open_bound(restarted, write)
+        assert open_bound(restarted, downgraded)["session_id"] != one["session_id"]
+        assert store.turn_for_client(old["session_id"], "stale") is None
+        assert not (workspace / "ACTIVE_GOAL_STATE.md").exists()
+    finally:
+        restarted.close()
+
+
+def test_two_bound_audiences_continue_independently_and_use_core_queue_and_stop(ordinary):  # noqa: F811
+    store, runtime, contexts, _, _, _, workspace = ordinary
+    observations = {
+        "notes-app": {"transport_ref": "notes-app", "provider_ref": "c" * 24,
+                      "operator_ref": "d" * 24, "verified": True},
+        "other-app": {"transport_ref": "other-app", "provider_ref": "e" * 24,
+                      "operator_ref": "f" * 24, "verified": True},
+    }
+    bindings = ChatConversationBindings(root=store.root, project_contexts=contexts,
+                                        observe=lambda profile: observations[profile])
+    contexts.conversation_bindings = bindings
+    ref = contexts.available()[0]["project_ref"]
+    first = bindings.configure(transport_ref="notes-app", project_ref=ref, executor_endpoint_id="codex")
+    second = bindings.configure(transport_ref="other-app", project_ref=ref, executor_endpoint_id="codex")
+    assert bindings.configure(transport_ref="notes-app", project_ref=ref,
+                              executor_endpoint_id="codex")["binding_id"] == first["binding_id"]
+
+    def open_bound(row):
+        return runtime.open_session(goal_id=None, agent_id="codex", work_dir=workspace, objective="ignored",
+            mode="resume_latest", conversation_binding_id=row["binding_id"], source_context={
+                "source_ref": "a" * 24, "sender_ref": row["operator_ref"], "private_human_message": True})[0]
+
+    try:
+        one, two = open_bound(first), open_bound(second)
+        assert one["session_id"] != two["session_id"] and one["channel_id"] != two["channel_id"]
+        assert one["goal_id"] is None and two["goal_id"] is None
+        assert open_bound(first)["session_id"] == one["session_id"]
+        blocked, _ = runtime.enqueue_turn(session_id=one["session_id"], client_turn_id="slow", message="wait for interrupt",
+            work_dir=workspace, objective="ignored", origin="lark")
+        deadline = time.monotonic() + 10
+        while store.load_session(one["session_id"])["active_turn_id"] != blocked["turn_id"]:
+            assert time.monotonic() < deadline
+            time.sleep(.01)
+        started = time.monotonic()
+        queued, created = runtime.enqueue_turn(session_id=one["session_id"], client_turn_id="later", message="follow-up",
+            work_dir=workspace, objective="ignored", origin="lark")
+        assert created and time.monotonic() - started < 3
+        assert store.load_turn(one["session_id"], queued["turn_id"])["status"] == "queued"
+        assert store.turn_for_client(one["session_id"], "later")["turn_id"] == queued["turn_id"]
+        assert runtime.enqueue_turn(session_id=one["session_id"], client_turn_id="later", message="follow-up",
+            work_dir=workspace, objective="ignored", origin="lark")[1] is False
+        independent, _ = runtime.enqueue_turn(session_id=two["session_id"], client_turn_id="independent", message="other audience",
+            work_dir=workspace, objective="ignored", origin="lark")
+        assert runtime.wait_for_turn(session_id=two["session_id"], turn_id=independent["turn_id"], timeout_sec=10)["status"] == "completed"
+        assert store.load_turn(one["session_id"], blocked["turn_id"])["status"] not in {"completed", "interrupted"}
+        runtime.interrupt_turn(session_id=one["session_id"], turn_id=blocked["turn_id"])
+        assert runtime.wait_for_turn(session_id=one["session_id"], turn_id=queued["turn_id"], timeout_sec=10)["status"] == "completed"
+        assert store.load_turn(one["session_id"], blocked["turn_id"])["status"] == "interrupted"
+        assert "other audience" not in str(store.messages(one["session_id"]))
+        assert "follow-up" not in str(store.messages(two["session_id"]))
+        with pytest.raises(ValueError, match="source"):
+            runtime.submit_turn(session_id=one["session_id"], client_turn_id="web", message="wrong source",
+                                work_dir=workspace, objective="ignored")
+        bindings.disconnect(first["binding_id"], expected_revision=bindings.read()["revision"])
+        with pytest.raises(ValueError, match="no longer authorized"):
+            runtime.enqueue_turn(session_id=one["session_id"], client_turn_id="revoked", message="old grant",
+                                 work_dir=workspace, objective="ignored", origin="lark")
+        assert store.turn_for_client(one["session_id"], "revoked") is None
+    finally:
+        runtime.close()
+
+
+def test_binding_replacement_or_identity_change_cannot_move_existing_context(tmp_path):
+    from loopx.capabilities.native_chat.project_context import ChatProjectContexts
+    from loopx.chat_store import ChatSessionStore
+
+    a, b = tmp_path / "notes", tmp_path / "other"
+    a.mkdir()
+    b.mkdir()
+    contexts = ChatProjectContexts([a, b])
+    store = ChatSessionStore(tmp_path / "runtime")
+    observation = {"transport_ref": "notes-app", "provider_ref": "c" * 24,
+                   "operator_ref": "d" * 24, "verified": True}
+    bindings = ChatConversationBindings(root=store.root, project_contexts=contexts, observe=lambda _: observation)
+    old = bindings.configure(transport_ref="notes-app", project_ref=contexts.available()[0]["project_ref"], executor_endpoint_id="codex")
+    saved = bindings.resolve(binding_id=old["binding_id"], source_ref="a" * 24,
+                             sender_ref=observation["operator_ref"], private_human_message=True)["context"]
+    observation["operator_ref"] = "f" * 24
+    with pytest.raises(ValueError, match="independently verified"):
+        bindings.session_context(saved)
+    observation["operator_ref"] = "d" * 24
+    new = bindings.configure(transport_ref="notes-app", project_ref=contexts.available()[1]["project_ref"], executor_endpoint_id="codex")
+    assert new["binding_id"] != old["binding_id"]
+    with pytest.raises(ValueError, match="no longer authorized"):
+        bindings.session_context(saved)
+    with pytest.raises(ValueError, match="revision"):
+        bindings.disconnect(new["binding_id"], expected_revision=0)
+    assert bindings.read()["bindings"][0]["binding_id"] == new["binding_id"]
+    assert bindings.path.stat().st_mode & 0o777 == 0o600
diff --git a/tests/test_chat_ordinary_project.py b/tests/test_chat_ordinary_project.py
index 7a2eec5e03..36a168dd0d 100644
--- a/tests/test_chat_ordinary_project.py
+++ b/tests/test_chat_ordinary_project.py
@@ -26,7 +26,7 @@ def ordinary(tmp_path, monkeypatch):
     fake = tmp_path / "codex"
     fake.write_text(source)
     fake.chmod(0o700)
-    contexts = ChatProjectContexts([workspace])
+    contexts = ChatProjectContexts([workspace], workspace_grant="workspace_read")
     store = ChatSessionStore(tmp_path / "runtime")
     runtime = ChatRuntimeController(store=store, codex_bin=str(fake), project_contexts=contexts,
                                     registry_path=tmp_path / "no-registry.json")
@@ -120,3 +120,33 @@ def test_retargeted_symlink_does_not_rebind_a_project_grant(tmp_path):
     link.symlink_to(second, target_is_directory=True)
     with pytest.raises(ValueError, match="outside"):
         contexts.resolve(ref)
+
+
+def test_default_project_host_grant_is_write_and_read_only_launch_is_enforced(ordinary):
+    from loopx.capabilities.native_chat.conversation_bindings import ChatConversationBindings
+
+    store, runtime, contexts, request, capture, _, workspace = ordinary
+    # The fixture intentionally launched read-only. The ordinary product default
+    # is write-capable, and both observed settings and actual host must agree.
+    assert ChatProjectContexts([workspace]).available()[0]["grant"] == "workspace_write"
+    contexts.workspace_grant = "workspace_write"
+    status, projects = request("/api/chat/projects")
+    assert status == 200 and projects["projects"][0]["grant"] == "workspace_write"
+    _, opened = request("/api/chat/sessions", {"context_kind": "project", "project_ref": projects["projects"][0]["project_ref"]})
+    assert opened["goal_id"] is None
+    assert runtime.adapters[opened["session_id"]].session.sandbox == "workspace-write"
+    row = json.loads(capture.read_text().splitlines()[-1])
+    assert row["method"] == "thread/start" and row["params"]["sandbox"] == "workspace-write"
+    proof = {"transport_ref": "notes-app", "provider_ref": "c" * 24, "operator_ref": "d" * 24, "verified": True}
+    bindings = ChatConversationBindings(root=store.root, project_contexts=contexts, observe=lambda _: proof)
+    contexts.conversation_bindings = bindings
+    binding = bindings.configure(transport_ref="notes-app", project_ref=projects["projects"][0]["project_ref"], executor_endpoint_id="codex")
+    assert binding["grant"] == "workspace_write"
+    contexts.workspace_grant = "workspace_read"
+    assert request(f"/api/chat/sessions/{opened['session_id']}/turns", {"message": "edit", "client_turn_id": "host-downgraded"})[0] == 400
+    with pytest.raises(ValueError, match="write grant"):
+        bindings.resolve(binding_id=binding["binding_id"], source_ref="a" * 24, sender_ref=proof["operator_ref"], private_human_message=True)
+    with pytest.raises(ValueError, match="workspace grant"):
+        bindings.configure(transport_ref="notes-app", project_ref=projects["projects"][0]["project_ref"], executor_endpoint_id="codex", project_grant="workspace_write")
+    assert bindings.read()["bindings"][0] == binding
+    runtime.close()
diff --git a/tests/test_lark_private_agents.py b/tests/test_lark_private_agents.py
new file mode 100644
index 0000000000..d89d09579e
--- /dev/null
+++ b/tests/test_lark_private_agents.py
@@ -0,0 +1,236 @@
+"""Exact App grants reuse the original registered host and canonical queue."""
+import json
+from types import SimpleNamespace
+
+import pytest
+from test_chat_ordinary_project import ordinary  # noqa: F401
+from test_lark_private_conversations import connect
+from test_attached_session_broker import _registry, GOAL_ID, AGENT_ID, HOST_SURFACE, HOST_SESSION_ID
+
+from loopx.attached_session import bind_attached_agent_session, claim_attached_agent_turn, complete_attached_agent_turn
+from loopx.capabilities.native_chat.external_conversations import ChatExternalConversations
+from loopx.chat_store import _read_json
+from loopx.extensions.lark.private_conversation_api import PrivateConversationRequestMixin
+
+
+def target(fixture):
+    store, runtime, provider, transport = connect(fixture)
+    workspace = fixture[-1]
+    registry = _registry()
+    registry["goals"][0]["repo"] = str(workspace)
+    runtime.registry_path.write_text(json.dumps(registry))
+    packet = bind_attached_agent_session(store=store, registry=registry, registry_path=runtime.registry_path,
+        goal_id=GOAL_ID, agent_id=AGENT_ID, host_surface=HOST_SURFACE, host_session_id=HOST_SESSION_ID,
+        executor_endpoint_id="codex", execute=True)
+    sid = packet["session"]["session_id"]
+    bindings = transport.bindings
+    bid = next(row["binding_id"] for row in bindings.read()["bindings"] if row["transport_ref"] == "notes-app")
+    state = bindings.change_agent_target(binding_id=bid, expected_revision=bindings.read()["revision"], session_id=sid)
+    grant = next(row for row in state["bindings"] if row["binding_id"] == bid)["agent_targets"][0]
+    return store, runtime, provider, transport, bid, sid, grant
+
+
+def send(provider, transport, name, text, app="notes-app"):
+    event = provider.event(app, name, text)
+    result = transport.admit(app, event)
+    return result, event
+
+
+def claim(store, runtime, sid, name="exact-claim"):
+    return claim_attached_agent_turn(store=store, registry_path=runtime.registry_path, session_id=sid,
+        host_surface=HOST_SURFACE, host_session_id=HOST_SESSION_ID, claim_id=name)
+
+
+def test_private_agent_selection_preserves_original_host_session_and_original_app_result(ordinary):  # noqa: F811
+    store, runtime, provider, transport, _, sid, grant = target(ordinary)
+    try:
+        assert send(provider, transport, "ordinary", "ordinary project text")[0]["status"] == "durably_accepted"
+        ordinary_row = next(row for row in transport.core.pending() if row["message"] == "ordinary project text")
+        runtime.wait_for_turn(session_id=ordinary_row["session_id"], turn_id=ordinary_row["turn_id"], timeout_sec=10)
+        assert send(provider, transport, "list", "/agents")[0]["status"] == "command_recorded"
+        assert send(provider, transport, "select", f"/agent {grant['target_ref']}")[0]["status"] == "command_recorded"
+        transport.reconcile()
+        assert any(grant["target_ref"] in text for _, text in provider.writes)
+        assert send(provider, transport, "agent-first", "first direct Agent question")[0]["status"] == "durably_accepted"
+        first = next(row for row in transport.core.pending() if row["message"] == "first direct Agent question")
+        assert first["session_id"] == sid and len(store.queued_turns(sid)) == 1
+        assert sid not in runtime.adapters
+        claimed = claim(store, runtime, sid)
+        assert claimed["claimed"] and claimed["turn"]["message"] == "first direct Agent question"
+        assert claimed["turn"]["external_audience"]["binding_id"] == grant_binding(store)
+        assert send(provider, transport, "status", "/status")[0]["status"] == "command_recorded"
+        assert send(provider, transport, "stop", "/stop")[0]["status"] == "command_recorded"
+        assert send(provider, transport, "new", "/new")[0]["status"] == "command_recorded"
+        assert store.load_session(sid)["active_turn_id"] == first["turn_id"]
+        assert send(provider, transport, "return", "/project")[0]["status"] == "command_recorded"
+        complete_attached_agent_turn(store=store, registry_path=runtime.registry_path, session_id=sid,
+            turn_id=first["turn_id"], host_surface=HOST_SURFACE, host_session_id=HOST_SESSION_ID,
+            claim_id="exact-claim", completion_id="exact-completion", response={"message": "Original Agent answer"})
+        transport.reconcile()
+        assert ("notes-app", "Original Agent answer") in provider.writes
+        assert not any(app == "steward-app" and "Original Agent" in text for app, text in provider.writes)
+        assert any(AGENT_ID in text and "正在执行" in text for _, text in provider.writes)
+        assert any("没有被停止或替换" in text for _, text in provider.writes)
+        before = len(store.list_sessions())
+        assert send(provider, transport, "select-again", f"/agent {grant['target_ref']}")[0]["status"] == "command_recorded"
+        assert send(provider, transport, "follow-up", "follow-up with same Agent")[0]["status"] == "durably_accepted"
+        second = next(row for row in transport.core.pending() if row["message"] == "follow-up with same Agent")
+        assert second["session_id"] == sid
+        assert len(store.list_sessions()) == before
+        assert store.load_session(sid)["upstream_thread_id"] == HOST_SESSION_ID
+        assert claim(store, runtime, sid, "second-claim")["claimed"]
+        assert send(provider, transport, "other-app", f"/agent {grant['target_ref']}", "steward-app")[0]["status"] == "command_rejected"
+        denied = next(row for row in transport.core.pending() if row["source"]["sender_ref"] != first["source"]["sender_ref"])
+        assert denied["status"] == "rejected"
+    finally:
+        runtime.close()
+
+
+def grant_binding(store):
+    return next(row["binding_id"] for row in _read_json(store.root / "conversation-bindings.json")["bindings"] if row["transport_ref"] == "notes-app")
+
+
+def test_revoked_agent_queue_cannot_be_claimed_and_session_audience_cannot_be_reassigned(ordinary):  # noqa: F811
+    store, runtime, provider, transport, bid, sid, grant = target(ordinary)
+    try:
+        send(provider, transport, "select", f"/agent {grant['target_ref']}")
+        send(provider, transport, "pending", "pending private message")
+        row = next(row for row in transport.core.pending() if row["message"] == "pending private message")
+        bindings = transport.bindings
+        other = next(item["binding_id"] for item in bindings.read()["bindings"] if item["transport_ref"] == "steward-app")
+        with pytest.raises(ValueError, match="another App"):
+            bindings.change_agent_target(binding_id=other, expected_revision=bindings.read()["revision"], session_id=sid)
+        bindings.change_agent_target(binding_id=bid, expected_revision=bindings.read()["revision"], target_ref=grant["target_ref"])
+        assert not claim(store, runtime, sid)["claimed"]
+        assert store.load_turn(sid, row["turn_id"])["error_code"] == "external_agent_grant_unavailable"
+        with pytest.raises(ValueError, match="another App"):
+            bindings.change_agent_target(binding_id=other, expected_revision=bindings.read()["revision"], session_id=sid)
+        assert send(provider, transport, "return", "/project")[0]["status"] == "command_recorded"
+        assert send(provider, transport, "normal", "ordinary chat remains usable")[0]["status"] == "durably_accepted"
+        assert not any("pending private message" in text for _, text in provider.writes)
+        assert bindings.agent_candidates(other) == []
+    finally:
+        runtime.close()
+
+
+def test_prepared_agent_request_recovers_same_turn_after_recipient_switch(ordinary, monkeypatch):  # noqa: F811
+    store, runtime, provider, transport, _, sid, grant = target(ordinary)
+    try:
+        send(provider, transport, "select", f"/agent {grant['target_ref']}")
+        import loopx.capabilities.native_chat.external_conversations as external
+        actual_write = external._atomic_write_json
+        def fail_once(path, row):
+            if row.get("status") == "accepted":
+                raise OSError("synthetic crash after canonical admission")
+            actual_write(path, row)
+        with monkeypatch.context() as patch:
+            patch.setattr(external, "_atomic_write_json", fail_once)
+            with pytest.raises(OSError):
+                send(provider, transport, "crash", "already admitted before crash")
+        assert len(store.queued_turns(sid)) == 1
+        send(provider, transport, "return", "/project")
+        restarted = ChatExternalConversations(runtime)
+        restarted.recover()
+        row = next(item for item in restarted.pending() if item["message"] == "already admitted before crash")
+        assert row["status"] == "accepted" and row["session_id"] == sid
+        assert len(store.queued_turns(sid)) == 1 and sid not in runtime.adapters
+        assert claim(store, runtime, sid)["turn"]["message"] == row["message"]
+    finally:
+        runtime.close()
+
+
+def test_agent_settings_api_requires_exact_revision_and_registered_workspace(ordinary):  # noqa: F811
+    store, runtime, provider, transport, bid, sid, grant = target(ordinary)
+    class Handler(PrivateConversationRequestMixin):
+        server = SimpleNamespace(runtime_controller=runtime)
+        def _read_json(self): return self.body
+        def _private_conversations(self): self.result = {"ok": True}
+        def _send_error(self, message, **kwargs): self.result = {"error": message, **kwargs}
+    handler = Handler()
+    try:
+        handler.body = {"binding_id": bid, "revision": -1, "target_ref": grant["target_ref"]}
+        handler._private_conversation_agent_target()
+        assert handler.result["status"] == 400 and "revision" in handler.result["error"]
+        handler.body = {"binding_id": bid, "revision": transport.bindings.read()["revision"], "target_ref": grant["target_ref"]}
+        handler._private_conversation_agent_target()
+        assert handler.result == {"ok": True}
+        registry = json.loads(runtime.registry_path.read_text())
+        registry["goals"][0]["repo"] = str(ordinary[-1].parent)
+        runtime.registry_path.write_text(json.dumps(registry))
+        with pytest.raises(ValueError, match="workspace"):
+            transport.bindings.change_agent_target(binding_id=bid, expected_revision=transport.bindings.read()["revision"], session_id=sid)
+    finally:
+        runtime.close()
+
+
+def test_same_host_in_another_session_cannot_inherit_a_different_app_audience(ordinary):  # noqa: F811
+    store, runtime, _, transport, bid, sid, grant = target(ordinary)
+    try:
+        registry = json.loads(runtime.registry_path.read_text())
+        duplicate = bind_attached_agent_session(store=store, registry=registry, registry_path=runtime.registry_path,
+            goal_id=GOAL_ID, agent_id=AGENT_ID, host_surface=HOST_SURFACE, host_session_id=HOST_SESSION_ID,
+            executor_endpoint_id="codex", channel_id="another-channel", execute=True)["session"]["session_id"]
+        bindings = transport.bindings
+        other = next(item["binding_id"] for item in bindings.read()["bindings"] if item["transport_ref"] == "steward-app")
+        bindings.change_agent_target(binding_id=bid, expected_revision=bindings.read()["revision"], target_ref=grant["target_ref"])
+        with pytest.raises(ValueError, match="available registered host"):
+            bindings.change_agent_target(binding_id=other, expected_revision=bindings.read()["revision"], session_id=duplicate)
+        assert bindings.agent_candidates(other) == []
+        # Removing the host's registration after admission prevents claim.
+        bindings.change_agent_target(binding_id=bid, expected_revision=bindings.read()["revision"], session_id=sid)
+        new_grant = next(row for row in bindings.read()["bindings"] if row["binding_id"] == bid)["agent_targets"][0]
+        provider = transport.runner
+        send(provider, transport, "select", f"/agent {new_grant['target_ref']}")
+        send(provider, transport, "queued", "registration-sensitive message")
+        registry["goals"][0]["coordination"]["thread_agent_bindings"] = []
+        runtime.registry_path.write_text(json.dumps(registry))
+        assert not claim(store, runtime, sid)["claimed"]
+    finally:
+        runtime.close()
+
+
+def test_http_agent_configuration_and_revoked_workspace_projection(ordinary):  # noqa: F811
+    import http.client
+    import threading
+    from loopx.chat_server import ChatHTTPServer, ChatRequestHandler
+    _, runtime, _, transport, bid, sid, grant = target(ordinary)
+    server = ChatHTTPServer(("127.0.0.1", 0), ChatRequestHandler)
+    server.runtime_controller = runtime
+    server.lark_goal_topic_runtime = SimpleNamespace(health_snapshot=lambda: {}, close=lambda: None)
+    server.lark_private_conversations = transport
+    server.verbose = False
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    path = "/api/chat/lark/private-conversations"
+    def request(method, url, body=None, origin=None):
+        connection = http.client.HTTPConnection(*server.server_address, timeout=15)
+        try:
+            headers = {"Content-Type": "application/json"}
+            if origin:
+                headers["Origin"] = origin
+            connection.request(method, url, json.dumps(body) if body else None, headers=headers)
+            response = connection.getresponse()
+            return response.status, json.loads(response.read())
+        finally:
+            connection.close()
+    try:
+        code, snapshot = request("GET", path)
+        assert code == 200
+        row = next(row for row in snapshot["connections"] if row["binding_id"] == bid)
+        assert row["agent_candidates"][0]["session_id"] == sid
+        assert row["agent_targets"][0]["target_ref"] == grant["target_ref"]
+        assert "upstream_thread_id" not in json.dumps(snapshot) and "host_session_id" not in json.dumps(snapshot)
+        body = {"binding_id": bid, "revision": snapshot["revision"], "target_ref": grant["target_ref"]}
+        assert request("POST", path + "/agent-targets", body, "https://untrusted.example")[0] == 403
+        code, updated = request("POST", path + "/agent-targets", body)
+        assert code == 200
+        assert next(row for row in updated["connections"] if row["binding_id"] == bid)["agent_targets"] == []
+        runtime.project_contexts.roots = []
+        code, unavailable = request("GET", path)
+        assert code == 200
+        assert all(row["agent_candidates"] == [] and not row["context_available"] for row in unavailable["connections"])
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=2)
+        runtime.close()
diff --git a/tests/test_lark_private_compatibility.py b/tests/test_lark_private_compatibility.py
new file mode 100644
index 0000000000..96f17ea9d3
--- /dev/null
+++ b/tests/test_lark_private_compatibility.py
@@ -0,0 +1,124 @@
+"""Private configuration must preserve the existing group listener boundary."""
+import hashlib
+import http.client
+import json
+from pathlib import Path
+import subprocess
+import sys
+import threading
+import time
+from types import SimpleNamespace
+
+import pytest
+
+from loopx.chat_server import ChatHTTPServer, ChatRequestHandler
+from loopx.extensions.lark.conversation_identity import identity_ref
+from loopx.extensions.lark.goal_topic_runtime_service import LarkGoalTopicRuntimeService
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX cross-process flock contract")
+def test_legacy_consumer_stays_standby_until_original_profile_owner_exits(tmp_path, monkeypatch):
+    from loopx.extensions.lark import goal_topic_runtime as runtime
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    profile = "legacy-group"
+    lease = tmp_path / ".loopx/lark-consumers" / hashlib.sha256(profile.encode()).hexdigest()[:32]
+    lease.parent.mkdir(parents=True)
+    # This is the actual prior owner key and an independent process, not a
+    # synthetic result from the new key selection rule.
+    owner = subprocess.Popen([sys.executable, "-u", "-c",
+        "import fcntl,sys; f=open(sys.argv[1],'a'); fcntl.flock(f,fcntl.LOCK_EX); "
+        "print('owned',flush=True); sys.stdin.read()", str(lease.with_name(lease.name + ".lock"))],
+        stdin=subprocess.PIPE, stdout=subprocess.PIPE, text=True)
+    assert owner.stdout.readline().strip() == "owned"
+    snapshot = {"target_payload": {"targets": {"group": {"enabled": True,
+        "channel": {"chat_id": "oc_public_fixture"},
+        "identity": {"sender_profile": profile, "cli_bin": "fake-lark"}}}},
+        "binding_payloads": {"goal": {"bindings": {"goal": {"goal_id": "goal", "enabled": True,
+            "provider": "lark", "target_ref": "group", "topic": {"root_message_id": "om_public_fixture"}}}}},
+        "private_profiles": {}, "goal_contexts": {}}
+    started = threading.Event()
+    monkeypatch.setattr(runtime, "stream_lark_goal_topic_profile",
+        lambda **_: started.set() or {"ok": True, "status": "stopped"})
+    service = LarkGoalTopicRuntimeService(snapshot_provider=lambda: snapshot,
+        runtime_root=tmp_path / "runtime", runtime_controller=object())
+    stop = threading.Event()
+    worker = threading.Thread(target=service._poll_profile, args=(profile, stop))
+    try:
+        worker.start()
+        deadline = time.monotonic() + 2
+        while service.health_snapshot().get(profile, {}).get("status") != "standby" and time.monotonic() < deadline:
+            threading.Event().wait(.01)
+        assert service.health_snapshot()[profile]["status"] == "standby"
+        assert not started.is_set()
+        stop.set()
+        worker.join(2)
+        owner.stdin.close()
+        assert owner.wait(2) == 0
+        resumed_stop = threading.Event()
+        successor = threading.Thread(target=service._poll_profile, args=(profile, resumed_stop))
+        successor.start()
+        assert started.wait(2)
+        resumed_stop.set()
+        successor.join(2)
+    finally:
+        stop.set()
+        worker.join(2)
+        service.close()
+        if owner.poll() is None:
+            owner.stdin.close()
+            owner.wait(2)
+
+
+@pytest.mark.parametrize("private_rows", [[], [{"transport_ref": "other-app", "provider_ref": identity_ref("cli_other_fixture")}],
+    [{"transport_ref": "other-alias", "provider_ref": identity_ref("cli_public_fixture")}]] )
+def test_group_http_preview_preserves_auth_cost_and_checks_real_private_aliases(tmp_path, private_rows):
+    calls = []
+    registry = {"schema_version": "0.1", "goals": [{"id": "goal", "repo": str(tmp_path),
+        "coordination": {"registered_agents": ["codex"]}}]}
+    class Handler(ChatRequestHandler):
+        def _require_lark_cli(self):
+            return "fake-lark"
+        def _goal_channel_context(self, _goal):
+            return registry, tmp_path / "binding.json"
+        def _goal_channel_target_path(self):
+            return tmp_path / "targets.json"
+        def _refresh_lark_goal_topic_runtime(self):
+            pass
+        def _lark_runner(self):
+            def run(args, _cwd, _timeout):
+                calls.append(args)
+                if args[-4:] == ["auth", "status", "--verify", "--json"]:
+                    return {"returncode": 0, "stdout": json.dumps({"appId": "cli_public_fixture", "identities": {
+                        "bot": {"openId": "ou_public_fixture", "appName": "Fixture", "available": True, "verified": True}}})}
+                return {"returncode": 0, "stdout": "{}"}
+            return run
+    server = ChatHTTPServer(("127.0.0.1", 0), Handler)
+    server.verbose = False
+    server.runtime_controller = SimpleNamespace(close=lambda: None, project_contexts=SimpleNamespace(
+        conversation_bindings=SimpleNamespace(read=lambda: {"bindings": private_rows})))
+    worker = threading.Thread(target=server.serve_forever, daemon=True)
+    worker.start()
+    def post(body):
+        conn = http.client.HTTPConnection(*server.server_address, timeout=5)
+        try:
+            conn.request("POST", "/api/chat/lark/connections", json.dumps(body), {"Content-Type": "application/json"})
+            result = conn.getresponse()
+            return result.status, json.loads(result.read())
+        finally:
+            conn.close()
+    try:
+        assert post({"app_ref": "workspace-app"})[0] == 400
+        assert not calls  # malformed structural input must never reach auth
+        code, result = post({"app_ref": "workspace-app", "goal_id": "goal", "agent_id": "codex",
+            "chat_id": "oc_public_fixture", "chat_name": "Fixture", "execute": False})
+        auth = [args for args in calls if args[-4:] == ["auth", "status", "--verify", "--json"]]
+        assert len(auth) == 1, (code, result, calls)
+        if private_rows and private_rows[0]["provider_ref"] == identity_ref("cli_public_fixture"):
+            assert code == 400 and "private listener" in result["error"]
+        else:
+            assert code == 200 and result["ok"], result
+        assert not (tmp_path / "binding.json").exists()
+    finally:
+        server.shutdown()
+        server.server_close()
+        worker.join(2)
diff --git a/tests/test_lark_private_conversations.py b/tests/test_lark_private_conversations.py
new file mode 100644
index 0000000000..d1ccdcd84d
--- /dev/null
+++ b/tests/test_lark_private_conversations.py
@@ -0,0 +1,261 @@
+"""Public synthetic provider/native Core journeys, never private credentials."""
+import json
+import time
+
+import pytest
+from test_chat_ordinary_project import ordinary  # noqa: F401
+
+from loopx.capabilities.native_chat.conversation_bindings import ChatConversationBindings
+from loopx.capabilities.native_chat.external_conversations import ChatExternalConversations
+from loopx.extensions.lark.conversation_identity import observe_lark_conversation_identity
+from loopx.extensions.lark.private_conversations import LarkPrivateConversations
+from loopx.extensions.lark.goal_topic_runtime import poll_lark_goal_topic_profile_once
+
+
+class Provider:
+    def __init__(self):
+        self.messages = {}
+        self.calls = []
+        self.writes = []
+        self.verify_replies = True
+
+    def event(self, profile, name, text, kind="text"):
+        event = {"schema_version": "lark_event_inbox_event_v0", "event_id": f"event_{name}",
+            "message_id": f"om_{name}", "chat_id": f"oc_{profile.replace('-', '_')}", "chat_type": "p2p",
+            "sender_type": "user", "sender_id": f"ou_{profile.replace('-', '_')}", "message_type": kind,
+            "content": text}
+        self.messages[event["message_id"]] = {"message_id": event["message_id"], "chat_id": event["chat_id"],
+            "sender": {"id": event["sender_id"], "sender_type": "user"}, "msg_type": kind, "content": text}
+        return event
+
+    def __call__(self, args, cwd=None, timeout=None):
+        self.calls.append(list(args))
+        profile = args[args.index("--profile") + 1]
+        if "auth" in args:
+            data = {"ok": True, "appId": f"cli_{profile.replace('-', '_')}", "identities": {
+                "bot": {"available": True, "verified": True, "appName": profile},
+                "user": {"available": True, "verified": True, "openId": f"ou_{profile.replace('-', '_')}"}}}
+        elif "+messages-mget" in args:
+            ref = args[args.index("--message-ids") + 1]
+            message = self.messages[ref]
+            if not self.verify_replies and ref.startswith("om_out_"):
+                message = {**message, "body": {"content": json.dumps({"text": "not yet visible"})}}
+            data = {"ok": True, "data": {"items": [message]}}
+        elif "+messages-send" in args:
+            text = args[args.index("--text") + 1]
+            content = json.dumps({"text": text})
+            if "--dry-run" in args:
+                data = {"ok": True, "api": [{"body": {"content": content}}]}
+            else:
+                ref = f"om_out_{len(self.writes)}"
+                self.writes.append((profile, text))
+                self.messages[ref] = {"message_id": ref, "body": {"content": content}}
+                data = {"ok": True, "data": {"message_id": ref}}
+        else:
+            pytest.fail(f"unnecessary provider operation: {args[2:5]}")
+        return {"returncode": 0, "stdout": json.dumps(data), "stderr": ""}
+
+
+def connect(fixture):
+    store, runtime, contexts, _, _, _, _ = fixture
+    provider = Provider()
+    bindings = ChatConversationBindings(root=store.root, project_contexts=contexts,
+        observe=lambda profile: observe_lark_conversation_identity(profile=profile, runner=provider, cli_bin="lark-cli"))
+    contexts.conversation_bindings = bindings
+    for profile in ["notes-app", "steward-app"]:
+        bindings.configure(transport_ref=profile, project_ref=contexts.available()[0]["project_ref"], executor_endpoint_id="codex")
+    return store, runtime, provider, LarkPrivateConversations(controller=runtime, runtime_root=store.root.parent,
+                                                             runner=provider, cli_bin="lark-cli")
+
+
+def test_native_private_admission_queue_other_app_stop_and_verified_delivery(ordinary):  # noqa: F811
+    store, runtime, provider, transport = connect(ordinary)
+    try:
+        first = provider.event("notes-app", "slow", "wait for interrupt")
+        assert transport.admit("notes-app", first)["status"] == "durably_accepted"
+        canonical = ChatExternalConversations(runtime).pending()[0]
+        sid = canonical["session_id"]
+        deadline = time.monotonic() + 10
+        while store.load_session(sid).get("active_turn_id") != canonical["turn_id"]:
+            assert time.monotonic() < deadline
+            time.sleep(.01)
+        queued = provider.event("notes-app", "queued", "follow-up")
+        started = time.monotonic()
+        assert transport.admit("notes-app", queued)["status"] == "durably_accepted"
+        assert time.monotonic() - started < 3
+        assert len(store.queued_turns(sid)) == 1
+        assert transport.admit("notes-app", {**queued, "event_id": "redelivery"})["status"] == "durably_accepted"
+        assert len(store.queued_turns(sid)) == 1
+        other = provider.event("steward-app", "other", "different audience")
+        assert transport.admit("steward-app", other)["status"] == "durably_accepted"
+        other_row = next(row for row in transport.core.pending() if row["message"] == "different audience")
+        assert runtime.wait_for_turn(session_id=other_row["session_id"], turn_id=other_row["turn_id"], timeout_sec=10)["status"] == "completed"
+        transport.reconcile()
+        assert any(profile == "steward-app" and text == "Runtime response." for profile, text in provider.writes)
+        assert any(profile == "notes-app" and "持久受理" in text for profile, text in provider.writes)
+        stop = provider.event("notes-app", "stop", "/stop")
+        assert transport.admit("notes-app", stop)["status"] == "command_recorded"
+        queued_row = next(row for row in transport.core.pending() if row["message"] == "follow-up")
+        assert runtime.wait_for_turn(session_id=sid, turn_id=queued_row["turn_id"], timeout_sec=10)["status"] == "completed"
+        transport.reconcile()
+        before = len(provider.writes)
+        transport.reconcile()
+        assert len(provider.writes) == before
+        assert "different audience" not in str(store.messages(sid))
+        assert not any("chats" in call for call in provider.calls)
+        assert not any("schema_version" in text for _, text in provider.writes)
+        assert all(row["goal_id"] is None for row in store.list_sessions())
+    finally:
+        runtime.close()
+
+
+def test_source_rejection_attachment_notice_and_ambiguous_reply_readback(ordinary):  # noqa: F811
+    _, runtime, provider, transport = connect(ordinary)
+    try:
+        image = provider.event("notes-app", "image", "", kind="image")
+        assert transport.admit("notes-app", {**image, "sender_type": "app"})["status"] == "audience_rejected"
+        assert transport.admit("steward-app", image)["status"] == "audience_rejected"
+        assert transport.core.pending() == []
+        assert transport.admit("notes-app", image)["status"] == "command_recorded"
+        provider.verify_replies = False
+        assert transport.reconcile() == 0
+        assert len(provider.writes) == 1 and "图片或文件没有交给模型" in provider.writes[0][1]
+        assert transport.reconcile() == 0 and len(provider.writes) == 1
+        provider.verify_replies = True
+        assert transport.reconcile() == 1 and len(provider.writes) == 1
+        assert runtime.store.list_sessions() == []
+        with pytest.raises(ValueError, match="non-default"):
+            observe_lark_conversation_identity(profile="default", runner=provider, cli_bin="lark-cli")
+    finally:
+        runtime.close()
+
+
+def test_existing_consumer_dispatches_private_admission_without_waiting_for_model():
+    event = {"chat_type": "p2p", "message_type": "text", "message_id": "om_synthetic"}
+    admitted = []
+    result = poll_lark_goal_topic_profile_once(profile="notes-app", snapshot={"private_profiles": {
+        "notes-app": {"cli_bin": "lark-cli", "provider_ref": "a" * 24}}}, runtime_root=".",
+        answer=lambda *_: pytest.fail("ordinary private Chat must not call a Goal answer"),
+        consume_runner=lambda args: {"returncode": 0, "stdout": json.dumps(event)},
+        private_admitter=lambda profile, event: admitted.append((profile, event)) or {"status": "durably_accepted"})
+    assert result["event_statuses"] == ["durably_accepted"]
+    assert admitted == [("notes-app", event)]
+
+
+def test_new_session_replay_cannot_close_a_later_session(ordinary):  # noqa: F811
+    store, runtime, provider, transport = connect(ordinary)
+    try:
+        transport.admit("notes-app", provider.event("notes-app", "first", "first"))
+        first = next(row for row in transport.core.pending() if row["message"] == "first")
+        runtime.wait_for_turn(session_id=first["session_id"], turn_id=first["turn_id"], timeout_sec=10)
+        new = provider.event("notes-app", "new", "/new")
+        transport.admit("notes-app", new)
+        transport.admit("notes-app", provider.event("notes-app", "next", "next"))
+        second = next(row for row in transport.core.pending() if row["message"] == "next")
+        assert first["session_id"] != second["session_id"]
+        transport.admit("notes-app", new)
+        assert store.load_session(second["session_id"])["status"] != "closed"
+        # Simulate a lost correlation response after original Core admission.
+        # Its stable Turn must remain in the closed original Session.
+        original_path = transport.core.root / f"{first['request_ref']}.json"
+        original = json.loads(original_path.read_text())
+        original["status"] = "prepared"
+        original_path.write_text(json.dumps(original))
+        transport.core.recover()
+        recovered = json.loads(original_path.read_text())
+        assert recovered["session_id"] == first["session_id"] and recovered["turn_id"] == first["turn_id"]
+        assert store.turn_for_client(second["session_id"], f"external-{first['request_ref']}") is None
+        runtime.wait_for_turn(session_id=second["session_id"], turn_id=second["turn_id"], timeout_sec=10)
+    finally:
+        runtime.close()
+
+
+def test_private_setup_companion_verifies_each_app_and_redacts_subjects(ordinary, tmp_path):  # noqa: F811
+    from types import SimpleNamespace
+    from loopx.extensions.lark.private_conversation_api import PrivateConversationRequestMixin
+    _, runtime, _, transport = connect(ordinary)
+    registry = tmp_path / "fresh-registry.json"
+    registry.write_text(json.dumps({"schema_version": "0.1", "goals": []}))
+    updates = []
+    server = SimpleNamespace(runtime_controller=runtime, registry_path=registry, runtime_root_override=tmp_path,
+        lark_private_conversations=transport, lark_goal_topic_runtime=SimpleNamespace(
+            refresh=lambda: updates.append(True), health_snapshot=lambda: {}))
+
+    class Handler(PrivateConversationRequestMixin):
+        def __init__(self):
+            self.server = server
+            self.body = {}
+            self.result = None
+        def _read_json(self):
+            return self.body
+        def _send_json(self, value):
+            self.result = value
+        def _send_error(self, value, **kwargs):
+            self.result = {"error": value, **kwargs}
+
+    handler = Handler()
+    try:
+        handler._private_conversations()
+        assert len(handler.result["connections"]) == 2
+        assert all(row["context_available"] for row in handler.result["connections"])
+        encoded = json.dumps(handler.result)
+        assert all(marker not in encoded for marker in ["operator_ref", "provider_ref", "workspace_path", "ou_notes", "cli_notes"])
+        handler.body = {"app_ref": "notes-app", "project_ref": "f" * 24, "executor_endpoint_id": "codex"}
+        handler._private_conversation_connect()
+        assert handler.result["status"] == 400 and not updates
+        handler.body = {"binding_id": transport.bindings.read()["bindings"][0]["binding_id"], "revision": 0}
+        handler._private_conversation_disconnect()
+        assert handler.result["status"] == 400 and not updates
+        handler.body["revision"] = transport.bindings.read()["revision"]
+        handler._private_conversation_disconnect()
+        assert handler.result["ok"] and len(handler.result["connections"]) == 1 and updates == [True]
+    finally:
+        runtime.close()
+
+
+def test_rendered_cli_text_is_preserved_and_source_type_must_agree(ordinary):  # noqa: F811
+    store, runtime, provider, transport = connect(ordinary)
+    try:
+        literal = '{"text":"this is literal user text"}'
+        event = provider.event("notes-app", "rendered", literal)
+        assert transport.admit("notes-app", event)["status"] == "durably_accepted"
+        assert transport.core.pending()[0]["message"] == literal
+        mismatched = provider.event("notes-app", "wrong_type", "not a text message")
+        provider.messages[mismatched["message_id"]]["msg_type"] = "image"
+        assert transport.admit("notes-app", mismatched)["status"] == "source_conflict"
+        assert len(transport.core.pending()) == 1
+    finally:
+        runtime.close()
+
+
+def test_private_app_alias_guard_rejects_unknown_or_unverified_identity():
+    from loopx.chat_lark_api import _app_identity_for_private_guard
+    provider = Provider()
+    assert _app_identity_for_private_guard("notes-app", provider, "lark-cli") == "cli_notes_app"
+    for data in [{}, {"appId": "cli_notes_app"}, {"appId": "malformed", "identities": {"bot": {
+        "available": True, "verified": True}}}, {"appId": "cli_notes_app", "identities": {"bot": {
+        "available": True, "verified": False}}}]:
+        def unverified(*_args, **_kwargs):
+            return {"returncode": 0, "stdout": json.dumps(data), "stderr": ""}
+        with pytest.raises(ValueError, match="could not be verified"):
+            _app_identity_for_private_guard("notes-app", unverified, "lark-cli")
+
+
+def test_one_expired_app_identity_does_not_hide_the_other_listener(ordinary):  # noqa: F811
+    _, runtime, _, transport = connect(ordinary)
+    original = transport.bindings.observe
+    def observe(profile):
+        if profile == "steward-app":
+            raise ValueError("this App owner is no longer verified")
+        return original(profile)
+    transport.bindings.observe = observe
+    try:
+        assert set(transport.profiles()) == {"notes-app"}
+        transport.bindings.observe = lambda profile: {**original(profile), "operator_ref": "f" * 24}
+        assert transport.profiles() == {}
+        transport.bindings.observe = observe
+        rejected = {"message_id": "om_unknown", "chat_id": "oc_steward_app", "sender_id": "ou_steward_app",
+                    "chat_type": "p2p", "sender_type": "user", "message_type": "text", "content": "unverified"}
+        assert transport.admit("steward-app", rejected)["status"] == "audience_rejected"
+    finally:
+        runtime.close()
diff --git a/tests/test_lark_private_status.py b/tests/test_lark_private_status.py
new file mode 100644
index 0000000000..352fc211b6
--- /dev/null
+++ b/tests/test_lark_private_status.py
@@ -0,0 +1,118 @@
+"""Status observes real native files/queue without creating model work."""
+import time
+
+import pytest
+
+from test_chat_ordinary_project import ordinary  # noqa: F401
+from test_lark_private_conversations import connect
+from loopx.extensions.lark.private_conversations import LarkPrivateConversations, _status_text
+
+
+def test_help_and_empty_steward_status_do_not_open_sessions_or_borrow_scope(ordinary):  # noqa: F811
+    store, runtime, provider, transport = connect(ordinary)
+    try:
+        transport.admit("notes-app", provider.event("notes-app", "help", "/help"))
+        assert transport.reconcile() == 1
+        message = provider.writes[-1][1]
+        assert "角色：普通项目对话" in message and "只读授权" in message
+        assert "/new" in message and "设置 → Lark" in message
+        assert "/delegate" not in message and "没有自动选用注册 Agent" in message
+        assert store.list_sessions() == []
+        project = runtime.project_contexts.available()[0]
+        transport.bindings.configure(transport_ref="steward-app", project_ref=project["project_ref"],
+                                     executor_endpoint_id="codex", context_kind="steward")
+        transport.admit("steward-app", provider.event("steward-app", "empty", "/status"))
+        assert transport.reconcile() == 1
+        assert "角色：长期管家" in provider.writes[-1][1]
+        assert "已授权新委托：0" in provider.writes[-1][1]
+        assert "执行结束不代表委托验收" in provider.writes[-1][1]
+        assert store.list_sessions() == []
+        assert all(row["turn_id"] is None for row in transport.core.pending())
+    finally:
+        runtime.close()
+
+
+def test_pending_status_readback_recovers_from_files_without_resending(ordinary):  # noqa: F811
+    store, runtime, provider, transport = connect(ordinary)
+    try:
+        provider.verify_replies = False
+        transport.admit("notes-app", provider.event("notes-app", "status", "/status"))
+        snapshot = transport.core.pending()[0]["status_snapshot"]
+        assert transport.reconcile() == 0
+        assert len(provider.writes) == 1
+        assert transport.health()[transport.bindings.read()["bindings"][0]["binding_id"]]["recovery_count"] == 1
+        # A new production transport instance observes the original durable
+        # intent and native request; it neither opens a Session nor resends.
+        restarted = LarkPrivateConversations(controller=runtime, runtime_root=store.root.parent,
+                                            runner=provider, cli_bin="lark-cli")
+        provider.verify_replies = True
+        assert restarted.reconcile() == 1
+        assert len(provider.writes) == 1
+        assert restarted.core.pending()[0]["status_snapshot"] == snapshot
+        assert store.list_sessions() == []
+    finally:
+        runtime.close()
+
+
+def test_explicit_write_status_matches_binding_without_opening_a_model_session(ordinary):  # noqa: F811
+    store, runtime, provider, transport = connect(ordinary)
+    try:
+        runtime.project_contexts.workspace_grant = "workspace_write"
+        transport.bindings.configure(transport_ref="notes-app", project_ref=runtime.project_contexts.available()[0]["project_ref"],
+            executor_endpoint_id="codex", project_grant="workspace_write")
+        transport.admit("notes-app", provider.event("notes-app", "write-status", "/help"))
+        assert transport.reconcile() == 1
+        assert "已明确授权此工作区读写" in provider.writes[-1][1]
+        assert "只读授权" not in provider.writes[-1][1]
+        assert "项目规则和 skills" in provider.writes[-1][1]
+        assert store.list_sessions() == []
+    finally:
+        runtime.close()
+
+
+def test_busy_status_reads_durable_queue_and_duplicate_retains_original_snapshot(ordinary):  # noqa: F811
+    store, runtime, provider, transport = connect(ordinary)
+    try:
+        transport.admit("notes-app", provider.event("notes-app", "slow", "wait for interrupt"))
+        first = transport.core.pending()[0]
+        sid = first["session_id"]
+        deadline = time.monotonic() + 10
+        while store.load_session(sid).get("active_turn_id") != first["turn_id"]:
+            assert time.monotonic() < deadline
+            time.sleep(.01)
+        transport.admit("notes-app", provider.event("notes-app", "queued", "follow-up"))
+        status = provider.event("notes-app", "status", "/status")
+        transport.admit("notes-app", status)
+        original = next(row for row in transport.core.pending() if row["command"] == "status")
+        assert original["status_snapshot"]["queued_count"] == 1
+        assert original["status_snapshot"]["active_turn_status"] in {"starting", "running"}
+        transport.reconcile()
+        assert any("已持久排队：1 条" in text for _, text in provider.writes)
+        transport.admit("notes-app", provider.event("notes-app", "stop", "/stop"))
+        queued = next(row for row in transport.core.pending() if row["message"] == "follow-up")
+        runtime.wait_for_turn(session_id=sid, turn_id=queued["turn_id"], timeout_sec=10)
+        transport.reconcile()
+        before = len(provider.writes)
+        transport.admit("notes-app", {**status, "event_id": "redelivery"})
+        transport.reconcile()
+        assert len(provider.writes) == before
+        assert transport.core.read_request(original["request_ref"])["status_snapshot"] == original["status_snapshot"]
+        transport.admit("notes-app", provider.event("notes-app", "current", "/status"))
+        transport.reconcile()
+        assert "已持久排队：0 条" in provider.writes[-1][1]
+        assert len(store.list_sessions()) == 1
+        assert store.load_session(sid)["goal_id"] is None
+        assert not any("source_ref" in text or "operator_ref" in text for _, text in provider.writes)
+    finally:
+        runtime.close()
+
+
+@pytest.mark.parametrize("unknown", ["session", "turn", "missing"])
+def test_unavailable_execution_evidence_is_not_presented_as_ready(unknown):
+    snapshot = {"context_kind": "project", "observed_at": "2026-01-01T10:00:00Z",
+        "workspace_path": "/authorized/notes", "executor_endpoint_id": "codex", "grant": "workspace_read",
+        "queued_count": 0, "authorized_commission_count": 0, "session_status": "future_state" if unknown == "session" else "busy",
+        "active_turn_status": "future_state" if unknown == "turn" else None,
+        "active_turn_observation_available": unknown != "missing"}
+    text = _status_text(snapshot, help_requested=False)
+    assert "暂不可" in text and "会话可继续" not in text
diff --git a/tests/test_native_steward_private.py b/tests/test_native_steward_private.py
new file mode 100644
index 0000000000..87905f56ea
--- /dev/null
+++ b/tests/test_native_steward_private.py
@@ -0,0 +1,315 @@
+"""Native steward journeys exercise the same Core, action store and provider.
+
+Synthetic transport/model fixtures never certify phone or real-model acceptance.
+"""
+import json
+import time
+from pathlib import Path
+import runpy
+
+import pytest
+
+from test_lark_private_conversations import connect
+from loopx.chat_action_store import ChatActionStore
+from loopx.chat_actions import ChatActionService, ProtectedActionGate
+from loopx.chat_manager_context import collect_manager_turn_context, manager_turn_context
+from loopx.chat_runtime import ChatRuntimeController
+from loopx.chat_store import ChatSessionStore
+from loopx.capabilities.native_chat.project_context import ChatProjectContexts
+from loopx.extensions.lark.conversation_identity import identity_ref
+
+
+@pytest.fixture
+def steward(tmp_path):
+    workspace = tmp_path / "fresh-workspace"
+    workspace.mkdir()
+    contexts = ChatProjectContexts([workspace])
+    store = ChatSessionStore(tmp_path / "runtime")
+    capture, fake = tmp_path / "requests.jsonl", tmp_path / "codex"
+    source = runpy.run_path(str(Path(__file__).parents[1] / "examples/loopx-chat-runtime-smoke.py"))["FAKE_CODEX"]
+    source = source.replace('    method = request.get("method")',
+        f'    with open({str(capture)!r}, "a") as output:\n        output.write(json.dumps(request) + "\\n")\n'
+        '    method = request.get("method")')
+    fake.write_text(source)
+    fake.chmod(0o700)
+    runtime = ChatRuntimeController(store=store, codex_bin=str(fake), project_contexts=contexts,
+                                    registry_path=tmp_path / "registry.json")
+    runtime.registry_path.write_text(json.dumps({"schema_version": "0.1", "runtime_root": str(store.root.parent), "goals": []}))
+    (workspace / ".git").mkdir()
+    source = fake.read_text().replace('active_turn = None', 'active_turn = None\nnative_goal = None', 1)
+    begin = source.index('    elif method in {"thread/goal/set", "thread/goal/get"}:')
+    end = source.index('    elif method == "turn/start":', begin)
+    source = source[:begin] + source[end:]
+    source = source.replace('    elif method == "turn/start":', '''    elif method == "thread/goal/get":
+        result = {"goal": native_goal}
+    elif method == "thread/goal/set":
+        native_goal = {**(native_goal or {}), "threadId": "durable-thread", "tokensUsed": 120, "timeUsedSeconds": 1, **request["params"]}
+        print(json.dumps({"id": request_id, "result": {"goal": native_goal}}), flush=True)
+        if native_goal["status"] == "active":
+            turn = "native-first"
+            active_turn = turn
+            print(json.dumps({"method": "turn/started", "params": {"threadId": "durable-thread", "turn": {"id": turn}}}), flush=True)
+            if "wait for interrupt" in str(native_goal.get("objective")):
+                continue
+            print(json.dumps({"method": "item/agentMessage/delta", "params": {"threadId": "durable-thread", "turnId": turn, "delta": "Verified synthetic result: the workspace has one README and no inherited portfolio."}}), flush=True)
+            native_goal["status"] = "complete"
+            print(json.dumps({"method": "turn/completed", "params": {"threadId": "durable-thread", "turn": {"id": turn, "status": "completed"}}}), flush=True)
+        continue
+    elif method == "turn/start":''')
+    fake.write_text(source)
+    store, runtime, provider, transport = connect((store, runtime, contexts, None, capture, fake, workspace))
+    ref = contexts.available()[0]["project_ref"]
+    binding = transport.bindings.configure(transport_ref="steward-app", project_ref=ref,
+                                          executor_endpoint_id="codex", context_kind="steward")
+    runtime.manager_scope_resolver = transport.bindings.steward_scope
+    transport.core.actions = ChatActionService(store=ChatActionStore(store.root / "actions"),
+        registry_path=runtime.registry_path, chat_store=store, runtime_controller=runtime, workspace_roots=[workspace])
+    yield store, runtime, provider, transport, binding, capture, workspace
+    runtime.close()
+
+
+def finish(runtime, row):
+    return runtime.wait_for_turn(session_id=row["session_id"], turn_id=row["turn_id"], timeout_sec=15)
+
+
+def test_verified_empty_steward_is_not_missing_authorization_and_does_not_inherit(steward):
+    store, runtime, provider, transport, binding, _, _ = steward
+    transport.admit("steward-app", provider.event("steward-app", "empty", "What new work do you manage?"))
+    row = transport.core.pending()[0]
+    assert finish(runtime, row)["status"] == "completed"
+    session = store.load_session(row["session_id"])
+    context = collect_manager_turn_context(runtime.registry_path, session, store.root.parent, runtime.manager_scope_resolver)
+    assert context["goals"] == [] and context["bound_steward"] == {"authorized": True, "goal_count": 0, "empty": True}
+    assert context["coverage"]["discovered"] == 0 and "external_authorization_unavailable" not in context["warnings"]
+    assert "empty_inventory" in context["warnings"]
+    assert json.loads(runtime.registry_path.read_text())["goals"] == []
+    missing = manager_turn_context(runtime.registry_path, {"goal_id": "loopx-manager", "channel_id": "manager.external.unbound"}, store.root.parent, authorized_goal_ids=[])
+    assert missing["warnings"] == ["external_authorization_unavailable"]
+    transport.admit("notes-app", provider.event("notes-app", "notes", "ordinary notes conversation"))
+    notes = next(r for r in transport.core.pending() if r["message"] == "ordinary notes conversation")
+    assert finish(runtime, notes)["status"] == "completed"
+    assert store.load_session(notes["session_id"])["goal_id"] is None
+    assert notes["session_id"] != row["session_id"]
+    assert "ordinary notes conversation" not in str(store.messages(row["session_id"]))
+    transport.bindings.disconnect(binding["binding_id"], expected_revision=transport.bindings.read()["revision"])
+    assert collect_manager_turn_context(runtime.registry_path, session, store.root.parent, runtime.manager_scope_resolver)["warnings"] == ["external_authorization_unavailable"]
+    assert transport.admit("steward-app", provider.event("steward-app", "revoked", "more"))["status"] == "audience_rejected"
+
+
+def test_confirmed_commission_runs_native_goal_returns_result_and_extends_same_session(steward):
+    store, runtime, provider, transport, binding, capture, _ = steward
+    transport.admit("steward-app", provider.event("steward-app", "before", "Check the empty portfolio"))
+    initial = transport.core.pending()[0]
+    assert finish(runtime, initial)["status"] == "completed"
+    original = store.load_session(initial["session_id"])["upstream_thread_id"]
+    event = provider.event("steward-app", "delegate", "/delegate --tokens 12000 Inspect the authorized README and report findings")
+    started = time.monotonic()
+    assert transport.admit("steward-app", event)["status"] == "command_recorded"
+    assert time.monotonic() - started < 3
+    assert json.loads(runtime.registry_path.read_text())["goals"] == []
+    transport.reconcile()
+    preview = transport.core.actions.store.list()[0]
+    assert preview["status"] == "preview_ready" and preview["normalized_parameters"]["heartbeat"] == {"enabled": False}
+    with pytest.raises(ProtectedActionGate):
+        transport.core.actions.apply(preview["proposal_id"])
+    # The other App cannot consume even a known, exact proposal id.
+    text = "/confirm " + preview["proposal_id"]
+    transport.admit("notes-app", provider.event("notes-app", "wrong_app", text))
+    wrong_app = next(r for r in transport.core.pending() if r["message"] == text)
+    assert finish(runtime, wrong_app)["status"] == "completed"
+    assert transport.core.actions.load(preview["proposal_id"])["status"] == "preview_ready"
+    confirm = provider.event("steward-app", "confirm", text)
+    transport.admit("steward-app", confirm)
+    transport.reconcile()
+    applied = transport.core.actions.load(preview["proposal_id"])
+    assert applied["status"] == "applied", transport.core.pending()
+    resources = applied["receipt"]["resource_ids"]
+    turn = finish(runtime, resources)
+    assert turn["status"] == "completed", turn
+    assert "Verified synthetic result" in turn["response"]["message"]
+    assert "Codex Goal: complete" in turn["response"]["message"]
+    transport.reconcile()
+    assert any(profile == "steward-app" and "Verified synthetic result" in text for profile, text in provider.writes)
+    assert not any(profile == "notes-app" and "Verified synthetic result" in text for profile, text in provider.writes)
+    count = len(provider.writes)
+    transport.admit("steward-app", confirm)
+    transport.reconcile()
+    assert len(provider.writes) == count
+    assert len(json.loads(runtime.registry_path.read_text())["goals"]) == 1
+    assert transport.bindings.read()["bindings"][1]["goal_ids"] == [resources["goal_id"]]
+    transport.admit("steward-app", provider.event("steward-app", "after", "Report the new commission status"))
+    after = next(r for r in transport.core.pending() if r["message"] == "Report the new commission status")
+    assert finish(runtime, after)["status"] == "completed"
+    assert after["session_id"] == initial["session_id"]
+    assert store.load_session(after["session_id"])["upstream_thread_id"] == original
+    context = collect_manager_turn_context(runtime.registry_path, store.load_session(after["session_id"]), store.root.parent, runtime.manager_scope_resolver)
+    assert [g["goal_id"] for g in context["goals"]] == [resources["goal_id"]]
+    facts = transport.core.commission_evidence(store.load_session(after["session_id"]))
+    assert facts[0]["native_execution"]["status"] == "complete"
+    assert facts[0]["result_delivery_verified"] is True
+    assert facts[0]["canonical_acceptance_attested"] is False
+    requests = [json.loads(line) for line in capture.read_text().splitlines()]
+    assert len([r for r in requests if r.get("method") == "thread/start"]) == 3
+    assert any(r.get("method") == "thread/goal/set" for r in requests)
+    from loopx.chat_runtime import ChatRuntimeController
+    from loopx.chat_store import ChatSessionStore
+    runtime.close()
+    restarted = ChatRuntimeController(store=ChatSessionStore(store.root.parent), registry_path=runtime.registry_path,
+        project_contexts=runtime.project_contexts, codex_bin=runtime.codex_bin,
+        manager_scope_resolver=transport.bindings.steward_scope)
+    try:
+        current, resumed = restarted.open_session(goal_id=None, agent_id="codex", work_dir=runtime.registry_path.parent,
+            objective="ignored", mode="resume_latest", conversation_binding_id=binding["binding_id"],
+            source_context=initial["source"])
+        assert resumed and current["session_id"] == initial["session_id"] and current["upstream_thread_id"] == original
+    finally:
+        restarted.close()
+
+
+@pytest.mark.parametrize("fault", ["adoption", "adoption_readback", "creation_owner_crash"])
+def test_applied_commission_recovers_after_io_owner_restart_without_recreation(steward, monkeypatch, fault):
+    from loopx.extensions.lark.private_conversations import LarkPrivateConversations
+
+    class InterruptedOwner(BaseException):
+        pass
+
+    store, runtime, provider, transport, binding, capture, _ = steward
+    transport.admit("steward-app", provider.event("steward-app", "delegate", "/delegate --tokens 12000 Inspect README"))
+    transport.reconcile()
+    preview = transport.core.actions.store.list()[0]
+    text = "/confirm " + preview["proposal_id"]
+    transport.admit("steward-app", provider.event("steward-app", "confirm", text))
+    request = next(r for r in transport.core.pending() if r["message"] == text)
+    original_adopt = transport.bindings.adopt_created_goal
+    original_apply = transport.core.actions.apply
+    failed = False
+
+    def adopt(**kwargs):
+        nonlocal failed
+        if failed:
+            return original_adopt(**kwargs)
+        failed = True
+        if fault == "adoption_readback":
+            original_adopt(**kwargs)
+        raise OSError("temporary adoption IO failure")
+
+    def apply(*args, **kwargs):
+        nonlocal failed
+        result = original_apply(*args, **kwargs)
+        if not failed:
+            failed = True
+            raise InterruptedOwner()
+        return result
+
+    if fault == "creation_owner_crash":
+        monkeypatch.setattr(transport.core.actions, "apply", apply)
+        with pytest.raises(InterruptedOwner):
+            transport.reconcile()
+    else:
+        monkeypatch.setattr(transport.bindings, "adopt_created_goal", adopt)
+        transport.reconcile()
+    applied = transport.core.actions.load(preview["proposal_id"])
+    resources = applied["receipt"]["resource_ids"]
+    assert applied["status"] == "applied"
+    assert finish(runtime, resources)["status"] == "completed"
+    pending = transport.core.read_request(request["request_ref"])
+    assert pending["status"] == "command_queued" and not pending.get("delivery_verified")
+    assert not any("管家操作未完成" in message for _, message in provider.writes)
+    if fault != "creation_owner_crash":
+        assert pending["commission_resources"] == resources and pending["commission_adoption_pending"]
+        with pytest.raises(ValueError, match="adoption is pending"):
+            transport.core.record_delivery(request["request_ref"], session_id=pending["session_id"], turn_id=pending["turn_id"])
+    monkeypatch.setattr(transport.core.actions, "apply", original_apply)
+    monkeypatch.setattr(transport.bindings, "adopt_created_goal", original_adopt)
+    threads_before = sum(json.loads(line).get("method") == "thread/start" for line in capture.read_text().splitlines())
+    recovered = LarkPrivateConversations(controller=runtime, runtime_root=transport.runtime_root,
+                                         runner=provider, cli_bin=transport.cli_bin)
+    recovered.core.actions = transport.core.actions
+    recovered.reconcile()
+    result = recovered.core.read_request(request["request_ref"])
+    assert result["commission_resources"] == resources and result["delivery_verified"]
+    assert not result.get("commission_adoption_pending")
+    assert transport.bindings.read()["bindings"][1]["goal_ids"] == [resources["goal_id"]]
+    assert len(json.loads(runtime.registry_path.read_text())["goals"]) == 1
+    assert recovered.core.actions.load(preview["proposal_id"])["receipt"]["resource_ids"] == resources
+    assert sum(profile == "steward-app" and "Verified synthetic result" in message for profile, message in provider.writes) == 1
+    writes = len(provider.writes)
+    recovered.reconcile()
+    assert len(provider.writes) == writes
+    assert sum(json.loads(line).get("method") == "thread/start" for line in capture.read_text().splitlines()) == threads_before
+
+
+def test_post_commit_adoption_cannot_outlive_original_private_authority(steward, monkeypatch):
+    _, runtime, provider, transport, binding, _, _ = steward
+    transport.admit("steward-app", provider.event("steward-app", "delegate", "/delegate --tokens 12000 Inspect README"))
+    transport.reconcile()
+    preview = transport.core.actions.store.list()[0]
+    text = "/confirm " + preview["proposal_id"]
+    transport.admit("steward-app", provider.event("steward-app", "confirm", text))
+    original = transport.bindings.adopt_created_goal
+    def unavailable(**kwargs):
+        raise OSError("temporary adoption IO failure")
+    monkeypatch.setattr(transport.bindings, "adopt_created_goal", unavailable)
+    transport.reconcile()
+    resources = transport.core.actions.load(preview["proposal_id"])["receipt"]["resource_ids"]
+    assert finish(runtime, resources)["status"] == "completed"
+    transport.bindings.disconnect(binding["binding_id"], expected_revision=transport.bindings.read()["revision"])
+    monkeypatch.setattr(transport.bindings, "adopt_created_goal", original)
+    writes = len(provider.writes)
+    transport.reconcile()
+    row = next(r for r in transport.core.pending() if r["message"] == text)
+    assert row["commission_adoption_pending"] and not row.get("delivery_verified")
+    assert row["commission_resources"] == resources
+    assert len(provider.writes) == writes
+    assert len(json.loads(runtime.registry_path.read_text())["goals"]) == 1
+
+
+def test_expired_preview_and_wrong_source_cannot_create_a_goal(steward):
+    _, runtime, provider, transport, _, _, _ = steward
+    transport.admit("steward-app", provider.event("steward-app", "delegate", "/delegate --tokens 1000 Read only"))
+    transport.reconcile()
+    preview = transport.core.actions.store.list()[0]
+    text = "/confirm " + preview["proposal_id"]
+    wrong = provider.event("steward-app", "foreign", text)
+    wrong["chat_id"] = "oc_other_source"
+    provider.messages[wrong["message_id"]]["chat_id"] = wrong["chat_id"]
+    transport.admit("steward-app", wrong)
+    transport.reconcile()
+    assert json.loads(runtime.registry_path.read_text())["goals"] == []
+    # Simulate a confirmation received beyond the immutable preview expiry.
+    event = provider.event("steward-app", "expired", text)
+    transport.admit("steward-app", event)
+    binding = transport.bindings.read()["bindings"][1]
+    request_ref = identity_ref(binding["provider_ref"], event["message_id"])
+    row = transport.core.read_request(request_ref)
+    path = transport.core.root / f"{row['request_ref']}.json"
+    row["created_at"] = "2099-01-01T00:00:00+00:00"
+    path.write_text(json.dumps(row))
+    transport.reconcile()
+    assert json.loads(runtime.registry_path.read_text())["goals"] == []
+    assert transport.core.actions.load(preview["proposal_id"])["status"] == "preview_ready"
+
+
+def test_exact_commission_stop_keeps_other_app_running_and_replay_keeps_target(steward):
+    store, runtime, provider, transport, _, _, _ = steward
+    transport.admit("steward-app", provider.event("steward-app", "delegate", "/delegate --tokens 12000 wait for interrupt"))
+    transport.reconcile()
+    preview = transport.core.actions.store.list()[0]
+    transport.admit("steward-app", provider.event("steward-app", "confirm", "/confirm " + preview["proposal_id"]))
+    transport.reconcile()
+    resources = transport.core.actions.load(preview["proposal_id"])["receipt"]["resource_ids"]
+    deadline = time.monotonic() + 10
+    while not any(e["kind"] == "turn.started" for e in store.events_after(resources["session_id"], resources["turn_id"], None)):
+        assert time.monotonic() < deadline
+        time.sleep(.01)
+    transport.admit("notes-app", provider.event("notes-app", "independent", "ordinary independent answer"))
+    other = next(r for r in transport.core.pending() if r["message"] == "ordinary independent answer")
+    assert finish(runtime, other)["status"] == "completed"
+    stop = provider.event("steward-app", "stop_exact", "/stop-commission " + preview["proposal_id"])
+    transport.admit("steward-app", stop)
+    transport.reconcile()
+    assert finish(runtime, resources)["status"] == "interrupted"
+    transport.admit("steward-app", stop)
+    transport.reconcile()
+    assert store.load_turn(other["session_id"], other["turn_id"])["status"] == "completed"
+    assert transport.core.actions.load(preview["proposal_id"])["receipt"]["resource_ids"] == resources