diff --git a/.delphi/exec.sh b/.delphi/exec.sh
new file mode 100644
index 0000000..1cf3281
--- /dev/null
+++ b/.delphi/exec.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Run a command with this clone's layout, even in hosts whose fresh shells discard session exports.
+set -euo pipefail
+# shellcheck source=.delphi/paths.sh
+source "$(dirname "$0")/paths.sh"
+[ "$#" -gt 0 ] || { echo "usage: bash .delphi/exec.sh <command> [<arg>...]" >&2; exit 2; }
+exec "$@"
diff --git a/.delphi/manifest.yml b/.delphi/manifest.yml
index 335e3b7..fb1aa03 100644
--- a/.delphi/manifest.yml
+++ b/.delphi/manifest.yml
@@ -6,7 +6,7 @@
 #   MINOR  something new that existing clones need nothing for
 #   MAJOR  clones need cleanup (MINOR while 0.x): add .delphi/migrations/<version>-<slug>.sh, which
 #          setup.sh runs once per workspace in each clone (rules in Delphi's CLAUDE.md)
-version: 2.0.0
+version: 2.1.0
 files:                        # repo-relative paths; a trailing / means everything under it
   - .delphi/manifest.yml
   - .delphi/.gitattributes
@@ -14,6 +14,7 @@ files:                        # repo-relative paths; a trailing / means everythi
   - .delphi/version.sh
   - .delphi/setup.sh
   - .delphi/new-worktree.sh
+  - .delphi/exec.sh
   - .delphi/paths.sh
   - .delphi/plugins.sh
   - .delphi/switch.sh
diff --git a/.delphi/versions b/.delphi/versions
index b5e272d..1c95e06 100644
--- a/.delphi/versions
+++ b/.delphi/versions
@@ -18,3 +18,4 @@
 1.1.0 a3446f7f763c setup.sh clones each repos: entry at repos/<name> (a normal clone on its default branch, was a bare store) and adds no worktree; new-worktree.sh makes worktrees from that clone; older bare stores are left as they are
 1.2.0 d139aaf9f4a5 worktrees come from their own bare store, worktrees/<name>/.bare, separate from the plain clone at repos/<name>; setup.sh makes the store and the default-branch worktree again; an older bare store at repos/<name> is left as it is
 2.0.0 750acf945979 a bare repos/<name> from before 1.1.0 becomes the worktree store, worktrees/<name>/.bare, with its worktrees, and repos/<name> is cloned normally (migration; skipped with a message if it has no origin or work not on origin)
+2.1.0 84b00128fc22 add a harness-independent per-command workspace bootstrap for Codex
diff --git a/CLAUDE.md b/CLAUDE.md
index 4b5131d..1d042da 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -17,9 +17,10 @@ source of truth; `docs/goals.md` lists what any change must keep.
   labelled `by: ai` (new-workspace: `--by ai-assisted|human` when the user says so).
 - `ci/plugins.sh`: writes `.claude-plugin/marketplace.json` from the plugin sets
   (`software/**/plugins/<harness>/<set>/`, named `<scope>[.<set>]`; a folder's scope is its
-  `plugins/scope`, else its `short-name`, else its name), each workspace's `workspace.yml` `plugins:` defaults (the
+  `plugins/scope`, else its `short-name`, else its name), each Claude Code workspace's `workspace.yml` `plugins:` defaults (the
   `default` set of every folder above), and its `.claude/settings.json` (enabled sets, and the SessionStart hook that sets `$DELPHI_ROOT`; never edit
-  it by hand). Run it after changing a set or a `workspace.yml`'s `plugins:`.
+  it by hand). `ci/render.sh` calls it for main-side plugin output; sync keeps branch-selected
+  plugin sets active while their proposal to main is pending.
 - `.delphi/{setup,new-worktree,switch,park,plugins}.sh`: the scripts every workspace runs (setup.sh
   runs `plugins.sh`, which makes this clone's local `@delphi` installs what the workspace enables and
   uninstalls ones the marketplace dropped, so plugin changes need no migration); `.delphi/paths.sh`
@@ -31,18 +32,29 @@ source of truth; `docs/goals.md` lists what any change must keep.
   version, with its hash from `.delphi/version.sh`), `.delphi/migrations/<version>-<slug>.sh` (clone
   cleanup, run by `setup.sh`).
 - `templates/workspace/`: `workspace.yml`, `CLAUDE.md` (`{{name}}`, `{{folder}}`), the managed
-  `.github/workflows/delphi.yml` every workspace carries unchanged. The general `new-worktree`,
-  `switch-workspace`, `setup-workspace`, and `journal` skills are in `software/workspace-inherit/`.
+  `.github/workflows/delphi.yml` every workspace carries unchanged. The general skills are in
+  `software/workspace-inherit/.claude/skills/`; Codex adds its bootstrap from `templates/harnesses/`
+  to the common instruction base once at creation.
 - `software/plugins/claude/default/`: the `delphi` plugin set, a mod whose `/ws-delphi` pane switches
   workspaces (`hooks/register.tsx`, tests in `tests/ws.test.ts`, run by `claude plugin test`);
   `/ws-delphi --web` serves the same cards in a browser tab (`web/server.py`, `web/index.html`).
 - `software/…/workspaces/<leaf>/`: the workspaces. Org structure is plain directories. A project
   folder (the one holding `workspaces/`) may add `README.md`, `AUTHORING.md`, and `workspace-defaults/`
-  (copied once into a new workspace there). Any folder may add `workspace-inherit/` (written onto the
-  `ws/*` root of every workspace below on each refresh, never proposed; `opt-out:` in a
-  `workspace.yml` skips a path).
+  (translated once into a new workspace there). Existing source layouts stay intact; optional
+  `source.yml` declares a different authoring format. Any org/project folder may add `workspace-inherit/`;
+  CI prepares inheritance in temporary staging and refresh copies it only to ws branches.
+  Their `workspace.generated` records ownership; `opt-out:` transfers a native path to the workspace.
+  Main keeps owned native files and canonical sources, never inherited copies or ledgers.
 - `.github/workflows/delphi.yml` (identical to the template's copy), `.github/CODEOWNERS`; issue templates (idea, spike, epic, dev work) and the PR template in `.github/`, filed with the `create-ticket` skill (`.claude/skills/`).
 - `tests/e2e.sh`: end-to-end test in a throwaway sandbox (bare origin, stub `gh` logging to `gh.log`).
+- `ci/render.sh [--check] [--workspace <folder>] [<main-checkout> [<staging-output>]]`: update plugin
+  output, or prepare inherited native files and ledgers in optional temporary staging. Main-side
+  checks reject managed copies, ledgers and ownership collisions; inherited output is never committed there.
+  `ci/harnesses.sh` reads `ci/harnesses/<name>.sh` through pure `harness_field` queries;
+  `ci/sources.sh` reads independently selected formats; `ci/inherit.sh` resolves sources.
+  `ci/managed.sh` shares ownership logic with sync, whose refresh
+  copies staged output. Every workspace must explicitly declare its harness. Codex uses
+  `.delphi/exec.sh` to initialize helper commands in independent shells.
 
 ## Rules
 
@@ -52,11 +64,18 @@ source of truth; `docs/goals.md` lists what any change must keep.
   headers): name the file or key that holds them ("the folders in `.delphi/park.list`", "each repo
   under `repos:`"), never its entries. A copied list goes stale. Runtime tools: bash, git, and `gh` (only to open or update PRs).
 - Every script: `#!/usr/bin/env bash`, `set -euo pipefail`, `shellcheck`-clean.
-- Skills name nothing harness-specific (SKILL.md is the shared Agent Skills format): call scripts by
+- Keep Claude skill sources under workspace-inherit/.claude/skills with their metadata intact.
+  Each descriptor owns `translate_skill`; native metadata conversion, identifier mappings and
+  helper bootstrap affect only generated output. Write skills once in Claude format; translate
+  identifiers and feature bullets, never exact source sentences or per-skill copies. Validation
+  rejects unmapped Claude identifiers in other harnesses; qualified code-repository paths stay literal.
+  Shared-source paths and opt-out keys follow `docs/design.md`'s portable-path rule; existing owned
+  workspace filenames are unaffected.
+  Skill scripts stay harness-independent (SKILL.md uses the Agent Skills format): call scripts by
   their path in the skill's folder, `bash scripts/<script>.sh <names>…`, and reference files the same
   way. Skill scripts (inherited, plugin or workspace) take only names (repo, branch) and read the workspace
   from `$DELPHI_ROOT`, sourcing `$DELPHI_ROOT/.delphi/paths.sh` for every folder; each harness's
-  generated settings set it (Claude Code: a SessionStart hook in `.claude/settings.json`, from
+  bootstrap sets it (Claude Code: a SessionStart hook in `.claude/settings.json`, from
   `ci/plugins.sh`). Never search for the root or default to the cwd's branch.
 - `.delphi/*.sh` run on people's machines: bash 3.2 (macOS) and Git Bash safe. No bash-4
   features (associative arrays, `mapfile`, `${x,,}`, `|&`), POSIX awk only.
diff --git a/README.md b/README.md
index 4b4ba4f..c6a5b99 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,10 @@ named by the **short name** of each folder above it, from `software/` down, then
 name, joined by dots: `software/application-software/argos/workspaces/argos-dev` is
 `s.app.argos.argos-dev` (a folder's short name is its `short-name` file, else its name;
 `.delphi/names.sh` prints them all). For each one, CI keeps a branch **`ws/<name>`**
-whose repo root *is* that folder, so people and agents work on it with plain git. Design: `docs/design.md`. Goals: `docs/goals.md`.
+whose repo root *is* that folder. Each workspace explicitly declares its harness and keeps its owned
+files at native paths on `main`. Shared skills stay in their canonical sources on main; CI adds
+inherited native copies only to `ws/*`. People and agents work with plain git. Design:
+`docs/design.md`. Goals: `docs/goals.md`.
 
 ## How it works
 
@@ -83,11 +86,30 @@ references are there too (a workspace inside another's `workspaces/` skips its o
 edited from the workspace that links them; to change one, work in its own clone or switch to it.
 
 The workspace's dotted name is repeated in `name:` so a checkout knows which workspace it is; names
-are unique (give a folder a `short-name` that no sibling's name or short name clashes with). Every other file in the folder is the workspace's own, at its normal harness
-path, except `.github/workflows/delphi.yml` (a copy of the template's). The scripts, `.delphi/*.sh`
+are unique (give a folder a `short-name` that no sibling's name or short name clashes with). Files
+live at normal harness paths. On `ws/*`, `workspace.generated` records managed copies; it never
+returns to main. Instructions, docs and opted-out copies remain workspace-owned. The workflow comes from
+the template. The scripts, `.delphi/*.sh`
 (listed in `.delphi/manifest.yml`), live once at main's root: sync puts
 `.delphi/` on every `ws/*` branch, so change them only through PRs to main.
 
+## Codex
+
+Argos's `default-codex` workspace targets the Codex harness across hosts:
+
+```sh
+git clone -b ws/s.app.argos.default-codex https://github.com/Northeastern-Electric-Racing/Delphi.git delphi
+cd delphi
+bash .delphi/setup.sh
+```
+
+Open the workspace in Codex and follow `AGENTS.md`. It discovers native skills under `.agents/skills/`.
+Use `.delphi/exec.sh` for helper commands so each shell receives the workspace layout. Start a fresh
+session after switching workspaces. The host supplies dependencies, credentials and integrations;
+Codex workspaces do not enable Delphi's Claude plugin sets.
+Generated Codex skills include the complete helper invocation in each script command, so fresh
+shells and sub-agents initialize the same layout.
+
 ## Versions
 
 `.delphi/manifest.yml` lists Delphi's own files under a `version:` (MAJOR.MINOR.PATCH), and
@@ -98,7 +120,7 @@ a version needs cleanup in people's clones, it ships `.delphi/migrations/<versio
 
 ## New workspace
 
-`tools/new-workspace.sh <org-path under software/> <leaf>` copies `templates/workspace/` into
+`tools/new-workspace.sh [--harness <adapter>] <org-path under software/> <leaf>` copies `templates/workspace/` into
 `software/<org-path>/workspaces/<leaf>/`, adds the project's `workspace-defaults/` if it has one, and
 opens a PR to `main`, labelled `by: ai` (put `--by ai-assisted` or `--by human` first to change it).
 Once it merges, CI creates `ws/<name>` (its dotted name).
@@ -107,12 +129,26 @@ Once it merges, CI creates `ws/<name>` (its dotted name).
 can hold shared context (`README.md`), a guide to its workspaces (`AUTHORING.md`), and
 `workspace-defaults/` (what a new workspace there starts with).
 
-**Inherited files.** Any folder under `software/`, `software/` itself included, can hold
-`workspace-inherit/`: files (usually skills, never `CLAUDE.md`) that CI writes onto the `ws/*` branch
-of every workspace below it on each sync. Edit them on `main`; a workspace's own edit is undone. To
-keep its own copy, a workspace lists the path under `opt-out:` in its `workspace.yml`.
-A workspace that lists `main` under `workspaces:` reads them at `workspaces/main/` (recommended for every
-new workspace); to change them, switch to `main`.
+**Shared sources.** Keep Claude skills and their metadata in
+`workspace-inherit/.claude/skills/<name>/`. The optional `source.yml` selects an authoring format
+from the harness registry; each workspace's `harness:` independently selects its target.
+`workspace-defaults/` seeds owned files once; `workspace-inherit/` stays managed.
+Each harness descriptor owns its translation function. Skills are authored once in Claude format;
+CI rejects Claude identifiers that a non-Claude translator leaves unmapped.
+Register a target or source format in `ci/harnesses/<name>.sh`; its entry owns the native contract.
+
+**Preparation and sync.** CI translates inheritance from main into temporary staging, then refresh
+copies it onto workspace branches. Main contains no inherited copies or ownership ledgers.
+After source or configuration changes, run `bash ci/render.sh` to update plugin settings and
+`bash ci/check.sh` to validate the repo. Commit sources and owned files; CI prepares inheritance.
+
+**Ownership.** Edit shared sources instead of their managed branch copies. To keep an editable
+workspace copy, list its native path under `opt-out:`. Proposals retain owned files and opted-out
+skills while stripping managed copies, `workspace.generated` and the branch's `.delphi/`.
+Collisions are reported. See `docs/design.md` for the adapter contract and ownership rules.
+Source-native opt-outs also exclude unsupported inputs before mapping. Shared paths and opt-out
+keys use portable ASCII names without spaces or control characters; this naming rule does not
+restrict workspace-owned files.
 
 ## CI (`.github/workflows/delphi.yml`)
 
diff --git a/ci/check.sh b/ci/check.sh
index ebdcdfe..79042db 100755
--- a/ci/check.sh
+++ b/ci/check.sh
@@ -1,31 +1,10 @@
 #!/usr/bin/env bash
-# ci/check.sh [<dir> [<base>]]: validate Delphi (CI runs it on PRs to main, against main; sync.sh on
-# each proposal). Rules: a workspace is software/**/workspaces/<leaf>/ with a workspace.yml; its name
-# is the short names of its folders and <leaf>, joined by dots (.delphi/names.sh; branch ws/<name>),
-# and unique across the tree; a folder's `short-name` file is one line of lowercase letters, digits
-# and '-'; so is each <leaf>; workspaces never nest; no symlinks under
-# software/; no workspace (nor the template) has its own .delphi/ (sync puts main's on every ws/*
-# branch); .delphi/manifest.yml lists itself, every file in .delphi/ but `versions`, and only files
-# git tracks; its `version:` and the hash of those files (.delphi/version.sh) are the last line of
-# .delphi/versions, whose versions rise; each .delphi/migrations/<version>-<slug>.sh has its line
-# there, bumps MAJOR (MINOR while 0.x) over the line before, and starts like every script; against
-# <base>, .delphi/versions only gains lines and released migrations are unchanged; each manifest file
-# outside .delphi/ (the workflow) is the same in templates/workspace/ and every workspace; workspace.yml is `name: <its name>`,
-# `harness: <adapter>`, an optional `repos:` map of `<name>: <git-url>`, and an optional
-# `references-git:` map of `<name>: <git-url> [<ref>]`; names are unique across both; and an optional
-# `workspaces:` list of `- <name>` (a workspace on main) or `- main`, without duplicates or the workspace itself, and an
-# optional `plugins:` list of `- <scope>[.<set>]` without duplicates, and an optional `opt-out:` list
-# of `- <path>` it inherits, each matching something. A project's workspace-defaults/workspace.yml is
-# the same without `name:` (and a project has no old defaults/). A workspace-inherit/ folder sits in
-# an org or project folder, never holds a workspace's own files (CLAUDE.md, workspace.yml, .delphi/,
-# .claude/settings.json, the workflow), and no workspace inherits a path from two of them or has a
-# file at an inherited path it hasn't opted out of. The files ci/plugins.sh generates
-# (.claude-plugin/marketplace.json, each workspace's plugins: defaults and .claude/settings.json) are up to date.
-# No SKILL.md body names a harness variable (${CLAUDE_…}): skills call scripts by their path in the
-# skill's folder, and scripts read $DELPHI_ROOT.
-# Lists every problem; exits 1 if any.
+# ci/check.sh [<dir> [<base>]]: validate docs/design.md's workspace, source and runtime contracts.
+# Main owns native files/settings; inherited copies and ledgers are branch-only. Checks never write.
 set -euo pipefail
 here=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=ci/inherit.sh
+source "$here/inherit.sh"
 cd "${1:-.}"
 base=${2:-}
 problems=0
@@ -89,7 +68,9 @@ while IFS= read -r at; do bad "$at: names a harness variable; call scripts as \`
   git ls-files '*SKILL.md' | while IFS= read -r f; do # frontmatter is harness metadata; the body is shared
     awk 'NR == 1 && /^---$/ { f = 1; next } f && /^---$/ { f = 0; next } !f && /\$\{CLAUDE_/ { print FILENAME ":" FNR; exit }' "$f"
   done)
-while IFS= read -r msg; do bad "${msg#plugins: }"; done < <(bash "$here/plugins.sh" --check . 2>&1 >/dev/null || true)
+if messages=$(bash "$here/render.sh" --check . 2>&1); then :
+elif [ -z "$messages" ]; then bad "inherited output validation failed"; fi
+while IFS= read -r msg; do [ -z "$msg" ] || bad "$msg"; done <<<"$messages"
 
 manifest() { # <workspace.yml> [<name>]: without <name> (a workspace-defaults/ manifest), `name:` is not allowed
   while IFS= read -r msg; do bad "$1: $msg"; done < <(awk -v want="${2:-}" '
@@ -113,7 +94,7 @@ manifest() { # <workspace.yml> [<name>]: without <name> (a workspace-defaults/ m
       if (pk[v]++) print "duplicate park entry: " v
       next }
     r == 5 && /^[[:space:]]/ {
-      if ($0 !~ /^[[:space:]]+-[[:space:]]+[A-Za-z0-9._][A-Za-z0-9._\/-]*[[:space:]]*(#.*)?$/ || $0 ~ /(^|[[:space:]\/])\.\.(\/|[[:space:]]|$)/) {
+      if ($0 !~ /^[[:space:]]+-[[:space:]]+[A-Za-z0-9._@+][A-Za-z0-9._/@+-]*[[:space:]]*(#.*)?$/ || $0 ~ /(^|[[:space:]\/])\.\.(\/|[[:space:]]|$)/) {
         print "bad opt-out entry (want `  - <path it inherits>`, e.g. .claude/skills/journal): " $0; next }
       v = $0; sub(/^[[:space:]]+-[[:space:]]+/, "", v); sub(/[[:space:]]*#.*$/, "", v)
       if (opt[v]++) print "duplicate opt-out: " v
@@ -141,35 +122,49 @@ manifest() { # <workspace.yml> [<name>]: without <name> (a workspace-defaults/ m
       if (seen[n]++) print "duplicate repo: " n
       next }
     { print "unexpected line: " $0 }
-    END { if (!h) print "harness is missing"; if (want != "" && !nm) print "name is missing" }' "$1")
+    END { if (want != "" && !h) print "harness is missing"; if (want != "" && !nm) print "name is missing" }' "$1")
+  local adapter instruction foreign plugins
+  adapter=$(awk '/^harness:/ { print $2; exit }' "$1")
+  if [ -n "$adapter" ]; then
+    harness_exists "$adapter" || { bad "$1: unknown harness '$adapter'"; return; }
+    plugins=$(harness_field "$adapter" plugins)
+    instruction=$(harness_field "$adapter" instruction)
+    foreign=$(harness_foreign "$adapter")
+    if [ "$plugins" = none ] && awk '/^plugins:/ { s = 1; next } /^[^[:space:]#]/ { s = 0 } s && /^[[:space:]]+-/ { found = 1 } END { exit !found }' "$1"; then
+      bad "$1: $adapter does not support Delphi plugin sets"
+    fi
+    if [ -n "${2:-}" ]; then
+      [ -f "${1%/*}/$instruction" ] || bad "${1%/*}/$instruction: required for $adapter"
+      for incompatible in $foreign; do
+        [ ! -e "${1%/*}/$incompatible" ] || bad "${1%/*}/$incompatible: belongs to a different harness"
+      done
+    fi
+  fi
   while IFS= read -r v; do listed="$listed $1|$v"; done < <(awk '/^workspaces:/ { s = 1; next } /^[^[:space:]#]/ { s = 0 }
     s && /^[[:space:]]+-[[:space:]]+/ { sub(/^[[:space:]]+-[[:space:]]+/, ""); sub(/[[:space:]]*#.*$/, ""); if ($0 != "main") print }' "$1")
 }
 
-levels() { # <workspace folder>: software/ and each folder down to its project folder, top first
-  echo "${1%/workspaces/*}" | awk -F/ '{ p = $1; print p; for (i = 2; i <= NF; i++) { p = p "/" $i; print p } }'
-}
-inherits() { # <workspace folder> <workspace.yml>: what it inherits, against what it has and opts out of
-  local level p o opted seen="" used="" out
-  out=$(awk '/^opt-out:/ { s = 1; next } /^[^[:space:]#]/ { s = 0 }
-    s && /^[[:space:]]+-[[:space:]]+/ { sub(/^[[:space:]]+-[[:space:]]+/, ""); sub(/[[:space:]]*#.*$/, ""); sub(/\/$/, ""); print }' "$2")
-  for level in $(levels "$1"); do
-    [ -d "$level/workspace-inherit" ] || continue
-    for p in $(cd "$level/workspace-inherit" && find . -type f | sed 's#^\./##' | sort); do
-      case " $seen " in *" $p "*) bad "$level/workspace-inherit/$p: $1 also inherits it from a folder above; keep one" ;; esac
-      seen="$seen $p" opted=""
-      for o in $out; do case "$p/" in "$o"/*) opted=1 used="$used $o" ;; esac; done
-      [ -n "$opted" ] || [ ! -e "$1/$p" ] || bad "$1/$p: inherited from $level/workspace-inherit/; remove it, or list it under opt-out: in workspace.yml"
-    done
-  done
-  for o in $out; do case " $used " in *" $o "*) ;; *) bad "$2: opt-out: $o is nothing it inherits" ;; esac; done
-}
 while IFS= read -r d; do
   case "$d" in */workspaces/*) bad "$d: belongs in an org or project folder, not under workspaces/" ;; esac
-  for f in CLAUDE.md workspace.yml .delphi .claude/settings.json $managed; do
+  for f in $(harness_protected) workspace.yml workspace.generated .delphi $managed; do
     [ ! -e "$d/$f" ] || bad "$d/$f: each workspace has its own; it can't be inherited"
   done
 done < <(find software -type d -name workspace-inherit 2>/dev/null | sort)
+while IFS= read -r d; do
+  case "$d" in */workspaces/*) continue ;; esac
+  if format=$(source_format "$d" 2>/dev/null); then
+    if ! messages=$(bundle_files "$d" "$format" 2>&1 >/dev/null); then bad "$messages"; fi
+  else bad "$d/source.yml: declare one supported source format"; fi
+done < <(find software -type d \( -name workspace-defaults -o -name workspace-inherit \) 2>/dev/null | sort)
+while IFS= read -r d; do
+  case "$d" in */workspaces/*) continue ;; esac
+  format=$(source_format "$d" 2>/dev/null) || continue
+  skills=$(harness_field "$format" skills)
+  [ -d "$d/$skills" ] || continue
+  for skill in "$d/$skills"/*; do
+    [ ! -e "$skill" ] || [ -f "$skill/SKILL.md" ] || bad "$skill: shared skills need <name>/SKILL.md"
+  done
+done < <(find software -type d -name workspace-inherit 2>/dev/null)
 while IFS= read -r d; do
   [ ! -d "${d%/workspaces}/defaults" ] || bad "${d%/workspaces}/defaults: renamed workspace-defaults/"
 done < <(find software -type d -name workspaces 2>/dev/null)
@@ -181,6 +176,10 @@ done < <(find software -name short-name -type f 2>/dev/null | sort)
 all=$(bash .delphi/names.sh 2>/dev/null || true) # <name> <folder>
 folders="" names="" listed=""
 while IFS= read -r f; do
+  case "$f" in
+    */workspaces/*) ;; # a workspace may itself be named workspace-defaults
+    */workspace-inherit/* | */workspace-defaults/*) continue ;;
+  esac
   folder=${f%/workspace.yml}
   case "$(dirname "$folder")" in */workspaces) ;; *)
     bad "$f: must be at software/**/workspaces/<leaf>/workspace.yml" && continue ;;
@@ -200,8 +199,7 @@ while IFS= read -r f; do
   [ ! -e "$folder/.delphi" ] || bad "$folder/.delphi: managed in the root .delphi/ on main; remove it"
   for m in $managed; do cmp -s "$tpl/$m" "$folder/$m" || bad "$folder/$m: differs from $tpl/$m"; done
   manifest "$f" "$name"
-  inherits "$folder" "$f"
-done < <(find software -name workspace.yml -type f ! -path '*/workspace-inherit/*' \( ! -path '*/workspace-defaults/workspace.yml' -o -path '*/workspaces/workspace-defaults/*' \) 2>/dev/null | sort)
+done < <(find software -name workspace.yml -type f 2>/dev/null | sort)
 while IFS= read -r f; do manifest "$f"; done \
   < <(find software -path '*/workspace-defaults/workspace.yml' ! -path '*/workspaces/workspace-defaults/*' -type f 2>/dev/null)
 for l in $listed; do
diff --git a/ci/harnesses.sh b/ci/harnesses.sh
new file mode 100644
index 0000000..c7e438d
--- /dev/null
+++ b/ci/harnesses.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Harness registry and shared skill rendering. Per-target facts live in harnesses/<name>.sh.
+set -euo pipefail
+harness_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")/harnesses" && pwd)
+
+harnesses() { # registered target/source formats
+  local file
+  for file in "$harness_dir"/*.sh; do
+    [ -f "$file" ] || continue
+    file=${file##*/}; printf '%s\n' "${file%.sh}"
+  done
+}
+
+harness_exists() {
+  case "$1" in '' | *[!a-z0-9-]*) return 1 ;; esac
+  [ -f "$harness_dir/$1.sh" ]
+}
+
+harness_field() ( # <target> <property>: descriptor fields and functions never escape the query
+  harness_exists "$1" || { echo "harness: unknown harness '$1'" >&2; return 1; }
+  case "$2" in instruction | instruction_base | instruction_template | skills | native | protected | plugins | settings_file | settings_generator | bootstrap | skill_ref) ;;
+    *) echo "harness: unknown property '$2'" >&2; return 1 ;;
+  esac
+  # shellcheck disable=SC2034 # descriptors are read through indirect property expansion
+  local instruction='' instruction_base='' instruction_template='' skills='' native='' protected='' plugins=none
+  # shellcheck disable=SC2034 # optional descriptor properties
+  local settings_file='' settings_generator='' bootstrap='' skill_ref='/%s'
+  # shellcheck disable=SC1090 # a registered, trusted main-side descriptor
+  source "$harness_dir/$1.sh"
+  printf '%s\n' "${!2}"
+)
+
+harness_foreign() { # paths owned by other targets, excluding shared native conventions
+  local own other path
+  own="$(harness_field "$1" instruction) $(harness_field "$1" native)"
+  for other in $(harnesses); do
+    [ "$other" != "$1" ] || continue
+    for path in $(harness_field "$other" instruction) $(harness_field "$other" native); do
+      case " $own " in *" $path "*) ;; *) printf '%s\n' "$path" ;; esac
+    done
+  done
+}
+
+harness_protected() { # native root instructions and target-owned configuration are never inherited
+  local target
+  for target in $(harnesses); do
+    harness_field "$target" instruction
+    harness_field "$target" settings_file
+    harness_field "$target" protected
+  done
+}
+
+harness_settings() { # <target> <folder> <manifest>: the target's registered settings generator
+  local generator
+  generator=$(harness_field "$1" settings_generator) || return 1
+  [ -n "$generator" ] || return 0
+  bash "$harness_dir/../../$generator" settings "$2" "$3"
+}
+
+harness_skill_names() { # <target> <workspace folder> <records> [opt-outs]: only this workspace's native skills
+  local prefix path exclusion skip
+  prefix=$(harness_field "$1" skills) || return 1
+  [ -n "$prefix" ] || return 0
+  {
+    while IFS=$'\t' read -r _ path _; do
+      skip=0
+      for exclusion in ${4:-}; do case "$path/" in "$exclusion"/*) skip=1 ;; esac; done
+      [ "$skip" = 1 ] || printf '%s\n' "$path"
+    done <<<"$3"
+    if [ -d "$2/$prefix" ]; then
+      while IFS= read -r path; do printf '%s\n' "${path#"$2"/}"; done < <(find "$2/$prefix" -type f -name SKILL.md)
+    fi
+  } | awk -v prefix="$prefix/" 'index($0, prefix) == 1 {
+    path = substr($0, length(prefix) + 1)
+    if (path ~ /^[a-z0-9-]+\/SKILL[.]md$/) { sub(/\/SKILL[.]md$/, "", path); print path }
+  }' | LC_ALL=C sort -u | tr '\n' ' '
+}
+
+harness_file() ( # <target> <source> [skill names]: each descriptor owns its translator; validate every non-Claude output
+  local target=$1 file=$2 harness_skill_names=${3:-}
+  case "$file" in */SKILL.md) ;; *) cat "$file"; return ;; esac
+  # shellcheck source=ci/harnesses/claude-code.sh
+  source "$harness_dir/claude-code.sh"
+  # shellcheck disable=SC1090 # trusted target descriptor, isolated from caller state
+  source "$harness_dir/$target.sh"
+  if [ "$target" = claude-code ]; then translate_skill "$file"
+  else translate_skill "$file" | claude_identifiers check; fi
+)
+
+skill_bootstrap() { # target translators place this after their native metadata
+  cat <<'BOOTSTRAP'
+
+Run every skill helper through the workspace bootstrap, including in fresh shells and sub-agents:
+
+```sh
+bash "<absolute-workspace-root>/.delphi/exec.sh" bash "<absolute-installed-skill-folder>/scripts/<script>.sh" <arguments...>
+```
+
+Replace the placeholders with the known workspace root, this skill's installed native folder, the script name, and its arguments. Obtain the workspace's absolute path once with `bash .delphi/paths.sh` from the checked-out workspace root. The wrapper sets `DELPHI_ROOT` for every invocation and preserves the caller's working directory; do not assume shell exports persist.
+
+BOOTSTRAP
+}
+
+skill_commands() { # common shell syntax; targets choose whether helper commands need bootstrap
+  # shellcheck disable=SC2031 # called inside the same descriptor subshell that sets bootstrap
+  awk -v bootstrap="$bootstrap" '
+    bootstrap == "exec" {
+      rest = $0; adapted = ""
+      # Translate the command syntax, including nested command substitutions, without editing prose.
+      while (match(rest, /(^|[[:space:]`(;])bash scripts\/[A-Za-z0-9._\/-]+/)) {
+        before = substr(rest, 1, RSTART - 1); command = substr(rest, RSTART, RLENGTH)
+        rest = substr(rest, RSTART + RLENGTH)
+        at = index(command, "bash scripts/")
+        adapted = adapted before substr(command, 1, at - 1) "bash \"<absolute-workspace-root>/.delphi/exec.sh\" bash \"<absolute-installed-skill-folder>/" substr(command, at + 5) "\""
+      }
+      print adapted rest; next
+    }
+    { print }
+  '
+}
diff --git a/ci/harnesses/claude-code.sh b/ci/harnesses/claude-code.sh
new file mode 100644
index 0000000..af39a79
--- /dev/null
+++ b/ci/harnesses/claude-code.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2034
+# Claude-native paths and CI capabilities; read by the shared registry.
+set -euo pipefail
+instruction=CLAUDE.md
+instruction_base=''
+instruction_template=templates/workspace/CLAUDE.md
+skills=.claude/skills
+native='.claude'
+protected='.claude/settings.json'
+plugins=claude
+settings_file=.claude/settings.json
+settings_generator=ci/plugins.sh
+bootstrap=hook
+skill_ref='/%s'
+github_tool=''
+github_integration=''
+browser_tool=''
+pane_guidance=''
+reload_guidance=''
+
+translate_skill() { cat "$1"; }
+
+claude_identifiers() { # [check]: Claude's identifier contract, shared by target translators and leak validation
+  # shellcheck disable=SC2154 # target, file and the skill catalog come from the registry's translator scope
+  awk -v check="${1:-}" -v target="$target" -v file="$file" -v instruction="$instruction" \
+    -v skills="$skills" -v ref="$skill_ref" -v ids="$harness_skill_names" \
+    -v github="$github_tool" -v integration="$github_integration" -v browser="$browser_tool" \
+    -v pane="$pane_guidance" -v reload="$reload_guidance" '
+    function literal(s, from, to, at, out) {
+      while ((at = index(s, from))) { out = out substr(s, 1, at - 1) to; s = substr(s, at + length(from)) }
+      return out s
+    }
+    function missing(id) { print "harness: " target ": missing Claude mapping for " id " in " file " (translated line " NR ")" > "/dev/stderr"; failed = 1 }
+    function native_skills(s, at, out) {
+      while (match(s, /(^|[^A-Za-z0-9_.\/-])[.]claude\/skills/)) {
+        at = RSTART + RLENGTH - 14
+        out = out substr(s, 1, at - 1) skills; s = substr(s, at + 14)
+      }
+      return out s
+    }
+    function refs(s, code, start, at, size, before, after, id, active, out) {
+      start = 1
+      while (!code && match(substr(s, start), /CLAUDE[.]md/)) {
+        at = start + RSTART - 1; before = substr(s, at - 1, 1); after = substr(s, at + 9, 1)
+        active = (at == 1 || before !~ /[A-Za-z0-9_.\/-]/) && after !~ /[A-Za-z0-9_\/-]/ &&
+          (after != "." || substr(s, at + 10, 1) !~ /[A-Za-z0-9]/)
+        out = out substr(s, start, at - start)
+        if (active && check && instruction != "CLAUDE.md") missing("CLAUDE.md")
+        out = out (active && !check ? instruction : "CLAUDE.md"); start = at + 9
+      }
+      s = out substr(s, start); start = 1; out = ""
+      # Always inspect boundaries in the original string, including after an unmatched path segment.
+      while (match(substr(s, start), /\/[a-z][a-z0-9-]*/)) {
+        at = start + RSTART - 1; size = RLENGTH; id = substr(s, at + 1, size - 1)
+        before = substr(s, at - 1, 1); after = substr(s, at + size, 1)
+        active = id in known && (at == 1 || before ~ /[[:space:](]/) && after != "/" &&
+          (after != "." || substr(s, at + size + 1, 1) !~ /[A-Za-z0-9]/) && (!code || at == 1)
+        out = out substr(s, start, at - start)
+        if (active && check && ref != "/%s") missing("/" id)
+        out = out (active && !check ? sprintf(ref, id) : "/" id); start = at + size
+      }
+      return out substr(s, start)
+    }
+    function spans(s, out, marker, tail, search, closing, size, offset) {
+      while (match(s, /`+/)) {
+        offset = RSTART; marker = substr(s, offset, RLENGTH); tail = substr(s, offset + RLENGTH)
+        search = tail; closing = 0; size = 0
+        while (match(search, /`+/)) {
+          if (RLENGTH == length(marker)) { closing = size + RSTART; break }
+          size += RSTART + RLENGTH - 1; search = substr(search, RSTART + RLENGTH)
+        }
+        if (!closing) break
+        out = out refs(substr(s, 1, offset - 1), 0) marker refs(substr(tail, 1, closing - 1), 1) marker
+        s = substr(tail, closing + length(marker))
+      }
+      return out refs(s, 0)
+    }
+    function fence_line(s, marker, size, suffix) {
+      sub(/^[[:space:]]*/, "", s)
+      if (!match(s, /^(```+|~~~+)/)) return 0
+      marker = substr(s, 1, 1); size = RLENGTH; suffix = substr(s, size + 1)
+      if (!fence) { fence = marker; fence_size = size; return 1 }
+      if (fence == marker && size >= fence_size && suffix ~ /^[[:space:]]*$/) { fence = ""; return 1 }
+      return 0
+    }
+    BEGIN { n = split(ids, names, " "); for (i = 1; i <= n; i++) known[names[i]] = 1 }
+    {
+      line = $0
+      if (fence_line(line)) { print line; next }
+      if (!check) {
+        # Feature bullets are selected by identifiers, never by their English wording.
+        if (!fence && line ~ /^[-*] / && index(line, "/ws-delphi") && pane != "") {
+          if (pane != "drop") print "- " pane
+          next
+        }
+        if (!fence && line ~ /^[-*] / && index(line, "`delphi` mod") && reload != "") { print "- " reload; next }
+        if (integration != "") line = literal(line, "GitHub MCP server", integration)
+        if (github != "") {
+          line = literal(line, "mcp__github__pull_request_read", github)
+          line = literal(line, "pull_request_read", github)
+        }
+        if (browser != "") {
+          line = literal(line, "`playwright-cdp`", "`" browser "`")
+          line = literal(line, "`playwright`", "`" browser "`")
+        }
+        line = native_skills(line)
+      }
+      # Code filenames and qualified paths are literal; backticked skill calls still adapt.
+      if (!fence) line = spans(line)
+      if (check) {
+        rest = line
+        while (match(rest, /mcp__[A-Za-z0-9_]+|CLAUDE_[A-Za-z0-9_]+|(^|[^A-Za-z0-9_.\/-])[.]claude([\/`[:space:]]|$)|(~|\$HOME|\$\{HOME\})\/[.]claude([\/`[:space:]]|$)|\/ws-delphi|pull_request_read|playwright-cdp|GitHub MCP server|Claude Code|`delphi` mod|subagent_type[[:space:]]*=[[:space:]]*Explore|(^|[^A-Za-z0-9_])(WebFetch|ultrathink)([^A-Za-z0-9_]|$)|claude[[:space:]]+plugin[[:space:]]+install/)) {
+          missing(substr(rest, RSTART, RLENGTH)); rest = substr(rest, RSTART + RLENGTH)
+        }
+      }
+      print line
+    }
+    END { exit failed }'
+}
diff --git a/ci/harnesses/codex.sh b/ci/harnesses/codex.sh
new file mode 100644
index 0000000..9b58812
--- /dev/null
+++ b/ci/harnesses/codex.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2034
+# Codex-native paths and CI capabilities; host credentials and integrations stay external.
+set -euo pipefail
+instruction=AGENTS.md
+instruction_base=templates/workspace/CLAUDE.md
+instruction_template=templates/harnesses/codex/AGENTS.md
+skills=.agents/skills
+native='.agents .codex'
+protected='.codex/config.toml'
+plugins=none
+settings_file=''
+settings_generator=''
+bootstrap='exec'
+skill_ref='$%s'
+github_tool='PR reader'
+github_integration='available authenticated GitHub integration'
+browser_tool='browser automation available in this harness'
+pane_guidance=drop
+reload_guidance="Start a fresh Codex session after switching so the new workspace's instructions and skills load before further work."
+
+translate_skill() { # Claude metadata becomes Codex metadata; identifiers follow this descriptor's contract.
+  {
+    awk '
+      { sub(/\r$/, "") }
+      NR == 1 { if ($0 !~ /^---$/) exit; front = 1; print; next }
+      front && /^---$/ { print; exit }
+      front {
+        line = $0; sub(/^ */, "", line); indent = length($0) - length(line)
+        if (!root && line !~ /^(#|$)/) { root = 1; level = indent }
+        if (indent == level && line ~ /^["\047]?(allowed-tools|user-invocable|disable-model-invocation)["\047]?[[:space:]]*:/) { skip = 1; next }
+        if (skip && (indent > level || line ~ /^(#|$|-([[:space:]]|$))/)) next
+        skip = 0
+        if (indent == level && line ~ /^description: / && substr(line, 14) ~ /: / && substr(line, 14) !~ /^["\047>|]/) {
+          print substr($0, 1, level) "description: >-"; print substr($0, 1, level) "  " substr(line, 14)
+        } else print
+      }' "$1"
+    skill_bootstrap
+    awk '
+      NR == 1 && /^---\r?$/ { front = 1; next }
+      front && /^---\r?$/ { front = 0; next }
+      !front { print }
+    ' "$1"
+  } | claude_identifiers | skill_commands
+}
diff --git a/ci/inherit.sh b/ci/inherit.sh
new file mode 100644
index 0000000..efe0903
--- /dev/null
+++ b/ci/inherit.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Main-side inheritance resolver. Source format and target harness are independent inputs.
+set -euo pipefail
+# shellcheck source=ci/sources.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/sources.sh"
+inherit_levels() {
+  echo "${1%/workspaces/*}" | awk -F/ '{ p = $1; print p; for (i = 2; i <= NF; i++) { p = p "/" $i; print p } }'
+}
+inherited_files() { # <workspace folder> <harness>: mode blob<TAB>destination<TAB>source
+  local level
+  harness_exists "$2" || return 1
+  for level in $(inherit_levels "$1"); do
+    if [ -d "$level/workspace-inherit" ]; then
+      bundle_files "$level/workspace-inherit" "$2" "${3:-}" || return 1
+    fi
+  done
+}
diff --git a/ci/managed.sh b/ci/managed.sh
new file mode 100644
index 0000000..f351683
--- /dev/null
+++ b/ci/managed.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Ownership helpers shared by main-side rendering and branch sync; no harness or source-format logic.
+set -euo pipefail
+# shellcheck disable=SC2034 # sourced by render.sh and sync.sh
+generated=workspace.generated
+
+optouts() { # read a workspace.yml on stdin
+  awk '/^opt-out:/ { s = 1; next } /^[^[:space:]#]/ { s = 0 }
+    s && /^[[:space:]]+-[[:space:]]+/ { sub(/^[[:space:]]+-[[:space:]]+/, ""); sub(/[[:space:]]*#.*$/, ""); sub(/\/$/, ""); print }'
+}
+
+opted_out() { # <path> <space-separated opt-outs>
+  local out
+  for out in $2; do case "$1/" in "$out"/*) return 0 ;; esac; done
+  return 1
+}
+
+recorded() { # <path> <records>: exact managed ownership, including files retired by a topology change
+  printf '%s\n' "$2" | awk -F'\t' -v p="$1" '$2 == p { found = 1 } END { exit !found }'
+}
+
+settings_source() { # CI generator origins are separate from inherited software/ source paths
+  case "$1" in ci/*) return 0 ;; esac
+  return 1
+}
+
+safe_path() {
+  case "$1" in '' | /* | *[!A-Za-z0-9._/@+-]* | */ | *//* ) return 1 ;; esac
+  case "/$1/" in */../* | */./* | */.git/*) return 1 ;; esac
+}
+
+generated_records() { # ledger on stdin: validate and print records; mode blob<TAB>destination<TAB>source
+  local meta path source extra
+  while IFS=$'\t' read -r meta path source extra; do
+    case "$meta" in '' | '#'* ) continue ;; esac
+    if ! printf '%s\n' "$meta" | grep -Eq '^(100644|100755) [0-9a-f]{40}([0-9a-f]{24})?$' ||
+      ! safe_path "$path" || ! safe_path "$source" || [ -n "$extra" ]; then
+      echo "generated: invalid ownership record" >&2; return 1
+    fi
+    case "$path" in workspace.yml | workspace.generated | .delphi | .delphi/*)
+      echo "generated: protected destination $path" >&2; return 1 ;;
+    esac
+    printf '%s\t%s\t%s\n' "$meta" "$path" "$source"
+  done
+}
+
+ledger() { # <revision:path>: missing ledgers are allowed for pre-render workspaces
+  local contents
+  contents=$(git show "$1" 2>/dev/null || true)
+  printf '%s\n' "$contents" | generated_records
+}
+
+ledger_header() { printf '# Generated by ci/render.sh; edit shared sources or opt out in workspace.yml.\n'; }
diff --git a/ci/plugins.sh b/ci/plugins.sh
index 0c73b3c..2fabf3b 100755
--- a/ci/plugins.sh
+++ b/ci/plugins.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# ci/plugins.sh [--check] [<dir>]: write the generated harness files of a main checkout <dir> (default .):
+# ci/plugins.sh [--check] [<dir>]: render.sh uses this on main to write the generated harness files of a main checkout <dir> (default .):
 #   .claude-plugin/marketplace.json: marketplace `delphi`, one plugin per set folder
 #     software/**/plugins/claude/<set>/ outside workspaces, named <scope>, or <scope>.<set> unless the
 #     set is `default`. A folder's scope is the one line in its plugins/scope, else its short-name
@@ -15,7 +15,7 @@
 #     settings go in .claude/settings.local.json, shared ones here or in workspace.yml.
 #   --check writes nothing; it lists each out-of-date file or problem and exits 1 if any.
 # ci/plugins.sh yml|settings <folder> <workspace.yml>: print one workspace's workspace.yml or
-#   settings.json, from <dir> = . (sync uses them for ws/* branches, reading workspace.yml from the branch).
+#   settings.json, from <dir> = . (also used for temporary branch staging).
 set -euo pipefail
 repo=Northeastern-Electric-Racing/Delphi
 
@@ -124,7 +124,7 @@ put() { # <file> <what's stale> <command...>: write <command>'s output to <file>
   "$@" >"$tmp" || { problems=$((problems + 1)) && return; }
   cmp -s "$tmp" "$f" && return
   if [ "$check" = 1 ]; then
-    echo "plugins: $f $what; run ci/plugins.sh" >&2
+    echo "plugins: $f $what; run ci/render.sh" >&2
     problems=$((problems + 1))
   else
     mkdir -p "$(dirname "$f")" && cp "$tmp" "$f" && echo "plugins: wrote $f"
diff --git a/ci/render.sh b/ci/render.sh
new file mode 100755
index 0000000..39e53f3
--- /dev/null
+++ b/ci/render.sh
@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# ci/render.sh [--check] [--workspace <folder>] [<main checkout> [<staging output>]]:
+# validate main-owned files and prepare inherited native files outside workspace folders on main.
+set -euo pipefail
+here=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=ci/inherit.sh
+source "$here/inherit.sh"
+# shellcheck source=ci/managed.sh
+source "$here/managed.sh"
+check=0 only=""
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --check) check=1; shift ;;
+    --workspace) [ "$#" -ge 2 ] || exit 2; only=$2; shift 2 ;;
+    *) break ;;
+  esac
+done
+[ "$#" -le 2 ] || { echo "render: too many arguments" >&2; exit 2; }
+[ -z "$only" ] || { safe_path "$only" && [ "$#" = 2 ]; } || { echo "render: --workspace needs a safe folder and staging output" >&2; exit 2; }
+checkout=${1:-.} output=${2:-}
+if [ -n "$output" ]; then mkdir -p "$output"; output=$(cd "$output" && pwd -P); fi
+cd "$checkout"
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+output=${output:-$tmp/native}
+case "$output/" in "$(pwd -P)/"*) echo "render: staging output must be outside the main checkout" >&2; exit 2 ;; esac
+problems=0
+bad() { echo "render: $*" >&2; problems=$((problems + 1)); }
+while IFS= read -r path; do bad "$path: symlinks are not allowed under software/"; done \
+  < <(find software -type l 2>/dev/null)
+while IFS= read -r path; do bad "$path: symlinks are not allowed in staging output"; done \
+  < <(find "$output" -type l 2>/dev/null)
+[ "$problems" = 0 ] || exit 1
+if [ -z "$only" ]; then
+  if [ "$check" = 1 ]; then bash "$here/plugins.sh" --check . || problems=$((problems + 1))
+  else bash "$here/plugins.sh" . || exit 1; fi
+fi
+
+render_workspace() { # <workspace folder>: main keeps owned files; inherited output and ledger go to staging
+  local folder=$1 adapter out records meta path src seen="" used="" o parent protected_path settings_file plugins skill_names target=$output/$1
+  [ ! -e "$folder/$generated" ] || { bad "$folder/$generated: ownership records belong only on workspace branches"; return; }
+  adapter=$(awk '/^harness:/ { print $2; exit }' "$folder/workspace.yml")
+  harness_exists "$adapter" || { bad "$folder/workspace.yml: unknown harness '$adapter'"; return; }
+  plugins=$(harness_field "$adapter" plugins)
+  if [ "$plugins" = none ] && awk '/^plugins:/ { s = 1; next } /^[^[:space:]#]/ { s = 0 }
+    s && /^[[:space:]]+-/ { found = 1 } END { exit !found }' "$folder/workspace.yml"; then
+    bad "$folder/workspace.yml: $adapter does not support Delphi plugin sets"; return
+  fi
+  out=$(optouts <"$folder/workspace.yml")
+  records=$(inherited_files "$folder" "$adapter" "$out") || { bad "$folder: cannot resolve inherited sources"; return; }
+  skill_names=$(harness_skill_names "$adapter" "$folder" "$records" "$out") || return 1
+  rm -rf "$target"
+  mkdir -p "$target"
+  : >"$tmp/records"
+  while IFS=$'\t' read -r meta path src; do
+    [ -n "$path" ] || continue
+    if ! safe_path "$path" || ! safe_path "$src"; then bad "$src: unsafe inherited destination '$path'"; continue; fi
+    case "$path" in workspace.yml | workspace.generated | .delphi | .delphi/* | .github/workflows/delphi.yml)
+      bad "$src: each workspace has its own $path; it can't be inherited"; continue ;;
+    esac
+    protected_path=0
+    for o in $(harness_protected); do
+      if [ "$path" = "$o" ]; then bad "$src: each workspace has its own $path; it can't be inherited"; protected_path=1; break; fi
+    done
+    [ "$protected_path" = 0 ] || continue
+    case " $seen " in *" $path "*) bad "$src: $folder also inherits it from a folder above; keep one" ;; esac
+    seen="$seen $path"
+    for o in $out; do if opted_out "$path" "$o"; then used="$used $o"; fi; done
+    opted_out "$path" "$out" && continue
+    if [ -e "$folder/$path" ]; then
+      bad "$folder/$path: workspace-owned file collides with $src; inherited copies belong only on workspace branches"; continue
+    fi
+    parent=$path
+    while [ "$parent" != "${parent%/*}" ]; do
+      parent=${parent%/*}
+      if [ -e "$folder/$parent" ] && [ ! -d "$folder/$parent" ]; then
+        bad "$folder/$parent: workspace-owned file collides with $src"; break
+      fi
+    done
+    mkdir -p "$(dirname "$target/$path")"
+    harness_file "$adapter" "$src" "$skill_names" >"$target/$path"
+    meta="${meta%% *} $(git hash-object -- "$target/$path")"
+    if [ "${meta%% *}" = 100755 ]; then chmod +x "$target/$path"; fi
+    printf '%s\t%s\t%s\n' "$meta" "$path" "$src" >>"$tmp/records"
+  done <<<"$records"
+  for o in $out; do
+    # Refresh can carry an obsolete branch opt-out until its owner removes it in a PR.
+    [ -z "$only" ] || continue
+    case " $used " in *" $o "*) ;; *) bad "$folder/workspace.yml: opt-out: $o is nothing it inherits" ;; esac
+  done
+  settings_file=$(harness_field "$adapter" settings_file)
+  if [ -n "$settings_file" ]; then
+    mkdir -p "$(dirname "$target/$settings_file")"
+    harness_settings "$adapter" "$folder" "$folder/workspace.yml" >"$target/$settings_file" || return 1
+    printf '100644 %s\t%s\tci/harnesses/%s.sh\n' "$(git hash-object -- "$target/$settings_file")" "$settings_file" "$adapter" >>"$tmp/records"
+    if [ -z "$only" ]; then
+      if [ "$check" = 1 ]; then
+        cmp -s "$target/$settings_file" "$folder/$settings_file" || bad "$folder/$settings_file: generated settings are out of date"
+      else mkdir -p "$(dirname "$folder/$settings_file")"; cp "$target/$settings_file" "$folder/$settings_file"; fi
+    fi
+  fi
+  { ledger_header; LC_ALL=C sort -t $'\t' -k2,2 "$tmp/records"; } >"$target/$generated"
+}
+
+if [ -n "$only" ]; then
+  [ -f "$only/workspace.yml" ] || { echo "render: no workspace $only" >&2; exit 1; }
+  render_workspace "$only"
+else
+  while read -r _ folder; do render_workspace "$folder"; done < <(bash "$here/../.delphi/names.sh")
+fi
+[ "$problems" = 0 ] || exit 1
diff --git a/ci/sources.sh b/ci/sources.sh
new file mode 100644
index 0000000..8d1605e
--- /dev/null
+++ b/ci/sources.sh
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Source readers: a bundle declares its authoring format independently of the consuming workspace.
+set -euo pipefail
+# shellcheck source=ci/harnesses.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/harnesses.sh"
+# shellcheck source=ci/managed.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/managed.sh"
+
+source_format() { # <bundle>: legacy bundles are Claude-authored
+  local config format
+  if [ ! -e "$1/source.yml" ]; then echo claude-code; return; fi
+  config=$(cat "$1/source.yml")
+  format=$(printf '%s\n' "$config" | awk '
+    /^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
+    /^format:[[:space:]]+[a-z0-9-]+[[:space:]]*(#.*)?$/ { if (!n++) value = $2; next }
+    { invalid = 1 }
+    END { if (n == 1 && !invalid) print value }')
+  { [ -n "$format" ] && harness_exists "$format"; } || { echo "source: $1/source.yml: declare one supported source format" >&2; return 1; }
+  printf '%s\n' "$format"
+}
+
+source_path() { # <format> <target> <path>: explicit native mapping without global registry mutation
+  local from_instruction from_skills incompatible native to_skills
+  from_instruction=$(harness_field "$1" instruction) || return 1
+  from_skills=$(harness_field "$1" skills) || return 1
+  safe_path "$3" || { echo "source: unsafe path '$3'" >&2; return 1; }
+  for incompatible in $(harness_foreign "$1"); do
+    case "$3" in "$incompatible" | "$incompatible"/*)
+      echo "source: $3 does not belong to the declared $1 format" >&2; return 1 ;;
+    esac
+  done
+  case "$3" in
+    "$from_instruction") harness_field "$2" instruction ;;
+    "$from_skills"/*)
+      to_skills=$(harness_field "$2" skills) || return 1
+      [ -n "$to_skills" ] || { echo "source: $1:$3 has no skill mapping to $2" >&2; return 1; }
+      printf '%s/%s\n' "$to_skills" "${3#"$from_skills"/}" ;;
+    *)
+      for native in $(harness_field "$1" native); do
+        case "$3" in "$native" | "$native"/*)
+          [ "$1" = "$2" ] || { echo "source: $1:$3 has no mapping to $2; opt out of its source path or provide an adapter mapping" >&2; return 1; } ;;
+        esac
+      done
+      printf '%s\n' "$3" ;;
+  esac
+}
+
+bundle_files() { # <bundle> <target> [<source exclusions>]: mode blob<TAB>destination<TAB>source
+  local format records record meta path dest
+  format=$(source_format "$1") || return 1
+  records=$(source_files "$1") || return 1
+  while IFS= read -r record; do
+    [ -n "$record" ] || continue
+    meta=${record%%$'\t'*}; path=${record#*$'\t'}
+    [ "$path" != source.yml ] || continue
+    meta="${meta%% *} ${meta##* }"
+    if opted_out "$path" "${3:-}"; then
+      # A source-path exclusion can skip unavailable mappings. Mapped files still use native opt-outs.
+      if dest=$(source_path "$format" "$2" "$path" 2>/dev/null); then
+        if [ "$dest" != "$path" ] && ! opted_out "$dest" "${3:-}"; then
+          echo "source: opt-out for $path must use its native destination $dest" >&2; return 1
+        fi
+      else dest=$path; fi
+    else
+      dest=$(source_path "$format" "$2" "$path") || return 1
+    fi
+    printf '%s\t%s\t%s\n' "$meta" "$dest" "$1/$path"
+  done <<<"$records"
+}
+
+source_files() { # <folder>: validate NUL-delimited names before emitting sorted newline/tab records
+  local file mode path
+  [ -d "$1" ] || return 0
+  while IFS= read -r -d '' file; do
+    path=${file#"$1"/}
+    safe_path "$path" || { echo "source: unsafe path '$path'" >&2; return 1; }
+    mode=100644; [ ! -x "$file" ] || mode=100755
+    printf '%s %s\t%s\n' "$mode" "$(git hash-object -- "$file")" "$path"
+  done < <(find "$1" -type f -print0) | LC_ALL=C sort -t $'\t' -k2,2
+}
diff --git a/ci/sync.sh b/ci/sync.sh
index f8cb282..53a650b 100755
--- a/ci/sync.sh
+++ b/ci/sync.sh
@@ -1,29 +1,14 @@
 #!/usr/bin/env bash
-# ci/sync.sh [refresh|propose] [<name>]: sync each workspace folder software/**/workspaces/<leaf>/ on
-# origin/main (or just <name>) with its branch ws/<name>, whose root is the folder. A workspace's
-# <name> is .delphi/names.sh's: its folders' short names and <leaf>, joined by dots
-# (software/application-software/argos/workspaces/argos-dev -> s.app.argos.argos-dev). CI runs it
-# with no direction (both) on every push to main or ws/**.
-#   refresh: merge main into ws/<name> (-Xsubtree=<folder>), then make its .delphi/ main's root
-#            .delphi/ (a "delphi: sync" commit if that changed it), write over it the files it inherits
-#            from main (every workspace-inherit/ folder from software/ down to its project folder,
-#            less its workspace.yml's opt-out: paths) and remove those it inherited from the main it
-#            last merged but no longer does (a "delphi: sync inherited" commit), list main's default plugin sets
-#            above it under its workspace.yml's plugins: and regenerate its .claude/settings.json from
-#            that (ci/plugins.sh; a "delphi: generate" commit if that changed either), and push if the
-#            tree changed. While ws/<old> (the branch's name when workspaces were named by their
-#            folder's path, software/application-software/argos/argos-dev) is ahead of ws/<name> or
-#            ws/<name> is missing, it starts from ws/<old> (so its history and unproposed edits carry
-#            over) and pushes the result to both, so clones still on ws/<old> get the version that
-#            moves them. A missing ws/<name> with no ws/<old> is created as one commit: tree = the
-#            folder plus main's .delphi/ and inherited files, parent = main.
-#   propose: build propose/<name> = main + a subtree merge of ws/<name> without <folder>/.delphi/
-#            or its inherited files (both managed on main); if that changes main and isn't already on propose/<name>, check it (against main),
-#            force-push it, and open or update its PR.
-# A conflict is reported with its files and that workspace skipped; exits 1 if any failed. ws/*
-# branches without a folder, old names included, get a notice, never deleted. Merges run in a temporary worktree.
+# ci/sync.sh [refresh|propose] [<name>]: subtree-sync native workspace folders on main with ws/<name>.
+# Inherited native output is staged from main's sources and kept only on workspace branches.
+# Subtree merges carry owned files; proposals exclude inherited copies and their ownership ledger.
+# Temporary worktrees keep the caller untouched. Conflicts in workspace-owned files are reported.
 set -euo pipefail
 here=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=ci/managed.sh
+source "$here/managed.sh"
+# shellcheck source=ci/harnesses.sh
+source "$here/harnesses.sh"
 dir=both
 case "${1:-}" in refresh | propose) dir=$1 && shift ;; esac
 only=${1:-}
@@ -33,64 +18,324 @@ case "$only" in *[!a-z0-9.-]*) echo "usage: ci/sync.sh [refresh|propose] [<name>
 git fetch --quiet --prune origin
 main=$(git rev-parse origin/main)
 wt=$(mktemp -d)
-mw=$(mktemp -d) # main, for ci/plugins.sh to read the plugin sets from
+cache=$(mktemp -d)
 git worktree add --quiet --detach "$wt" "$main"
-git worktree add --quiet --detach "$mw" "$main"
-trap 'git worktree remove --force "$wt"; git worktree remove --force "$mw"; rm -f "$wt.yml" "$wt.settings" "$wt.err"' EXIT
+trap 'git worktree remove --force "$wt"; rm -f "$wt.index"; rm -rf "$cache"' EXIT
 failed=0 names=" "
 tree() { git -C "$wt" rev-parse --quiet --verify "$1^{tree}" || true; } # empty if <rev> is missing
+file_entry() { git ls-tree "$1" -- "$2" | awk '$1 == "100644" || $1 == "100755" { print $1 " " $3 }'; }
 
 with_delphi() { # <commit> [<folder>/]: its tree with <folder>/.delphi/ dropped, or (no folder) its
   # .delphi/ replaced by main's. Built in a temporary index, so the worktree is untouched.
   local i=$wt.index
-  rm -f "$i"
-  GIT_INDEX_FILE=$i git read-tree "$1"
-  GIT_INDEX_FILE=$i git rm -rqf --cached --ignore-unmatch -- "${2:-}.delphi" >/dev/null
+  rm -f "$i" || return 1
+  GIT_INDEX_FILE=$i git read-tree "$1" || return 1
+  GIT_INDEX_FILE=$i git rm -rqf --cached --ignore-unmatch -- "${2:-}.delphi" >/dev/null || return 1
   [ -n "${2:-}" ] || ! git rev-parse -q --verify "$main:.delphi" >/dev/null ||
-    GIT_INDEX_FILE=$i git read-tree --prefix=.delphi/ "$main:.delphi"
-  GIT_INDEX_FILE=$i git write-tree
+    GIT_INDEX_FILE=$i git read-tree --prefix=.delphi/ "$main:.delphi" || return 1
+  GIT_INDEX_FILE=$i git write-tree || return 1
   rm -f "$i"
 }
 
-optouts() { # <rev:path of a workspace.yml>: its opt-out: entries, space-separated
-  git show "$1" 2>/dev/null | awk '/^opt-out:/ { s = 1; next } /^[^[:space:]#]/ { s = 0 }
-    s && /^[[:space:]]+-[[:space:]]+/ { sub(/^[[:space:]]+-[[:space:]]+/, ""); sub(/[[:space:]]*#.*$/, ""); sub(/\/$/, ""); printf "%s ", $0 }'
+source_checkout() { # <main revision>: extract immutable sources once, outside the merge worktree
+  local source=$cache/$1/source
+  if [ ! -f "$cache/$1/source-ready" ]; then
+    mkdir -p "$source" || return 1
+    git archive "$1" | tar -x -C "$source" || return 1
+    : >"$cache/$1/source-ready" || return 1
+  fi
+  printf '%s\n' "$source"
 }
 
-inherited() { # <rev> <folder> <opt-outs>: `<mode> <blob><TAB><path>` for each file the workspace at
-  # <folder> inherits from <rev>'s workspace-inherit/ folders, top first, less <opt-outs> (a folder covers what's under it)
-  local level
-  for level in $(echo "${2%/workspaces/*}" | awk -F/ '{ p = $1; print p; for (i = 2; i <= NF; i++) { p = p "/" $i; print p } }'); do
-    git ls-tree -r "$1:$level/workspace-inherit" 2>/dev/null || true
-  done | awk -F'\t' -v out="$3" 'BEGIN { n = split(out, o, " ") }
-    { for (i = 1; i <= n; i++) if ($2 == o[i] || index($2, o[i] "/") == 1) next
-      split($1, m, " "); print m[1] " " m[3] "\t" $2 }'
+staged() { # <main revision> <folder>: trusted native output, including historical pre-staging main
+  local source target=$cache/$1/native/$2 renderer records meta path src ready=$cache/status/main/$1/$2
+  if [ ! -f "$ready" ]; then
+    source=$(source_checkout "$1") || return 1
+    mkdir -p "$target" || return 1
+    if git cat-file -e "$1:$2/$generated" 2>/dev/null; then
+      records=$(ledger "$1:$2/$generated") || return 1
+      while IFS=$'\t' read -r meta path src; do
+        [ -n "$path" ] || continue
+        [ "$(file_entry "$1" "$2/$path")" = "$meta" ] || { echo "sync: invalid historical managed output $2/$path" >&2; return 1; }
+        mkdir -p "$(dirname "$target/$path")" || return 1
+        git show "$1:$2/$path" >"$target/$path" || return 1
+        [ "${meta%% *}" != 100755 ] || chmod +x "$target/$path" || return 1
+      done <<<"$records"
+      { ledger_header; printf '%s\n' "$records"; } >"$target/$generated" || return 1
+    else
+      renderer=$here/render.sh
+      if [ -f "$source/ci/render.sh" ] && grep -q -- '--workspace' "$source/ci/render.sh"; then renderer=$source/ci/render.sh; fi
+      if [ ! -f "$source/ci/render.sh" ] && ! grep -q '^harness:' "$source/$2/workspace.yml"; then
+        printf '\nharness: claude-code\n' >>"$source/$2/workspace.yml" || return 1
+      fi
+      bash "$renderer" --workspace "$2" "$source" "$cache/$1/native" >&2 || return 1
+    fi
+    mkdir -p "$(dirname "$ready")" || return 1
+    : >"$ready" || return 1
+  fi
+  printf '%s\n' "$target"
 }
 
-with_inherited() { # <tree-ish> <folder> <old main or ''> <rev:path of its workspace.yml> [<prefix>/]: without
-  # <prefix>, its tree with what the workspace inherits from main written over it, and what it
-  # inherited from <old> but no longer does removed; with <prefix> (a proposal), those paths under
-  # <prefix> put back to main's. Opt-outs come from that workspace.yml.
-  local i=$wt.index out now p ms pre=${5:-}
-  out=$(optouts "$4")
-  now=$(inherited "$main" "$2" "$out")
-  rm -f "$i"
-  GIT_INDEX_FILE=$i git read-tree "$1"
-  { [ -z "$3" ] || inherited "$3" "$2" "$out"; [ -z "$pre" ] || printf '%s\n' "$now"; } | cut -f2 | sort -u |
-    while IFS= read -r p; do
-      [ -z "$p" ] && continue
-      [ -n "$pre" ] || ! printf '%s\n' "$now" | cut -f2 | grep -qxF "$p" || continue # still inherited: written below
-      GIT_INDEX_FILE=$i git rm -qf --cached --ignore-unmatch -- "$pre$p" >/dev/null
-      [ -z "$pre" ] || { ms=$(git ls-tree "$main" -- "$pre$p" | cut -f1) && [ -z "$ms" ]; } ||
-        GIT_INDEX_FILE=$i git update-index --add --cacheinfo "${ms%% *},${ms##* },$pre$p"
+previous_main() { # <workspace commit>: newest source-shaped main ancestor, never a workspace merge-base
+  local commit result last revision=""
+  commit=$(git rev-parse "$1^{commit}") || return 1
+  result=$cache/previous-main/$commit
+  if [ ! -f "$result" ]; then
+    last=$(git rev-list --first-parent "$main" --not "$commit" | tail -n 1) || return 1
+    if [ -z "$last" ]; then revision=$main
+    else revision=$(git rev-parse --verify "$last^1" 2>/dev/null || true); fi
+    if [ -n "$revision" ]; then git merge-base --is-ancestor "$revision" "$commit" || return 1; fi
+    mkdir -p "$(dirname "$result")" || return 1
+    printf '%s\n' "$revision" >"$result" || return 1
+  fi
+  cat "$result"
+}
+
+workspace_names() { # <main revision>: names remain stable when folders move under unchanged short names
+  local result=$cache/names/$1
+  if [ ! -f "$result" ]; then
+    mkdir -p "$(dirname "$result")" || return 1
+    bash "$here/../.delphi/names.sh" "$1" >"$result.tmp" || return 1
+    mv "$result.tmp" "$result" || return 1
+  fi
+  cat "$result"
+}
+
+historical_folder() { # <old main revision> <current folder>: resolve the same logical workspace on old main
+  local name
+  name=$(workspace_names "$main" | awk -v folder="$2" '$2 == folder { print $1; exit }') || return 1
+  workspace_names "$1" | awk -v name="$name" '$1 == name { print $2; exit }'
+}
+
+aligned_refs() { # <workspace commit> <current folder> <ownership commit>: align a moved subtree's merge base
+  local base old common folder fragment i=$wt.index aligned ws incoming t
+  base=$(previous_main "$3") || return 1
+  old=""
+  [ -z "$base" ] || old=$(historical_folder "$base" "$2") || return 1
+  if [ -z "$old" ] || [ "$old" = "$2" ]; then printf '%s %s\n' "$1" "$main"; return; fi
+  common=$(git merge-base --all "$1" "$main") || return 1
+  case "$common" in *$'\n'*) echo "sync: $2: CONFLICT: moved workspace has multiple merge bases; resolve the folder move in a workspace PR" >&2; return 1 ;; esac
+  if git cat-file -e "$common:workspace.yml" 2>/dev/null; then fragment=$(tree "$common")
+  else
+    folder=$(historical_folder "$common" "$2") || return 1
+    [ -n "$folder" ] || return 1
+    fragment=$(git rev-parse --verify "$common:$folder") || return 1
+  fi
+  [ -n "$fragment" ] || return 1
+  rm -f "$i" || return 1
+  GIT_INDEX_FILE=$i git read-tree "$base" || return 1
+  GIT_INDEX_FILE=$i git rm -rqf --cached --ignore-unmatch -- "$old" "$2" >/dev/null || return 1
+  GIT_INDEX_FILE=$i git read-tree --prefix="$2/" "$fragment" || return 1
+  t=$(GIT_INDEX_FILE=$i git write-tree) || return 1
+  rm -f "$i" || return 1
+  # A shared virtual base corrects Git's prefix alignment without changing either owned file tree.
+  aligned=$(git commit-tree -p "$common" -m "delphi: align moved workspace base" "$t") || return 1
+  ws=$(git commit-tree -p "$1" -p "$aligned" -m "delphi: align workspace merge" "$(tree "$1")") || return 1
+  incoming=$(git commit-tree -p "$main" -p "$aligned" -m "delphi: align main merge" "$(tree "$main")") || return 1
+  printf '%s %s\n' "$ws" "$incoming"
+}
+
+previous_records() { # <workspace commit> <folder>: cache reconstructed records, including an empty ownership set
+  local commit result
+  commit=$(git rev-parse "$1^{commit}") || return 1
+  result=$cache/records/$commit/$2
+  if [ ! -f "$result" ]; then
+    mkdir -p "$(dirname "$result")" || return 1
+    reconstruct_records "$commit" "$2" >"$result.tmp" || { rm -f "$result.tmp"; return 1; }
+    mv "$result.tmp" "$result" || return 1
+  fi
+  cat "$result"
+}
+
+reconstruct_records() { # <workspace commit> <folder>: only trusted main sources supply native hashes and modes
+  local base folder native recipe
+  recipe=$(git log --first-parent -1 --format=%H "$1" -- "$generated") || return 1
+  recipe=${recipe:-$1}
+  base=$(previous_main "$recipe") || return 1
+  [ -n "$base" ] || return 0
+  folder=$(historical_folder "$base" "$2") || return 1
+  [ -n "$folder" ] || return 0
+  if ! git cat-file -e "$recipe:$generated" 2>/dev/null || git cat-file -e "$base:$folder/$generated" 2>/dev/null; then
+    native=$(staged "$base" "$folder") || return 1
+    generated_records <"$native/$generated"
+    return
+  fi
+  native=$(stage_inheritance "$base" "$folder" "$recipe") || return 1
+  generated_records <"$native/$generated"
+}
+
+stage_inheritance() { # <source revision> <folder> <workspace commit>: render its manifest with trusted source-side code
+  local source original renderer manifest target ready
+  manifest=$(git rev-parse "$3:workspace.yml") || return 1
+  if [ "$manifest" = "$(git rev-parse "$1:$2/workspace.yml" 2>/dev/null || true)" ]; then staged "$1" "$2"; return; fi
+  target=$cache/recipe/$1/$manifest/native/$2 ready=$cache/status/recipe/$1/$manifest/$2
+  if [ ! -f "$ready" ]; then
+    original=$(source_checkout "$1") || return 1
+    source=$cache/recipe/$1/$manifest/source
+    mkdir -p "$source" || return 1
+    cp -R "$original/." "$source/" || return 1
+    rm -rf "${source:?}/$2" || return 1
+    mkdir -p "$source/$2" || return 1
+    git show "$3:workspace.yml" >"$source/$2/workspace.yml" || return 1
+    renderer=$here/render.sh
+    if [ -f "$source/ci/render.sh" ] && grep -q -- '--workspace' "$source/ci/render.sh"; then renderer=$source/ci/render.sh; fi
+    bash "$renderer" --workspace "$2" "$source" "$cache/recipe/$1/$manifest/native" >&2 || return 1
+    mkdir -p "$(dirname "$ready")" || return 1
+    : >"$ready" || return 1
+  fi
+  printf '%s\n' "$target"
+}
+
+legacy_workspace() { # pre-ledger workspaces alone may adopt copies proven by source provenance
+  local base
+  git cat-file -e "$1:$generated" 2>/dev/null && return 1
+  base=$(previous_main "$1") || return 1
+  [ -n "$base" ] && ! git cat-file -e "$base:ci/render.sh" 2>/dev/null
+}
+
+managed_records() { # <workspace commit> <folder>: trusted previous ownership, restricted by branch ownership
+  local old trusted meta path src
+  old=$(ledger "$1:$generated") || return 1
+  trusted=$(previous_records "$1" "$2") || return 1
+  if legacy_workspace "$1"; then
+    while IFS=$'\t' read -r meta path src; do
+      [ -n "$path" ] || continue
+      [ "$(file_entry "$1" "$path")" != "$meta" ] || printf '%s\t%s\t%s\n' "$meta" "$path" "$src"
+    done <<<"$trusted"
+    return
+  fi
+  # Dropping an entry after an opt-out records the ownership transfer, even before its proposal merges.
+  printf '%s\n' "$old" | awk -F'\t' -v trusted="$trusted" 'BEGIN {
+    n = split(trusted, rows, "\n"); for (i = 1; i <= n; i++) { split(rows[i], f, "\t"); owned[f[2]] = rows[i] }
+  } $2 in owned { print owned[$2] }'
+}
+
+apply_inheritance() { # <merged workspace> <folder> <original workspace> <native stage>: validate ownership, apply prepared bytes
+  local i=$wt.index now old out meta path src entry blob base="" legacy=0 branch_entry child parent paths native owner=$3 trusted folder
+  native=$4
+  now=$(generated_records <"$native/$generated") || return 1
+  old=$(managed_records "$owner" "$2") || return 1
+  trusted=$(previous_records "$owner" "$2") || return 1
+  out=$(git show "$1:workspace.yml" | optouts) || return 1
+  # A branch's ledger cannot authorize removal of a file outside trusted prior output.
+  while IFS=$'\t' read -r meta path src; do
+    [ -z "$path" ] || recorded "$path" "$trusted" || {
+      echo "sync: $2: CONFLICT: untrusted managed path $path in $generated" >&2; return 1;
+    }
+  done <<<"$(ledger "$owner:$generated")"
+  if legacy_workspace "$owner"; then
+    legacy=1
+    base=$(previous_main "$owner") || return 1
+    folder=$(historical_folder "$base" "$2") || return 1
+  fi
+  while IFS=$'\t' read -r meta path src; do
+    [ -n "$path" ] || continue
+    opted_out "$path" "$out" && continue
+    while IFS=$'\t' read -r branch_entry child; do
+      [ -n "$child" ] || continue
+      if recorded "$child" "$old" && ! opted_out "$child" "$out"; then continue; fi
+      ! settings_source "$src" || [ "$child" != "$path" ] || continue
+      branch_entry="${branch_entry%% *} ${branch_entry##* }"
+      # Pre-ledger clones can adopt copies proven by reviewed output or previous main provenance.
+      if [ "$legacy" = 1 ] && [ "$child" = "$path" ] && { [ "$branch_entry" = "$meta" ] ||
+        [ "$branch_entry" = "$(printf '%s\n' "$trusted" | awk -F'\t' -v p="$path" '$2 == p { print $1; exit }')" ] ||
+        [ "$branch_entry" = "$(file_entry "$base" "$src")" ] ||
+        [ "$branch_entry" = "$(file_entry "$base" "$folder/$path")" ]; }; then continue; fi
+      echo "sync: $2: CONFLICT: workspace-owned $child collides with managed output $path; opt out or resolve it in a workspace PR" >&2
+      return 1
+    done < <(git ls-tree -r "$1" -- "$path")
+    parent=$(dirname "$path")
+    while [ "$parent" != . ]; do
+      branch_entry=$(git ls-tree "$1" -- "$parent" | awk '$1 != "040000" { print $1 " " $3 }')
+      if [ -n "$branch_entry" ] && { ! recorded "$parent" "$old" || opted_out "$parent" "$out"; }; then
+        echo "sync: $2: CONFLICT: workspace-owned $parent collides with managed output $path; opt out or resolve it in a workspace PR" >&2
+        return 1
+      fi
+      parent=$(dirname "$parent")
     done
-  [ -n "$pre" ] || printf '%s\n' "$now" | while IFS=$'\t' read -r ms p; do
-    [ -z "$p" ] || GIT_INDEX_FILE=$i git update-index --add --cacheinfo "${ms% *},${ms#* },$p"
-  done
-  GIT_INDEX_FILE=$i git write-tree
+  done <<<"$now"
+  while IFS=$'\t' read -r meta path src; do
+    [ -n "$path" ] || continue
+    opted_out "$path" "$out" && continue
+    recorded "$path" "$now" && continue
+    settings_source "$src" && continue
+    branch_entry=$(git ls-tree "$owner" -- "$path" | awk '$1 != "040000" { print $1 " " $3 }')
+    if [ -n "$branch_entry" ] && [ "$branch_entry" != "$meta" ]; then
+      echo "sync: $2: CONFLICT: retired managed $path has local edits; preserve it at another path or resolve it explicitly in a workspace PR" >&2
+      return 1
+    fi
+  done <<<"$old"
+  rm -f "$i" || return 1
+  GIT_INDEX_FILE=$i git read-tree "$1" || return 1
+  paths=$(printf '%s\n%s\n' "$old" "$now" | cut -f2 | LC_ALL=C sort -u) || return 1
+  while IFS= read -r path; do
+    [ -n "$path" ] || continue
+    opted_out "$path" "$out" && continue
+    # A retired inherited path may now hold a reviewed, workspace-owned file on main.
+    if ! recorded "$path" "$now" && [ -n "$(file_entry "$main" "$2/$path")" ]; then
+      src=$(printf '%s\n' "$old" | awk -F'\t' -v p="$path" '$2 == p { print $3; exit }')
+      settings_source "$src" || continue
+    fi
+    GIT_INDEX_FILE=$i git update-index --force-remove -- "$path" || return 1
+  done <<<"$paths"
+  while IFS=$'\t' read -r meta path src; do
+    [ -n "$path" ] || continue
+    opted_out "$path" "$out" && continue
+    entry=$native/$path
+    blob=$(git hash-object -w -- "$entry") || return 1
+    [ "$blob" = "${meta#* }" ] || { echo "sync: staged hash mismatch for $path" >&2; return 1; }
+    GIT_INDEX_FILE=$i git update-index --add --cacheinfo "${meta%% *},$blob,$path" || return 1
+  done <<<"$now"
+  blob=$({ ledger_header
+    while IFS=$'\t' read -r meta path src; do
+      [ -n "$path" ] || continue
+      opted_out "$path" "$out" || printf '%s\t%s\t%s\n' "$meta" "$path" "$src"
+    done <<<"$now"
+  } | git hash-object -w --stdin) || return 1
+  GIT_INDEX_FILE=$i git update-index --add --cacheinfo "100644,$blob,$generated" || return 1
+  GIT_INDEX_FILE=$i git write-tree || return 1
+  rm -f "$i"
+}
+
+without_generated() { # <normalized workspace commit>: leave owned payloads and native settings for a proposal
+  local i=$wt.index records meta path src
+  records=$(ledger "$1:$generated") || return 1
+  rm -f "$i" || return 1
+  GIT_INDEX_FILE=$i git read-tree "$1" || return 1
+  while IFS=$'\t' read -r meta path src; do
+    [ -n "$path" ] || continue
+    ! settings_source "$src" || continue
+    GIT_INDEX_FILE=$i git update-index --force-remove -- "$path" || return 1
+  done <<<"$records"
+  GIT_INDEX_FILE=$i git update-index --force-remove -- "$generated" || return 1
+  GIT_INDEX_FILE=$i git write-tree || return 1
   rm -f "$i"
 }
 
+resolve_managed_conflicts() { # <original workspace> <folder> <prefix>: defer only managed-file conflicts; validate after rendering
+  local records out paths path relative entry target
+  records=$(ledger "$1:$generated") || return 1
+  out="$(git show "$1:workspace.yml" | optouts) $(git show "$main:$2/workspace.yml" | optouts)"
+  paths=" $(printf '%s\n' "$records" | cut -f2 | tr '\n' ' ') $generated "
+  for target in $(harnesses); do paths="$paths$(harness_field "$target" settings_file) "; done
+  while IFS= read -r path; do
+    relative=${path#"$3"}
+    [ "$path" = "$3$relative" ] || continue
+    case "$paths" in *" $relative "*) ;; *) continue ;; esac
+    opted_out "$relative" "$out" && continue
+    git -C "$wt" update-index --force-remove -- "$path" || return 1
+    entry=""
+    if [ "$relative" = "$generated" ]; then :
+    else
+      entry=$(file_entry "$main" "$2/$relative")
+    fi
+    [ -z "$entry" ] || git -C "$wt" update-index --add --cacheinfo "${entry%% *},${entry##* },$path" || return 1
+  done < <(git -C "$wt" diff --name-only --diff-filter=U)
+  [ -z "$(git -C "$wt" diff --name-only --diff-filter=U)" ] || return 1
+  git -C "$wt" commit --quiet --no-edit || return 1
+  git -C "$wt" reset --quiet --hard HEAD || return 1
+}
+
 conflict() { # <message>: report the conflicted files, abort the merge, skip this workspace
   echo "$1 Files:" >&2
   git -C "$wt" diff --name-only --diff-filter=U | sed 's/^/  /' >&2
@@ -105,65 +350,90 @@ refresh() { # <name> <folder> <old name>: leave the worktree at ws/<name> with m
     from=$was # its old name is ahead: carry that over
   fi
   if [ -z "$(tree "$from")" ]; then
+    local initial native
+    initial=$(with_delphi "$main:$2") || { failed=1 ok=0; return; }
+    initial=$(git commit-tree -p "$main" -m "delphi: prepare ws/$1" "$initial") || { failed=1 ok=0; return; }
+    native=$(staged "$main" "$2") || { failed=1 ok=0; return; }
+    initial=$(apply_inheritance "$initial" "$2" "$initial" "$native") || { failed=1 ok=0; return; }
     git -C "$wt" checkout --quiet --detach \
-      "$(git commit-tree -p "$main" -m "delphi: create ws/$1 from $2" "$(with_inherited "$(with_delphi "$main:$2")" "$2" "" "$main:$2/workspace.yml")")"
-    git -C "$wt" push --quiet origin "HEAD:refs/heads/ws/$1"
+      "$(git commit-tree -p "$main" -m "delphi: create ws/$1 from $2" "$initial")" || { failed=1 ok=0; return; }
+    git -C "$wt" push --quiet origin "HEAD:refs/heads/ws/$1" || { failed=1 ok=0; return; }
     echo "ws/$1: created from $2"
     return
   fi
-  git -C "$wt" checkout --quiet --detach "$from"
-  local old head t
-  old=$(git merge-base "$from" "$main" || true) # the main it last merged: what it inherited then
-  # --no-ff: once ws commits are in main, a fast-forward would put main's whole tree on ws/<name>.
-  if ! git -C "$wt" merge --quiet --no-ff -Xsubtree="$2" -m "delphi: refresh ws/$1 from main" "$main" >/dev/null; then
-    conflict "ws/$1: CONFLICT refreshing from main; merge main into ws/$1 in a PR (see README)."
-    return
+  local head t ws native alignment incoming
+  ws=$from
+  alignment=$(aligned_refs "$ws" "$2" "$from") || { failed=1 ok=0; return; }
+  ws=${alignment%% *} incoming=${alignment#* }
+  git -C "$wt" checkout --quiet --detach "$ws"
+  if ! git -C "$wt" merge --quiet --no-ff -Xsubtree="$2" -m "delphi: refresh ws/$1 from main" "$incoming" >/dev/null; then
+    if ! resolve_managed_conflicts "$from" "$2" ""; then
+      conflict "ws/$1: CONFLICT refreshing from main; merge main into ws/$1 in a PR (see README)."
+      return
+    fi
   fi
-  head=$(git -C "$wt" rev-parse HEAD) && t=$(with_delphi "$head")
+  head=$(git -C "$wt" rev-parse HEAD)
+  native=$(stage_inheritance "$main" "$2" "$head") || { failed=1 ok=0; return; }
+  t=$(apply_inheritance "$head" "$2" "$from" "$native") || { failed=1 ok=0; return; }
   if [ "$t" != "$(tree "$head")" ]; then
-    git -C "$wt" checkout --quiet --detach "$(git commit-tree -p "$head" -m "delphi: sync .delphi/ from main" "$t")"
+    head=$(git commit-tree -p "$head" -m "delphi: sync generated files from main" "$t")
+    git -C "$wt" checkout --quiet --detach "$head"
   fi
-  head=$(git -C "$wt" rev-parse HEAD) && t=$(with_inherited "$head" "$2" "$old" "$head:workspace.yml")
+  t=$(with_delphi "$head")
   if [ "$t" != "$(tree "$head")" ]; then
-    git -C "$wt" checkout --quiet --detach "$(git commit-tree -p "$head" -m "delphi: sync inherited files from main" "$t")"
+    git -C "$wt" checkout --quiet --detach "$(git commit-tree -p "$head" -m "delphi: sync .delphi/ from main" "$t")"
   fi
-  if [ "$(awk '/^harness:/ { print $2; exit }' "$wt/workspace.yml")" = claude-code ]; then
-    if ! (cd "$mw" && bash "$here/plugins.sh" yml "$2" "$wt/workspace.yml" >"$wt.yml" &&
-      bash "$here/plugins.sh" settings "$2" "$wt.yml" >"$wt.settings") 2>"$wt.err"; then
-      echo "ws/$1: $(cat "$wt.err"); not refreshed" >&2
-      failed=1 ok=0
-      return
-    fi
-    cp "$wt.yml" "$wt/workspace.yml" && mkdir -p "$wt/.claude" && cp "$wt.settings" "$wt/.claude/settings.json"
-    if [ -n "$(git -C "$wt" status --porcelain -- workspace.yml .claude/settings.json)" ]; then
-      git -C "$wt" add workspace.yml .claude/settings.json
-      git -C "$wt" commit --quiet -m "delphi: generate plugins: defaults and .claude/settings.json"
-    fi
+  # The tree includes the ownership ledger, so changed provenance and opt-out transfers still advance the branch.
+  if [ "$(tree HEAD)" = "$(tree "$from")" ]; then
+    git -C "$wt" checkout --quiet --detach "$from"
+  else
+    # Publish one real merge; preparation and prefix-alignment commits stay temporary.
+    t=$(tree HEAD)
+    git -C "$wt" checkout --quiet --detach "$(git commit-tree -p "$from" -p "$main" -m "delphi: refresh ws/$1 from main" "$t")"
   fi
-  if [ "$from" = "$was" ]; then
+  if [ "$from" != "refs/remotes/origin/ws/$1" ]; then
     git -C "$wt" push --quiet origin "HEAD:refs/heads/ws/$1" "HEAD:refs/heads/ws/$3"
     echo "ws/$1: from ws/$3, its old name (pushed to both)"
-  elif [ "$(tree HEAD)" != "$(tree "$ws")" ]; then
+  elif [ "$(git -C "$wt" rev-parse HEAD)" != "$(git rev-parse "refs/remotes/origin/ws/$1")" ]; then
     git -C "$wt" push --quiet origin "HEAD:refs/heads/ws/$1"
     echo "ws/$1: refreshed"
   fi
 }
 
-propose() { # <name> <folder>: PR the worktree's ws/<name> into main if it changes anything
-  local ws title="ws/$1 → main" body pr
+propose() { # <name> <folder>: PR owned workspace files into main, leaving inherited output on ws/*
+  local ws owner title="ws/$1 → main" body pr
   ws=$(git -C "$wt" rev-parse HEAD)
-  git -C "$wt" checkout --quiet --detach "$main"
+  owner=$ws
+  local t alignment incoming candidate native normalized
+  alignment=$(aligned_refs "$ws" "$2" "$owner") || { failed=1 ok=0; return; }
+  ws=${alignment%% *} incoming=${alignment#* }
+  git -C "$wt" checkout --quiet --detach "$incoming"
   if ! git -C "$wt" merge --quiet --no-ff -Xsubtree="$2" -m "delphi: propose ws/$1 to main" "$ws" >/dev/null; then
-    conflict "ws/$1: CONFLICT proposing to main; merge main into ws/$1 in a PR (see README)."
-    return
+    if ! resolve_managed_conflicts "$owner" "$2" "$2/"; then
+      conflict "ws/$1: CONFLICT proposing to main; merge main into ws/$1 in a PR (see README)."
+      return
+    fi
+  fi
+  candidate=$(git -C "$wt" rev-parse "HEAD:$2")
+  candidate=$(git commit-tree -p "$owner" -m "delphi: prepare proposal ownership" "$candidate")
+  native=$(stage_inheritance "$main" "$2" "$candidate") || { failed=1 ok=0; return; }
+  t=$(apply_inheritance "$candidate" "$2" "$owner" "$native") || { failed=1 ok=0; return; }
+  normalized=$(git commit-tree -p "$owner" -m "delphi: prepare proposal files" "$t")
+  t=$(without_generated "$normalized") || { failed=1 ok=0; return; }
+  git -C "$wt" rm -rq -- "$2"
+  git -C "$wt" read-tree --prefix="$2/" -u "$t"
+  git -C "$wt" rm -rq --ignore-unmatch -- "$2/.delphi"
+  t=$(git -C "$wt" write-tree)
+  git -C "$wt" checkout --quiet --detach "$(git commit-tree -p "$main" -p "$owner" -m "delphi: prepare main candidate" "$t")"
+  if ! bash "$wt/ci/render.sh" "$wt"; then
+    echo "ws/$1: main-side rendering failed; not proposed" >&2
+    failed=1; return
   fi
-  local t
-  t=$(with_delphi "$(git -C "$wt" rev-parse HEAD)" "$2/") # .delphi/ and inherited files are managed on main, never proposed
-  t=$(with_inherited "$t" "$2" "$(git merge-base "$ws" "$main" || true)" "$ws:workspace.yml" "$2/")
-  [ "$t" = "$(tree HEAD)" ] ||
-    git -C "$wt" checkout --quiet --detach "$(git commit-tree -p "$main" -p "$ws" -m "delphi: propose ws/$1 to main" "$t")"
+  git -C "$wt" add -A
+  t=$(git -C "$wt" write-tree)
+  git -C "$wt" checkout --quiet --detach "$(git commit-tree -p "$main" -p "$owner" -m "delphi: propose ws/$1 to main" "$t")"
   case "$(tree HEAD)" in "$(tree "$main")" | "$(tree "refs/remotes/origin/propose/$1")") return ;; esac
-  "$wt/ci/check.sh" "$wt" "$main" || { echo "ws/$1: check failed; not proposed" >&2 && failed=1 && return; }
+  "$wt/ci/check.sh" "$wt" "$main" || { echo "ws/$1: check failed; not proposed" >&2; failed=1; return; }
   git -C "$wt" push --quiet --force origin "HEAD:refs/heads/propose/$1"
   body="## Changes
 
@@ -200,7 +470,7 @@ while read -r name folder; do
     git -C "$wt" checkout --quiet --detach "refs/remotes/origin/ws/$name" # propose ws/<name> as is
   else ok=0; fi
   if [ "$ok" = 1 ] && [ "$dir" != refresh ]; then propose "$name" "$folder"; fi
-done < <(bash "$here/../.delphi/names.sh" "$main")
+done < <(workspace_names "$main")
 
 [ -z "$only" ] || case "$names" in *" $only "*) ;; *) echo "no workspace '$only' on main" >&2 && exit 1 ;; esac
 for b in $(git for-each-ref --format='%(refname:lstrip=3)' refs/remotes/origin/ws/); do
diff --git a/docs/design.md b/docs/design.md
index e321a2c..40f6479 100644
--- a/docs/design.md
+++ b/docs/design.md
@@ -4,8 +4,8 @@ Goals: `docs/goals.md`. No CLI: plain git plus a few shell scripts run by GitHub
 
 ## 1. Model
 
-`main` holds every workspace as a folder, `software/**/workspaces/<leaf>/`, with its files at their
-normal harness paths (`CLAUDE.md`, `.claude/…`, `docs/…`). A workspace's `<name>` is the short name
+`main` holds each workspace's owned files in `software/**/workspaces/<leaf>/`, at their native
+harness paths (declared in `ci/harnesses/<name>.sh`). A workspace's `<name>` is the short name
 of each folder from `software/` down to its project folder, then `<leaf>`, joined by dots
 (`s.app.argos.argos-dev` for `software/application-software/argos/workspaces/argos-dev`). A folder's
 short name is the one line in its `short-name` file, else its own name; `.delphi/names.sh [<rev>]`
@@ -16,11 +16,11 @@ folder name (`workspaces/<name>`, `.delphi/parked/<name>`), and no branch can be
 merges (`git merge -Xsubtree=<folder>`), so the histories stay joined and edits on either side meet
 in normal three-way merges. The one thing shared is main's root `.delphi/` (the scripts): sync
 puts it at the root of every `ws/*` branch, so it is on every branch, main included, and is edited
-only on main. Likewise each `workspace-inherit/` folder: sync writes its files onto the `ws/*`
-root of every workspace below its folder and never proposes them back. Otherwise nothing is shared
-or generated between workspaces: a project's `workspace-defaults/` is copied once at creation, `workspaces:` only checks out other branches to read, and
-harness plugins (section 2) carry what workspaces opt into. The one generated workspace file is
-`.claude/settings.json`.
+only on main. Shared context lives once in canonical sources on main. CI prepares inherited native
+files in temporary staging; refresh adds them only to `ws/*`. Each workspace explicitly selects
+its `harness:`, independently of a source bundle's `format:`. A project's `workspace-defaults/`
+seeds owned files once at creation. Proposals return owned changes and omit managed inheritance.
+`workspaces:` checks out other branches to read, and harness plugins carry optional capabilities.
 
 ```
    ┌───────────────────────────────┐
@@ -51,20 +51,24 @@ harness plugins (section 2) carry what workspaces opt into. The one generated wo
 ## 2. Repository (main)
 
 ```
-software/<org>/…/<project>/           README.md  AUTHORING.md  workspace-defaults/   (optional, main only)
-software/[<org>/…/]workspace-inherit/  files every workspace below gets on its ws/* root (optional, main only)
+software/<org>/…/<project>/           project context and optional workspace-defaults/ source bundle
+software/[<org>/…/]workspace-inherit/  existing native sources, including .claude/skills/<name>/
 software/<org>/…/plugins/<harness>/<set>/   a plugin set for the workspaces under that folder (optional, main only)
 software/<org>/…/short-name           the folder's short name in workspace names (optional; default: its name)
 software/<org>/…/plugins/scope        its scope in plugin names (optional; default: its short name)
 .claude-plugin/marketplace.json       every Claude Code plugin set under software/ (generated)
-software/<org>/…/workspaces/<leaf>/   workspace.yml  CLAUDE.md  .claude/…  docs/…
-                                      .github/workflows/delphi.yml  .gitattributes
+software/<org>/…/workspaces/<leaf>/   workspace.yml and owned native files; no inherited copies or ledger
 .delphi/                              {setup,new-worktree,switch,park,plugins,version}.sh  manifest.yml  versions
                                       migrations/  .gitattributes  .gitignore: on every ws/* root
 ci/sync.sh  ci/check.sh               CI scripts
+ci/harnesses/                        one native contract per registered target or source format
+ci/harnesses.sh  ci/sources.sh       registry queries and independent source reader
+ci/inherit.sh  ci/render.sh          source resolution and temporary native staging
+ci/managed.sh                        ownership records; shared with branch sync
 ci/plugins.sh                         writes the marketplace and each workspace's .claude/settings.json
 tools/new-workspace.sh                new workspace as a PR
-templates/workspace/                  what new-workspace copies
+templates/workspace/                  common workspace template
+templates/harnesses/                  other adapters' native instruction templates
 .github/workflows/delphi.yml          CI
 tests/e2e.sh                          sandbox test of all of the above
 ```
@@ -82,32 +86,102 @@ workspace folder (nor the template) has a `.delphi/` of its own. Each manifest f
 clones.
 `.github/CODEOWNERS` assigns reviewers per org folder.
 
-The folder holding a `workspaces/` directory is a project folder. It may hold shared context
-(`README.md`), a guide to its workspaces (`AUTHORING.md`), and `workspace-defaults/`: files a new
-workspace directly in its `workspaces/` starts with, copied once and then its own. These live only on
-`main`; workspaces read them by listing `main` under `workspaces:`. A `workspace-defaults/workspace.yml`
-is checked as a manifest (without `name:`) but is not a workspace.
-
-Any folder from `software/` down to a project folder may hold `workspace-inherit/`: files laid out as
-in a workspace root (`.claude/skills/<skill>/…`) that every workspace below it gets, at any depth.
-They are never copied into the workspace folder on main; refresh writes them onto `ws/<name>` and
-propose drops them, so they stay one copy, edited on main, and a workspace's own edit to one is
-undone on refresh. A workspace that wants its own copy lists the path (or a folder above it) under
-`opt-out:` in its `workspace.yml`; refresh then leaves that path alone and propose carries it like
-any workspace file. `ci/check.sh` fails on a path inherited from two folders, a workspace file at an
-inherited path it hasn't opted out of, an `opt-out:` that matches nothing, and a workspace's own
-files in `workspace-inherit/` (`CLAUDE.md`, `workspace.yml`, `.delphi/`, `.claude/settings.json`,
-the workflow). The general skills (worktrees, switching, setup, the journal) live in
-`software/workspace-inherit/`, and the skills a folder's workspaces share live in its own (e.g.
-`application-software/` for PRs and tickets, `argos/` for running and verifying Argos). Shared
-skills go there rather than in a plugin: they're plain files on the workspace branch, with nothing
-to install.
+The folder holding `workspaces/` is a project folder. Its optional `workspace-defaults/` seeds
+workspace-owned files once. Any ancestor org or project may provide managed `workspace-inherit/`
+files. Existing Claude skills stay under `workspace-inherit/.claude/skills/` with their metadata
+intact. A source bundle is Claude-authored unless its optional `source.yml` declares another
+`format:` from the harness registry. Source metadata is never copied into a workspace.
+A defaults manifest's optional `harness:` suggests a creation target; every workspace records its
+own explicit target.
+
+`ci/render.sh` prepares inheritance from a main checkout into temporary staging. `ci/inherit.sh`
+selects ancestor sources, `ci/sources.sh` maps paths, and `ci/harnesses.sh` adapts target content.
+Each payload is prepared once, then hashed and copied from those same bytes. Claude skill content
+passes through unchanged. Each harness descriptor owns `translate_skill`: it converts metadata,
+workspace identifiers and capability-specific bullets. Codex uses `$skill` calls and wraps literal
+`bash scripts/...` commands with `.delphi/exec.sh`. Claude identifiers are defined in its descriptor;
+non-Claude output with an unmapped identifier fails validation and names the target and source.
+Qualified paths and filenames in inline or fenced code stay literal; standalone backticked skill
+calls still translate. Bare instruction names in prose always map to the target instruction file.
+Use a qualified path for a code repository's own file. Skill names come from that
+workspace's selected inheritance and owned native skills. Helper scripts pass through unchanged.
+Leak checks cover recognized Claude identifiers, report every hit and label translated-output line
+numbers; they do not establish that arbitrary tooling or prose is portable.
+
+`ci/render.sh [--check] [--workspace <folder>] [<main-checkout> [<staging-output>]]` updates plugin
+output by default. An optional staging destination receives inherited native files and ownership
+ledgers without adding them to main. `--workspace` selects one workspace; `--check` validates
+without changing the main checkout. `ci/check.sh` rejects committed inherited copies, ledgers,
+ownership collisions and invalid sources, and checks generated plugin settings.
+
+On `ws/*`, `workspace.generated` records managed destinations, origins, modes and native hashes.
+Edit sources instead of managed copies. `opt-out:` transfers a native file or folder to workspace
+ownership; that copy can return to main through a proposal. Managed output and its ledger exist
+only in staging and workspace branches. Ownership checks protect owned additions and report
+ambiguous edits or retirements. Inheritance cannot replace workspace identity, root instructions,
+runtime or workflow files.
+When changing a workspace's harness, update its owned native files too; CI regenerates inheritance.
+
+Source-native `opt-out:` paths are applied before mapping, so a Codex workspace can exclude a
+Claude-only input such as `.claude/commands`. Mapped native opt-outs still transfer copies to
+workspace ownership. Unsupported native mappings fail unless explicitly excluded. Refresh merges
+the manifest before rendering, so a new source and its exclusion can arrive together.
+
+Shared-source paths, generated ledger paths and opt-out keys accept only ASCII
+`[A-Za-z0-9._/@+-]`. Spaces and control characters are unsupported; paths must be relative without
+`.`, `..` or `.git` components. This restriction does not apply to workspace-owned filenames.
+
+```mermaid
+---
+config:
+  theme: base
+  htmlLabels: false
+  fontSize: 16
+  themeVariables:
+    primaryColor: '#f3f4f6'
+    primaryTextColor: '#111827'
+    primaryBorderColor: '#64748b'
+    nodeTextColor: '#111827'
+    clusterBkg: '#f8fafc'
+    clusterBorder: '#94a3b8'
+    titleColor: '#111827'
+    lineColor: '#64748b'
+    edgeLabelBackground: '#f3f4f6'
+  flowchart:
+    htmlLabels: false
+    subGraphTitleMargin:
+      top: 10
+      bottom: 18
+---
+flowchart TD
+    subgraph MAIN["Stored on main"]
+        S["Canonical inherited sources"]
+        O["Owned native workspace files"]
+    end
+    subgraph CI["Temporary CI staging"]
+        M["1. Merge main into workspace tree"]
+        T["2. Prepare inheritance for merged harness"]
+        H["3. Check ownership and apply files"]
+        C["4. Commit changed workspace tree"]
+        M --> T --> H --> C
+    end
+    S --> T
+    C -->|"push"| B["Workspace branch"]
+    O --> M
+    B -->|"strip managed output"| P["PR: owned native changes"]
+    style T fill:#eff6ff,stroke:#2563eb,color:#111827,stroke-width:2px
+```
+
+The blue step runs after the merge, using its manifest to select the harness and opt-outs.
+`stage_inheritance()` calls the renderer; `apply_inheritance()` checks ownership and installs the
+prepared bytes. Historical output may be replayed to verify prior ownership. Proposals discard
+staged inheritance and return owned files in their existing native format.
 
 A plugin set is for what `workspace-inherit/` can't do: context only some workspaces opt into, or
 harness features beyond files (hooks, MCP servers). It lives in `plugins/<harness>/<set>/` of a
 folder (`plugins/claude/` for Claude Code; a sister folder per other harness), one copy for the
 workspaces below. The one so far is `delphi`, `software/`'s `default` set (scope `delphi`): a mod
-(section 5) whose `/ws-delphi` pane switches workspaces. Every workspace gets the
+(section 5) whose `/ws-delphi` pane switches workspaces. Every Claude Code workspace gets the
 `default` set of each folder above it, which `ci/plugins.sh` lists first under `plugins:` in its
 `workspace.yml` (`- argos   # default, from software/application-software/argos/`; a removed line
 comes back); other sets are listed there by hand (`- <scope>.<set>`). `ci/plugins.sh` generates the
@@ -123,9 +197,9 @@ rest, and `ci/check.sh` fails if the list or either file is out of date:
 - Each `harness: claude-code` workspace's `.claude/settings.json`: the shared settings in
   `ci/plugins.sh`, plus the `delphi` marketplace (with `autoUpdate`) and the sets under `plugins:`
   in `enabledPlugins`. Never edit it by hand: personal settings go in `.claude/settings.local.json`
-  (git-ignored by Claude Code), shared ones in `workspace.yml` or the generator. Sync regenerates it
-  on every `ws/*` branch (section 3); a PR to `main` that changes a set or a `workspace.yml` runs
-  `ci/plugins.sh` itself.
+  (git-ignored by Claude Code), shared ones in `workspace.yml` or the generator. Main's settings
+  are generated before their PR merges into main. Refresh generates branch settings from its plugin selections and
+  main's plugin catalog, so enabled sets remain active while their proposal to main is pending.
 - Enabled isn't installed: Claude Code only offers to install a project's enabled plugins, so
   someone may never have installed a set, and then its skills are silently missing; and a set that
   leaves the marketplace stays installed, failing to load. So `setup.sh` (on every setup, switch and
@@ -151,37 +225,31 @@ that touches a set is an update.
 
 For every workspace on `origin/main` (or just `<name>`):
 
-1. **Refresh** (main → `ws/<name>`). If `ws/<old>` (its name before dotted names, the folder's
-   path without `workspaces/`) exists and `ws/<name>` is missing or behind it, start from `ws/<old>`,
-   so its history and unproposed edits carry over, refresh as below, and push the result to both
-   (so clones still on `ws/<old>` pull the 0.8.0 migration that renames their branch; the old branch
-   is kept, with a notice to delete it once no clone is on it). Otherwise, if `ws/<name>` is missing, create it as one commit
-   (`git commit-tree <main>:<folder> -p <main>`, "delphi: create ws/<name> from <folder>"): root =
-   folder plus main's `.delphi/`, parent = main, so no unrelated histories. Otherwise merge
-   `origin/main` into `ws/<name>` with `--no-ff -Xsubtree=<folder>`, then, if its `.delphi/` differs
-   from main's, commit main's over it ("delphi: sync .delphi/ from main", built in a temporary
-   index). Then write over it the files it inherits from main (every `workspace-inherit/` from
-   `software/` down to its project folder, less its `opt-out:` paths) and remove those it
-   inherited from the main it last merged (the merge base) but no longer does ("delphi: sync
-   inherited files from main"; a new branch gets them in its one commit), and push if the tree changed. (`--no-ff` matters: once ws commits are in main, a
-   fast-forward would put main's whole tree on the ws branch.) A `.delphi/` edit made on `ws/<name>`
-   is undone here. Then, for a `claude-code` workspace, list main's default sets above it under the
-   branch's `workspace.yml` `plugins:` and regenerate `.claude/settings.json` from that
-   (`ci/plugins.sh yml`, `settings`), and commit them if they changed ("delphi: generate plugins:
-   defaults and .claude/settings.json"), so a new default set or one added under `plugins:` is
-   enabled and a hand edit is undone. A set that main doesn't have is reported and that
-   workspace is skipped.
-2. **Propose** (`ws/<name>` → PR to main). Build `propose/<name>` = `origin/main` +
-   `git merge --no-ff -Xsubtree=<folder> ws/<name>`, with `<folder>/.delphi/` dropped from the result
-   (it is main's, never a workspace's) and its inherited paths put back to main's. Stop if its tree equals main's or the current
-   `propose/<name>`'s (nothing new). Otherwise run `ci/check.sh` on it, force-push it, and create or
-   update the PR `ws/<name> → main` with `gh` (body: the PR template's sections, with the ws commit subjects
-   and authors under Changes; labelled `by: ai` when opened, and labels never touched after, so a
-   changed written-by label stays).
-
-A conflict or failed check is reported (conflicts with their files); that workspace is skipped, the
-others continue, and the script exits 1. A `ws/*` branch without a folder on main gets a notice and
-is never deleted. Merges happen in a temporary worktree, so the caller's checkout is untouched.
+1. **Merge** main into the workspace tree in a temporary checkout. Owned-file conflicts are
+   reported. Managed-file conflicts can be deferred using ownership metadata, then verified
+   against trusted source history before publication.
+2. **Prepare inheritance** once from main's sources and the merged manifest. The registered
+   harness maps paths and converts skill content; Claude copies its original bytes. Ownership
+   checks protect local files and retired edits before prepared output and `workspace.generated`
+   are applied. Sync adds main's `.delphi/`, commits only a changed tree, then pushes `ws/<name>`.
+   A missing workspace branch starts from its main folder and gets the same preparation step.
+   Branch plugin selections remain active while their proposal is pending.
+3. **Propose** merges the workspace into a temporary main candidate, verifies ownership and strips
+   managed inheritance, `workspace.generated` and the branch runtime. Owned files and opted-out
+   copies remain native. It regenerates settings, runs `ci/check.sh`, and updates `propose/<name>`
+   only when the tree changes. Existing PR labels are preserved.
+
+History stays joined through subtree merges; workspace branches are never force-pushed. Legacy
+path-named branches still carry over into dotted names while ahead, and receive the result once;
+otherwise they are kept with a notice. Removed workspace branches are kept with a notice too.
+An unchanged result leaves the workspace ref untouched. Renaming an org or project folder while
+keeping its dotted workspace name preserves ownership history. Sync aligns the common ancestor's
+folder prefix before merging a move, so later owned edits still use their original merge base.
+Preparation commits stay temporary: each changed refresh publishes one merge parented by the
+original workspace tip and main; proposals likewise use the actual workspace tip.
+
+A conflict or failed render/check is reported and that workspace is skipped; other workspaces keep
+syncing and the command exits 1. All work happens in temporary worktrees.
 
 ## 4. Working on a workspace
 
@@ -244,23 +312,26 @@ The inherited `new-worktree` skill makes worktrees the default way to start a br
 
 `.delphi/paths.sh` is the layout in one place: sourced, it sets and exports `DELPHI_ROOT` (from the
 file's own place) and `DELPHI_REPOS`, `DELPHI_WORKTREES`, `DELPHI_REFERENCES`, `DELPHI_WORKSPACES`; run,
-it prints them as an export line. Each harness's generated settings put that line into every shell
-at session start: for Claude Code, a SessionStart hook in `.claude/settings.json` (from
+it prints them as an export line. The adapter supplies layout initialization: for Claude Code, a SessionStart hook in `.claude/settings.json` (from
 `ci/plugins.sh`) appends it to `$CLAUDE_ENV_FILE`, which reaches the model's commands, subagents' and
 skill scripts'. In a terminal, `. .delphi/paths.sh` from the root. `new-worktree.sh` sources it from
 its own folder; every skill script, plugin or workspace, sources `$DELPHI_ROOT/.delphi/paths.sh` and
 takes only names (repo, branch), never a searched-for path, so the model types only the names.
-Skills themselves stay harness-neutral (SKILL.md is the shared Agent Skills format): they call
-scripts by their path in the skill's folder (`bash scripts/<script>.sh …`) and name no harness
-variable, so another harness needs only its own settings to set `DELPHI_ROOT`.
+Codex uses `AGENTS.md` and `.agents/skills/` from its checked-out branch. Run helper commands through
+`bash "<root>/.delphi/exec.sh" <command> ...`; it initializes the layout without changing the caller's
+directory and exports it to children. Generated Codex skills use the full wrapper command for
+helper calls. Fill its explicit root and installed-skill placeholders from the known checkout,
+then use the same invocation in fresh shells and sub-agents. The host supplies
+dependencies, credentials and integrations. `DELPHI_GITHUB_REST_PROXY` enables the shared helper's
+REST-proxy fallback; existing Claude remote sessions retain their fallback.
 
 `.delphi/switch.sh <workspace>|main` moves the clone to `ws/<workspace>` (or `main`): it refuses while
 tracked files have changes, fetches the branch, switches (the hook parks and restores), fast-forwards
 to origin, and runs the new workspace's `setup.sh`. `switch.sh --list` prints `main` and each workspace with a branch, as `<name> <project folder>`, `*` before this clone's. The `delphi` mod
 (`software/plugins/claude/default/`) puts that in a pane to keep open: `/ws-delphi` shows them as cards grouped by project, this clone's
 marked current, with a warning when tracked files have changed; pressing a card selects it, and
-**Switch workspace** runs `switch.sh` (`/ws-delphi <name>` skips the pane). No restart: Claude Code
-reloads skills from `.claude/skills/` itself, and the mod sends the root's new `CLAUDE.md` with the
+**Switch workspace** runs `switch.sh` (`/ws-delphi <name>` skips the pane). Codex sessions must
+restart after a switch. Claude Code with this mod reloads skills from `.claude/skills/` itself, and the mod sends the root's new `CLAUDE.md` with the
 next prompt (once, after any change: a switch, a pull, `switch.sh` by hand), saying it replaces the
 one the session started with (a user mod can't rewrite the session's own `CLAUDE.md` block). All
 the git work stays in `switch.sh`, which `tests/e2e.sh` covers; the mod's own tests
@@ -301,14 +372,40 @@ it's switched back to (`switch.sh` runs setup). Migrations must be safe to re-ru
 fresh clone, and delete only what nothing is lost from, stopping with what to do otherwise. `setup.sh`
 also warns when `.delphi/` isn't exactly the version it says (edited in the clone).
 
-## 6. New workspaces (`tools/new-workspace.sh [--by <who>] <org-path> <leaf>`)
-
-Validates the leaf and the dotted name it gets (format, unique, no leftover `ws/<name>` or `ws/<old>`), copies `templates/workspace/`
-and then `software/<org-path>/workspace-defaults/` if present (its `CLAUDE.md` appended to the template's)
-into `software/<org-path>/workspaces/<leaf>/` (filling `{{name}}`/`{{folder}}` in `CLAUDE.md`) in a
-temporary worktree, sets `name: <name>`, generates its `.claude/settings.json`, runs `ci/check.sh`, pushes branch
-`new-workspace/<org-path>/<leaf>`, and opens a PR in the PR template's sections, labelled `by: <who>` (`ai`,
-the default, `ai-assisted` or `human`). Sync creates `ws/<name>` once it merges.
+## 6. New workspaces
+
+`tools/new-workspace.sh [--by <who>] [--harness <adapter>] <org-path> <leaf>` validates the leaf and
+dotted name in a temporary main checkout. Explicit selection overrides the project's creation
+suggestion, with Claude Code suggested when neither is supplied. The chosen harness is always
+written into the workspace manifest. The source reader translates project defaults into that
+harness's native paths, appends instruction defaults to its native template, fills placeholders,
+and preserves ordinary defaults. Unsupported native mappings fail.
+
+The tool runs `ci/render.sh` and `ci/check.sh`, then opens `new-workspace/<org-path>/<leaf>` as a
+main-side PR with owned native files and a `by: <who>` label. After merge, CI creates `ws/<name>`
+and adds staged inheritance there. Defaults are seeded once; inherited skills never enter the
+creation PR.
+
+### Adding a harness or source format
+
+Add `ci/harnesses/<name>.sh` and the template its `instruction_template` field names.
+Creation combines optional `instruction_base` with the harness's `instruction_template`, keeping
+common layout authored once and the result an owned snapshot.
+`ci/harnesses.sh` exposes pure `harness_field <name> <field>` queries; native, protected and foreign
+paths are derived from the registered entries. The same registry recognizes source formats.
+Define `translate_skill` in the descriptor; reuse Claude's identifier translator and the shared
+bootstrap helpers where appropriate. New metadata formats belong in that function. Select the target in a workspace
+manifest, validate staging, and run the sandbox suite. Ordinary targets need no renderer, validator
+or sync changes. Add a capability implementation only when the target introduces one.
+
+An optional `settings_generator` implements `settings <folder> <manifest>`; a file-only target
+needs no generator. The entry also selects its helper bootstrap. Template locations are entry data,
+so the existing Claude template stays where seed-once creation already reads it.
+
+A new source format supplies the same file records (mode/hash, destination, origin) through
+`ci/sources.sh`. It does not select a workspace's target. Creation suggestions and source formats
+can change independently of existing workspaces. Runtime changes follow the normal version rules;
+adding a harness does not require a particular host or account.
 
 ## 7. CI (`.github/workflows/delphi.yml`)
 
diff --git a/docs/goals.md b/docs/goals.md
index 1bce948..fe682e7 100644
--- a/docs/goals.md
+++ b/docs/goals.md
@@ -4,13 +4,14 @@ What Delphi must achieve, not how. Any change must keep these. Details: `docs/de
 
 ## Purpose
 
-Store NER's AI context (instructions, skills, docs, settings) once, organized by the org chart. Let
-anyone, person or agent, work on a workspace with plain git and send improvements back.
+Author reusable AI context once, organized by the org chart, and deliver native context to each
+workspace branch. Let anyone, person or agent, work with plain git and send improvements back.
 
 ## Goals
 
-- **G1. Workspaces live in Delphi.** Each workspace is a folder on `main` with every file at its
-  normal harness location.
+- **G1. Workspaces live in Delphi.** Each workspace is a folder on `main` with an explicit harness
+  and its owned files at native paths. Shared context lives once in canonical sources; inherited
+  copies exist only on workspace branches.
 - **G2. The workspace is the repo root.** Checking out `ws/<name>` gives exactly that workspace at
   the root. `.delphi/setup.sh` clones the code repos it lists and, separately, checks out their default branch as a worktree.
 - **G3. Both directions, automatically.** Refresh: changes on `main` reach `ws/<name>`. Propose:
diff --git a/software/application-software/argos/AUTHORING.md b/software/application-software/argos/AUTHORING.md
index b6343df..9b60e2f 100644
--- a/software/application-software/argos/AUTHORING.md
+++ b/software/application-software/argos/AUTHORING.md
@@ -7,43 +7,54 @@ full model; this is the Argos-specific short version.
 
 1. Check out `ws/s.app.argos.<leaf>` (from another workspace: `bash .delphi/switch.sh s.app.argos.<leaf>`, the
    `switch-workspace` skill), then `git switch -c <branch>`.
-2. Edit at normal harness paths: `CLAUDE.md`, `.claude/skills/<skill>/SKILL.md`, `docs/`.
+2. Edit at normal harness paths: the native instruction file and skill paths for its `harness:` (`AGENTS.md` and `.agents/skills/` for Codex), or `docs/`.
 3. Push the branch and open a PR into `ws/<name>`. After it merges, CI proposes it to `main`.
 
-Don't edit `.delphi/`, `.github/workflows/delphi.yml`, or `.claude/settings.json`: Delphi manages
-them (`.delphi/` comes from main's root and sync resets it; `settings.json` is generated from
-`workspace.yml`'s `plugins:`, where CI lists any folder's `default` plugin set; add other sets below them), nor the skills
-inherited from `workspace-inherit/` (sync overwrites them: change them on `main`, or list one under `opt-out:` to keep your own).
-Personal settings go in `.claude/settings.local.json`.
+Delphi manages `.delphi/`, the workflow and generated settings. Edit shared skills through their
+`workspace-inherit/` sources on main. To keep an editable workspace copy, list its native path
+under `opt-out:`. Claude personal settings belong in `.claude/settings.local.json`.
 
 ## Create a new Argos workspace
 
-From a Delphi checkout: `tools/new-workspace.sh application-software/argos <name>`. It copies
-Delphi's template, then `workspace-defaults/` (its `CLAUDE.md` is appended after the Delphi section), and opens
-a PR to `main`. Trim what the new workspace doesn't need before merging.
+From a Delphi checkout: `tools/new-workspace.sh [--harness codex] application-software/argos <name>`. It copies
+the resolved harness instructions and translated `workspace-defaults/`, then opens a PR to `main`.
 
 ## Change the defaults or this folder
 
 Edit on a branch of `main` and open a PR to `main` (from a workspace: `bash .delphi/switch.sh main`;
 don't edit `workspaces/main/` from a workspace). `workspace-defaults/`
-only affects workspaces created afterwards; to change existing ones, PR each workspace too. `workspace-inherit/` reaches
-every Argos workspace on the next sync.
+only affects workspaces created afterwards; to change existing ones, PR each workspace too.
+Seeded instruction files are owned snapshots. For context that should stay current across
+workspaces, use inheritance or a read-only reference through `workspaces/main/`.
+`workspace-inherit/` reaches every Argos workspace through temporary CI preparation and refresh.
+Commit its sources, never generated skill copies or `workspace.generated`, to main. Run
+`bash ci/render.sh` for plugin output and `bash ci/check.sh` before opening the PR.
 
 ## Writing good workspace context
 
-- Keep the Delphi section of `CLAUDE.md` as generated; put project rules below it.
+- Keep the Delphi section of the native instruction file as generated; put project rules below it.
 - One skill per repeatable workflow, with a `description` that says when to use it.
 - Agent context (glossary, conventions, skills) lives in the workspace; the glossary goes in `docs/`.
-  Skills every Argos workspace needs go in `workspace-inherit/` here (`implement`, `run-local`,
-  `verify-graph`, `verify-telemetry`, `pr-conventions`, `ticket-conventions`), and those shared with
-  other application-software projects in `software/application-software/workspace-inherit/`
-  (`commit`, `open-pr`, `update-pr`, `address-pr-comments`, `create-ticket`); Delphi's own
-  (`new-worktree`, `journal`, `setup-workspace`, `switch-workspace`) come from
-  `software/workspace-inherit/`. Sync puts them all on every Argos workspace's branch; change them by
-  PR to `main`. Context only some workspaces need goes in the workspace, or in a plugin set
-  (`plugins/claude/<set>/`) they list under `plugins:` (run `ci/plugins.sh`). Workspaces keep only
-  skills tied to that workspace (the `workflow`, `review` and `to-tickets` trial in the experimental
-  ones).
+  Shared Claude skills stay in `workspace-inherit/.claude/skills/<name>/` at the project or org level.
+  CI preserves Claude metadata and translates Codex copies into its native directory only on
+  workspace branches; change sources through PRs to `main`. Ordinary inherited docs go in `workspace-inherit/`.
+  Write skills once in Claude format; harness descriptors translate identifiers and native metadata.
+  Fix missing mappings in the translator. Generated Codex skills carry their helper bootstrap command.
+  Optional `source.yml` selects a different authoring format. Context only some workspaces need goes in
+  the workspace, or in a supported plugin set selected under `plugins:`. Codex does not load the
+  Claude plugin sets. Workspace-owned native skills remain editable and proposable; use a native
+  destination under `opt-out:` when taking ownership of an inherited skill. Proposals return that
+  owned copy to main and strip other managed inheritance.
+  A source-native opt-out can exclude a harness-only file before translation. Shared-source and
+  opt-out paths follow the portable ASCII rule in Delphi's `docs/design.md`; spaces are unsupported.
   ADRs about a code repo live in that repo, so `docs/` holds only ADRs about the workspace itself.
   Avoid file paths and code in specs and tickets.
 - Make new branches as worktrees (`new-worktree` skill) unless told otherwise.
+
+## Codex
+
+Open `ws/s.app.argos.default-codex` in Codex and follow `AGENTS.md`. Use `.delphi/exec.sh` for skill
+helpers in fresh shells and sub-agents. The host supplies tooling and credentials. Restart the
+Codex session after switching workspaces.
+Its project rules and glossary point to the existing Argos development context in the read-only
+main link; edit those canonical files through PRs to main, not through the link.
diff --git a/software/application-software/argos/README.md b/software/application-software/argos/README.md
index d5ae31c..9d26bea 100644
--- a/software/application-software/argos/README.md
+++ b/software/application-software/argos/README.md
@@ -11,10 +11,13 @@ backend (`scylla-server/`), with schema tooling in `charybdis/` and MQTT broker
 |---|---|
 | `workspaces/<leaf>/` | One workspace per purpose; branch `ws/s.app.argos.<leaf>` is its root |
 | `workspaces/argos-dev/` | Day-to-day Argos development: tickets, specs, PRs |
+| `workspaces/default-codex/` | Argos development with the Codex harness |
 | `workspace-defaults/` | What a new Argos workspace starts with (see `AUTHORING.md`) |
-| `workspace-inherit/` | Skills every Argos workspace gets on each sync: ticket and PR conventions, `implement`, `run-local`, `verify-graph`, `verify-telemetry` |
+| `workspace-inherit/` | Shared workflows and docs staged by CI and added only to workspace branches |
 | `plugins/claude/<set>/` | Claude Code plugin sets a workspace lists under `plugins:` (none yet) |
 | `AUTHORING.md` | How to create and change Argos workspaces |
 
-Shared facts that every Argos workspace needs belong here, in `workspace-defaults/`, or in `workspace-inherit/`. Facts that one
-workspace needs belong in that workspace.
+Shared Claude workflows stay in `workspace-inherit/.claude/skills/`. Shared facts belong here or in `workspace-inherit/`;
+`workspace-defaults/` seeds new workspaces. Facts that one workspace needs belong in that workspace.
+The Codex workspace reads the existing Argos development rules and glossary through its read-only
+`workspaces/main/` link, so those facts have one maintained copy.
diff --git a/software/application-software/argos/workspaces/default-codex/.gitattributes b/software/application-software/argos/workspaces/default-codex/.gitattributes
new file mode 100644
index 0000000..4965641
--- /dev/null
+++ b/software/application-software/argos/workspaces/default-codex/.gitattributes
@@ -0,0 +1,2 @@
+# LF everywhere, so .delphi/setup.sh runs in Git Bash even with core.autocrlf=true
+* text=auto eol=lf
diff --git a/software/application-software/argos/workspaces/default-codex/.github/workflows/delphi.yml b/software/application-software/argos/workspaces/default-codex/.github/workflows/delphi.yml
new file mode 100644
index 0000000..b8ffdd9
--- /dev/null
+++ b/software/application-software/argos/workspaces/default-codex/.github/workflows/delphi.yml
@@ -0,0 +1,41 @@
+# Delphi CI (docs/design.md). This file is at main's root and, identically, at the root of every
+# ws/<name> (GitHub runs a push's workflow from the pushed commit, so ws pushes need their own copy).
+# PRs to main: ci/check.sh, against main (so released versions stay as they are). Pushes to main or
+# ws/**: ci/sync.sh (refresh + propose), always run from main. Pushes and PRs made with GITHUB_TOKEN
+# trigger no workflows: no loops, and CI-opened PRs don't run `check` (sync.sh runs it itself).
+name: delphi
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main, 'ws/**']
+permissions:
+  contents: read
+jobs:
+  check:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - run: ci/check.sh . origin/main
+  sync:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    concurrency: delphi-sync
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+      - env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          ci/sync.sh
diff --git a/software/application-software/argos/workspaces/default-codex/AGENTS.md b/software/application-software/argos/workspaces/default-codex/AGENTS.md
new file mode 100644
index 0000000..aafef6e
--- /dev/null
+++ b/software/application-software/argos/workspaces/default-codex/AGENTS.md
@@ -0,0 +1,25 @@
+# Delphi workspace
+
+You're in Delphi workspace `s.app.argos.default-codex` (branch `ws/s.app.argos.default-codex`); code repos are cloned at `repos/<repo>/`, and separately checked out as worktrees under `worktrees/<repo>/` (`.delphi/setup.sh` makes the default branch's). Work in worktrees: make each new branch one under `worktrees/<repo>/<branch>` (`new-worktree` skill) unless the user says not to. Read-only dependency sources from `references-git:` are checked out under `references/<name>/` at the version the workspace pins: read them to learn how a dependency behaves (prefer them over web docs), and never edit, branch, or push them. Delphi workspaces (or `main`) under `workspaces:` in `workspace.yml` (`- <name>`, a workspace's dotted name like `s.app.argos.argos-dev`, or `- main`) are clones at `workspaces/<name>/`, each on its branch, for reading their context (don't edit them from here; setup switches each back to its branch and pulls it); change what's checked out with the `setup-workspace` skill. To work in another workspace, switch this clone to it (`switch-workspace` skill). Park rough notes with the `journal` skill. Work here unless the task clearly belongs to another project.
+
+
+## Workspace setup
+
+Work from the checked-out workspace root, where `workspace.yml` is. Run `bash .delphi/paths.sh` from this root to learn its absolute path, and run `bash .delphi/setup.sh` when the repositories have not been set up.
+
+Shell exports may not persist between commands or reach independently launched sub-agents. Run skill helpers through `bash <absolute-workspace-root>/.delphi/exec.sh bash <absolute-skill-folder>/scripts/<script>.sh <names>...`; this sets the layout on every invocation and preserves the caller's working directory. Pass the workspace's absolute path and this rule to sub-agents. Native skills live under `.agents/skills/`. After a workspace switch, start a fresh Codex session before further work.
+
+Use the tools available in the current harness for browser verification and GitHub access. If a skill requires unavailable tooling or authentication, report the missing prerequisite and the verification that remains. Delphi does not configure Codex permissions, credentials, MCP servers or host dependencies.
+
+# Argos
+
+Before working on Argos, read the project rules in
+`workspaces/main/software/application-software/argos/workspaces/argos-dev/CLAUDE.md`, starting at
+`NER Software conventions`, and follow `docs/CONTEXT.md` for the canonical glossary and code
+conventions. These live references keep this workspace aligned with Argos development without
+copying its project context. Use the corresponding native Codex skills when those rules name
+slash commands; use the Codex bootstrap above for helper commands.
+
+The linked `main` checkout is read-only from this workspace. Run `bash .delphi/setup.sh` if it is
+missing or needs refreshing. Propose shared context changes through a normal PR to Delphi main
+from a separate checkout or after switching workspaces; do not edit the linked clone here.
diff --git a/software/application-software/argos/workspaces/default-codex/docs/CONTEXT.md b/software/application-software/argos/workspaces/default-codex/docs/CONTEXT.md
new file mode 100644
index 0000000..e1ce7a4
--- /dev/null
+++ b/software/application-software/argos/workspaces/default-codex/docs/CONTEXT.md
@@ -0,0 +1,8 @@
+# Argos context
+
+Read the canonical glossary and code conventions at
+`workspaces/main/software/application-software/argos/workspaces/argos-dev/docs/CONTEXT.md`
+from the workspace root. Read the relevant ADRs in the Argos code worktree too.
+
+The `main` link is read-only here and refreshed by `bash .delphi/setup.sh`. Shared vocabulary
+changes belong in a PR to Delphi main at that canonical path; keep this file as a pointer.
diff --git a/software/application-software/argos/workspaces/default-codex/workspace.yml b/software/application-software/argos/workspaces/default-codex/workspace.yml
new file mode 100644
index 0000000..8f94d77
--- /dev/null
+++ b/software/application-software/argos/workspaces/default-codex/workspace.yml
@@ -0,0 +1,17 @@
+name: s.app.argos.default-codex
+harness: codex
+park:                     # `- <folder>`: root folders that park with this workspace on a switch (.delphi/park.sh), besides the ones it always parks
+  - pictures
+  - .playwright-mcp
+  - .playwright-cli
+# .delphi/setup.sh checks out everything below (git-ignored); re-run it after any change.
+repos:                    # `<name>: <git-url>`: code you change; a clone at repos/<name>, and separately worktrees/<name>/<branch> (default branch first)
+  argos: https://github.com/Northeastern-Electric-Racing/Argos.git
+  odyssey-definitions: https://github.com/Northeastern-Electric-Racing/Odyssey-Definitions.git
+references-git:           # `<name>: <git-url> [<tag-or-branch>]`: dependency sources to read, never edit; shallow copy at references/<name>
+  # pins match scylla-server/Cargo.lock and angular-client/package-lock.json on develop
+  socketioxide: https://github.com/Totodore/socketioxide.git socketioxide-v0.18.7
+  socket.io: https://github.com/socketio/socket.io.git socket.io-client@4.8.1   # monorepo: client, server, engine.io, parser
+  zenoh: https://github.com/eclipse-zenoh/zenoh.git 1.10.1
+workspaces:               # `- <name>` (dotted) or `- main`: Delphi workspaces to read, not edit from here; a clone on its branch at workspaces/<name or main>
+  - main
diff --git a/software/application-software/workspace-inherit/.claude/skills/address-pr-comments/scripts/github.sh b/software/application-software/workspace-inherit/.claude/skills/address-pr-comments/scripts/github.sh
index 118d210..da0be20 100644
--- a/software/application-software/workspace-inherit/.claude/skills/address-pr-comments/scripts/github.sh
+++ b/software/application-software/workspace-inherit/.claude/skills/address-pr-comments/scripts/github.sh
@@ -1,15 +1,15 @@
 # github.sh: sourced by skill scripts that call GitHub. gh_init <tool> <git-dir> picks a backend
-# (gh when logged in, else a Claude Code remote session's REST proxy via curl; jq is needed either
+# (gh when logged in, else an explicitly enabled GitHub REST proxy via curl; jq is needed either
 # way), sets SLUG from that repo's origin, and makes any failure exit 3 so the calling skill falls
-# back to the GitHub MCP server. TMP is a scratch dir removed on exit.
+# back to the available GitHub integration. TMP is a scratch dir removed on exit.
 # shellcheck shell=bash
-fail() { echo "$TOOL: $1; use the GitHub MCP server" >&2; exit 3; }
+fail() { echo "$TOOL: $1; use the available GitHub integration" >&2; exit 3; }
 on_exit() { local rc=$?; rm -rf "$TMP"; [ "$rc" -eq 0 ] || fail "GitHub request failed ($MODE)"; }
 gh_init() {
   TOOL=$1
   if { command -v gh && gh auth status; } >/dev/null 2>&1; then MODE=gh
-  elif [ -n "${CLAUDE_CODE_REMOTE:-}" ] && command -v curl >/dev/null; then MODE=rest
-  else fail "no authenticated gh or remote-session proxy"; fi
+  elif [ -n "${DELPHI_GITHUB_REST_PROXY:-${CLAUDE_CODE_REMOTE:-}}" ] && command -v curl >/dev/null; then MODE=rest
+  else fail "no authenticated gh or enabled REST proxy"; fi
   command -v jq >/dev/null || fail "jq not installed"
   SLUG=$(git -C "$2" remote get-url origin) && SLUG=${SLUG#*github.com[:/]} && SLUG=${SLUG%.git}
   TMP=$(mktemp -d)
diff --git a/templates/harnesses/codex/AGENTS.md b/templates/harnesses/codex/AGENTS.md
new file mode 100644
index 0000000..7ad803f
--- /dev/null
+++ b/templates/harnesses/codex/AGENTS.md
@@ -0,0 +1,9 @@
+
+
+## Workspace setup
+
+Work from the checked-out workspace root, where `workspace.yml` is. Run `bash .delphi/paths.sh` from this root to learn its absolute path, and run `bash .delphi/setup.sh` when the repositories have not been set up.
+
+Shell exports may not persist between commands or reach independently launched sub-agents. Run skill helpers through `bash <absolute-workspace-root>/.delphi/exec.sh bash <absolute-skill-folder>/scripts/<script>.sh <names>...`; this sets the layout on every invocation and preserves the caller's working directory. Pass the workspace's absolute path and this rule to sub-agents. Native skills live under `.agents/skills/`. After a workspace switch, start a fresh Codex session before further work.
+
+Use the tools available in the current harness for browser verification and GitHub access. If a skill requires unavailable tooling or authentication, report the missing prerequisite and the verification that remains. Delphi does not configure Codex permissions, credentials, MCP servers or host dependencies.
diff --git a/tests/e2e.sh b/tests/e2e.sh
index def7a38..fd9d04f 100644
--- a/tests/e2e.sh
+++ b/tests/e2e.sh
@@ -49,6 +49,7 @@ cp -R "$src/templates/workspace/." "$t/seed/$B/"
 sed -i.bak "s|{{name}}|$BN|" "$t/seed/$B/workspace.yml" && rm "$t/seed/$B/workspace.yml.bak"
 FD=software/electrical/firmware/workspace-defaults # project defaults for new workspaces under electrical/firmware
 mkdir -p "$t/seed/$FD/.claude/skills/fw"
+printf "format: claude-code\n" >"$t/seed/$FD/source.yml"
 printf 'harness: claude-code\nrepos:\n  fw: https://example.com/fw.git\n' >"$t/seed/$FD/workspace.yml"
 printf '# Firmware for {{name}}\n' >"$t/seed/$FD/CLAUDE.md"
 echo "fw skill" >"$t/seed/$FD/.claude/skills/fw/SKILL.md"
@@ -59,7 +60,7 @@ set_json "$t/seed/software/application-software" default app # its scope: its sh
 set_json "$t/seed/software/application-software/argos" default argos # default sets above argos-dev
 TS=software/application-software/argos/plugins/claude/testing # an extra set a workspace can list under plugins:
 mkdir -p "$t/seed/$TS/.claude-plugin" && printf '{\n  "name": "argos.testing"\n}\n' >"$t/seed/$TS/.claude-plugin/plugin.json"
-(cd "$t/seed" && bash ci/plugins.sh >/dev/null) # the marketplace and each workspace's .claude/settings.json
+(cd "$t/seed" && bash ci/render.sh >/dev/null) # the marketplace and each workspace's .claude/settings.json
 git -C "$t/seed" add -A && git -C "$t/seed" commit -qm init
 git clone -q --bare "$t/seed" "$t/origin.git"
 git clone -q "$t/origin.git" "$t/ci"
@@ -69,7 +70,7 @@ o() { git -C "$t/origin.git" "$@"; }
 # commit_on <branch> <file> <text>: a person's PR into <branch>, merged (edit on a branch, merge --no-ff)
 commit_on() {
   (cd "$t/dev" && git fetch -q && git checkout -q -B "edit" "origin/$1" && printf '%s\n' "$3" >>"$2" &&
-    git commit -qam "edit $2 on $1" && git checkout -q -B "tmp-$1" "origin/$1" &&
+    { [ "$1" != main ] || bash ci/render.sh >/dev/null; } && git add -A && git commit -qm "edit $2 on $1" && git checkout -q -B "tmp-$1" "origin/$1" &&
     git merge -q --no-ff --no-edit edit && git push -q origin "HEAD:$1")
 }
 
@@ -78,11 +79,13 @@ sync >"$t/out"
 main=$(o rev-parse main)
 for w in "$A" "$B"; do
   n=$BN && [ "$w" != "$A" ] || n=$AN
-  o diff --quiet "main:$w" "ws/$n" -- ':!.delphi' || fail "ws/$n root != $w"
+  o diff --quiet "main:$w" "ws/$n" -- ':!.delphi' ':!workspace.generated' || fail "ws/$n root != $w"
   [ "$(o rev-parse "ws/$n:.delphi")" = "$(o rev-parse main:.delphi)" ] || fail "ws/$n lacks main's .delphi/"
   [ "$(o rev-parse "ws/$n^")" = "$main" ] || fail "ws/$n parent is not main"
   [ "$(o log -1 --format=%s "ws/$n")" = "delphi: create ws/$n from $w" ] || fail "ws/$n message"
   o cat-file -e "ws/$n:workspace.yml" || fail "ws/$n lacks workspace.yml"
+  o cat-file -e "ws/$n:workspace.generated" || fail "ws/$n lacks staged ownership metadata"
+  ! o cat-file -e "main:$w/workspace.generated" 2>/dev/null || fail "main contains branch ownership metadata"
   { ! o cat-file -e "ws/$n:README.md" 2>/dev/null && ! o cat-file -e "ws/$n:ci" 2>/dev/null; } ||
     fail "ws/$n has Delphi root files"
   [ "$(o rev-parse "ws/$n:.github/workflows/delphi.yml")" = "$(o rev-parse main:.github/workflows/delphi.yml)" ] ||
@@ -124,6 +127,13 @@ sync >"$t/out" || fail "sync after merging propose failed"
 [ "$(o rev-parse "ws/$AN^{tree}")" = "$(o rev-parse "$ws^{tree}")" ] || fail "ws tree changed"
 [ ! -s "$t/gh.log" ] || fail "gh called after propose merged: $(cat "$t/gh.log")"
 ok "after the propose PR merges into main, sync is clean and opens no PR"
+before=$(o for-each-ref --format='%(refname) %(objectname)' refs/heads/ws refs/heads/propose)
+commit_on main README.md "documentation-only edit"
+: >"$t/gh.log"
+sync >"$t/out" 2>"$t/err" || fail "documentation-only sync failed: $(cat "$t/err")"
+[ "$before" = "$(o for-each-ref --format='%(refname) %(objectname)' refs/heads/ws refs/heads/propose)" ] || fail "documentation-only main edit changed workspace or proposal refs"
+[ ! -s "$t/gh.log" ] || fail "documentation-only main edit contacted the PR stub"
+ok "a README-only main change leaves workspace and proposal refs unchanged"
 
 # --- 4. a main change to another file refreshes into a ws branch with its own edits, then propose
 commit_on ws/$AN docs/CONTEXT.md "ws edit two"
@@ -135,7 +145,7 @@ o show ws/$AN:docs/CONTEXT.md | grep -qx "ws edit two" || fail "ws edit lost"
 ! o cat-file -e ws/$AN:README.md 2>/dev/null || fail "root file leaked into ws"
 [ "$(o diff --name-only main propose/$AN)" = "$A/docs/CONTEXT.md" ] || fail "propose diff wrong after refresh"
 ok "main-side edit refreshes cleanly alongside ws edits; propose carries only the ws edit"
-o diff --quiet "main:$B" ws/$BN -- ":!.delphi" || fail "bms-dev drifted"
+o diff --quiet "main:$B" ws/$BN -- ":!.delphi" ":!workspace.generated" || fail "bms-dev drifted"
 ok "unrelated main changes leave other ws branches' trees alone"
 
 # --- 4b. .delphi/ lives only at main's root: refresh syncs it onto every ws/*, propose never carries it
@@ -147,7 +157,7 @@ sync >"$t/out" 2>&1 || fail "sync after a .delphi/ change failed: $(cat "$t/out"
 for n in "$AN" "$BN"; do
   [ "$(o rev-parse "ws/$n:.delphi")" = "$(o rev-parse main:.delphi)" ] || fail "ws/$n .delphi/ not synced from main"
 done
-[ "$(o log -1 --format=%s ws/$AN)" = "delphi: sync .delphi/ from main" ] || fail "no sync commit on ws/$AN"
+[ "$(o rev-parse "ws/$AN^2")" = "$(o rev-parse main)" ] || fail "runtime refresh is not joined directly to main"
 ok "a main change to .delphi/, released as a new version, reaches every ws/* branch on refresh"
 commit_on ws/$AN .delphi/setup.sh "# ws edit"
 sync "$AN" >"$t/out" 2>&1 || fail "sync after a ws .delphi/ edit failed: $(cat "$t/out")"
@@ -155,63 +165,55 @@ sync "$AN" >"$t/out" 2>&1 || fail "sync after a ws .delphi/ edit failed: $(cat "
 [ "$(o diff --name-only main propose/$AN)" = "$A/docs/CONTEXT.md" ] || fail "propose carries .delphi/: $(o diff --name-only main propose/$AN)"
 ok "a ws/* edit to .delphi/ is reset by refresh and never proposed into the folder"
 
-# --- 4c. .claude/settings.json is generated: refresh writes it from the ws branch's workspace.yml
+# --- 4c. native settings are reviewed on main; branch edits are rendered in a main-side proposal
 for p in app argos; do
-  o show "ws/$AN:.claude/settings.json" | grep -q "\"$p@delphi\": true" || fail "argos-dev lacks the $p default set"
+  o show "main:$A/.claude/settings.json" | grep -q "\"$p@delphi\": true" || fail "main lacks the $p default set"
 done
-! o show "ws/$BN:.claude/settings.json" | grep -q enabledPlugins || fail "bms-dev enables plugins with none above it"
+[ "$(o rev-parse "main:$A/.claude/settings.json")" = "$(o rev-parse "ws/$AN:.claude/settings.json")" ] || fail "settings differ from main"
 # shellcheck disable=SC2016 # the hook expands them
-o show "ws/$BN:.claude/settings.json" | grep -qF '"command": "bash \"$CLAUDE_PROJECT_DIR/.delphi/paths.sh\" >> \"$CLAUDE_ENV_FILE\""' ||
-  fail "bms-dev's settings.json lacks the SessionStart hook that sets DELPHI_ROOT"
-ok "each workspace's settings.json enables the default set of every folder above it"
-for p in app argos; do
-  o show "ws/$AN:workspace.yml" | grep -Eq "^  - $p +# default, from " || fail "argos-dev's workspace.yml doesn't list the $p default"
-done
-commit_on ws/$AN workspace.yml "$(printf 'plugins:\n  - app   # by hand')"
-(cd "$t/dev" && git fetch -q && git checkout -q -B drop origin/ws/$AN && sed -i.bak '/^  - argos .*# default, from /d' workspace.yml &&
-  rm workspace.yml.bak && git commit -qam "drop the argos default" && git push -q origin HEAD:ws/$AN)
-sync "$AN" >"$t/out" 2>&1 || fail "sync after dropping a default failed: $(cat "$t/out")"
-o show "ws/$AN:workspace.yml" | grep -Eq "^  - argos +# default, from " || fail "dropped default not listed again"
-[ "$(o show "ws/$AN:workspace.yml" | grep -c '^  - app ')" = 1 ] || fail "hand-listed default not folded into the generated line"
-[ "$(o log -1 --format=%s ws/$AN)" = "delphi: generate plugins: defaults and .claude/settings.json" ] || fail "no generate commit for the yml"
-ok "refresh lists every default set first under plugins: on ws/*, restoring a removed one and folding in a hand-listed one"
+o show "ws/$BN:.claude/settings.json" | grep -qF '"command": "bash \"$CLAUDE_PROJECT_DIR/.delphi/paths.sh\" >> \"$CLAUDE_ENV_FILE\""' || fail "SessionStart hook missing"
+ok "native settings already exist on main and refresh copies them unchanged"
 commit_on ws/$AN workspace.yml "$(printf 'plugins:\n  - argos.testing')"
-sync "$AN" >"$t/out" 2>&1 || fail "sync after listing a plugin set failed: $(cat "$t/out")"
-o show "ws/$AN:.claude/settings.json" | grep -q '"argos.testing@delphi": true' || fail "listed set not enabled"
-[ "$(o log -1 --format=%s ws/$AN)" = "delphi: generate plugins: defaults and .claude/settings.json" ] || fail "no generate commit"
-o show "propose/$AN:$A/.claude/settings.json" | grep -q argos.testing || fail "proposal lacks the generated settings"
-ok "a set listed under plugins: on ws/* is enabled by refresh's generated settings.json and proposed with it"
+sync "$AN" >"$t/out" 2>&1 || fail "main-side plugin proposal failed: $(cat "$t/out")"
+o show "ws/$AN:.claude/settings.json" | grep -q argos.testing || fail "branch-selected plugin is disabled before its proposal merges"
+! o show "main:$A/.claude/settings.json" | grep -q argos.testing || fail "branch plugin choice changed main before merge"
+o show "propose/$AN:$A/.claude/settings.json" | grep -q argos.testing || fail "main proposal lacks generated settings"
+branch_settings=$(o rev-parse "ws/$AN:.claude/settings.json")
+plugin_head=$(o rev-parse "ws/$AN")
+sync refresh "$AN" >/dev/null 2>&1 || fail "repeated branch plugin refresh failed"
+[ "$(o rev-parse "ws/$AN")" = "$plugin_head" ] || fail "repeated branch plugin refresh changed its ref"
+ok "branch-selected plugins stay enabled while their main proposal is pending, without advancing unchanged refs"
 commit_on ws/$AN .claude/settings.json "hand edit"
-sync "$AN" >"$t/out" 2>&1 || fail "sync after a settings.json hand edit failed: $(cat "$t/out")"
-! o show "ws/$AN:.claude/settings.json" | grep -qx "hand edit" || fail "hand edit to settings.json kept"
-ok "a hand edit to .claude/settings.json on ws/* is reset by refresh"
+sync "$AN" >"$t/out" 2>&1 || fail "settings reset failed: $(cat "$t/out")"
+[ "$branch_settings" = "$(o rev-parse "ws/$AN:.claude/settings.json")" ] || fail "hand edit kept or branch plugin selection lost"
+ok "refresh resets hand-edited settings to the branch's selected plugins"
 commit_on ws/$AN workspace.yml "  - argos.nope"
-ws=$(o rev-parse ws/$AN)
-if sync "$AN" >"$t/out" 2>"$t/err"; then fail "sync with an unknown plugin set exited 0"; fi
-grep -q "ws/$AN: plugins: .* lists argos.nope, which isn't a plugin set" "$t/err" || fail "unknown set not reported: $(cat "$t/err")"
+if sync "$AN" >"$t/out" 2>"$t/err"; then fail "unknown plugin set accepted"; fi
+grep -q "lists argos.nope, which isn't a plugin set" "$t/err" || fail "unknown set not reported: $(cat "$t/err")"
 (cd "$t/dev" && git fetch -q && git checkout -q -B fix origin/ws/$AN && sed -i.bak '/nope/d' workspace.yml && rm workspace.yml.bak &&
   git commit -qam "drop unknown set" && git push -q origin HEAD:ws/$AN)
-sync "$AN" >/dev/null 2>&1 || fail "sync after dropping the unknown set failed"
-ok "an unknown set under plugins: is reported, exit 1, until fixed"
+sync "$AN" >/dev/null 2>&1 || fail "sync after dropping unknown set failed"
+ok "a failed main-side render prevents publication of the proposal"
 
-# --- 4d. workspace-inherit/: every workspace below a folder gets its files on refresh, never proposes them, and can opt out
+# --- 4d. inherited copies exist only on workspace branches; opt-outs transfer ownership
 on_main() { # <message> <command...>: a change on main, pushed
   local m=$1 && shift
-  (cd "$t/dev" && git fetch -q && git checkout -q -B tmp-main origin/main && "$@" && git add -A && git commit -qm "$m" && git push -q origin HEAD:main)
+  (cd "$t/dev" && git fetch -q && git checkout -q -B tmp-main origin/main && "$@" && bash ci/render.sh >/dev/null && git add -A && git commit -qm "$m" && git push -q origin HEAD:main)
 }
 TI=software/workspace-inherit/.claude/skills/top AI=software/application-software/workspace-inherit/notes
-on_main "inherit" sh -c "mkdir -p $TI $AI && echo 'top v1' >$TI/SKILL.md && echo 'app v1' >$AI/app.md"
+on_main "inherit" sh -c "mkdir -p $TI $AI && echo 'top v1' >$TI/SKILL.md && echo 'app v1' >$AI/app.md && printf 'format: claude-code\\n' >software/application-software/workspace-inherit/source.yml"
 sync >"$t/out" 2>&1 || fail "sync after adding workspace-inherit/ failed: $(cat "$t/out")"
 for n in "$AN" "$BN"; do o show "ws/$n:.claude/skills/top/SKILL.md" | grep -qx "top v1" || fail "ws/$n lacks software/workspace-inherit/"; done
 o show "ws/$AN:notes/app.md" | grep -qx "app v1" || fail "ws/$AN lacks application-software/workspace-inherit/"
 ! o cat-file -e "ws/$BN:notes/app.md" 2>/dev/null || fail "ws/$BN inherited from a folder it isn't under"
-[ "$(o log -1 --format=%s ws/$BN)" = "delphi: sync inherited files from main" ] || fail "no inherit commit on ws/$BN"
-! o cat-file -e "propose/$AN:$A/.claude/skills/top/SKILL.md" 2>/dev/null || fail "inherited file proposed"
-ok "refresh writes every workspace-inherit/ folder above a workspace onto ws/<name>, and only those"
+! o cat-file -e "main:$A/.claude/skills/top/SKILL.md" 2>/dev/null || fail "main contains inherited output"
+! o cat-file -e "propose/$AN:$A/.claude/skills/top/SKILL.md" 2>/dev/null || fail "proposal contains inherited output"
+! o cat-file -e "propose/$AN:$A/workspace.generated" 2>/dev/null || fail "proposal contains branch ownership metadata"
+ok "canonical sources stay on main while applicable native inheritance and ledgers exist only on workspace branches"
 commit_on ws/$AN .claude/skills/top/SKILL.md "ws edit"
 sync "$AN" >"$t/out" 2>&1 || fail "sync after a ws edit to an inherited file failed: $(cat "$t/out")"
 [ "$(o show "ws/$AN:.claude/skills/top/SKILL.md")" = "top v1" ] || fail "ws edit to an inherited file not reset"
-! o cat-file -e "propose/$AN:$A/.claude/skills/top/SKILL.md" 2>/dev/null || fail "ws edit to an inherited file proposed"
+! o cat-file -e "propose/$AN:$A/.claude/skills/top/SKILL.md" 2>/dev/null || fail "ws edit to managed output proposed"
 on_main "inherit v2, drop app.md" sh -c "echo 'top v2' >$TI/SKILL.md && git rm -q $AI/app.md"
 sync >"$t/out" 2>&1 || fail "sync after changing workspace-inherit/ failed: $(cat "$t/out")"
 o show "ws/$AN:.claude/skills/top/SKILL.md" | grep -qx "top v2" || fail "inherited change not refreshed"
@@ -226,6 +228,432 @@ o show "propose/$BN:$B/.claude/skills/top/SKILL.md" | grep -qx "bms own" || fail
 o show "ws/$AN:.claude/skills/top/SKILL.md" | grep -qx "top v3" || fail "argos-dev lost the inherited file"
 ok "a workspace that lists a path under opt-out: keeps and proposes its own copy, and refresh leaves it alone"
 
+on_main "inherited file fixture" sh -c "mkdir -p $AI && echo before >$AI/layout"
+sync refresh "$AN" >/dev/null
+on_main "replace inherited file with directory" sh -c "rm $AI/layout && mkdir $AI/layout && echo after >$AI/layout/guide.md"
+sync refresh "$AN" >"$t/out" 2>&1 || fail "managed file-to-directory refresh: $(cat "$t/out")"
+! o cat-file -e "main:$A/notes/layout/guide.md" 2>/dev/null || fail "main contains native nested output"
+o show "ws/$AN:notes/layout/guide.md" | grep -qx after || fail "refresh lost nested output"
+ok "native managed paths can change from files to directories without creating sparse-index entries"
+on_main "replace inherited directory with file" sh -c "rm -r $AI/layout && echo final >$AI/layout"
+sync "$AN" >"$t/out" 2>&1 || fail "managed directory-to-file round trip: $(cat "$t/out")"
+o show "ws/$AN:notes/layout" | grep -qx final || fail "refresh lost replacement file"
+ok "native managed paths can change back from directories to files in refresh and propose"
+
+# Ancestor files and owned directory siblings must be reported before any index writes.
+NI=software/workspace-inherit/docs
+commit_on "ws/$AN" docs/blocked "owned ancestor"
+on_main "inherited descendant collision" sh -c "mkdir -p $NI/blocked && echo shared >$NI/blocked/guide.md"
+owned_head=$(o rev-parse "ws/$AN")
+for direction in refresh propose; do
+  if sync "$direction" >"$t/out" 2>"$t/err"; then fail "$direction replaced an owned ancestor"; fi
+  grep -q 'workspace-owned docs/blocked collides' "$t/err" || fail "$direction did not report the owned ancestor"
+  [ "$(o rev-parse "ws/$AN")" = "$owned_head" ] || fail "$direction changed the owned ancestor"
+done
+o show "ws/$BN:docs/blocked/guide.md" | grep -qx shared || fail "ancestor collision blocked another workspace"
+(cd "$t/dev" && git fetch -q && git checkout -q -B accept-descendant "origin/ws/$AN" &&
+  git rm -q docs/blocked && git commit -qm "accept managed descendant" && git push -q origin "HEAD:ws/$AN")
+sync refresh "$AN" >/dev/null
+commit_on "ws/$AN" docs/blocked/own.md "owned sibling"
+on_main "replace inherited directory around an owned sibling" sh -c "rm -r $NI/blocked && echo replacement >$NI/blocked"
+owned_head=$(o rev-parse "ws/$AN")
+for direction in refresh propose; do
+  if sync "$direction" "$AN" >"$t/out" 2>"$t/err"; then fail "$direction replaced an owned sibling"; fi
+  grep -q 'workspace-owned docs/blocked/own.md collides' "$t/err" || fail "$direction did not report the owned sibling"
+  [ "$(o rev-parse "ws/$AN")" = "$owned_head" ] || fail "$direction changed the owned sibling"
+done
+o show "ws/$AN:docs/blocked/own.md" | grep -qx 'owned sibling' || fail "owned sibling was lost"
+(cd "$t/dev" && git fetch -q && git checkout -q -B accept-replacement "origin/ws/$AN" &&
+  git rm -q docs/blocked/own.md && git commit -qm "accept managed replacement" && git push -q origin "HEAD:ws/$AN")
+sync refresh "$AN" >/dev/null
+ok "owned ancestors and directory siblings conflict explicitly while other workspaces keep refreshing"
+
+# New inheritance must not replace a file owned only on the workspace branch.
+commit_on "ws/$AN" notes/collision.txt "workspace-owned"
+on_main "new inherited collision" sh -c "echo shared >$AI/collision.txt"
+owned_head=$(o rev-parse "ws/$AN") proposal_head=$(o rev-parse "propose/$AN")
+for direction in refresh propose; do
+  if sync "$direction" "$AN" >"$t/out" 2>"$t/err"; then fail "$direction replaced an owned collision"; fi
+  grep -q 'workspace-owned notes/collision.txt collides' "$t/err" || fail "$direction did not report ownership"
+  [ "$(o rev-parse "ws/$AN")" = "$owned_head" ] || fail "$direction changed the workspace branch"
+  [ "$(o rev-parse "propose/$AN")" = "$proposal_head" ] || fail "$direction published the collision"
+done
+o show "ws/$AN:notes/collision.txt" | grep -qx workspace-owned || fail "owned content was lost"
+ok "refresh and propose report new inherited collisions without changing workspace-owned content"
+(cd "$t/dev" && git fetch -q && git checkout -q -B accept-inheritance "origin/ws/$AN" &&
+  git rm -q notes/collision.txt && git commit -qm "accept shared note" && git push -q origin "HEAD:ws/$AN")
+sync refresh "$AN" >/dev/null
+
+
+# Source retirement must preserve ownership claimed on a workspace branch before its proposal merges.
+on_main "unmerged ownership fixture" sh -c 'mkdir -p software/workspace-inherit/.claude/skills/unmerged; echo shared >software/workspace-inherit/.claude/skills/unmerged/SKILL.md'
+sync refresh "$BN" >/dev/null
+commit_on "ws/$BN" workspace.yml "  - .claude/skills/unmerged"
+commit_on "ws/$BN" .claude/skills/unmerged/SKILL.md "workspace-owned unmerged"
+sync refresh "$BN" >/dev/null
+on_main "retire unmerged source" git rm -rq software/workspace-inherit/.claude/skills/unmerged
+sync refresh "$BN" >"$t/out" 2>&1 || fail "retiring an unmerged opt-out conflicted: $(cat "$t/out")"
+(cd "$t/dev" && git fetch -q && git checkout -q -B retire-owned "origin/ws/$BN" &&
+  sed -i.bak '\|^  - .claude/skills/unmerged$|d' workspace.yml && rm workspace.yml.bak &&
+  git commit -qam "drop obsolete opt-out" && git push -q origin "HEAD:ws/$BN")
+sync "$BN" >"$t/out" 2>&1 || fail "unmerged owned copy proposal: $(cat "$t/out")"
+o show "ws/$BN:.claude/skills/unmerged/SKILL.md" | grep -qx 'workspace-owned unmerged' || fail "unmerged ownership was deleted"
+o show "propose/$BN:$B/.claude/skills/unmerged/SKILL.md" | grep -qx 'workspace-owned unmerged' || fail "unmerged ownership not proposed"
+ok "retiring a source and obsolete opt-out preserves workspace ownership before its proposal merges"
+
+# Retirement compares against reviewed provenance, even if the branch edits its ledger hash.
+RI=software/workspace-inherit/.claude/skills/retire-safety
+on_main "retirement safety fixture" sh -c "mkdir -p $RI && echo shared >$RI/SKILL.md"
+sync refresh >/dev/null
+(cd "$t/dev" && git fetch -q && git checkout -q -B edited-retirement "origin/ws/$AN" &&
+  echo owned >>.claude/skills/retire-safety/SKILL.md &&
+  blob=$(git hash-object .claude/skills/retire-safety/SKILL.md) &&
+  awk -F'\t' -v OFS='\t' -v blob="$blob" '$2 == ".claude/skills/retire-safety/SKILL.md" { $1 = "100644 " blob } { print }' workspace.generated >ledger.tmp &&
+  mv ledger.tmp workspace.generated && git add -A && git commit -qm "edit retired payload and ledger hash" && git push -q origin "HEAD:ws/$AN")
+on_main "retire safety source" git rm -rq "$RI"
+owned_head=$(o rev-parse "ws/$AN")
+for direction in refresh propose; do
+  if sync "$direction" >"$t/out" 2>"$t/err"; then fail "$direction deleted edited retired output"; fi
+  grep -q 'retired managed .claude/skills/retire-safety/SKILL.md has local edits' "$t/err" || fail "$direction did not report retired edits"
+  [ "$(o rev-parse "ws/$AN")" = "$owned_head" ] || fail "$direction changed edited retired output"
+done
+o show "ws/$AN:.claude/skills/retire-safety/SKILL.md" | grep -qx owned || fail "edited retired payload was lost"
+! o cat-file -e "ws/$BN:.claude/skills/retire-safety/SKILL.md" 2>/dev/null || fail "retirement failure blocked another workspace"
+(cd "$t/dev" && git fetch -q && git checkout -q -B accept-retirement "origin/ws/$AN" &&
+  git rm -q .claude/skills/retire-safety/SKILL.md && git commit -qm "accept retirement" && git push -q origin "HEAD:ws/$AN")
+sync refresh "$AN" >/dev/null
+ok "retired edits refuse refresh and propose against trusted hashes while other workspaces continue"
+
+RI=software/workspace-inherit/.claude/skills/retire-mode
+on_main "retirement mode fixture" sh -c "mkdir -p $RI && echo shared >$RI/SKILL.md && chmod +x $RI/SKILL.md"
+sync refresh "$AN" >/dev/null
+(cd "$t/dev" && git fetch -q && git checkout -q -B edited-retirement-mode "origin/ws/$AN" &&
+  chmod -x .claude/skills/retire-mode/SKILL.md && git commit -qam "edit retired executable mode" && git push -q origin "HEAD:ws/$AN")
+on_main "retire mode source" git rm -rq "$RI"
+owned_head=$(o rev-parse "ws/$AN")
+for direction in refresh propose; do
+  if sync "$direction" "$AN" >"$t/out" 2>"$t/err"; then fail "$direction deleted a mode-edited retired file"; fi
+  grep -q 'retired managed .claude/skills/retire-mode/SKILL.md has local edits' "$t/err" || fail "$direction did not report retired mode edit"
+  [ "$(o rev-parse "ws/$AN")" = "$owned_head" ] || fail "$direction changed a mode-edited retired file"
+done
+[ "$(o ls-tree "ws/$AN" .claude/skills/retire-mode/SKILL.md | cut -d' ' -f1)" = 100644 ] || fail "retired local mode was lost"
+(cd "$t/dev" && git fetch -q && git checkout -q -B accept-mode-retirement "origin/ws/$AN" &&
+  git rm -q .claude/skills/retire-mode/SKILL.md && git commit -qm "accept mode retirement" && git push -q origin "HEAD:ws/$AN")
+sync refresh "$AN" >/dev/null
+ok "branch retirement preserves executable-mode-only edits in both refresh and propose"
+
+RI=software/workspace-inherit/.claude/skills/retire-optout
+on_main "unsynced opt-out fixture" sh -c "mkdir -p $RI && echo shared >$RI/SKILL.md"
+sync refresh "$BN" >/dev/null
+commit_on "ws/$BN" workspace.yml "  - .claude/skills/retire-optout"
+commit_on "ws/$BN" .claude/skills/retire-optout/SKILL.md "owned before sync"
+on_main "retire unsynced opt-out source" git rm -rq "$RI"
+(cd "$t/dev" && git fetch -q && git checkout -q -B obsolete-optout "origin/ws/$BN" &&
+  sed -i.bak '\|^  - .claude/skills/retire-optout$|d' workspace.yml && rm workspace.yml.bak &&
+  git commit -qam "drop obsolete opt-out before syncing" && git push -q origin "HEAD:ws/$BN")
+owned_head=$(o rev-parse "ws/$BN")
+if sync refresh "$BN" >"$t/out" 2>"$t/err"; then fail "retirement deleted unsynced ownership"; fi
+[ "$(o rev-parse "ws/$BN")" = "$owned_head" ] || fail "unsynced owned output changed"
+o show "ws/$BN:.claude/skills/retire-optout/SKILL.md" | grep -qx 'owned before sync' || fail "unsynced ownership was lost"
+(cd "$t/dev" && git fetch -q && git checkout -q -B accept-optout-retirement "origin/ws/$BN" &&
+  git rm -q .claude/skills/retire-optout/SKILL.md && git commit -qm "accept retirement" && git push -q origin "HEAD:ws/$BN")
+sync refresh "$BN" >/dev/null
+ok "retirement preserves an opt-out rescinded before any intermediate sync by reporting the ambiguity"
+
+# A folder can move without changing its dotted workspace name or losing trusted ownership.
+d=$t/stable-name-rename
+git clone -q "$t/seed" "$d"
+bash -euo pipefail -s -- "$d" "$t/stable-name-origin.git" "$A" "$AN" <<'RENAME' >"$t/out" 2>"$t/err" || fail "stable-name ancestor rename: $(cat "$t/err")"
+cd "$1"
+origin=$2 folder=$3 name=$4
+project=${folder%/workspaces/*} leaf=${folder##*/}
+printf 'argos\n' >"$project/short-name"
+mkdir -p "$project/workspace-inherit/notes"
+echo shared >"$project/workspace-inherit/notes/project.txt"
+bash ci/render.sh
+git add -A; git commit -qm 'project inheritance before rename'
+git clone -q --bare . "$origin"
+git remote set-url origin "$origin"
+bash ci/sync.sh refresh "$name"
+git mv "$project" software/application-software/product
+bash ci/render.sh
+git add -A; git commit -qm 'move project with stable short name'; git push -q origin main
+folder=software/application-software/product/workspaces/$leaf
+bash ci/sync.sh refresh "$name"
+git -C "$origin" show "ws/$name:workspace.generated" | grep -q 'software/application-software/product/workspace-inherit/notes/project.txt'
+! git -C "$origin" show "ws/$name:workspace.generated" | grep -q 'software/application-software/argos/workspace-inherit/notes/project.txt'
+git fetch -q; git checkout -q -B edit "origin/ws/$name"
+echo 'active edit must reset' >notes/project.txt
+git commit -qam 'edit moved managed file'; git push -q origin "HEAD:ws/$name"; git checkout -q main
+bash ci/sync.sh refresh "$name"
+[ "$(git -C "$origin" show "ws/$name:notes/project.txt")" = shared ]
+echo updated >software/application-software/product/workspace-inherit/notes/project.txt
+git commit -qam 'update source after project move'; git push -q origin main
+bash ci/sync.sh refresh "$name"
+[ "$(git -C "$origin" show "ws/$name:notes/project.txt")" = updated ]
+git fetch -q; git checkout -q -B edit "origin/ws/$name"
+printf 'opt-out:\n  - notes/project.txt\n' >>workspace.yml
+echo 'owned after rename' >notes/project.txt
+echo 'owned proposal' >own.txt
+git add -A; git commit -qm 'own moved context'; git push -q origin "HEAD:ws/$name"; git checkout -q main
+bash ci/sync.sh refresh "$name"
+git rm -q software/application-software/product/workspace-inherit/notes/project.txt
+git commit -qm 'retire moved source'; git push -q origin main
+bash ci/sync.sh refresh "$name"
+git fetch -q; git checkout -q -B edit "origin/ws/$name"
+sed -i.bak '/^opt-out:$/d;\|^  - notes/project.txt$|d' workspace.yml; rm workspace.yml.bak
+git commit -qam 'drop obsolete exclusion'; git push -q origin "HEAD:ws/$name"; git checkout -q main
+bash ci/sync.sh "$name"
+[ "$(git -C "$origin" show "propose/$name:$folder/notes/project.txt")" = 'owned after rename' ]
+[ "$(git -C "$origin" show "propose/$name:$folder/own.txt")" = 'owned proposal' ]
+! git -C "$origin" cat-file -e "propose/$name:$folder/workspace.generated" 2>/dev/null
+RENAME
+ok "a stable-name ancestor move preserves source origins, reset, updates, opt-out retirement and owned proposals"
+
+# A metadata-only move is a no-op even when its unmerged workspace has ordinary manifest edits.
+for rename_timing in before after; do
+  for rename_direction in refresh propose; do
+    d=$t/rename-manifest-$rename_timing-$rename_direction
+    git clone -q "$t/seed" "$d"
+    bash -euo pipefail -s -- "$d" "$d-origin.git" "$A" "$AN" "$rename_timing" "$rename_direction" <<'MANIFEST' >"$t/out" 2>"$t/err" || fail "rename manifest $rename_timing/$rename_direction: $(cat "$t/err")"
+cd "$1"
+origin=$2 folder=$3 name=$4 timing=$5 direction=$6
+project=${folder%/workspaces/*} leaf=${folder##*/}
+printf 'argos\n' >"$project/short-name"
+git rm -rq "$folder/CLAUDE.md" "$folder/.claude"
+printf '# Codex rename fixture\n' >"$folder/AGENTS.md"
+printf 'name: %s\nharness: codex\n' "$name" >"$folder/workspace.yml"
+mkdir -p software/workspace-inherit/notes
+echo shared >software/workspace-inherit/notes/common.txt
+bash ci/render.sh
+git add -A; git commit -qm 'metadata rename baseline'
+git clone -q --bare . "$origin"
+git remote set-url origin "$origin"
+bash ci/sync.sh refresh "$name"
+before=$(git -C "$origin" rev-parse "ws/$name")
+git mv "$project" software/application-software/product
+bash ci/render.sh
+git add -A; git commit -qm 'metadata-only project move'; git push -q origin main
+folder=software/application-software/product/workspaces/$leaf
+if [ "$timing" = after ]; then
+  bash ci/sync.sh refresh "$name"
+  [ "$(git -C "$origin" rev-parse "ws/$name")" = "$before" ]
+fi
+git fetch -q; git checkout -q -B edit "origin/ws/$name"
+printf 'repos:\n  sample: https://example.invalid/sample.git\n' >>workspace.yml
+git commit -qam 'ordinary workspace manifest edit'; git push -q origin "HEAD:ws/$name"; git checkout -q main
+owned=$(git -C "$origin" rev-parse "ws/$name")
+bash ci/sync.sh "$direction" "$name"
+git -C "$origin" show "ws/$name:workspace.yml" | grep -qx '  sample: https://example.invalid/sample.git'
+[ "$(git -C "$origin" show "ws/$name:notes/common.txt")" = shared ]
+[ "$(git -C "$origin" rev-parse "ws/$name")" = "$owned" ]
+bash ci/sync.sh propose "$name"
+git -C "$origin" show "propose/$name:$folder/workspace.yml" | grep -qx '  sample: https://example.invalid/sample.git'
+! git -C "$origin" cat-file -e "propose/$name:$folder/workspace.generated" 2>/dev/null
+! git -C "$origin" cat-file -e "propose/$name:$folder/notes/common.txt" 2>/dev/null
+if [ "$timing/$direction" = after/propose ]; then
+  # Once a proposal merges, Git may use its workspace-shaped ancestor as the next merge base.
+  git fetch -q; git merge -q --no-ff --no-edit "origin/propose/$name"; git push -q origin main
+  sed -i.bak 's|https://example.invalid/sample.git|https://example.invalid/main.git|' "$folder/workspace.yml"
+  rm "$folder/workspace.yml.bak"
+  git commit -qam 'main edits the same repository'; git push -q origin main
+  git checkout -q -B edit "origin/ws/$name"
+  sed -i.bak 's|https://example.invalid/sample.git|https://example.invalid/branch.git|' workspace.yml
+  rm workspace.yml.bak
+  git commit -qam 'workspace edits the same repository'; git push -q origin "HEAD:ws/$name"; git checkout -q main
+  owned=$(git -C "$origin" rev-parse "ws/$name")
+  proposal=$(git -C "$origin" rev-parse "propose/$name")
+  for attempt in refresh propose; do
+    if bash ci/sync.sh "$attempt" "$name" >conflict.log 2>&1; then exit 1; fi
+    grep -q CONFLICT conflict.log; grep -q workspace.yml conflict.log
+    [ "$(git -C "$origin" rev-parse "ws/$name")" = "$owned" ]
+    [ "$(git -C "$origin" rev-parse "propose/$name")" = "$proposal" ]
+  done
+  git -C "$origin" show "main:$folder/workspace.yml" | grep -qx '  sample: https://example.invalid/main.git'
+  git -C "$origin" show "ws/$name:workspace.yml" | grep -qx '  sample: https://example.invalid/branch.git'
+fi
+MANIFEST
+  done
+done
+ok "metadata-only stable-name moves preserve ordinary manifest edits before or after refresh and in propose-only runs"
+ok "after a moved workspace proposal merges, same-key manifest conflicts preserve both refs and contents"
+
+# A new source and its main-side exclusion must reach an already-created Codex branch together.
+d=$t/sync-source-exclusion
+git clone -q "$t/seed" "$d"
+bash -euo pipefail -s -- "$d" "$d-origin.git" "$A" "$AN" <<'EXCLUSION' >"$t/out" 2>"$t/err" || fail "sync source exclusion: $(cat "$t/err")"
+cd "$1"
+origin=$2 folder=$3 name=$4
+git rm -rq "$folder/CLAUDE.md" "$folder/.claude"
+echo '# Codex' >"$folder/AGENTS.md"
+printf 'name: %s\nharness: codex\n' "$name" >"$folder/workspace.yml"
+bash ci/render.sh; git add -A; git commit -qm 'Codex exclusion baseline'
+git clone -q --bare . "$origin"; git remote set-url origin "$origin"
+bash ci/sync.sh refresh "$name"
+git fetch -q; git checkout -q -B edit "origin/ws/$name"
+echo owned >own.txt; git add own.txt; git commit -qm 'workspace owned change'
+git push -q origin "HEAD:ws/$name"; git checkout -q main
+before=$(git -C "$origin" rev-parse "ws/$name")
+mkdir -p software/workspace-inherit/.claude/commands software/workspace-inherit/notes
+echo 'Claude command' >software/workspace-inherit/.claude/commands/x.md
+echo shared >software/workspace-inherit/notes/arrived.txt
+printf 'opt-out:\n  - .claude/commands\n' >>"$folder/workspace.yml"
+bash ci/render.sh; bash ci/check.sh
+git add -A; git commit -qm 'add source with its target exclusion'; git push -q origin main
+bash ci/sync.sh propose "$name"
+[ "$(git -C "$origin" rev-parse "ws/$name")" = "$before" ]
+[ "$(git -C "$origin" show "propose/$name:$folder/own.txt")" = owned ]
+[ "$(git -C "$origin" rev-parse "propose/$name^2")" = "$before" ]
+bash ci/sync.sh refresh "$name"
+after=$(git -C "$origin" rev-parse "ws/$name")
+[ "$(git -C "$origin" rev-parse "$after^1")" = "$before" ]
+[ "$(git -C "$origin" rev-parse "$after^2")" = "$(git -C "$origin" rev-parse main)" ]
+[ "$(git -C "$origin" rev-list --count "$before..$after" --not main)" = 1 ]
+git -C "$origin" show "$after:workspace.yml" | grep -qx '  - .claude/commands'
+[ "$(git -C "$origin" show "$after:notes/arrived.txt")" = shared ]
+[ "$(git -C "$origin" show "$after:own.txt")" = owned ]
+! git -C "$origin" cat-file -e "$after:.claude/commands/x.md" 2>/dev/null
+bash ci/sync.sh refresh "$name"
+[ "$(git -C "$origin" rev-parse "ws/$name")" = "$after" ]
+EXCLUSION
+ok "main source additions and exclusions sync together in both directions; refresh publishes one real merge and repeats unchanged"
+
+# The incoming harness is selected after the merge, and its skill renderer runs once.
+d=$t/merge-first
+git clone -q "$t/seed" "$d"
+bash -euo pipefail -s -- "$d" "$d-origin.git" "$A" "$AN" <<'MERGE_FIRST' >"$t/out" 2>"$t/err" || fail "merge-first generation: $(cat "$t/err")"
+cd "$1"
+origin=$2 folder=$3 name=$4
+for descriptor in ci/harnesses/claude-code.sh ci/harnesses/codex.sh; do
+  cat >>"$descriptor" <<'TRACE'
+eval "$(declare -f translate_skill | sed '1s/translate_skill/original_translate_skill/')"
+translate_skill() {
+  if [ -n "${DELPHI_RENDER_TRACE:-}" ]; then
+    printf '%s|%s|%s\n' "$(cat "$harness_dir/../../render-revision")" \
+      "$(awk '/^harness:/ { print $2 }' "$folder/workspace.yml")" \
+      "$(awk '/^  sample:/ { print $2 }' "$folder/workspace.yml")" >>"$DELPHI_RENDER_TRACE"
+  fi
+  original_translate_skill "$@"
+}
+TRACE
+done
+echo old >render-revision
+echo base >"$folder/owned.txt"
+git rm -rq --ignore-unmatch "$folder/.claude/skills"
+printf 'name: %s\nharness: claude-code\nworkspaces:\n  - main\n' "$name" >"$folder/workspace.yml"
+mkdir -p software/workspace-inherit/.claude/skills/render-order
+printf '%s\n' '---' 'name: render-order' 'description: Render order fixture' '---' 'Read CLAUDE.md.' >software/workspace-inherit/.claude/skills/render-order/SKILL.md
+bash ci/render.sh; git add -A; git commit -qm 'merge-first baseline'
+git clone -q --bare . "$origin"; git remote set-url origin "$origin"
+bash ci/sync.sh refresh "$name"
+git fetch -q; git checkout -q -B edit "origin/ws/$name"
+printf 'repos:\n  sample: https://example.invalid/branch.git\n' >>workspace.yml
+git commit -qam 'branch-owned repository choice'; git push -q origin "HEAD:ws/$name"; git checkout -q main
+before=$(git -C "$origin" rev-parse "ws/$name")
+echo new >render-revision
+git rm -rq "$folder/CLAUDE.md" "$folder/.claude"
+echo '# Codex workspace' >"$folder/AGENTS.md"
+printf 'name: %s\nharness: codex\nworkspaces:\n  - main\n' "$name" >"$folder/workspace.yml"
+bash ci/render.sh; bash ci/check.sh
+git add -A; git commit -qm 'main selects the next harness'; git push -q origin main
+DELPHI_RENDER_TRACE=$PWD/render-trace.log bash ci/sync.sh refresh "$name"
+[ "$(grep -c '^new|' render-trace.log)" = 1 ]
+grep -qx 'new|codex|https://example.invalid/branch.git' render-trace.log
+[ "$(head -n 1 render-trace.log)" = 'new|codex|https://example.invalid/branch.git' ]
+after=$(git -C "$origin" rev-parse "ws/$name")
+[ "$(git -C "$origin" rev-parse "$after^1")" = "$before" ]
+[ "$(git -C "$origin" rev-parse "$after^2")" = "$(git -C "$origin" rev-parse main)" ]
+git -C "$origin" show "$after:.agents/skills/render-order/SKILL.md" | grep -qx 'Read AGENTS.md.'
+! git -C "$origin" cat-file -e "$after:.claude/skills/render-order/SKILL.md" 2>/dev/null
+
+# A retired managed path can become an explicitly owned file on main.
+git rm -rq software/workspace-inherit/.claude/skills/render-order
+mkdir -p "$folder/.agents/skills/render-order"
+printf '%s\n' '---' 'name: render-order' 'description: Owned fixture' '---' 'Owned on main.' >"$folder/.agents/skills/render-order/SKILL.md"
+bash ci/render.sh; git add -A; git commit -qm 'replace inheritance with owned native context'; git push -q origin main
+bash ci/sync.sh refresh "$name"
+git -C "$origin" show "ws/$name:.agents/skills/render-order/SKILL.md" | grep -qx 'Owned on main.'
+! git -C "$origin" show "ws/$name:workspace.generated" | grep -q 'render-order/SKILL.md'
+
+# A forged ledger cannot hide a real conflict in an owned file.
+git fetch -q; git checkout -q -B edit "origin/ws/$name"
+echo branch >owned.txt
+printf '100644 %s\towned.txt\tsoftware/workspace-inherit/fake.txt\n' "$(git hash-object owned.txt)" >>workspace.generated
+git commit -qam 'forge an owned-file claim'; git push -q origin "HEAD:ws/$name"; git checkout -q main
+echo main >"$folder/owned.txt"
+git commit -qam 'main edits the same owned file'; git push -q origin main
+before=$(git -C "$origin" for-each-ref --format='%(refname) %(objectname)' "refs/heads/ws/$name" "refs/heads/propose/$name")
+for direction in refresh propose; do
+  if bash ci/sync.sh "$direction" "$name" >conflict.log 2>&1; then exit 1; fi
+  grep -q 'untrusted managed path owned.txt' conflict.log
+  [ "$(git -C "$origin" for-each-ref --format='%(refname) %(objectname)' "refs/heads/ws/$name" "refs/heads/propose/$name")" = "$before" ]
+done
+[ "$(git -C "$origin" show "ws/$name:owned.txt")" = branch ]
+[ "$(git -C "$origin" show "main:$folder/owned.txt")" = main ]
+MERGE_FIRST
+ok "refresh renders the merged harness/configuration once, then publishes one commit"
+ok "retired inheritance preserves main-owned replacements; forged ledgers cannot bypass owned-file conflicts"
+
+d=$t/branch-only-harness
+git clone -q "$t/seed" "$d"
+bash -euo pipefail -s -- "$d" "$d-origin.git" "$A" "$AN" <<'BRANCH_HARNESS' >"$t/out" 2>"$t/err" || fail "branch-only harness: $(cat "$t/err")"
+cd "$1"
+origin=$2 folder=$3 name=$4
+git rm -rq --ignore-unmatch "$folder/.claude/skills"
+git add -A; git commit -qm 'branch harness fixture'
+git clone -q --bare . "$origin"; git remote set-url origin "$origin"
+bash ci/sync.sh refresh "$name"
+git fetch -q; git checkout -q -B edit "origin/ws/$name"
+git mv CLAUDE.md AGENTS.md
+awk '/^plugins:/ { skip = 1; next } /^[^[:space:]#]/ { skip = 0 } !skip { print }' workspace.yml >manifest.tmp
+sed 's/harness: claude-code/harness: codex/' manifest.tmp >workspace.yml; rm manifest.tmp
+git commit -qam 'branch selects Codex before main'; git push -q origin "HEAD:ws/$name"; git checkout -q main
+bash ci/sync.sh refresh "$name"
+! git -C "$origin" cat-file -e "ws/$name:.claude/settings.json" 2>/dev/null
+git -C "$origin" show "main:$folder/workspace.yml" | grep -qx 'harness: claude-code'
+git -C "$origin" cat-file -e "main:$folder/.claude/settings.json"
+bash ci/sync.sh propose "$name"
+git -C "$origin" show "propose/$name:$folder/workspace.yml" | grep -qx 'harness: codex'
+! git -C "$origin" cat-file -e "propose/$name:$folder/.claude/settings.json" 2>/dev/null
+BRANCH_HARNESS
+ok "branch-only harness switches retire generated settings while main keeps the original harness"
+
+# A failed main-candidate generator must leave the temporary worktree ready for the next workspace.
+d=$t/proposal-isolation
+git clone -q "$t/seed" "$d"
+bash -euo pipefail -s -- "$d" "$d-origin.git" "$A" "$AN" "$B" "$BN" <<'ISOLATION' >"$t/out" 2>"$t/err" || fail "proposal failure isolation: $(cat "$t/err")"
+cd "$1"
+origin=$2 a=$3 an=$4 b=$5 bn=$6
+mv ci/render.sh ci/render-base.sh
+cat >ci/render.sh <<'WRAPPER'
+#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in --workspace) ;; *)
+  if [ -f "${1:-.}/software/application-software/argos/workspaces/argos-dev/fail-proposal.txt" ]; then
+    echo 'forced proposal render failure' >&2; exit 1
+  fi ;;
+esac
+exec bash "$(dirname "$0")/render-base.sh" "$@"
+WRAPPER
+git add -A; git commit -qm 'proposal isolation fixture'
+git clone -q --bare . "$origin"; git remote set-url origin "$origin"
+bash ci/sync.sh refresh
+git fetch -q
+for name in "$an" "$bn"; do
+  git checkout -q -B edit "origin/ws/$name"
+  file=surviving-proposal.txt; [ "$name" != "$an" ] || file=fail-proposal.txt
+  echo owned >"$file"; git add "$file"; git commit -qm 'workspace edit'
+  git push -q origin "HEAD:ws/$name"
+done
+git checkout -q main
+if bash ci/sync.sh propose >isolation.log 2>&1; then exit 1; fi
+grep -q 'forced proposal render failure' isolation.log
+! git -C "$origin" rev-parse --quiet --verify "refs/heads/propose/$an" >/dev/null
+[ "$(git -C "$origin" show "propose/$bn:$b/surviving-proposal.txt")" = owned ]
+[ "$(git -C "$origin" diff --name-only main "propose/$bn")" = "$b/surviving-proposal.txt" ]
+ISOLATION
+ok "a failed proposal generator preserves other workspace proposals without leaking its candidate files"
+
 # --- 5. a conflict on bms-dev is reported; argos-dev still syncs; exit 1
 commit_on ws/$BN CLAUDE.md "ws side"
 commit_on main "$B/CLAUDE.md" "main side"
@@ -264,6 +692,31 @@ expect_bad() { # <label> <expected message> <setup command...>: copy the real la
   grep -q -- "$want" "$t/err" || fail "check $label: no '$want' in: $(cat "$t/err")"
   ok "check fails: $label ($want)"
 }
+CX=software/application-software/argos/workspaces/default-codex
+expect_bad unknown-harness "unknown harness 'unknown'" sed -i.bak 's/harness: codex/harness: unknown/' "$CX/workspace.yml"
+expect_bad codex-plugin "codex does not support Delphi plugin sets" sh -c "printf 'plugins:\n  - delphi\n' >>$CX/workspace.yml"
+expect_bad codex-no-instructions "AGENTS.md: required for codex" rm "$CX/AGENTS.md"
+expect_bad codex-wrong-native "CLAUDE.md: belongs to a different harness" touch "$CX/CLAUDE.md"
+expect_bad codex-unmapped-identifier 'codex: missing Claude mapping for mcp__unmapped__new_tool' sh -c 'echo "Use mcp__unmapped__new_tool." >>software/workspace-inherit/.claude/skills/journal/SKILL.md'
+expect_bad codex-inherited-wrong-native "has no mapping to codex" sh -c "mkdir -p software/workspace-inherit/.claude && printf 'format: claude-code\\n' >software/workspace-inherit/source.yml && echo x >software/workspace-inherit/.claude/extra.json"
+expect_bad inherited-collision "also inherits it from a folder above" sh -c "mkdir -p software/application-software/workspace-inherit/.claude/skills/journal && echo x >software/application-software/workspace-inherit/.claude/skills/journal/SKILL.md"
+expect_bad main-inherited-copy "workspace-owned file collides" sh -c "mkdir -p $CX/.agents/skills/journal && cp software/workspace-inherit/.claude/skills/journal/SKILL.md $CX/.agents/skills/journal/SKILL.md"
+expect_bad main-ownership-record "ownership records belong only on workspace branches" touch "$CX/workspace.generated"
+expect_bad unknown-source-format "declare one supported source format" sh -c "echo 'format: unknown' >${A%/workspaces/*}/workspace-defaults/source.yml"
+expect_bad mixed-source-formats "AGENTS.md does not belong to the declared claude-code format" touch "${A%/workspaces/*}/workspace-defaults/AGENTS.md"
+expect_bad owned-output-collision "workspace-owned file collides" sh -c "mkdir -p software/workspace-inherit/.claude/skills/collision $CX/.agents/skills/collision && echo shared >software/workspace-inherit/.claude/skills/collision/SKILL.md && echo own >$CX/.agents/skills/collision/SKILL.md"
+source_with_name() { mkdir -p "$1"; printf x >"$1/$2"; }
+expect_bad inherited-space-path 'unsafe path' source_with_name software/workspace-inherit/docs 'has space.md'
+printf -v unsafe_tab 'has\tname.md'
+expect_bad inherited-tab-path 'unsafe path' source_with_name software/workspace-inherit/docs "$unsafe_tab"
+printf -v unsafe_newline 'has\nname.md'
+expect_bad inherited-newline-path 'unsafe path' source_with_name software/workspace-inherit/docs "$unsafe_newline"
+
+d=$t/chk-owned-output-collision
+if "$src/ci/render.sh" "$d" >"$t/out" 2>"$t/err"; then fail "renderer overwrote an owned collision"; fi
+[ "$(cat "$d/$CX/.agents/skills/collision/SKILL.md")" = own ] || fail "renderer changed the workspace-owned file"
+ok "main-side generation refuses an owned collision and preserves its content"
+
 expect_bad no-harness "harness is missing" sh -c "sed -i.bak 's/^harness:.*//' $A/workspace.yml && rm $A/workspace.yml.bak"
 expect_bad duplicate-harness "duplicate harness" sh -c "printf 'harness: x\n' >>$A/workspace.yml"
 expect_bad bad-repo "bad repos entry" sh -c "awk '{ print } /^repos:/ { print \"  ../x: y\" }' $A/workspace.yml >$A/y && mv $A/y $A/workspace.yml"
@@ -312,15 +765,109 @@ expect_bad workflow-drift "argos-dev/.github/workflows/delphi.yml: differs" sh -
 expect_bad defaults-manifest "workspace-defaults/workspace.yml: unexpected line" sh -c "printf 'x: y\n' >>${A%/workspaces/*}/workspace-defaults/workspace.yml"
 expect_bad defaults-named-workspace "workspace-defaults/.delphi: managed" sh -c "mkdir -p software/x/workspaces/workspace-defaults/.delphi && cp -R $A/. software/x/workspaces/workspace-defaults/"
 expect_bad old-defaults "defaults: renamed workspace-defaults/" mkdir -p "${A%/workspaces/*}/defaults"
-expect_bad inherited-file-kept "$A/.claude/skills/journal/SKILL.md: inherited from software/workspace-inherit/" sh -c "mkdir -p $A/.claude/skills/journal && echo x >$A/.claude/skills/journal/SKILL.md"
-expect_bad inherited-twice "also inherits it from a folder above" sh -c "mkdir -p software/application-software/workspace-inherit/.claude/skills/journal && echo x >software/application-software/workspace-inherit/.claude/skills/journal/SKILL.md"
-expect_bad inherited-claude-md "software/workspace-inherit/CLAUDE.md: each workspace has its own" sh -c "echo x >software/workspace-inherit/CLAUDE.md"
+expect_bad inherited-file-kept "workspace-owned file collides" sh -c "mkdir -p $A/.claude/skills/journal && echo x >$A/.claude/skills/journal/SKILL.md"
+d=$t/chk-inherited-file-kept
+if "$src/ci/render.sh" "$d" >"$t/out" 2>"$t/err"; then fail "renderer overwrote main-owned output"; fi
+[ "$(cat "$d/$A/.claude/skills/journal/SKILL.md")" = x ] || fail "main-owned output changed"
+ok "main rejects inherited copies and preserves conflicting owned content"
+
+expect_bad managed-file-to-owned-directory 'workspace-owned file collides' sh -c "mkdir -p $A/.claude/skills/journal/SKILL.md && echo owned >$A/.claude/skills/journal/SKILL.md/own"
+d=$t/chk-managed-file-to-owned-directory
+if "$src/ci/render.sh" "$d" >"$t/out" 2>"$t/err"; then fail "renderer wrote managed output into an owned directory"; fi
+[ "$(cat "$d/$A/.claude/skills/journal/SKILL.md/own")" = owned ] || fail "owned directory contents changed"
+[ -n "$(find "$d/$A/.claude/skills/journal/SKILL.md" -prune -perm -100)" ] || fail "owned directory traversal mode changed"
+ok "staging refuses an inherited destination occupied by an owned directory without chmod or copy"
+
+expect_bad topology-empty-directory 'workspace-owned file collides' sh -c "mkdir -p $A/.claude/skills/journal/empty && rm -r software/workspace-inherit/.claude/skills/journal && echo replacement >software/workspace-inherit/.claude/skills/journal"
+d=$t/chk-topology-empty-directory
+if "$src/ci/render.sh" "$d" >"$t/out" 2>"$t/err"; then fail "renderer replaced an untracked empty directory"; fi
+[ -d "$d/$A/.claude/skills/journal/empty" ] || fail "untracked empty directory was removed"
+ok "staging preserves untracked empty directories at inherited destinations"
+
+expect_bad render-symlink 'symlinks are not allowed' sh -c "mkdir -p $A/.claude/skills/journal && cp software/workspace-inherit/.claude/skills/journal/SKILL.md outside-symlink-target && ln -s ../../../../../../../../outside-symlink-target $A/.claude/skills/journal/SKILL.md && echo changed >>software/workspace-inherit/.claude/skills/journal/SKILL.md"
+d=$t/chk-render-symlink
+cp "$d/outside-symlink-target" "$t/symlink-target-before"
+if "$src/ci/render.sh" "$d" >"$t/out" 2>"$t/err"; then fail "renderer followed a symlink"; fi
+cmp -s "$d/outside-symlink-target" "$t/symlink-target-before" || fail "renderer changed a symlink target"
+ok "render refuses symlinks before changing any generated output"
+
+d=$t/staging
+mkdir "$d"
+cp -R "$src/ci" "$src/software" "$src/templates" "$src/.github" "$src/.delphi" "$src/.claude-plugin" "$d/"
+(cd "$d" && git init -q && chmod +x software/workspace-inherit/.claude/skills/journal/scripts/capture.sh &&
+  mkdir -p software/workspace-inherit/docs/C++ && printf 'portable punctuation\n' >software/workspace-inherit/docs/C++/@config.md &&
+  printf 'ordinary body-named document\n' >software/workspace-inherit/docs/BODY.codex.md &&
+  echo changed >>software/workspace-inherit/.claude/skills/journal/SKILL.md && git add -A && git commit -qm source-change &&
+  bash ci/check.sh . && bash ci/render.sh --check . "$t/staged-native" &&
+  bash ci/render.sh . "$t/staged-native-again" && [ -z "$(git status --porcelain)" ]) >"$t/out" 2>"$t/err" || fail "read-only staging: $(cat "$t/err")"
+diff -qr "$t/staged-native" "$t/staged-native-again" >/dev/null || fail "repeated staging changed native output"
+for folder in "$A" "$CX"; do
+  [ -f "$t/staged-native/$folder/workspace.generated" ] || fail "staging lacks ownership metadata"
+  [ ! -e "$d/$folder/workspace.generated" ] || fail "staging wrote a ledger to main"
+done
+[ ! -e "$d/$CX/.agents/skills/journal/SKILL.md" ] || fail "staging wrote inherited skills to main"
+cmp -s "$d/software/workspace-inherit/docs/C++/@config.md" "$t/staged-native/$CX/docs/C++/@config.md" || fail "staging rejected or changed supported +/@ filenames"
+cmp -s "$d/software/workspace-inherit/docs/BODY.codex.md" "$t/staged-native/$CX/docs/BODY.codex.md" || fail "a BODY filename outside a skill was incorrectly omitted"
+while IFS=$'\t' read -r meta path _; do
+  case "$meta" in '' | '#'* ) continue ;; esac
+  [ "$(git -C "$d" hash-object -- "$t/staged-native/$CX/$path")" = "${meta#* }" ] || fail "staged ledger hash differs from native bytes"
+  if [ "${meta%% *}" = 100755 ]; then [ -x "$t/staged-native/$CX/$path" ] || fail "staged executable mode lost"; fi
+done <"$t/staged-native/$CX/workspace.generated"
+[ -x "$t/staged-native/$CX/.agents/skills/journal/scripts/capture.sh" ] || fail "staged helper lost executable mode"
+ok "source edits validate without main copies; staged native hashes, modes and repeat output are stable and leave main unchanged"
+echo stale-marker >>"$d/$A/.claude/settings.json"
+"$d/ci/render.sh" --workspace "$CX" "$d" "$t/staged-one" >"$t/out" 2>"$t/err" || fail "workspace-only staging: $(cat "$t/err")"
+grep -q stale-marker "$d/$A/.claude/settings.json" || fail "workspace-only staging rewrote global plugin output"
+[ -f "$t/staged-one/$CX/workspace.generated" ] && [ ! -e "$t/staged-one/$A" ] || fail "workspace-only staging included another workspace"
+if "$d/ci/render.sh" --workspace "$CX" "$d" >"$t/out" 2>"$t/err"; then fail "workspace-only staging accepted no output directory"; fi
+if "$d/ci/render.sh" "$d" "$d/staging" >"$t/out" 2>"$t/err"; then fail "staging output inside main was accepted"; fi
+ok "workspace-only staging requires an external output directory and skips global plugin generation"
+git -C "$d" checkout -q -- "$A/.claude/settings.json"
+mkdir "$t/staged-symlink"
+ln -s "$d/software" "$t/staged-symlink/software"
+owned_instruction=$(git -C "$d" hash-object "$CX/AGENTS.md")
+if "$d/ci/render.sh" --workspace "$CX" "$d" "$t/staged-symlink" >"$t/out" 2>"$t/err"; then fail "staging followed an output symlink into main"; fi
+grep -q 'symlink' "$t/err" || fail "unsafe staging symlink was not reported"
+[ "$(git -C "$d" hash-object "$CX/AGENTS.md")" = "$owned_instruction" ] || fail "staging output symlink changed main-owned instructions"
+[ -z "$(git -C "$d" status --porcelain)" ] || fail "refused staging output changed main"
+ok "staging refuses output symlinks before touching main-owned workspace data"
+
+d=$t/source-exclusions
+mkdir "$d"
+cp -R "$src/ci" "$src/software" "$src/templates" "$src/.github" "$src/.delphi" "$src/.claude-plugin" "$d/"
+mkdir -p "$d/software/application-software/argos/workspace-inherit/.claude/commands" "$d/$CX/.agents/skills/journal"
+mkdir -p "$d/software/workspace-inherit/docs/C++" "$d/$CX/docs/C++"
+echo 'Claude-only command' >"$d/software/application-software/argos/workspace-inherit/.claude/commands/only.md"
+echo 'owned native skill' >"$d/$CX/.agents/skills/journal/SKILL.md"
+echo 'shared punctuation' >"$d/software/workspace-inherit/docs/C++/@config.md"
+echo 'owned punctuation' >"$d/$CX/docs/C++/@config.md"
+printf 'opt-out:\n  - .claude/commands\n  - .agents/skills/journal\n  - docs/C++/@config.md\n' >>"$d/$CX/workspace.yml"
+(cd "$d" && git init -q && git add -A && git commit -qm exclusions &&
+  bash ci/render.sh --check . "$t/excluded-stage" && bash ci/check.sh .) >"$t/out" 2>"$t/err" || fail "source exclusions before mapping: $(cat "$t/err")"
+[ ! -e "$t/excluded-stage/$CX/.claude/commands" ] && [ ! -e "$t/excluded-stage/$CX/.agents/skills/journal" ] || fail "excluded source or native output was staged"
+[ "$(cat "$d/$CX/.agents/skills/journal/SKILL.md")" = 'owned native skill' ] || fail "native opt-out lost owned content"
+[ ! -e "$t/excluded-stage/$CX/docs/C++/@config.md" ] && [ "$(cat "$d/$CX/docs/C++/@config.md")" = 'owned punctuation' ] || fail "+/@ opt-out key was not respected"
+cmp -s "$d/software/application-software/argos/workspace-inherit/.claude/commands/only.md" "$t/excluded-stage/$A/.claude/commands/only.md" || fail "Claude-native command was not inherited by Claude"
+cp "$d/$CX/workspace.yml" "$t/source-exclusion-manifest"
+sed -i.bak '\|^  - .claude/commands$|d' "$d/$CX/workspace.yml"; rm "$d/$CX/workspace.yml.bak"
+if "$d/ci/render.sh" --check "$d" >"$t/out" 2>"$t/err"; then fail "unsupported unexcluded native command mapping was accepted"; fi
+grep -q 'has no mapping to codex' "$t/err" || fail "unsupported native command mapping was not explained"
+cp "$t/source-exclusion-manifest" "$d/$CX/workspace.yml"
+sed -i.bak 's|.agents/skills/journal|.claude/skills/journal|' "$d/$CX/workspace.yml"; rm "$d/$CX/workspace.yml.bak"
+if "$d/ci/render.sh" --workspace "$CX" "$d" "$t/wrong-native-exclusion" >"$t/out" 2>"$t/err"; then fail "mapped skill accepted a source-path ownership exclusion"; fi
+grep -q 'must use its native destination' "$t/err" || fail "mapped skill exclusion did not explain its native destination"
+[ "$(cat "$d/$CX/.agents/skills/journal/SKILL.md")" = 'owned native skill' ] || fail "wrong source exclusion changed native owned content"
+ok "source-native exclusions run before mapping while native destination opt-outs preserve owned files"
+
+expect_bad inherited-twice "also inherits it from a folder above" sh -c "mkdir -p software/application-software/workspace-inherit/.claude/skills/journal && printf 'format: claude-code\\n' >software/application-software/workspace-inherit/source.yml && echo x >software/application-software/workspace-inherit/.claude/skills/journal/SKILL.md"
+expect_bad inherited-claude-md "software/workspace-inherit/CLAUDE.md: each workspace has its own" sh -c "mkdir -p software/workspace-inherit && printf 'format: claude-code\\n' >software/workspace-inherit/source.yml && echo x >software/workspace-inherit/CLAUDE.md"
 expect_bad inherit-in-workspace "belongs in an org or project folder" sh -c "mkdir -p $A/workspace-inherit && echo x >$A/workspace-inherit/f"
 expect_bad bad-opt-out "bad opt-out entry" sh -c "printf 'opt-out:\n  - ../x\n' >>$A/workspace.yml"
 expect_bad opt-out-nothing "opt-out: nope is nothing it inherits" sh -c "printf 'opt-out:\n  - nope\n' >>$A/workspace.yml"
 d=$t/chk-opt-out && rm -rf "$d" && mkdir "$d" && cp -R "$src/software" "$src/templates" "$src/.github" "$src/.delphi" "$src/.claude-plugin" "$d/"
 (cd "$d" && git init -q && mkdir -p $A/.claude/skills/journal && echo x >$A/.claude/skills/journal/SKILL.md &&
   printf 'opt-out:\n  - .claude/skills/journal/\n' >>$A/workspace.yml && git add -A && git commit -qm base)
+"$src/ci/render.sh" "$d" >/dev/null 2>&1 || fail "opt-out rendering failed"
 "$src/ci/check.sh" "$d" >/dev/null 2>&1 || fail "check fails on a workspace keeping an inherited path it opts out of"
 ok "a workspace may keep its own copy of an inherited path it lists under opt-out:"
 expect_bad links-renamed "links: is now workspaces:" sh -c "sed -i.bak 's/^workspaces:/links:/' $A/workspace.yml && rm $A/workspace.yml.bak"
@@ -472,7 +1019,8 @@ o show "new-workspace/electrical/firmware/fw-dev:$F/CLAUDE.md" | grep -qx "# Fir
   fail "defaults workspace.yml not used, or name: not set"
 o cat-file -e "new-workspace/electrical/firmware/fw-dev:$F/.claude/skills/fw/SKILL.md" || fail "defaults skill not copied"
 o cat-file -e "new-workspace/electrical/firmware/fw-dev:$F/.claude/settings.json" || fail "new workspace has no generated settings.json"
-! o cat-file -e "new-workspace/electrical/firmware/fw-dev:$F/.claude/skills/top/SKILL.md" 2>/dev/null || fail "an inherited skill was copied into the folder"
+! o cat-file -e "new-workspace/electrical/firmware/fw-dev:$F/.claude/skills/top/SKILL.md" 2>/dev/null || fail "new workspace PR contains inherited output"
+! o cat-file -e "new-workspace/electrical/firmware/fw-dev:$F/workspace.generated" 2>/dev/null || fail "new workspace PR contains branch ownership metadata"
 grep -q "gh pr create --base main --head new-workspace/electrical/firmware/fw-dev --title Add workspace $FN --label by: ai --body ## Changes" "$t/gh.log" ||
   fail "no PR for new workspace, or not labelled by: ai with the template's sections: $(cat "$t/gh.log")"
 (cd "$t/dev" && tools/new-workspace.sh --by ai-assisted electrical/firmware fw-two >/dev/null) || fail "new-workspace.sh --by failed"
@@ -484,7 +1032,7 @@ grep -q "s.electrical.firmware.fw-two --label by: ai-assisted " "$t/gh.log" || f
 (cd "$t/dev" && ! tools/new-workspace.sh ../x ok 2>/dev/null) || fail "bad org path accepted"
 [ -z "$(git -C "$t/dev" status --porcelain)" ] || fail "new-workspace touched the checkout"
 ok "new-workspace.sh opens a PR with the templated folder; rejects duplicates and bad input"
-ok "new-workspace.sh adds the project's workspace-defaults/ (CLAUDE.md appended, placeholders filled), not inherited files"
+ok "new-workspace.sh adds the project's workspace-defaults/ (CLAUDE.md appended, placeholders filled), without inherited copies or ledgers on main"
 ok "new-workspace.sh works when a local new-workspace/<name> branch is left over"
 ok "new-workspace.sh's PR follows the PR template, labelled by: ai unless --by says otherwise"
 
@@ -720,7 +1268,8 @@ if command -v python3 >/dev/null && command -v curl >/dev/null; then
   for _ in $(seq 50); do [ -s "$t/web.out" ] && break; sleep 0.1; done
   url=$(head -1 "$t/web.out") port=${url#http://127.0.0.1:} port=${port%%/*}
   get() { curl -s -o /dev/null -w '%{http_code}' "$@"; }
-  { [ "$(get "$url")" = 200 ] && curl -s "$url" | grep -q "<title>Delphi workspaces</title>" &&
+  # Consume the whole HTML response: grep -q can make curl fail with SIGPIPE under pipefail.
+  { [ "$(get "$url")" = 200 ] && curl -s "$url" | grep "<title>Delphi workspaces</title>" >/dev/null &&
     [ "$(get "http://127.0.0.1:$port/")" = 404 ] && [ "$(get "http://127.0.0.1:$port/wrong/api/state")" = 404 ] &&
     [ "$(get -H "Host: evil.example:$port" "${url}api/state")" = 403 ]; } || fail "web/server.py let a request without its token or a local Host through"
   curl -s "${url}api/state" | python3 -c 'import json, sys; s = json.load(sys.stdin); sys.exit(not (s["here"] == sys.argv[1] and s["workspaces"] == ["main", sys.argv[1] + " software/application-software/argos"] and not s["isDirty"]))' "$AN" ||
@@ -749,7 +1298,13 @@ C=software/electrical/workspaces/vcu-dev CN=s.electrical.vcu-dev CO=software/ele
 (cd "$t/dev" && git fetch -q && git checkout -q -B main origin/main && mkdir -p "$C" && cp -R templates/workspace/. "$C/" &&
   sed -i.bak "s|{{name}}|$CO|" "$C/workspace.yml" && rm "$C/workspace.yml.bak" && bash ci/plugins.sh >/dev/null &&
   git add -A && git commit -qm "vcu-dev, still named the old way" && git push -q origin main &&
+  bash ci/render.sh --workspace "$C" . "$t/rename-stage" &&
   i=$t/legacy.index && GIT_INDEX_FILE=$i git read-tree "main:$C" && GIT_INDEX_FILE=$i git read-tree --prefix=.delphi/ main:.delphi &&
+  while IFS= read -r stage_file; do
+    stage_mode=100644; [ ! -x "$stage_file" ] || stage_mode=100755
+    stage_blob=$(git hash-object -w -- "$stage_file") &&
+      GIT_INDEX_FILE=$i git update-index --add --cacheinfo "$stage_mode,$stage_blob,${stage_file#"$t/rename-stage/$C/"}" || exit 1
+  done < <(find "$t/rename-stage/$C" -type f | LC_ALL=C sort) &&
   git push -q origin "$(git commit-tree -p main -m "delphi: create ws/$CO" "$(GIT_INDEX_FILE=$i git write-tree)"):refs/heads/ws/$CO" &&
   git push -q origin "origin/main:refs/heads/ws/$CN" && # a stale ws/<name> behind it
   rm "$i" && sed -i.bak "s|^name:.*|name: $CN|" "$C/workspace.yml" && rm "$C/workspace.yml.bak" && git commit -qam "vcu-dev named with dots" && git push -q origin main)
@@ -786,9 +1341,499 @@ commit_on "ws/$CO" CLAUDE.md "old side" && commit_on "ws/$CN" .gitattributes "#
   ! o show "ws/$CN:CLAUDE.md" | grep -qx "old side"; } || fail "a diverged old name was merged or not reported: $(cat "$t/out")"
 ok "an old name with commits of its own is reported, never merged"
 
-# --- 13. shellcheck, if installed
+# --- 13. portable harnesses: staged native output, round trips, transitions, bootstrap and authoring
+bash "$src/tests/harnesses.sh" >"$t/out" 2>"$t/err" || fail "harness regressions: $(cat "$t/out" "$t/err")"
+ok "harness translation preserves literal references, rejects known leaks and scopes skill names to the receiving workspace"
+frontmatter() { awk 'NR == 1 && /^---\r?$/ { front = 1; sub(/\r$/, ""); print; next } front { sub(/\r$/, ""); print; if (/^---$/) exit }'; }
+mkdir -p "$t/identifier-translation"
+cat >"$t/identifier-translation/SKILL.md" <<'IDENTIFIERS'
+---
+name: identifier-translation
+description: Use /commit and read CLAUDE.md.
+---
+Follow CLAUDE.md; invoke `/commit` and /open-pr.
+Keep `repos/example/CLAUDE.md`, `/tmp` and `https://example.invalid/commit` unchanged.
+Use the GitHub MCP server's `pull_request_read` or mcp__github__pull_request_read.
+- Reworded pane explanation: `/ws-delphi` can switch.
+- Reworded reload explanation: the `delphi` mod handles `.claude/skills/`.
+IDENTIFIERS
+bash -c 'source "$1"; harness_file codex "$2" "commit open-pr"' _ "$src/ci/harnesses.sh" "$t/identifier-translation/SKILL.md" >"$t/identifier-translation/native.md"
+# shellcheck disable=SC2016 # native skill references are literal assertion text
+grep -qF 'Follow AGENTS.md; invoke `$commit` and $open-pr.' "$t/identifier-translation/native.md" || fail "native instruction and direct skill references"
+# shellcheck disable=SC2016 # native skill references are literal assertion text
+grep -qF 'description: Use $commit and read AGENTS.md.' "$t/identifier-translation/native.md" || fail "metadata identifier translation"
+# shellcheck disable=SC2016 # code paths and backticks are literal assertion text
+grep -qF 'Keep `repos/example/CLAUDE.md`, `/tmp` and `https://example.invalid/commit` unchanged.' "$t/identifier-translation/native.md" || fail "qualified file or URL was treated as a harness identifier"
+! grep -qF /ws-delphi "$t/identifier-translation/native.md" || fail "reworded Claude-only pane leaked"
+grep -q 'Start a fresh Codex session' "$t/identifier-translation/native.md" || fail "reworded Claude reload feature was not translated"
+bash -c 'source "$1"; harness_file claude-code "$2"' _ "$src/ci/harnesses.sh" "$t/identifier-translation/SKILL.md" | cmp -s - "$t/identifier-translation/SKILL.md" || fail "Claude identifier output changed"
+ok "descriptor translators map identifiers and direct skill calls after prose changes, preserving literal code paths and Claude bytes"
+mkdir -p "$t/metadata-variants"
+cat >"$t/metadata-variants/source.md" <<'SKILL'
+---
+name: metadata-variants
+allowed-tools:
+- Read
+- Bash
+# A comment within the omitted value.
+"user-invocable" : false
+'disable-model-invocation': true
+metadata:
+  allowed-tools: preserve nested metadata
+description: |-
+  First line: useful
+  Second line
+---
+Read CLAUDE.md.
+SKILL
+cat >"$t/metadata-variants/expected.md" <<'SKILL'
+---
+name: metadata-variants
+metadata:
+  allowed-tools: preserve nested metadata
+description: |-
+  First line: useful
+  Second line
+---
+Read CLAUDE.md.
+SKILL
+for indent in '' '  '; do
+  sed "/^---$/!s/^/$indent/" "$t/metadata-variants/source.md" >"$t/metadata-variants/lf.md"
+  sed "/^---$/!s/^/$indent/" "$t/metadata-variants/expected.md" >"$t/metadata-variants/want.md"
+  for eol in lf crlf; do
+    if [ "$eol" = crlf ]; then awk '{ printf "%s\r\n", $0 }' "$t/metadata-variants/lf.md" >"$t/metadata-variants/SKILL.md"
+    else cp "$t/metadata-variants/lf.md" "$t/metadata-variants/SKILL.md"; fi
+    bash -c 'source "$1"; harness_file codex "$2"' _ "$src/ci/harnesses.sh" "$t/metadata-variants/SKILL.md" >"$t/metadata-variants/actual.md"
+    cmp -s <(frontmatter <"$t/metadata-variants/want.md") <(frontmatter <"$t/metadata-variants/actual.md") || fail "Codex metadata indentation/quotes/$eol"
+    grep -qF 'Read AGENTS.md.' "$t/metadata-variants/actual.md" || fail "Codex did not translate the workspace instruction identifier"
+    bash -c 'source "$1"; harness_file claude-code "$2"' _ "$src/ci/harnesses.sh" "$t/metadata-variants/SKILL.md" |
+      cmp -s - "$t/metadata-variants/SKILL.md" || fail "Claude metadata bytes changed"
+  done
+done
+ok "Codex metadata handles CRLF, quoted keys, indentless lists and root indentation; Claude stays byte-identical"
+cat >"$t/native-metadata.md" <<'SKILL'
+---
+name: native-metadata
+description: "Preserve: existing tool permissions and invocation settings."
+allowed-tools:
+  - Bash(git:*)
+  - Bash(bash ${CLAUDE_SKILL_DIR}/scripts/helper.sh *)
+user-invocable: false
+disable-model-invocation: true
+metadata:
+  custom-setting: unchanged
+---
+Read CLAUDE.md before making changes.
+Keep literal `repos/sample/CLAUDE.md` in code-repository commands and English examples.
+`printf 'repos/sample/CLAUDE.md\n'`
+SKILL
+mkdir "$t/portable"
+cat >"$t/portable/SKILL.md" <<'SKILL'
+---
+name: portable
+description: Run the portable helper.
+---
+portable v1
+
+```sh
+bash scripts/helper.sh "argument with spaces"
+```
+SKILL
+cat >"$t/portable/helper.sh" <<'HELPER'
+#!/usr/bin/env bash
+set -euo pipefail
+source "$DELPHI_ROOT/.delphi/paths.sh"
+printf '%s|%s|%s\n' "$DELPHI_ROOT" "$PWD" "$1"
+HELPER
+bash -c 'source "$1"; harness_file codex "$2"' _ "$src/ci/harnesses.sh" "$t/portable/SKILL.md" >"$t/portable-codex.md"
+C=software/application-software/argos/workspaces/sandbox-codex CN=s.app.argos.sandbox-codex
+# shellcheck disable=SC2016 # child shell expands its positional arguments
+on_main "add Codex and inherited Claude skills" bash -c '
+  mkdir -p "$1" software/workspace-inherit/.claude/skills/portable/scripts software/workspace-inherit/.claude/skills/native-metadata software/workspace-inherit/.claude/skills/switch-workspace
+  cp "$2/templates/harnesses/codex/AGENTS.md" "$1/AGENTS.md"
+  cp "$2/templates/workspace/.gitattributes" "$1/.gitattributes"
+  mkdir -p "$1/.github/workflows"
+  cp .github/workflows/delphi.yml "$1/.github/workflows/delphi.yml"
+  printf "name: %s\nharness: codex\n" "$3" >"$1/workspace.yml"
+  cp "$5/SKILL.md" software/workspace-inherit/.claude/skills/portable/SKILL.md
+  cp "$5/helper.sh" software/workspace-inherit/.claude/skills/portable/scripts/helper.sh
+  cp "$4" software/workspace-inherit/.claude/skills/native-metadata/SKILL.md
+  cp "$2/software/workspace-inherit/.claude/skills/switch-workspace/SKILL.md" software/workspace-inherit/.claude/skills/switch-workspace/SKILL.md
+' _ "$C" "$src" "$CN" "$t/native-metadata.md" "$t/portable"
+sync "$CN" >"$t/out" 2>&1 || fail "Codex creation: $(cat "$t/out")"
+for skill in top portable; do
+  o cat-file -e "ws/$CN:.agents/skills/$skill/SKILL.md" || fail "Codex lacks native $skill"
+done
+! o cat-file -e "ws/$CN:.claude" 2>/dev/null || fail "Codex inherited Claude files"
+[ "$(o rev-parse "ws/$CN^")" = "$(o rev-parse main)" ] || fail "Codex creation parent"
+ok "refresh translates existing inherited Claude skills to Codex native paths only on the workspace branch"
+! o cat-file -e "main:$C/.agents/skills" 2>/dev/null || fail "main contains inherited Codex skills"
+! o cat-file -e "main:$C/workspace.generated" 2>/dev/null || fail "main contains Codex ownership metadata"
+[ "$(o rev-parse "main:$C/AGENTS.md")" = "$(o rev-parse "ws/$CN:AGENTS.md")" ] || fail "Codex owned instructions changed"
+ok "main keeps owned native instructions while refresh adds inherited output and ownership only to the branch"
+
+sync refresh "$AN" >/dev/null
+! o cat-file -e "main:$A/.claude/skills/native-metadata/SKILL.md" 2>/dev/null || fail "main contains an inherited Claude metadata copy"
+cmp -s "$t/native-metadata.md" <(o show "ws/$AN:.claude/skills/native-metadata/SKILL.md") || fail "refresh changed Claude metadata"
+cmp -s "$t/native-metadata.md" <(o show "main:software/workspace-inherit/.claude/skills/native-metadata/SKILL.md") || fail "translation changed the inherited Claude source"
+ok "Claude source metadata, allowed-tools and invocation flags reach the branch byte for byte and remain canonical on main"
+cat >"$t/codex-metadata.md" <<'SKILL'
+---
+name: native-metadata
+description: "Preserve: existing tool permissions and invocation settings."
+metadata:
+  custom-setting: unchanged
+---
+SKILL
+cmp -s "$t/codex-metadata.md" <(o show "ws/$CN:.agents/skills/native-metadata/SKILL.md" | frontmatter) || fail "Codex translation changed portable metadata or retained Claude-only fields"
+o show "ws/$CN:.agents/skills/native-metadata/SKILL.md" | grep -qx 'Read AGENTS.md before making changes.' || fail "Codex did not translate workspace instructions"
+o show "ws/$CN:.agents/skills/native-metadata/SKILL.md" | grep -qF "printf 'repos/sample/CLAUDE.md\n'" || fail "Codex changed an opaque code reference"
+ok "Codex translation omits Claude-only fields and block values while preserving portable metadata"
+cmp -s "$src/software/workspace-inherit/.claude/skills/switch-workspace/SKILL.md" <(o show "ws/$AN:.claude/skills/switch-workspace/SKILL.md") || fail "Claude switching instructions changed"
+o show "ws/$AN:.claude/skills/switch-workspace/SKILL.md" | grep -q 'No restart needed' || fail "Claude lost its hot reload workflow"
+o show "ws/$CN:.agents/skills/switch-workspace/SKILL.md" | grep -q 'Start a fresh Codex session' || fail "Codex lacks native restart guidance"
+! o show "ws/$CN:.agents/skills/switch-workspace/SKILL.md" | grep -q 'No restart needed' || fail "Claude reload behavior leaked into Codex"
+ok "existing Claude plugin and hot reload guidance stays intact while Codex gets its own switch guidance"
+helper_root=$t/native-helper
+git clone -q -b "ws/$CN" "$t/origin.git" "$helper_root"
+helper_command=$(o show "ws/$CN:.agents/skills/portable/SKILL.md" | grep -F '<absolute-installed-skill-folder>/scripts/helper.sh')
+helper_command=${helper_command//<absolute-workspace-root>/$helper_root}
+helper_command=${helper_command//<absolute-installed-skill-folder>/$helper_root/.agents/skills/portable}
+helper_result=$(cd "$t" && env -u DELPHI_ROOT -u DELPHI_REPOS -u DELPHI_WORKTREES -u DELPHI_REFERENCES -u DELPHI_WORKSPACES bash -c "$helper_command") || fail "generated helper call failed in a fresh shell"
+[ "$helper_result" = "$helper_root|$t|argument with spaces" ] || fail "generated helper call lost root, caller directory or arguments"
+grep -qF 'Run every skill helper through the workspace bootstrap' "$helper_root/.agents/skills/portable/SKILL.md" || fail "translated skill lacks its bootstrap instructions"
+ok "translated helper commands initialize fresh shells with the known root while preserving arguments and caller directory"
+
+# A workspace's target can change before its proposal merges; ownership must use that native recipe on every refresh.
+for branch_target in claude-code codex; do
+  if [ "$branch_target" = claude-code ]; then
+    branch_instruction=CLAUDE.md; branch_previous=AGENTS.md; branch_skills=.claude/skills
+  else
+    branch_instruction=AGENTS.md; branch_previous=CLAUDE.md; branch_skills=.agents/skills
+  fi
+  (cd "$t/dev" && git fetch -q && git checkout -q -B branch-target "origin/ws/$CN" &&
+    git mv "$branch_previous" "$branch_instruction" &&
+    sed -i.bak "s/^harness:.*/harness: $branch_target/" workspace.yml && rm workspace.yml.bak &&
+    printf '\nbranch-only target %s\n' "$branch_target" >>"$branch_instruction" &&
+    git commit -qam "select branch-only $branch_target" && git push -q origin "HEAD:ws/$CN")
+  sync refresh "$CN" >"$t/out" 2>&1 || fail "branch-only $branch_target refresh: $(cat "$t/out")"
+  target_head=$(o rev-parse "ws/$CN")
+  sync refresh "$CN" >"$t/out" 2>&1 || fail "repeated branch-only $branch_target refresh: $(cat "$t/out")"
+  [ "$(o rev-parse "ws/$CN")" = "$target_head" ] || fail "repeated branch-only target refresh changed refs"
+  commit_on "ws/$CN" "$branch_skills/portable/SKILL.md" "reset generated target edit"
+  sync refresh "$CN" >"$t/out" 2>&1 || fail "branch-only target reset: $(cat "$t/out")"
+  portable_expected=$t/portable-codex.md; [ "$branch_target" != claude-code ] || portable_expected=$t/portable/SKILL.md
+  cmp -s "$portable_expected" <(o show "ws/$CN:$branch_skills/portable/SKILL.md") || fail "branch-only target lost trusted native ownership"
+  sync propose "$CN" >"$t/out" 2>&1 || fail "branch-only $branch_target proposal: $(cat "$t/out")"
+  ! o cat-file -e "propose/$CN:$C/$branch_skills/portable/SKILL.md" 2>/dev/null || fail "branch-only target proposed inherited output"
+  ! o cat-file -e "propose/$CN:$C/workspace.generated" 2>/dev/null || fail "branch-only target proposed ownership metadata"
+  o show "propose/$CN:$C/workspace.yml" | grep -qx "harness: $branch_target" || fail "branch-only target selection not proposed"
+done
+o show "main:$C/workspace.yml" | grep -qx 'harness: codex' || fail "branch-only target changed main before merge"
+ok "unmerged harness changes survive repeated refresh, reset inherited edits and propose only owned native files in both directions"
+
+commit_on "ws/$CN" .agents/skills/portable/SKILL.md "workspace edit"
+commit_on "ws/$CN" AGENTS.md "workspace-owned instructions"
+sync propose "$CN" >"$t/out" 2>&1 || fail "Codex proposal: $(cat "$t/out")"
+! o cat-file -e "propose/$CN:$C/.agents/skills/portable/SKILL.md" 2>/dev/null || fail "managed skill edit proposed"
+! o cat-file -e "propose/$CN:$C/workspace.generated" 2>/dev/null || fail "Codex ownership metadata proposed"
+o show "propose/$CN:$C/AGENTS.md" | grep -qx "workspace-owned instructions" || fail "AGENTS.md not proposed"
+sync refresh "$CN" >/dev/null
+cmp -s "$t/portable-codex.md" <(o show "ws/$CN:.agents/skills/portable/SKILL.md") || fail "Codex inherited edit not reset"
+ok "Codex proposals preserve native instructions and omit inherited skills and ledgers; refresh resets inherited edits"
+on_main "remove shared helper" git rm -q software/workspace-inherit/.claude/skills/portable/scripts/helper.sh
+sync refresh "$CN" >"$t/out" 2>&1 || fail "shared source update: $(cat "$t/out")"
+! o cat-file -e "main:$C/.agents/skills/portable/SKILL.md" 2>/dev/null || fail "source update materialized inherited output on main"
+ok "refresh reads canonical sources and adapters to stage changed native branch output"
+
+! o cat-file -e "ws/$CN:.agents/skills/portable/scripts/helper.sh" 2>/dev/null || fail "stale inherited helper survived"
+o show "ws/$CN:.agents/skills/top/SKILL.md" | grep -qx "top v3" || fail "shared source update lost skill"
+ok "shared source updates keep native paths stable and remove obsolete inherited files"
+# shellcheck disable=SC2016 # child shell expands its positional arguments
+on_main "switch Codex workspace to Claude" bash -c '
+  git mv "$1/AGENTS.md" "$1/CLAUDE.md"
+  sed -i.bak "s/harness: codex/harness: claude-code/" "$1/workspace.yml"
+  rm "$1/workspace.yml.bak"
+  bash ci/plugins.sh >/dev/null
+' _ "$C"
+# The ws-owned AGENTS edit would conflict with main renaming it: resolve via a normal workspace PR first.
+# Undo the test-only instruction change before the harness transition.
+(cd "$t/dev" && git fetch -q && git checkout -q -B transition "origin/ws/$CN" &&
+  git show "origin/main:$C/CLAUDE.md" >AGENTS.md && git commit -qam "prepare native instruction transition" &&
+  git push -q origin "HEAD:ws/$CN")
+sync refresh "$CN" >"$t/out" 2>&1 || fail "Codex to Claude: $(cat "$t/out")"
+{ o cat-file -e "ws/$CN:.claude/skills/portable/SKILL.md" &&
+  ! o cat-file -e "ws/$CN:.agents/skills/portable/SKILL.md" 2>/dev/null; } || fail "old native skill destination survived"
+# shellcheck disable=SC2016 # child shell expands its positional arguments
+on_main "switch workspace back to Codex" bash -c '
+  git mv "$1/CLAUDE.md" "$1/AGENTS.md"
+  git rm -q "$1/.claude/settings.json"
+  printf "name: %s\nharness: codex\n" "$2" >"$1/workspace.yml"
+' _ "$C" "$CN"
+sync "$CN" >"$t/out" 2>&1 || fail "Claude to Codex: $(cat "$t/out")"
+{ o cat-file -e "ws/$CN:.agents/skills/portable/SKILL.md" &&
+  ! o cat-file -e "ws/$CN:.claude/settings.json" 2>/dev/null &&
+  ! o cat-file -e "ws/$CN:.claude/skills/portable/SKILL.md" 2>/dev/null; } || fail "Claude files survived harness transition"
+ok "harness transitions remove old native skill destinations and generated settings in both directions"
+(cd "$t/dev" && git fetch -q && git checkout -q -B stale-settings "origin/ws/$CN" &&
+  mkdir -p .claude && echo '{}' >.claude/settings.json && git add .claude/settings.json &&
+  git commit -qm "stale settings from previous harness" && git push -q origin "HEAD:ws/$CN")
+if sync "$CN" >"$t/out" 2>"$t/err"; then fail "unrecorded foreign native file proposed"; fi
+grep -q 'belongs to a different harness' "$t/err" || fail "foreign native file not reported"
+o cat-file -e "ws/$CN:.claude/settings.json" || fail "unrecorded file silently deleted"
+(cd "$t/dev" && git fetch -q && git checkout -q -B remove-foreign "origin/ws/$CN" &&
+  git rm -q .claude/settings.json && git commit -qm "remove foreign native configuration" && git push -q origin "HEAD:ws/$CN")
+sync "$CN" >/dev/null 2>&1 || fail "sync after explicit foreign-file removal"
+ok "unrecorded foreign files fail validation and require an explicit workspace edit"
+commit_on "ws/$CN" workspace.yml "$(printf 'opt-out:\n  - .agents/skills/portable')"
+commit_on "ws/$CN" .agents/skills/portable/SKILL.md "Codex own"
+commit_on "ws/$CN" .agents/skills/portable/OWN.md "workspace-owned native file"
+sync "$CN" >"$t/out" 2>&1 || fail "Codex opt-out: $(cat "$t/out")"
+o show "propose/$CN:$C/.agents/skills/portable/OWN.md" | grep -qx "workspace-owned native file" || fail "Codex owned skill not proposed"
+o show "ws/$CN:.agents/skills/portable/SKILL.md" | grep -qx "Codex own" || fail "Codex opt-out overwritten"
+ok "Codex native opt-outs preserve editable and proposable workspace-owned skills"
+
+(cd "$t/dev" && git fetch -q && git checkout -q -B tmp-main origin/main &&
+  git merge -q --no-ff --no-edit "origin/propose/$CN" && git push -q origin HEAD:main)
+sync refresh "$CN" >/dev/null
+# A formerly opted-out skill is workspace-owned even after its shared source and opt-out are removed.
+# shellcheck disable=SC2016 # child expands its arguments
+on_main "retire shared skill without deleting owned copy" bash -c '
+  git rm -rq software/workspace-inherit/.claude/skills/portable
+  printf "name: %s\nharness: codex\n" "$2" >"$1/workspace.yml"
+' _ "$C" "$CN"
+sync "$CN" >"$t/out" 2>&1 || fail "retire owned skill source: $(cat "$t/out")"
+o show "ws/$CN:.agents/skills/portable/SKILL.md" | grep -qx "Codex own" || fail "former opt-out owned skill was deleted"
+ok "removing a shared source and old opt-out preserves the former workspace-owned skill"
+
+# Helper commands initialize their layout independently of Codex or the caller's shell exports.
+w=$t/codex && git clone -q -b "ws/$CN" "$t/origin.git" "$w"
+# shellcheck disable=SC2016 # fresh shell must receive the exports
+(cd "$t" && env -u DELPHI_ROOT -u DELPHI_REPOS -u DELPHI_WORKTREES bash "$w/.delphi/exec.sh" bash -c '
+  set -e
+  [ "$1" = "argument with spaces" ]
+  [ "$PWD" != "$DELPHI_ROOT" ]
+  [ -f "$DELPHI_ROOT/AGENTS.md" ]
+  [ "$DELPHI_REPOS" = "$DELPHI_ROOT/repos" ]
+  bash -c '\''[ "$DELPHI_WORKTREES" = "$DELPHI_ROOT/worktrees" ]'\''
+' _ "argument with spaces") || fail "fresh host command wrapper"
+ok "per-command bootstrap propagates layout to fresh shells and children while preserving arguments/cwd"
+# Proxy capability selection uses stubs only, without GitHub/network access.
+mkdir -p "$t/proxy-bin"
+printf '#!/usr/bin/env bash\nexit 1\n' >"$t/proxy-bin/gh"
+printf '#!/usr/bin/env bash\nprintf "proxy-response"\n' >"$t/proxy-bin/curl"
+printf '#!/usr/bin/env bash\nexit 0\n' >"$t/proxy-bin/jq"
+chmod +x "$t/proxy-bin/"*
+provider=$src/software/application-software/workspace-inherit/.claude/skills/address-pr-comments/scripts/github.sh
+# shellcheck disable=SC2016 # isolated shell sources helper and expands its variables
+proxy=$(PATH="$t/proxy-bin:$PATH" DELPHI_GITHUB_REST_PROXY=1 CLAUDE_CODE_REMOTE='' bash -c '
+  source "$1"; gh_init test "$2"; [ "$MODE" = rest ]; get repos/example/example
+' _ "$provider" "$w") || fail "explicit REST proxy capability selection"
+[ "$proxy" = proxy-response ] || fail "REST proxy did not use stubbed provider"
+ok "shared GitHub helpers support an explicit REST-proxy capability without harness-specific environment detection"
+# A Codex target consumes the single Claude-authored defaults bundle.
+(cd "$t/dev" && git fetch -q && git checkout -q -B main origin/main &&
+  tools/new-workspace.sh --harness codex electrical/firmware fw-codex >/dev/null) || fail "Codex new workspace"
+F=software/electrical/firmware/workspaces/fw-codex
+created=new-workspace/electrical/firmware/fw-codex
+o show "$created:$F/workspace.yml" | grep -qx 'harness: codex' || fail "default harness not overridden"
+o show "$created:$F/workspace.yml" | grep -q 'fw: https://example.com/fw.git' || fail "project repos lost"
+o show "$created:$F/AGENTS.md" | grep -qx '# Firmware for s.electrical.firmware.fw-codex' || fail "Claude-authored instructions not translated"
+{
+  o show main:templates/workspace/CLAUDE.md
+  o show main:templates/harnesses/codex/AGENTS.md
+  echo
+  o show "main:$FD/CLAUDE.md"
+} | sed -e 's|{{name}}|s.electrical.firmware.fw-codex|g' -e "s|{{folder}}|$F|g" >"$t/expected-codex-instructions.md"
+o show "$created:$F/AGENTS.md" | cmp -s - "$t/expected-codex-instructions.md" || fail "Codex instruction base/template composition"
+o cat-file -e "$created:$F/.agents/skills/fw/SKILL.md" || fail "Claude-authored default skill not translated"
+! o cat-file -e "$created:$F/.agents/skills/top/SKILL.md" 2>/dev/null || fail "main PR contains inherited native skill"
+! o cat-file -e "$created:$F/workspace.generated" 2>/dev/null || fail "main PR contains branch ownership metadata"
+{ ! o cat-file -e "$created:$F/CLAUDE.md" 2>/dev/null && ! o cat-file -e "$created:$F/.claude" 2>/dev/null; } || fail "Claude defaults leaked into Codex workspace"
+(cd "$t/dev" && ! tools/new-workspace.sh --harness unknown electrical/firmware bad-harness >/dev/null 2>&1) || fail "unknown authoring harness accepted"
+ok "Codex creation translates one Claude-authored defaults bundle into native files before its main PR"
+
+# Changing a creation suggestion does not change the source format or any existing workspace.
+# shellcheck disable=SC2016 # child shell edits the sandbox project's defaults
+on_main "project suggests Codex" bash -c '
+  sed -i.bak "s/harness: claude-code/harness: codex/" "$1/workspace.yml"
+  rm "$1/workspace.yml.bak"
+' _ "$FD"
+(cd "$t/dev" && git fetch -q && git checkout -q -B main origin/main &&
+  tools/new-workspace.sh electrical/firmware fw-project-codex >/dev/null) || fail "project-default Codex workspace"
+F=software/electrical/firmware/workspaces/fw-project-codex
+created=new-workspace/electrical/firmware/fw-project-codex
+o show "$created:$F/workspace.yml" | grep -qx 'harness: codex' || fail "project suggestion ignored"
+o show "$created:$F/AGENTS.md" | grep -qx '# Firmware for s.electrical.firmware.fw-project-codex' || fail "translated defaults lost"
+o show "main:$FD/source.yml" | grep -qx 'format: claude-code' || fail "creation suggestion changed source format"
+o show "main:$A/workspace.yml" | grep -qx 'harness: claude-code' || fail "existing workspace harness changed"
+ok "creation suggestions stay independent of source format and existing workspace harnesses"
+
+# A different source format feeds the same target adapters and unchanged branch model.
+# shellcheck disable=SC2016 # child shell migrates the source bundle
+on_main "author defaults in Codex format" bash -c '
+  printf "format: codex\n" >"$1/source.yml"
+  git mv "$1/CLAUDE.md" "$1/AGENTS.md"
+  mkdir -p "$1/.agents/skills"
+  git mv "$1/.claude/skills/fw" "$1/.agents/skills/fw"
+' _ "$FD"
+(cd "$t/dev" && git fetch -q && git checkout -q -B main origin/main &&
+  tools/new-workspace.sh --harness claude-code electrical/firmware fw-project-claude >/dev/null) || fail "Claude target from Codex source"
+F=software/electrical/firmware/workspaces/fw-project-claude
+created=new-workspace/electrical/firmware/fw-project-claude
+o show "$created:$F/workspace.yml" | grep -qx 'harness: claude-code' || fail "explicit harness did not override suggestion"
+o show "$created:$F/workspace.yml" | grep -q 'fw: https://example.com/fw.git' || fail "project repos lost"
+o show "$created:$F/CLAUDE.md" | grep -qx '# Firmware for s.electrical.firmware.fw-project-claude' || fail "Codex source instructions not translated"
+o cat-file -e "$created:$F/.claude/skills/fw/SKILL.md" || fail "Codex source skill not translated"
+{ ! o cat-file -e "$created:$F/AGENTS.md" 2>/dev/null && ! o cat-file -e "$created:$F/.agents" 2>/dev/null; } || fail "Codex files leaked into Claude target"
+ok "changing source format preserves target adapters, owned native defaults and explicit workspace harnesses"
+
+# Native settings require an explicit mapping, never silent removal.
+# shellcheck disable=SC2016 # child shell adds a source-native configuration
+on_main "Codex-native configuration default" bash -c 'mkdir -p "$1/.codex"; echo "# native settings" >"$1/.codex/config.toml"' _ "$FD"
+(cd "$t/dev" && git fetch -q && git checkout -q -B main origin/main &&
+  ! tools/new-workspace.sh --harness claude-code electrical/firmware unsupported >/dev/null 2>"$t/err") || fail "unsupported native settings silently accepted"
+grep -q 'has no mapping to claude-code' "$t/err" || fail "unsupported mapping not reported"
+[ -z "$(git -C "$t/dev" status --porcelain)" ] || fail "failed generation changed caller checkout"
+ok "unsupported native settings fail explicitly and leave the caller checkout untouched"
+
+(cd "$t/dev" && git fetch -q && git checkout -q -B main origin/main &&
+  bash ci/render.sh --check && [ -z "$(git status --porcelain)" ] &&
+  bash ci/render.sh >/dev/null && [ -z "$(git status --porcelain)" ]) || fail "main-side render was not idempotent"
+ok "render checks do not write and repeated rendering leaves a valid main checkout unchanged"
+
+# A pre-render branch has native copies but no ledger. Prove their old source provenance.
+legacy_dev=$t/legacy-dev legacy_origin=$t/legacy-origin.git
+git clone -q "$t/seed" "$legacy_dev"
+(cd "$legacy_dev" && git rm -q ci/render.sh &&
+  mkdir -p software/workspace-inherit/notes && echo old >software/workspace-inherit/notes/adoption.txt &&
+  git add -A && git commit -qm "legacy main without managed ledgers")
+legacy_base=$(git -C "$legacy_dev" rev-parse HEAD)
+git clone -q --bare "$legacy_dev" "$legacy_origin"
+git -C "$legacy_dev" remote set-url origin "$legacy_origin"
+for legacy_name in "$AN" "$BN"; do
+  legacy_folder=$A; [ "$legacy_name" != "$BN" ] || legacy_folder=$B
+  legacy_blob=$(printf 'old\n' | git -C "$legacy_dev" hash-object -w --stdin)
+  [ "$legacy_name" != "$BN" ] || legacy_blob=$(printf 'owned edit\n' | git -C "$legacy_dev" hash-object -w --stdin)
+  GIT_INDEX_FILE=$t/legacy.index git -C "$legacy_dev" read-tree "$legacy_base:$legacy_folder"
+  GIT_INDEX_FILE=$t/legacy.index git -C "$legacy_dev" read-tree --prefix=.delphi/ "$legacy_base:.delphi"
+  GIT_INDEX_FILE=$t/legacy.index git -C "$legacy_dev" update-index --add --cacheinfo "100644,$legacy_blob,notes/adoption.txt"
+  legacy_tree=$(GIT_INDEX_FILE=$t/legacy.index git -C "$legacy_dev" write-tree)
+  legacy_head=$(printf 'legacy workspace\n' | git -C "$legacy_dev" commit-tree -p "$legacy_base" "$legacy_tree")
+  git -C "$legacy_dev" push -q origin "$legacy_head:refs/heads/ws/$legacy_name"
+done
+(cd "$legacy_dev" && cp "$src/ci/render.sh" ci/render.sh && echo new >software/workspace-inherit/notes/adoption.txt &&
+  bash ci/render.sh && git add -A && git commit -qm "prepare native output" && git push -q origin main &&
+  bash ci/sync.sh refresh "$AN") >"$t/out" 2>"$t/err" || fail "legacy adoption: $(cat "$t/err")"
+git -C "$legacy_origin" show "ws/$AN:notes/adoption.txt" | grep -qx new || fail "legacy source was not refreshed"
+git -C "$legacy_origin" cat-file -e "ws/$AN:workspace.generated" || fail "legacy branch lacks ownership metadata"
+ok "pre-ledger branches adopt unchanged old source copies before applying reviewed updates"
+if (cd "$legacy_dev" && bash ci/sync.sh refresh "$BN") >"$t/out" 2>"$t/err"; then fail "ambiguous legacy edit overwritten"; fi
+git -C "$legacy_origin" show "ws/$BN:notes/adoption.txt" | grep -qx 'owned edit' || fail "legacy edit was lost"
+ok "ambiguous pre-ledger edits report a conflict and retain their content"
+
+# Add a target only in its registry/template; adaptations of helpers must also be hashed natively.
+d=$t/adapter-extension
+mkdir "$d"
+cp -R "$src/ci" "$src/software" "$src/templates" "$src/.github" "$src/.delphi" "$src/.claude-plugin" "$d/"
+(cd "$d" && git init -q && git add -A && git commit -qm base)
+cat >"$d/ci/harnesses/fixture.sh" <<'DESCRIPTOR'
+#!/usr/bin/env bash
+# Fixture native conventions, registered without editing the shared resolver.
+set -euo pipefail
+# shellcheck disable=SC2034 # declarative properties consumed by harness_field
+instruction=TASKS.md
+instruction_template=templates/harnesses/fixture/TASKS.md
+skill_ref='@%s'
+pane_guidance=drop
+reload_guidance='Restart the fixture harness after switching.'
+github_tool='PR reader'
+github_integration='authenticated GitHub integration'
+browser_tool='browser automation'
+translate_skill() {
+  printf 'fixture-format: native\n'
+  awk 'NR == 1 && /^---$/ { front = 1; next } front && /^---$/ { front = 0; next } !front { print }' "$1" | claude_identifiers
+}
+skills=.fixture/skills
+native=.fixture
+protected=.fixture/config.ini
+plugins=none
+DESCRIPTOR
+cat >>"$d/ci/harnesses.sh" <<'ADAPTER'
+eval "$(declare -f harness_file | sed '1s/harness_file/base_harness_file/')"
+harness_file() {
+  if [ "$1" = fixture ]; then
+    base_harness_file "$@"
+    case "$2" in */SKILL.md | */scripts/*.sh) printf '\n# fixture output\n' ;; esac
+  else base_harness_file "$@"; fi
+}
+ADAPTER
+F=software/fixture-target/workspaces/fixture
+mkdir -p "$d/$F" "$d/templates/harnesses/fixture"
+cp -R "$d/templates/workspace/." "$d/$F/"
+rm "$d/$F/CLAUDE.md"
+printf 'Fixture instructions\n' >"$d/templates/harnesses/fixture/TASKS.md"
+cp "$d/templates/harnesses/fixture/TASKS.md" "$d/$F/TASKS.md"
+printf 'name: s.fixture-target.fixture\nharness: fixture\n' >"$d/$F/workspace.yml"
+chmod +x "$d/software/workspace-inherit/.claude/skills/journal/scripts/capture.sh"
+(cd "$d" && bash ci/render.sh . "$t/fixture-stage" && git add -A && bash ci/check.sh . HEAD &&
+  bash ci/render.sh . "$t/fixture-stage-again" && git diff --quiet) >"$t/out" 2>"$t/err" || fail "adapter extension: $(cat "$t/err")"
+grep -qx '# fixture output' "$t/fixture-stage/$F/.fixture/skills/journal/SKILL.md" || fail "new target skill was not adapted"
+grep -qx 'fixture-format: native' "$t/fixture-stage/$F/.fixture/skills/journal/SKILL.md" || fail "descriptor-owned metadata format was not rendered"
+grep -qx '# fixture output' "$t/fixture-stage/$F/.fixture/skills/journal/scripts/capture.sh" || fail "new target helper was not adapted"
+[ -x "$t/fixture-stage/$F/.fixture/skills/journal/scripts/capture.sh" ] || fail "new target lost executable mode"
+diff -qr "$t/fixture-stage" "$t/fixture-stage-again" >/dev/null || fail "new target staging was not deterministic"
+[ ! -e "$d/$F/.fixture" ] && [ ! -e "$d/$F/workspace.generated" ] || fail "new target generated files on main"
+while IFS=$'\t' read -r meta path _; do
+  case "$meta" in '' | '#'* ) continue ;; esac
+  [ "$(git -C "$d" hash-object -- "$t/fixture-stage/$F/$path")" = "${meta#* }" ] || fail "new target ledger did not hash native bytes"
+done <"$t/fixture-stage/$F/workspace.generated"
+ok "registry-only targets stage adapted skills and helpers with native hashes and modes without generating copies on main"
+bash -euo pipefail -c '
+  source "$1/ci/harnesses.sh"
+  instruction=unchanged skills=unchanged plugins=unchanged
+  harness_field fixture instruction >"$2"
+  [ "$(cat "$2")" = TASKS.md ]
+  [ "$instruction:$skills:$plugins" = unchanged:unchanged:unchanged ]
+  ! declare -F harness >/dev/null
+  ! declare -F translate_skill >/dev/null
+  ! declare -F claude_identifiers >/dev/null
+  harness_foreign codex | grep -qx .fixture
+' _ "$d" "$t/fixture-field.txt" || fail "registry properties mutated caller state or did not compute new foreign paths"
+mkdir -p "$d/software/fixture-target/workspace-defaults/.fixture/skills/source"
+printf 'format: fixture\n' >"$d/software/fixture-target/workspace-defaults/source.yml"
+printf '# Fixture defaults\n' >"$d/software/fixture-target/workspace-defaults/TASKS.md"
+printf 'fixture source\n' >"$d/software/fixture-target/workspace-defaults/.fixture/skills/source/SKILL.md"
+(cd "$d" && bash -euo pipefail -c 'source ci/sources.sh; [ "$(source_format "$1")" = fixture ]; bundle_files "$1" codex' _ software/fixture-target/workspace-defaults) >"$t/fixture-source-records" || fail "new registry entry was not usable as a source format"
+grep -q $'\t.agents/skills/source/SKILL.md\t' "$t/fixture-source-records" || fail "new source skill path was not mapped"
+grep -q $'\tAGENTS.md\t' "$t/fixture-source-records" || fail "new source instruction path was not mapped"
+mkdir -p "$d/$CX/.fixture"
+echo foreign >"$d/$CX/.fixture/config.ini"
+if (cd "$d" && bash ci/check.sh) >"$t/out" 2>"$t/err"; then fail "new target native files were accepted in Codex"; fi
+grep -q '.fixture: belongs to a different harness' "$t/err" || fail "registry foreign-path exclusion was not automatic"
+rm -r "$d/$CX/.fixture"
+ok "registry reads are pure and new entries automatically provide source formats and foreign-path exclusions"
+rm "$d/$F/TASKS.md"
+mkdir -p "$d/software/fixture-target/workspace-inherit"
+printf 'format: fixture\n' >"$d/software/fixture-target/workspace-inherit/source.yml"
+echo 'must remain workspace-owned' >"$d/software/fixture-target/workspace-inherit/TASKS.md"
+if (cd "$d" && bash ci/render.sh) >"$t/out" 2>"$t/err"; then fail "new target inherited its root instructions"; fi
+grep -q "each workspace has its own TASKS.md" "$t/err" || fail "new target root protection not reported"
+[ ! -e "$d/$F/TASKS.md" ] || fail "new target wrote inherited root instructions"
+ok "registry-only targets protect their own instruction path even when its workspace file is missing"
+cp "$d/templates/harnesses/fixture/TASKS.md" "$d/$F/TASKS.md"
+rm "$d/software/fixture-target/workspace-inherit/TASKS.md"
+mkdir "$d/software/fixture-target/workspace-inherit/.fixture"
+echo forbidden >"$d/software/fixture-target/workspace-inherit/.fixture/config.ini"
+if (cd "$d" && bash ci/render.sh) >"$t/out" 2>"$t/err"; then fail "new target inherited its protected configuration"; fi
+grep -q 'each workspace has its own .fixture/config.ini' "$t/err" || fail "registry-protected configuration was not enforced"
+[ ! -e "$d/$F/.fixture/config.ini" ] || fail "protected native configuration was written to main"
+ok "new registry entries protect their declared native configuration without validator changes"
+
+
+# --- 14. shellcheck, if installed
 if command -v shellcheck >/dev/null; then
-  shellcheck "$src"/ci/*.sh "$src"/tools/*.sh "$src"/tests/*.sh "$src"/.delphi/*.sh "$src"/.delphi/migrations/*.sh ||
+  shellcheck "$src"/ci/*.sh "$src"/ci/harnesses/*.sh "$src"/tools/*.sh "$src"/tests/*.sh "$src"/.delphi/*.sh "$src"/.delphi/migrations/*.sh ||
     fail "shellcheck"
   ok "shellcheck clean"
 fi
diff --git a/tests/harnesses.sh b/tests/harnesses.sh
new file mode 100644
index 0000000..5fa8d91
--- /dev/null
+++ b/tests/harnesses.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# Focused translation regressions; runs without GitHub, a model or changes to the checkout.
+set -euo pipefail
+src=$(cd "$(dirname "$0")/.." && pwd)
+t=$(mktemp -d)
+trap 'rm -rf "$t"' EXIT
+fail() { echo "FAIL - $*" >&2; exit 1; }
+header() { printf '%s\n' '---' 'name: fixture' 'description: Translation fixture.' '---'; }
+render() { bash -euo pipefail -c 'source "$1"; harness_file "$2" "$3" "commit open-pr"' _ "$src/ci/harnesses.sh" "$1" "$t/SKILL.md"; }
+
+cat >"$t/body.md" <<'SOURCE'
+Read the code repo's CLAUDE.md; follow workspace CLAUDE.md.
+Read CLAUDE.md from the repository.
+Read the repository's own CLAUDE.md.
+Keep `CLAUDE.md` and `grep -n rules CLAUDE.md` literal.
+Keep ``printf '`CLAUDE.md`'`` literal; invoke ``/commit``.
+Keep src/CLAUDE.md, ./CLAUDE.md, CLAUDE.md.backup and _CLAUDE.md.
+Keep /tmp/commit, /tmp/open-pr, /commit.txt and /commit/README.
+Keep https://example.invalid/commit and `cat /commit` literal.
+Invoke /commit and (/open-pr); then `/commit`.
+```sh
+grep -n rules CLAUDE.md
+cat /commit
+```
+~~~~sh
+cat CLAUDE.md
+```
+~~~~
+Use the pull_request_read tool.
+Use slack_send_message if that integration is available.
+SOURCE
+cat >"$t/expected.md" <<'NATIVE'
+Read the code repo's AGENTS.md; follow workspace AGENTS.md.
+Read AGENTS.md from the repository.
+Read the repository's own AGENTS.md.
+Keep `CLAUDE.md` and `grep -n rules CLAUDE.md` literal.
+Keep ``printf '`CLAUDE.md`'`` literal; invoke ``$commit``.
+Keep src/CLAUDE.md, ./CLAUDE.md, CLAUDE.md.backup and _CLAUDE.md.
+Keep /tmp/commit, /tmp/open-pr, /commit.txt and /commit/README.
+Keep https://example.invalid/commit and `cat /commit` literal.
+Invoke $commit and ($open-pr); then `$commit`.
+```sh
+grep -n rules CLAUDE.md
+cat /commit
+```
+~~~~sh
+cat CLAUDE.md
+```
+~~~~
+Use the PR reader tool.
+Use slack_send_message if that integration is available.
+NATIVE
+{ header; cat "$t/body.md"; } >"$t/SKILL.md"
+render codex >"$t/native.md"
+tail -n "$(wc -l <"$t/body.md")" "$t/native.md" >"$t/actual.md"
+cmp -s "$t/expected.md" "$t/actual.md" || fail "literal references or native skill calls changed: $(diff -u "$t/expected.md" "$t/actual.md")"
+render claude-code | cmp -s - "$t/SKILL.md" || fail "Claude source bytes changed"
+echo 'ok - literal filenames, paths and commands survive; native skill calls and PR-tool wording translate'
+
+while IFS= read -r identifier; do
+  { header; printf 'Use %s.\n' "$identifier"; } >"$t/SKILL.md"
+  if render codex >"$t/native.md" 2>"$t/errors"; then fail "accepted known Claude identifier: $identifier"; fi
+  grep -qF 'missing Claude mapping' "$t/errors" || fail "no mapping diagnostic: $identifier"
+  grep -qF '(translated line ' "$t/errors" || fail "misleading source line number: $identifier"
+done <<'IDENTIFIERS'
+~/.claude/settings.json
+$HOME/.claude/CLAUDE.md
+${HOME}/.claude/CLAUDE.md
+subagent_type=Explore
+WebFetch
+claude plugin install
+ultrathink
+IDENTIFIERS
+{ header; echo 'Use Claude Code and mcp__unmapped__action.'; } >"$t/SKILL.md"
+if render codex >"$t/native.md" 2>"$t/errors"; then fail 'accepted unmapped identifiers'; fi
+[ "$(grep -c 'missing Claude mapping' "$t/errors")" = 2 ] || fail 'diagnostics omitted a hit on the same line'
+number=$(sed -n '1s/.*(translated line \([0-9]*\)).*/\1/p' "$t/errors")
+sed -n "${number}p" "$t/native.md" | grep -qF 'Claude Code and mcp__unmapped__action' || fail 'translated line number points at the wrong line'
+echo 'ok - known Claude paths and tools fail with every hit and accurate translated-line diagnostics'
+
+# Exercise the real renderer, including owned skills and opt-outs, rather than injecting a catalog.
+d=$t/main folder=software/project/workspaces/native
+mkdir -p "$d/$folder/.agents/skills/local" "$d/software/project/workspace-inherit/.claude/skills/commit" \
+  "$d/software/project/workspace-inherit/.claude/skills/retired"
+cp -R "$src/ci" "$d/"
+printf 'name: s.project.native\nharness: codex\nopt-out:\n  - .agents/skills/retired\n' >"$d/$folder/workspace.yml"
+{ header; echo 'Invoke /commit, /local, /review, /plugin and /retired.'; } >"$d/software/project/workspace-inherit/.claude/skills/commit/SKILL.md"
+header >"$d/software/project/workspace-inherit/.claude/skills/retired/SKILL.md"
+header >"$d/$folder/.agents/skills/local/SKILL.md"
+bash "$d/ci/render.sh" --workspace "$folder" "$d" "$t/before"
+mkdir -p "$d/software/elsewhere/workspaces/other/.claude/skills/review" "$d/software/plugins/claude/extra/skills/plugin"
+header >"$d/software/elsewhere/workspaces/other/.claude/skills/review/SKILL.md"
+header >"$d/software/plugins/claude/extra/skills/plugin/SKILL.md"
+bash "$d/ci/render.sh" --workspace "$folder" "$d" "$t/after"
+diff -qr "$t/before" "$t/after" >/dev/null || fail 'unrelated skills changed native output'
+# shellcheck disable=SC2016 # native skill syntax is literal assertion text
+grep -qF 'Invoke $commit, $local, /review, /plugin and /retired.' "$t/after/$folder/.agents/skills/commit/SKILL.md" || fail 'workspace skill catalog omitted available skills or included unrelated/excluded ones'
+echo 'ok - workspace rendering scopes names to selected inherited and owned native skills'
diff --git a/tools/new-workspace.sh b/tools/new-workspace.sh
index 085fe70..d50aa2b 100755
--- a/tools/new-workspace.sh
+++ b/tools/new-workspace.sh
@@ -1,19 +1,20 @@
 #!/usr/bin/env bash
-# tools/new-workspace.sh [--by ai|ai-assisted|human] <org-path under software/> <leaf>: propose a new
-# workspace as a PR to main, labelled `by: <who>` (default ai: who wrote it, as the PR template asks).
-# In a temporary worktree of origin/main, copies templates/workspace/ and then, if present, the
-# project's software/<org-path>/workspace-defaults/ (its CLAUDE.md appended to the template's) to
-# software/<org-path>/workspaces/<leaf>/, sets `name: <name>` in its workspace.yml (its dotted name from
-# .delphi/names.sh, like s.app.argos.argos-dev; the workspace-inherit/ folders above it reach ws/<name>
-# on each sync), lists its default plugin sets and generates its .claude/settings.json (ci/plugins.sh),
-# checks it, pushes branch new-workspace/<org-path>/<leaf>, and opens the PR with gh. Your checkout is
-# untouched. After merge, ci/sync.sh creates ws/<name>.
+# tools/new-workspace.sh [--by ai|ai-assisted|human] [--harness <adapter>] <org-path> <leaf>:
+# prepare a main-side PR with owned native defaults; CI adds inheritance on the workspace branch.
+# Uses a temporary checkout of origin/main; never changes the caller's checkout.
 set -euo pipefail
 die() { echo "new-workspace: $*" >&2 && exit 1; }
 by=ai
-[ "${1:-}" != --by ] || { by=${2:-} && shift 2; }
+adapter=""
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --by) [ "$#" -ge 2 ] || die "--by needs a value"; by=$2; shift 2 ;;
+    --harness) [ "$#" -ge 2 ] || die "--harness needs a value"; adapter=$2; shift 2 ;;
+    *) break ;;
+  esac
+done
 case "$by" in ai | ai-assisted | human) ;; *) die "--by must be ai, ai-assisted or human" ;; esac
-[ $# -eq 2 ] || die "usage: tools/new-workspace.sh [--by ai|ai-assisted|human] <org-path under software/> <leaf>"
+[ $# -eq 2 ] || die "usage: tools/new-workspace.sh [--by ai|ai-assisted|human] [--harness <adapter>] <org-path under software/> <leaf>"
 org=${1%/}
 org=${org#software/}
 leaf=$2
@@ -30,11 +31,35 @@ trap 'git worktree remove --force "$wt"' EXIT
 defaults=$wt/software/$org/workspace-defaults
 [ ! -e "$wt/$folder" ] || die "$folder already exists on main"
 mkdir -p "$wt/$folder"
+# shellcheck source=ci/inherit.sh
+source "$wt/ci/inherit.sh"
+[ -n "$adapter" ] || adapter=$(awk '/^harness:/ { print $2; exit }' "$defaults/workspace.yml" 2>/dev/null || true)
+harness_exists "${adapter:-claude-code}" || die "unsupported harness"
+adapter=${adapter:-claude-code}
+instruction=$(harness_field "$adapter" instruction)
+instruction_template=$(harness_field "$adapter" instruction_template)
+instruction_base=$(harness_field "$adapter" instruction_base)
+plugins=$(harness_field "$adapter" plugins)
 cp -R "$wt/templates/workspace/." "$wt/$folder/"
+for target in $(harnesses); do rm -f "$wt/$folder/$(harness_field "$target" instruction)"; done
+mkdir -p "$(dirname "$wt/$folder/$instruction")"
+{ [ -z "$instruction_base" ] || cat "$wt/$instruction_base"; cat "$wt/$instruction_template"; } >"$wt/$folder/$instruction"
 if [ -d "$defaults" ]; then
-  cp -R "$defaults/." "$wt/$folder/"
-  cp "$wt/templates/workspace/CLAUDE.md" "$wt/$folder/CLAUDE.md"
-  [ ! -f "$defaults/CLAUDE.md" ] || { echo && cat "$defaults/CLAUDE.md"; } >>"$wt/$folder/CLAUDE.md"
+  records=$(cd "$wt" && bundle_files "software/$org/workspace-defaults" "$adapter") || die "cannot read project defaults"
+  exclusions=''
+  [ ! -f "$defaults/workspace.yml" ] || exclusions=$(optouts <"$defaults/workspace.yml")
+  inherited=$(cd "$wt" && inherited_files "$folder" "$adapter" "$exclusions") || die "cannot read inherited sources"
+  skill_names=$(harness_skill_names "$adapter" "$wt/$folder" "$records"$'\n'"$inherited" "$exclusions")
+  while IFS=$'\t' read -r meta path src; do
+    [ -n "$path" ] || continue
+    if [ "$path" = "$instruction" ]; then
+      { echo; cat "$wt/$src"; } >>"$wt/$folder/$instruction"
+    else
+      mkdir -p "$(dirname "$wt/$folder/$path")"
+      harness_file "$adapter" "$wt/$src" "$skill_names" >"$wt/$folder/$path"
+      [ "${meta%% *}" != 100755 ] || chmod +x "$wt/$folder/$path"
+    fi
+  done <<<"$records"
 fi
 name=$(cd "$wt" && bash .delphi/names.sh | awk -v f="$folder" '$2 == f { print $1 }')
 taken=$(cd "$wt" && bash .delphi/names.sh | awk -v n="$name" -v f="$folder" '$1 == n && $2 != f { print $2 }')
@@ -42,17 +67,21 @@ taken=$(cd "$wt" && bash .delphi/names.sh | awk -v n="$name" -v f="$folder" '$1
 for b in "ws/$name" "ws/software/$org/$leaf"; do # ws/software/…: a workspace's branch when they were named by path, which sync would carry over
   ! git rev-parse --quiet --verify "refs/remotes/origin/$b" >/dev/null || die "branch $b already exists (from a removed workspace?); pick another leaf"
 done
-sed -i.bak -e "s|{{name}}|$name|g" -e "s|{{folder}}|$folder|g" "$wt/$folder/CLAUDE.md" && rm "$wt/$folder/CLAUDE.md.bak"
+sed -i.bak -e "s|{{name}}|$name|g" -e "s|{{folder}}|$folder|g" "$wt/$folder/$instruction" && rm "$wt/$folder/$instruction.bak"
 y=$wt/$folder/workspace.yml
-{ echo "name: $name"; grep -v '^name:' "$y"; } >"$y.new" && mv "$y.new" "$y"
-bash "$wt/ci/plugins.sh" "$wt" >/dev/null # its plugins: defaults and .claude/settings.json
+if [ "$plugins" = none ] && awk '/^plugins:/ { s = 1; next } /^[^[:space:]#]/ { s = 0 }
+  s && /^[[:space:]]+-/ { found = 1 } END { exit !found }' "$y"; then
+  die "$adapter does not support Delphi plugin sets in project defaults"
+fi
+{ echo "name: $name"; echo "harness: $adapter"; awk -v plugins="$plugins" '/^name:|^harness:/ { next } plugins == "none" && /^plugins:/ { skip = 1; next } /^[^[:space:]#]/ { skip = 0 } !skip { print }' "$y"; } >"$y.new" && mv "$y.new" "$y"
+bash "$wt/ci/render.sh" "$wt"
 "$wt/ci/check.sh" "$wt"
 git -C "$wt" add -A "$folder"
 git -C "$wt" commit --quiet -m "New workspace $name"
 git -C "$wt" push --quiet origin "HEAD:refs/heads/$branch"
 gh pr create --base main --head "$branch" --title "Add workspace $name" --label "by: $by" --body "## Changes
 
-Adds \`$folder/\` from templates/workspace (plus software/$org/workspace-defaults if present). After merge, CI creates branch ws/$name.
+Adds \`$folder/\` from templates/workspace (plus translated project defaults). After merge, CI creates branch ws/$name with its inherited context.
 
 ## Testing
 
@@ -60,7 +89,7 @@ Adds \`$folder/\` from templates/workspace (plus software/$org/workspace-default
 
 ## Notes
 
-Before merging, fill in its workspace.yml repos (and list main under workspaces:, recommended, so it can read this project's shared context) and its CLAUDE.md.
+Before merging, fill in its workspace.yml repos (and list main under workspaces:, recommended, so it can read this project's shared context) and its $instruction.
 
 ## Checklist