feat(context): integrate verified isolated Claude generations (#3452)

docs/design/context-profile-delivery.md

@@ -68,7 +68,15 @@ The task call sends the query and selected reference content on standard input t
 
 `profile start` is an explicit terminal-only boundary. It revalidates the store and native generation, then launches the pinned Codex binary with inherited terminal capabilities and the isolated home. The bootstrap tells the active agent to resolve context at material task boundaries through bounded structured stdin. It remains prompt-advisory, grants no tools or permissions, and persists no task prose or selected skill bodies. Authentication must be completed separately inside the isolated home; the start path does not inherit or copy provider credentials.
 
-Switching the managed profile makes the old native generation stale until `prepare-native` succeeds. To undo a switch, first `rollback` the managed store, then use `native-rollback` with both roots. `native-recover` handles a retained interruption journal without deleting provider data. Existing sessions retain their original context. These commands support isolated Codex generations, not migration of an existing global installation or native activation for other providers.
+## Isolated native Claude generations
+
+A managed store with `--target claude` uses the same `prepare-native`, `native-status`, `native-rollback`, `native-recover`, `run` and `start` commands. Claude Code loads the carrier for each session with `--plugin-dir`; nothing is installed, no marketplace is registered and no settings are written. The generation holds a private `home/.claude` used as `CLAUDE_CONFIG_DIR`, an empty project and a verified copy of the carrier in `plugin/`. Every Claude call sets `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` and `CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL`, so the isolated home gains no other plugins.
+
+Preparation admits Claude Code 2.1.292 and later 2.1 patches; the receipt records the exact version, and a changed binary needs a new preparation. It requires a clean `claude plugin validate --json` report, exactly one session plugin (`ecc-context-carrier@inline`, enabled, at the generation's `plugin/` path) from `claude --plugin-dir … plugin list --json`, and a `claude --plugin-dir … plugin details` inventory whose skills equal the carrier selection with zero agents, hooks, MCP servers and LSP servers. `details` has no JSON form; an unparseable or changed report fails closed, which is why the admitted range is bounded to the 2.1 series. The copied files must match the carrier digests after the provider calls.
+
+The receipt records the host's always-on projection as `nativeObservation` (`surface: plugin-always-on-listing`, `method: claude-plugin-details@<version>`, `approximate: true`). It is Claude Code's own estimate of the listing cost of this one plugin, not whole-context usage. `native-status` checks file integrity of the plugin copy, `CLAUDE.md`, user settings, skills, agents and commands in the isolated home; provider runtime state such as `.claude.json` and plugin bookkeeping is outside those controls, and plugin registration is verified again at each preparation.
+
+Switching the managed profile makes the old native generation stale until `prepare-native` succeeds. To undo a switch, first `rollback` the managed store, then use `native-rollback` with both roots. `native-recover` handles a retained interruption journal without deleting provider data. Existing sessions retain their original context. These commands support isolated Codex and Claude generations, not migration of an existing global installation or native activation for other providers.
 
 Discovery evidence comes from the generation's empty project. Task launch inherits the caller's task working directory, whose repository instructions and native configuration may add context or affect policy. Native readiness attests the isolated home's recorded inventory and integrity, not the complete context or permissions of every possible task directory.
 

docs/design/context-profile-delivery.tdd.md

@@ -97,4 +97,15 @@ The 77-prompt routing corpus from #2945 (52 direct, 25 paraphrased) found one wr
 - Corpus result: zero loads outside the expected set; 19 implicit admissions become 17. The other dropped admission, `skill:cost-tracking`, now defers to the bounded proposal instead of loading.
 - The existing nine-query auto/agent corpus, fallback, launch, evaluation and retrieval suites pass unchanged.
 
-These boundaries keep the shipped behavior distinct from the M1 release gate. Authenticated outcome observations, a complete Tier 2 disk diff, live-install migration, other-provider activation, whole-context token truth and release defaults remain unverified until their explicit prerequisites are available.
+## Isolated Claude native generations
+
+Session-only Claude discovery adapts the ownership and receipt intent of #2788 to the existing native store; it never writes a marketplace or user settings.
+
+- RED: 22 cases fail before the provider adapter (preview, prepare, version gate, nine discovery corruptions, details mismatch, static integrity, runtime-state tolerance, provider-home roots, Codex-to-Claude staleness, task launch and interactive start).
+- GREEN: all 22 pass. Codex native (39), interactive (8), launch (12), auto launch (5), evaluation (31), store (31) and profile CLI suites pass unchanged; Codex receipts keep their shape, and evaluator Claude launches without a plugin directory keep their arguments and environment.
+- Credential-free real run on Linux x64 with Claude Code 2.1.292 and the actual registry: Lean prepared ready with three skills and a 398-token always-on projection; Full prepared ready with 293 skills and 35,658 tokens; Full excluding `skill:python-patterns` verified 292 skills without it at 35,561 tokens. Switching profiles reported `stale`, and native rollback restored the Lean generation. `run --dry-run` resolved the pinned binary with `--plugin-dir`; `start --dry-run` proposed the Claude generation.
+- Claude Code auto-updated to 2.1.293 during review, and the exact 2.1.292 pin rejected it. RED: tests for later 2.1 patches fail. GREEN admits 2.1.292 and later 2.1 patches while rejecting 2.1.291, 2.2.0, prereleases and malformed output. A real 2.1.293 run prepared Lean ready at the same 398-token projection; preparation took 2.4 s (provider calls 1.2 s), an unchanged re-preparation 0.9 s and status 11 ms.
+- No authenticated model call, interactive turn or native skill invocation ran. The projection is the host's estimate for the plugin listing, not whole-context truth.
+- Maintainer credential-free macOS arm64 check, October 10: Claude Code 2.1.296 prepared Lean with three skills (~289 listing tokens), Full with the then-current 302 skills (~25,982 listing tokens), reported stale after each managed profile switch, and restored Lean through managed and native rollback. These are observed plugin-listing projections for that snapshot, not whole-context measurements.
+
+These boundaries keep the shipped behavior distinct from the M1 release gate. Authenticated outcome observations, a complete Tier 2 disk diff, live-install migration, additional-provider activation, whole-context token truth and release defaults remain unverified until their explicit prerequisites are available.