Build 3: Hosts #24

Claude Code is the only host Baley supports in this release, and Build 3 removes Codex support. Each Claude Code session starts its own Baley MCP server over stdio, and the session's subagents reach it through the session's connection. There is no launcher, no HTTP listener and no background service, and every worker in this release is a subagent of its session. The server takes its project from CLAUDE_PROJECT_DIR, records its working directory beside it, and creates a session id that every call carries, with the host's own session id beside it when one is set. Ledger events record which caller wrote them. Each project call is prepared from the session's CLAUDE_PROJECT_DIR in the order the command line uses: a read appends nothing, and a write runs checkout admission and the host's policy step before its command. T7's document and T8's capture are the first operations to use it. Another host can connect and list the tools, but every tool call it makes is refused with Claude Code named as the supported host. Sessions share the ledger through the store: every write takes the writer queue and decides inside its transaction (ADR 0012), and the build's acceptance includes two live Claude Code sessions writing one project at once, with the record checked afterwards. Agents can neither read nor write Baley's home or its config folder (config.toml and keys.env). Claude Code's sandbox, its file permission rules and Baley's guard hook carry that together, and baley doctor reports what an agent can reach. The compiled instructions are served (ADR 0009), the build renders the stub content that the held delivery tasks will write, and it opens with warnings that say what a restore cannot undo. Captures are recorded.

Requirements:

• 0001: EVD-R24.
• 0002: SYS-R1 to SYS-R6.
• 0003: CFG-R11.
• 0010: GRD-R1 to GRD-R14.
• 0012: HST-R1 to HST-R7, HST-R9, HST-R13, HST-R17 to HST-R20.
• 0014: SUP-R1.

Blocked by #23 (Build 2). Carries #71 and #146.

Tasks

One pull request per task, ticked when it merges.

• T1. Explain purge uncertainty after a restore (Build 3 T1: explain purge uncertainty after a restore #176)
• T2. Claude host seam and Codex removal (Build 3 T2: Claude Code as the only host, Codex removed #182)
• T3. Caller provenance in the ledger (Build 3 T3: caller provenance in the ledger #183)
• T4. Per-session stdio server and store maintenance (Build 3 T4: per-session stdio server and store maintenance #189)
• T5. Per-request discovery, admission and policy (Build 3 T5: per-request discovery, admission and policy #191)
• T6. Guard decisions and protected paths (Build 3 T6: guard decisions and protected paths #196)
• T7. Compiled instructions, help, schemas and parts (Build 3 T7: compiled instructions, help, schemas and parts #199)
• T8. Ledger captures and project identity reads (Build 3 T8: ledger captures and project identity reads #202)
• T9. Bounded guard process and storage access (Build 3 T9: bounded guard process and storage access #204)
• T10. Per-user guard records and Claude hook answers (Build 3 T10: per-user guard records and Claude hook answers #207)
• T11. Claude artifact content and logical stubs (Render Claude Code's artifacts as content and refuse to call a sandbox bypass safe #228)
• T12. Live Claude qualification and concurrent sessions (Run Baley live in Claude Code and keep what three runs showed #236)
• T13. Runtime doctor host observations (Add the doctor's runtime host checks #237)
• T14. Binary delivery and update activation (Add binary delivery with unsigned development artifacts #250)
• T15. Claude artifact ownership and application (Add baley install with Claude artifact ownership and application #253)
• T16. Owner setup entry and completion record (Add provider choice and acknowledgement to the config interview #257)
• T17. Delivery doctor and installed qualification (Add installed doctor checks and the unsigned development qualification #262)