@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   linux-client:
-    name: Pinned Linux build and offline smoke
+    name: Pinned Linux build and synthetic protocol
     runs-on: ubuntu-24.04
     timeout-minutes: 90
     env:
@@ -46,9 +46,11 @@ jobs:
           set -euo pipefail
           rustup toolchain install 1.95.0 --profile minimal --no-self-update
           sudo apt-get update -y
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends build-essential pkg-config libcap-dev bubblewrap
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends build-essential pkg-config libcap-dev bubblewrap strace openssl iproute2
           rustc +1.95.0 --version --verbose
           df -h "$RUNNER_TEMP"
+      - name: Synthetic TLS namespace preflight
+        run: bash tools/session_store/protocol_smoke.sh /usr/bin/true --preflight
       - name: Offline namespace preflight
         run: |
           set -euo pipefail
@@ -95,3 +97,5 @@ jobs:
             -- /usr/bin/setpriv --reuid=65534 --regid=65534 --clear-groups \
             --bounding-set=-all --inh-caps=-all --ambient-caps=-all --no-new-privs \
             /usr/bin/python3 /work/check.py "$host_net"
+      - name: Synthetic TLS device-code and cancellation
+        run: bash tools/session_store/protocol_smoke.sh "$RUNNER_TEMP/native-source/codex-rs/target/dev-small/codex"
@@ -1,5 +1,26 @@
+# Synthetic Native Login Protocol - 2026-10-14
+
+- Added a CI-only harness for the pinned actual stdio app-server, fresh private
+  CA/local TLS peer and supported development issuer override. No real provider,
+  installed binary/profile, phone, medical data, model or therapy path is used.
+- Six bounded cases cover initialize, pending device-code polling, wrong/correct/
+  repeated cancellation, process termination, independent trust/name failures,
+  server refusal and malformed response. Strict request/header, syscall, private
+  file budget and namespace/process/listener teardown guards fail closed.
+- Nine initial guard tests failed before implementation; all44 tooling tests,
+  Ruff E/F and shell syntax now pass locally. A no-client TLS/network preflight
+  precedes compilation. Actual Linux protocol and exact-source Verify results
+  remain pending; publication is not deployment or real authentication.
+
 # Pinned Native Build Validation - 2026-10-14
 
+- Completed the exact-source native workflow at11e03445:169 native library tests,
+  full CLI build, strict offline version/private-scratch and provenance gates
+  passed. The single ignored outer entrypoint is parent-invoked. All35 Python
+  cases passed. Both push/PR Verify workflows passed backend/storage/Android.
+  Observed ELF digest was fa9607f213e252d25f01d2df2aa8ff42f3ab68ed3a9d4b27073dd2c083a4fc0f.
+  These results do not establish authenticated access or production readiness.
+
 - The corrected tmpfs run built the identical ELF digest again and successfully
   executed the exact quiet native --version offline. The strict scratch gate
   then refused the native temporary directory mode. Pinned tempfile3.27.0's Unix
 
@@ -19,8 +19,14 @@ Isolation preflight executes no client. Native login library tests and the actua
 minimal-root, nonroot version smoke. A success is build/provenance evidence only,
 not authenticated model access or production containment. No binary artifact,
 release, deployment, keyring/profile mount or real login is part of this workflow.
-Actual contained TLS/header/device-code/cancel tests and explicit runtime-change
-admission remain separate gates. Keep existing runtime and owner profile intact.
+The same workflow now includes a separate synthetic native protocol harness;
+see tools/session_store/README.md. It uses only a disposable private CA/loopback
+peer, the development build's supported issuer override, six bounded negative/
+cancel/termination cases and an independent namespace teardown check. Exact-source
+execution is a gate, not inferred from unit tests. No real provider login,
+token exchange, inference or production profile is involved. Explicit runtime-
+change admission and actual production containment remain separate gates.
+Keep existing runtime and owner profile intact.
 
 ## Atomic Session Candidate
 
 
@@ -10,6 +10,9 @@
   orphan promotion, guaranteed session continuity or power-cut claim.
 - Standalone helper/source checks do not attest a full installed client, active
   containment or authorization. No runtime replacement follows from passing CI.
+- Synthetic native protocol runs use only a fresh private CA/local peer and
+  development issuer override. They cannot broaden the independent HEAD-only
+  public transport profile or authorize real login/provider token exchange.
 
 ## Transport Probe Isolation
 
 
@@ -1,13 +1,24 @@
 # PLAN
 
+## Synthetic Native Protocol (2026-10-14)
+
+- Exact-source native component tests/full CLI/offline version/provenance and
+  push/PR Verify passed at11e03445. The candidate remains undeployed.
+- Implemented six CI-only local TLS protocol cases plus no-client preflight,
+  identity/route/body/syscall/private-state guards and independent namespace
+  teardown. All44 local tooling cases, Ruff and shell syntax passed. Actual
+  compiled-client protocol and exact-source publication/CI remain gates.
+- No real account login/token exchange, profile controller, production gateway,
+  authenticated inference, device history/chat or phone/therapy change.
+
 ## Atomic Session Storage Candidate (2026-10-14)
 
 - Original Rust file operations reproduced destructive interruption. The narrow
   tempfile/sync/replace candidate passed10 parent tests and9 verifier/fetch cases;
   source compatibility verifies clean application and exact tested helper bytes.
   Local format/Clippy/Python checks passed; an independent Linux CI gate is added.
-- This is not a full upstream/client binary build, deployment or authenticated
-  runtime. Resolve provider-rotation gaps and bounded serialized orphan admission,
+- Subsequent native-build validation passed; this is not deployment or an
+  authenticated runtime. Resolve provider-rotation gaps and bounded serialized orphan admission,
   obtain runtime-change approval and capture the actual isolated client before
   real owner login. No old auth, host keyring, phone or therapy change.
 
 
@@ -1,5 +1,19 @@
 # SECURITY REVIEW
 
+## Synthetic Native Login Protocol (2026-10-14)
+
+- CI-only peers use fresh private TLS material in an isolated loopback-only
+  network/PID/mount context. Nonroot/no-capabilities/no-new-privileges and cleared
+  native environment are checked before execution; no host profile is mounted.
+- Exact synthetic POST bodies/routes and neutral/absent identity headers are
+  admitted. No OAuth exchange or successful authorization is simulated. TLS trust
+  and certificate-name failures, server refusal and malformed replies must fail.
+- Actual client execution/connection trace, private bounded scratch, cancellation
+  polling silence, process/listener teardown and post-exit kernel namespace
+  references are checked. CI is not a production cgroup/seccomp/gateway proof;
+  bounded files are not a full native filename allowlist. No medical data or
+  provider credential can enter this harness. Real login remains separate.
+
 ## Offline Session Candidate (2026-10-14)
 
 - File persistence candidate only, with source-hash admission and fixed patch
 
@@ -2,7 +2,8 @@
 
 Source-level repair for the pinned upstream file backend. **Not deployed and not
 an authenticated runtime.** No client launcher, account/token import or provider
-request is included. Keep the existing runtime and empty owner profile unchanged.
+request to a real provider is included. Keep the existing runtime and owner
+profile unchanged. The CI-only synthetic protocol harness below is separate.
 
 The helper writes a private sibling temporary file, syncs its contents, atomically
 persists it over the destination, then syncs the parent directory on Unix. Before
@@ -74,6 +75,45 @@ different path/link/type, nonempty lock or nonprivate alias group is refused.
 Only counts are reported. This does not test a real login, TLS headers, model
 access or cancellation, and no existing owner profile is mounted.
 
+## Synthetic Native Protocol
+
+After compilation/version validation, `protocol_smoke.sh` runs the actual CLI's
+stdio app-server against a newly generated private CA and local TLS peer. The
+native development build's supported login-issuer override selects only
+`https://login.example.test:8443`. The source, native protocol and storage patch
+are unchanged. This does not establish the release build's issuer selection,
+production gateway behavior or real provider compatibility.
+
+An early no-client preflight checks the same namespace, peer/trust setup and
+teardown before expensive compilation. Only loopback is enabled inside a fresh
+network namespace, with a file-only name mapping and no host resolver/profile.
+Trusted setup holds network-administration privileges only until loopback is up;
+the checker, TLS peer and client run as UID/GID65534, no supplementary groups,
+all capabilities cleared and no-new-privileges. Read-only runtime/test inputs,
+a128MiB private tmpfs and time/CPU/address-space/process/file-size limits bound
+the run. Host /tmp, keyrings, auth, configuration and histories are not mounted.
+
+Six scenarios cover initialize/device-code/pending polling, wrong-ID/correct-ID/
+repeat cancellation, process-group termination, untrusted CA, trusted CA with a
+wrong certificate name, provider403 and malformed user-code JSON. Only two exact
+POST routes and synthetic bodies are accepted; OAuth token exchange is not
+allowed. Initialization and effective HTTP identities must be neutral, or absent
+for the native raw-auth client. Credential headers are refused.
+
+A bounded syscall trace admits only the mounted client execution and loopback
+peer connection attempts. Each scenario checks private owner/modes, bounded
+file counts/bytes and absence of auth.json. This is a bounded scratch inventory,
+not a complete native filename allowlist or proof against malicious client code.
+Polling must stop after cancellation; process groups/listener threads must exit.
+An independent host-side kernel namespace-reference check follows Bubblewrap's
+PID-namespace teardown. Only count/status receipts are printed. Generated peer
+keys are removed by the wrapper; no binary or test-state artifact is uploaded.
+
+Actual native protocol results remain pending until the exact-source workflow
+finishes. Synthetic codes are not credentials, successful cancellation is not
+authenticated inference, and none of this authorizes a real owner login or
+server runtime replacement.
+
 ## Limits
 
 - Tests execute the actual Rust helper on synthetic files, including controlled