SetraTheXX · SetraTheXX · Jul 25, 2026 · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026
diff --git a/README.md b/README.md
@@ -67,7 +67,9 @@ Nothing in that flow merges, pushes, publishes, tags, or creates a release.
 
 ## Codex Plugin
 
-The thin plugin contributes exactly three conversational skills. CEWP Core and the CLI remain authoritative.
+The thin plugin contributes exactly three conversational skills, a local stdio MCP bridge, and an optional
+review-required subagent evidence hook. Every mutating MCP operation delegates to the same CEWP Core used
+by the CLI; plugin surfaces do not become execution owners or bypass gates.
 
 From a source checkout:
 
@@ -77,7 +79,14 @@ codex plugin add cewp@cewp-local
 codex plugin list
 ```
 
-Then ask Codex to plan a supervised run, run the current checkpoint, or resume an existing run. The plugin does not gain direct access to the host's private thread, native goal lifecycle, billing data, or persistent UI.
+Then ask Codex to plan a supervised run, run the current checkpoint, or resume an existing run. The plugin
+can expose `cewp_create`, `cewp_inspect`, `cewp_approve`, `cewp_continue`, `cewp_retry`, `cewp_revise`,
+`cewp_verify`, and `cewp_finalize` when the package-provided `cewp-mcp` command is on `PATH`. It does not
+gain direct access to the host's private thread, native goal lifecycle, billing data, or persistent UI.
+
+For a workflow with a validated host binding, `cewp integration controls <workflow-run-id> --json` shows
+preventive, post-execution, imported-observation, and unavailable control classes without promoting
+audit-only evidence into enforcement.
 
 ## What CEWP Records
 
@@ -112,6 +121,7 @@ CEWP still ships ten reusable engineering skills and the earlier Coordinator Mod
 
 - [Install Guide](docs/install.md)
 - [Supervised Workflow](docs/supervised-workflow.md)
+- [External Integration Boundary](docs/external-integration-boundary.md)
 - [Workflow Runtime](docs/workflow-runtime.md)
 - [Known Limitations](docs/known-limitations.md)
 - [Pilot Kit](docs/pilot-kit.md)

diff --git a/bin/cewp-mcp.js b/bin/cewp-mcp.js
@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const { runStdio } = require("../src/mcp/server");
+
+runStdio();
diff --git a/bin/cewp.js b/bin/cewp.js
@@ -34,6 +34,7 @@ const { init } = require("../src/skills/install");
 const { list, doctor } = require("../src/skills/status");
 const { runSupervise } = require("../src/supervise/cli");
 const { runWorkflow } = require("../src/workflow/cli");
+const { runIntegration } = require("../src/integration/cli");
 const { printHuman: printSupervisedDemo, runSupervisedDemo } = require("../src/demo/supervised");
 
 function runDemo(options) {
@@ -209,12 +210,17 @@ async function main() {
       return;
     }
 
+    if (args.command === "integration") {
+      runIntegration(args);
+      return;
+    }
+
     if (args.command === "demo") {
       runDemo(args);
       return;
     }
 
-    if (!["init", "list", "doctor", "policy", "run", "supervise", "workflow", "demo"].includes(args.command)) {
+    if (!["init", "list", "doctor", "policy", "run", "supervise", "workflow", "integration", "demo"].includes(args.command)) {
       throw new Error(`Unsupported command: ${args.command}`);
     }
   } catch (error) {

diff --git a/docs/adr/0002-execution-ownership.md b/docs/adr/0002-execution-ownership.md
@@ -42,6 +42,11 @@ Receipts label each control as one of:
 
 Native and audit-only runs must not inherit managed claims. A hook or conversation warning may project a decision but never becomes the ownership or enforcement source.
 
+The runtime materializes these classifications as `integration-control-receipt/v1` and exposes the receipt
+through `cewp integration controls <workflow-run-id> --json`. Audit-only bindings with preventive entries or
+controls assigned to multiple classes are invalid. Imported entries explicitly render as observed, not
+enforced, and receipt inspection verifies the artifact still matches its validated host binding.
+
 ## Consequences
 
 The runtime needs a deterministic ownership registry and conflict fixtures before the supervised golden path ships. Recovery can safely resume only after worktree, plan, policy, owner, backend, and process state are compatible. App Server may later replace `codex-exec` for a managed checkpoint only through a new capability and migration decision; it cannot run beside it for the same checkpoint.
diff --git a/docs/adr/0005-codex-integration-backend.md b/docs/adr/0005-codex-integration-backend.md
@@ -39,6 +39,7 @@ The Phase 11 review used the current Codex manual and a controlled local probe a
 - Existing `codex-exec` users keep a stable fallback and one backend per managed checkpoint.
 - Native goals remain useful without CEWP pretending to control or inspect a private host session.
 - External agent interfaces can use MCP and `operator-json/v1` without CEWP building a competing terminal or desktop UI.
+- The shipped MCP transport is local stdio only, fixes repository scope to process `cwd`, and delegates all eight operations directly to CEWP Core. It is a control surface, not an execution owner or reviewer.
 - Capability or schema drift produces an explicit compatibility warning and returns to generated-goal or explicit intake.
 - App Server can be reconsidered later without changing CEWP's provider-neutral workflow and evidence schemas.
 

diff --git a/docs/codex-capability-matrix.md b/docs/codex-capability-matrix.md
@@ -47,10 +47,12 @@ Schema presence does not prove that a plugin can attach to the desktop app's exi
 | Desktop notifications | host-specific | The host owns documented notification behavior and settings. CEWP has no arbitrary notification category. |
 | Hook `statusMessage` | supported | Official hook configuration exposes it as transient handler status. |
 | Hook `systemMessage` | supported | Official hook output exposes it as a UI or event-stream warning. |
+| `SubagentStart`/`SubagentStop` evidence | supported, opt-in | The plugin records only documented parent session/turn, agent id/type, permission/model context, and bounded stop summary after separate CEWP approval and host `/hooks` trust. The documented input exposes no subagent thread id, so CEWP preserves it as `unknown`. |
+| Hook trust and version drift | supported | `npm run test:integration-hook-evidence` binds the exact bundle, Codex version, CEWP runtime, hook contract, and workflow revision. Drift or malformed input emits a warning, appends no trusted evidence, and leaves Core gates unchanged. |
 | `PreToolUse` deny output | supported | The deterministic fixture emits the documented `permissionDecision: deny` shape and is covered by `npm run test:hook-output`. |
 | `PreToolUse` as complete enforcement | unavailable | Official docs exclude or limit richer shell and non-MCP paths. A real CLI 0.137.0 Windows probe executed the requested PowerShell command despite the Bash deny hook. Core policy remains authoritative. |
 | Hook-based instant turn cancellation | unknown | Stop semantics do not establish instantaneous cancellation of an in-flight model or external process. |
-| Local MCP to CEWP Core | unknown | MCP is supported by the host. Phase 11 implements a small Core-backed tool surface while conversation and CLI fallbacks remain required. |
+| Local MCP to CEWP Core | supported | `cewp-mcp` implements the documented local stdio JSON-RPC lifecycle and exactly eight Core-backed tools. `npm run test:integration-mcp` proves schema validation, current-directory repository scope, Core state transitions, confirmation gates, business errors, protocol errors, and explicit protocol-version drift fallback without credentials. |
 
 ## App Server Boundary
 
@@ -102,7 +104,7 @@ Reasons:
 - App Server adds useful goal metadata and lifecycle methods, but remains a separately owned experimental process with version drift and unresolved authenticated usage/cancellation behavior.
 - The spike did not demonstrate enough recovery or accounting advantage to justify shipping two incomplete managed backends.
 
-The native fallback is a bounded generated goal brief plus supported host goal tools or explicit result intake. `audit-only` remains available for evidence supplied by another owner. The local MCP bridge is the next supported integration surface. Hooks and Apps SDK UI remain optional projections; their absence never weakens CEWP Core. See [ADR 0005](adr/0005-codex-integration-backend.md).
+The native fallback is a bounded generated goal brief plus supported host goal tools or explicit result intake. `audit-only` remains available for evidence supplied by another owner. The local MCP bridge is the supported headless integration surface. Hooks and Apps SDK UI remain optional projections; their absence never weakens CEWP Core. See [ADR 0005](adr/0005-codex-integration-backend.md) and the [external integration boundary](external-integration-boundary.md).
 
 ## Reproduction
 
@@ -115,6 +117,8 @@ npm run probe:codex-app-server
 npm run test:plugin-lifecycle
 npm run test:hook-output
 npm run test:integration-capabilities
+npm run test:integration-hook-evidence
+npm run test:integration-mcp
 ```
 
 The nested model probe is intentionally excluded from automated tests because it consumes account usage. Raw account values, credentials, thread ids, and machine-specific paths are not part of this document.

diff --git a/docs/external-integration-boundary.md b/docs/external-integration-boundary.md
@@ -0,0 +1,51 @@
+# External Integration Boundary
+
+CEWP is a local workflow, governance, verification, and evidence runtime. A third-party interface may
+present CEWP state in its own agent UI, but it must not become the execution owner merely by calling a
+CEWP control surface. It remains responsible for its UI, user consent, authentication, transport lifecycle,
+and any agent process it starts.
+
+## Supported Headless Surfaces
+
+`operator-json/v1` is the stable envelope shape for CLI inspection and control results. External tools may
+invoke documented `cewp ... --json` commands, retain the `command`, `generatedAt`, `data`, and `warnings`
+fields, and render them without converting warnings or observations into PASS. In particular,
+`cewp integration controls <workflow-run-id> --json` keeps preventive, post-execution, imported, and
+unavailable controls distinct.
+
+`cewp-mcp` is the structured local stdio bridge. Configure its current working directory as exactly one
+intended repository. It exposes create, inspect, approve, continue, retry, revise, verify, and finalize; the
+tools import the same CEWP Core services as the CLI. An MCP client may add its own confirmation UI, but
+cannot bypass Core approval, ownership, policy, effort, scope, budget, verification, receipt, or reviewer
+gates. The server opens no network listener and provides no host account, billing, or private-session data.
+Unsupported MCP protocol versions return an explicit `mcp-protocol-version-drift` compatibility warning
+and name `cewp-cli-operator-json` as the safe fallback.
+
+Hooks and conversation messages are optional projections. Hook evidence is separately trusted and
+version-bound; a missing, disabled, stale, or malformed hook never changes Core enforcement.
+
+## Execution Ownership
+
+The external UI is not a fourth owner. Each run remains `managed`, `native`, or `audit-only`. A managed
+checkpoint retains one backend and one CEWP-owned worktree. Native work remains host-owned. Audit-only
+evidence may be imported or checked after execution but never presented as preventive enforcement.
+Provider-specific host, goal, thread, turn, and subagent identifiers stay in integration sidecars rather
+than provider-neutral workflow schemas.
+
+## Rich Codex Clients And App Server
+
+A client that needs rich Codex thread, turn, or goal lifecycle should integrate with the documented Codex
+App Server and own that separate process, authentication boundary, thread identifiers, selected working
+directory, interruption behavior, and cleanup. That client is separate from the CEWP plugin. Its process
+does not attach to the ChatGPT desktop app's existing internal session, inherit private desktop credentials,
+or turn App Server schema presence into plugin capability.
+
+CEWP has not graduated App Server as a managed backend. A request for that ungraduated backend falls back
+to the selected `codex-exec` path, which already owns isolated dispatch, artifacts, verification, recovery,
+and reviewer gates. External clients can still use CEWP MCP or operator JSON around their own UI without
+changing this backend decision.
+
+CEWP will build no custom terminal-session protocol, terminal server, desktop shell, private Codex
+protocol adapter, UI scraper, or undocumented desktop-session attachment. A richer client should compose
+the supported Codex App Server and CEWP's headless surfaces rather than making CEWP a competing terminal
+product.
diff --git a/docs/install.md b/docs/install.md
@@ -228,6 +228,16 @@ The harness uses temporary repos, exercises Coordinator Mode runtime helpers, an
 
 The supervised demo uses a deterministic fake Codex process in a temporary repository. It does not use credentials or start a real provider.
 
+The npm package also installs the plugin-declared local MCP command:
+
+```bash
+cewp-mcp
+```
+
+It is a stdio protocol process, not an interactive shell command or network server. Codex starts it from
+the repository selected for the task. Third-party MCP clients may configure the same command with the
+intended repository as `cwd`; the command must be available on `PATH`.
+
 If Codex does not show installed skills, restart or reload Codex and confirm that each skill has:
 
 ```txt

diff --git a/docs/known-limitations.md b/docs/known-limitations.md
@@ -10,7 +10,8 @@ CEWP is beta software. These limits are product boundaries, not hidden roadmap p
 - ChatGPT subscription credit impact and host-internal retries or compaction remain `unknown` without a supported machine-readable contract.
 - Numeric usage estimates stay unavailable until enough comparable local runs exist. When available, they are ranges with confidence and sample basis, never point promises.
 - File-level test-authoring enforcement recognizes common test directories and filename conventions. It cannot prove whether production code contains test-like logic.
-- The plugin contributes skills only. It does not provide MCP tools, hooks, an Apps SDK card, or an App Server client.
+- The plugin contributes skills, a local stdio MCP bridge, and an optional review-required `SubagentStart`/`SubagentStop` evidence hook. The hook cannot expose a subagent thread id, does not read transcripts, and is never a Core enforcement boundary. MCP exposes only CEWP Core operations and does not attach to native host sessions. An Apps SDK card and App Server client are not shipped.
+- Audit-only integration can validate imported evidence and record post-execution checks, but it cannot claim that CEWP prevented actions performed by the external owner. Its integration control receipt therefore permits no preventive entries.
 - Experimental OpenCode execution remains optional and outside the supervised golden path. Binary/version availability does not prove authentication or model readiness.
 - Manual is a non-executing handoff adapter. Claude, Gemini, Hermes, and other providers are not implemented.
 - Supervised worktree cleanup automation is not shipped; rollback is available for owned unverified work, and terminal evidence is retained for deliberate inspection/removal.

diff --git a/docs/release-notes.md b/docs/release-notes.md
@@ -4,6 +4,34 @@
 
 No changes yet.
 
+## 0.11.0-beta.0
+
+### Summary
+
+Codex-first native-goal supervision and integration bridge preparation. Phase 11 keeps managed, native,
+and audit-only ownership separate, retains `codex-exec`, adds supported headless integration surfaces,
+and preserves provider-neutral workflow state. This version is prepared locally and is not published,
+tagged, or released; clean Linux validation remains required before the technical release gate can close.
+
+### Added
+
+- Enforced cross-mode worktree conflicts so native and managed ownership cannot target the same CEWP task worktree or active checkpoint.
+- Added explicit implementation, repair, and reviewer task classes with operator-approved model/effort revisions and no automatic model routing.
+- Added opt-in, exact-definition and version-bound `SubagentStart`/`SubagentStop` evidence. Hook absence, drift, malformed input, or host distrust leaves Core gates unchanged.
+- Added a local stdio bridge with eight Core-backed MCP tools for create, inspect, approve, continue, retry, revise, verify, and finalize. MCP and CLI call the same services and preserve the same Core gates.
+- Added MCP protocol-drift negotiation with a stable compatibility warning and CLI/operator-JSON fallback.
+- Added structured host observations that keep observed, imported, stale, malformed, unavailable, and unknown truth states distinct without inventing billing impact.
+- Added `integration-control-receipt/v1` and `cewp integration controls` so audit-only evidence cannot be presented as preventive enforcement.
+- Added a packaged external-integration boundary for third-party MCP/operator JSON clients and rich Codex clients that own a separate App Server lifecycle.
+
+### Changed
+
+- App Server remains ungraduated because no material supported lifecycle, usage, or recovery advantage was proven. An explicit request retains the `codex-exec` fallback.
+- Provider-specific host, goal, thread, turn, subagent, and worktree references stay outside provider-neutral workflow schemas.
+- Host goal completion, hook completion, and imported evidence never count as CEWP verification or independent reviewer PASS.
+- Independent external pilot evidence remains Phase 13 validation debt; fixtures, maintainer dogfood, and multiple machines used by one maintainer do not satisfy it.
+- No provider, desktop UI, terminal server, merge, push, publish, tag, or release automation was added.
+
 ## 0.10.0-beta.0
 
 ### Summary

diff --git a/docs/skill-plugin-compatibility.md b/docs/skill-plugin-compatibility.md
@@ -1,6 +1,6 @@
 # Skill And Plugin Compatibility
 
-Observed: 2026-07-16
+Observed: 2026-07-22
 
 CEWP's ten bundled skills use the current Codex skill shape: a required `SKILL.md` with `name` and `description`, plus optional `scripts/`, `references/`, `assets/`, and `agents/`. `agents/openai.yaml` is accepted as optional UI, invocation-policy, and dependency metadata. CEWP no longer treats these official components as forbidden.
 
@@ -23,7 +23,7 @@ The Phase 9 plugin follows the official boundary:
 
 - `.codex-plugin/plugin.json` is the required manifest and the only file under `.codex-plugin/`.
 - `skills/`, `hooks/`, `.mcp.json`, `.app.json`, and `assets/` live at the plugin root and use `./`-prefixed contained paths.
-- Installing or enabling a plugin does not trust its bundled hooks. CEWP hooks remain optional until the user reviews and trusts the current definition.
+- Installing or enabling a plugin does not trust its bundled hooks. CEWP declares one contained subagent-evidence bundle, requires a run-bound operator approval, and still directs the user to `/hooks` to review and trust the exact current host definition. Bundle, Codex, CEWP runtime, hook-contract, or workflow-revision drift disables trusted evidence and falls back to Core plus conversation output.
 - A repo marketplace lives at `.agents/plugins/marketplace.json`; npm remains the source of the CEWP Core CLI/runtime.
 - MCP and Apps SDK components are optional projections. The plugin skeleton and golden path cannot depend on them until their versioned capability tests pass.