diff --git a/apps/presentation/dashboard/src/features/personal-workspace/attached-agent-conversations.css b/apps/presentation/dashboard/src/features/personal-workspace/attached-agent-conversations.css
new file mode 100644
index 0000000000..4a64b1ab5c
--- /dev/null
+++ b/apps/presentation/dashboard/src/features/personal-workspace/attached-agent-conversations.css
@@ -0,0 +1,22 @@
+.attached-agent-conversations {margin: 12px 24px;}
+.attached-conversation-entry {font: inherit; padding: 8px 12px; border: 1px solid var(--pw-line); border-radius: 6px; background: var(--pw-card); color: var(--pw-text); cursor: pointer;}
+.attached-conversation-dialog {position: fixed; inset: 0; margin: auto; width: min(960px, calc(100vw - 24px)); max-height: calc(100dvh - 48px); padding: 0; border: 1px solid var(--pw-line); border-radius: 12px; background: var(--pw-card); color: var(--pw-text); font: inherit;}
+.attached-conversation-dialog[open] {display: flex; flex-direction: column;}
+.attached-conversation-dialog::backdrop {background: rgb(0 0 0 / 32%);}
+.attached-conversation-heading {display: flex; align-items: center; justify-content: space-between; padding: 16px; gap: 16px; border-bottom: 1px solid var(--pw-line);}
+.attached-conversation-heading h2 {margin: 0; font-size: var(--text-heading);}
+.attached-conversation-heading button {font: inherit; padding: 8px 12px; color: inherit; background: var(--pw-card); border: 1px solid var(--pw-line); border-radius: 6px;}
+.attached-conversation-content {padding: 0 16px 16px; font-size: var(--text-body); min-height: 0; overflow: auto;}
+.attached-conversation-content > p {color: var(--pw-text);}
+.attached-conversation-content label {display: grid; gap: 8px; margin-block: 12px;}
+.attached-conversation-content select, .attached-conversation-content textarea {font: inherit; padding: 8px; border: 1px solid var(--pw-line); border-radius: 6px; background: var(--pw-card); color: var(--pw-text);}
+.attached-conversation-content textarea {min-height: 88px; width: 100%; resize: vertical;}
+.attached-conversation-content button {font: inherit; padding: 8px 12px; border: 1px solid var(--pw-line); border-radius: 6px; background: var(--pw-card); color: var(--pw-text); cursor: pointer;}
+.attached-conversation-content button:disabled, .attached-conversation-content button[aria-disabled="true"] {opacity: .5; cursor: default;}
+.attached-conversation-content .attached-conversation-open {border: 0; padding: 0; border-radius: 0; background: transparent; text-decoration: underline; text-underline-offset: 3px;}
+.attached-conversation-messages {max-height: min(40vh, 360px); overflow: auto; overscroll-behavior: contain; margin-block: 16px;}
+.attached-conversation-messages article {padding-block: 16px; border-top: 1px solid var(--pw-line); overflow-wrap: anywhere;}
+.attached-conversation-messages header {display: flex; flex-wrap: wrap; gap: 8px; align-items: baseline;}
+.attached-conversation-messages time {font-size: var(--text-caption); color: var(--pw-muted);}
+.attached-conversation-messages [data-role="user"] {padding-inline: 12px; background: var(--pw-hover); border-radius: 6px;}
+@media (max-width: 640px) {.attached-agent-conversations {margin: 12px;} .attached-conversation-messages {max-height: 48vh;}}
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/attached-agent-conversations.tsx b/apps/presentation/dashboard/src/features/personal-workspace/attached-agent-conversations.tsx
new file mode 100644
index 0000000000..035239bdcb
--- /dev/null
+++ b/apps/presentation/dashboard/src/features/personal-workspace/attached-agent-conversations.tsx
@@ -0,0 +1,190 @@
+import {useEffect, useRef, useState} from "react";
+import {MarkdownText} from "./markdown";
+import "./attached-agent-conversations.css";
+
+type Binding = {agent_id: string; thread_id: string; binding_ref: string};
+type Message = {id: string; role: "user" | "assistant"; text: string; truncated: boolean; timestamp: string | null};
+type Snapshot = {messages?: Message[]; before?: number | null; source_ref?: string; history_size?: number; revision: string; unchanged?: boolean; connected?: boolean; can_reply?: boolean; activity: {state: string}};
+type Submission = {operation_id: string; text: string; status?: string};
+
+async function request<T>(url: string, options?: RequestInit): Promise<T> {
+  const response = await fetch(url, {...options, signal: AbortSignal.timeout(6_000)});
+  const value = await response.json();
+  if (!response.ok || value.ok !== true) throw new Error(value.error || "Conversation unavailable");
+  return value as T;
+}
+
+/** Owner-only original conversation. It never changes the selected executor. */
+export function AttachedAgentConversations({goalId, zh}: {goalId: string; zh: boolean}) {
+  const [open, setOpen] = useState(false);
+  const [agents, setAgents] = useState<Binding[]>([]);
+  const [selected, setSelected] = useState("");
+  const [messages, setMessages] = useState<Message[]>([]);
+  const [snapshot, setSnapshot] = useState<Snapshot | null>(null);
+  const [before, setBefore] = useState<number | null>(null);
+  const [error, setError] = useState("");
+  const [recoveryError, setRecoveryError] = useState("");
+  const [draft, setDraft] = useState("");
+  const [submission, setSubmission] = useState<Submission | null>(null);
+  const [sending, setSending] = useState(false);
+  const [loadingOlder, setLoadingOlder] = useState(false);
+  const [opening, setOpening] = useState(false);
+  const [openRequested, setOpenRequested] = useState(false);
+  const [openError, setOpenError] = useState("");
+  const [refresh, setRefresh] = useState(0);
+  const generation = useRef(0);
+  const receiptGeneration = useRef(0);
+  const revision = useRef("");
+  const history = useRef<{source: string; size: number} | null>(null);
+  const transcript = useRef<HTMLDivElement>(null);
+  const dialog = useRef<HTMLDialogElement>(null);
+  useEffect(() => {
+    if (open && !dialog.current?.open) dialog.current?.showModal();
+    else if (!open && dialog.current?.open) dialog.current.close();
+  }, [open]);
+  const binding = agents.find(agent => agent.agent_id === selected);
+  const awaitingReceipt = Boolean(submission?.status && submission.status !== "delivered");
+  const cacheKey = binding ? `loopx-attached-input:${goalId}:${binding.binding_ref}` : "";
+  const query = binding ? new URLSearchParams({goal_id: goalId, agent_id: binding.agent_id, binding_ref: binding.binding_ref}) : null;
+
+  useEffect(() => {
+    let active = true;
+    setAgents([]); setSelected(""); setMessages([]); setSnapshot(null); setError("");
+    if (open) void request<{agents: Binding[]}>(`/api/chat/codex-attached?${new URLSearchParams({goal_id: goalId})}`)
+      .then(value => {if (active) {setAgents(value.agents); setSelected(value.agents[0]?.agent_id ?? "");}})
+      .catch(failure => {if (active) setError(String(failure));});
+    return () => {active = false;};
+  }, [goalId, open, refresh]);
+
+  useEffect(() => {
+    const current = ++generation.current;
+    revision.current = "";
+    history.current = null;
+    setOpening(false); setOpenRequested(false); setOpenError("");
+    setMessages([]); setSnapshot(null); setBefore(null); setDraft(""); setSubmission(null); setSending(false); setLoadingOlder(false); setError(""); setRecoveryError("");
+    if (!binding || !open) return;
+    try {
+      const stored = sessionStorage.getItem(cacheKey);
+      if (stored) {
+        const pending = JSON.parse(stored) as Submission;
+        if (!pending || typeof pending.operation_id !== "string" || typeof pending.text !== "string" || !["pending", "delivered"].includes(pending.status ?? "")) throw new Error("Invalid recovery record");
+        setDraft(pending.status === "delivered" ? "" : pending.text); setSubmission(pending);
+        if (pending.status === "pending") void readReceipt(pending, current);
+      }
+    } catch {setRecoveryError(zh ? "浏览器回复恢复记录不可读，暂不能安全发送。请先在原 App 核对。" : "Reply recovery is unreadable; check the original App before clearing it.");}
+    let timer: ReturnType<typeof setTimeout>;
+    async function read() {
+      const params = new URLSearchParams(query!);
+      if (revision.current) params.set("revision", revision.current);
+      try {
+        const next = await request<Snapshot>(`/api/chat/codex-attached?${params}`);
+        if (current !== generation.current) return;
+        const follow = !transcript.current || transcript.current.scrollHeight - transcript.current.scrollTop - transcript.current.clientHeight < 64;
+        revision.current = next.revision;
+        if (!next.unchanged) {
+          const reset = !history.current || history.current.source !== next.source_ref || (next.history_size ?? 0) < history.current.size;
+          history.current = {source: next.source_ref ?? "", size: next.history_size ?? 0};
+          setMessages(previous => [...new Map([...(reset ? [] : previous), ...next.messages ?? []].map(message => [message.id, message])).values()].sort((a,b) => Number(a.id) - Number(b.id)).slice(-1000));
+          if (reset) setBefore(next.before ?? null);
+        }
+        setSnapshot(previous => ({...previous, ...next})); setError("");
+        if (follow) requestAnimationFrame(() => transcript.current?.scrollTo({top: transcript.current.scrollHeight}));
+      } catch (failure) {if (current === generation.current) {setError(String(failure)); setSnapshot(null);}}
+      finally {if (current === generation.current) timer = setTimeout(read, 1000);}
+    }
+    void read();
+    return () => {generation.current++; clearTimeout(timer);};
+  }, [goalId, binding?.binding_ref, open]);
+
+  async function openOriginal() {
+    if (!binding || opening) return;
+    const current = generation.current;
+    setOpening(true); setOpenRequested(false); setOpenError("");
+    try {
+      await request<{requested: true}>("/api/chat/codex-attached/open", {method: "POST", headers: {"Content-Type":"application/json"}, body: JSON.stringify({goal_id: goalId, agent_id: binding.agent_id, binding_ref: binding.binding_ref})});
+      if (current === generation.current) setOpenRequested(true);
+    } catch (failure) {if (current === generation.current) setOpenError(String(failure));}
+    finally {if (current === generation.current) setOpening(false);}
+  }
+
+  async function older() {
+    if (before === null || !query || loadingOlder) return;
+    const current = generation.current;
+    setLoadingOlder(true);
+    const params = new URLSearchParams(query); params.set("before", String(before));
+    try {
+      const next = await request<Snapshot>(`/api/chat/codex-attached?${params}`);
+      if (current === generation.current) {
+        if (!history.current || history.current.source !== next.source_ref || (next.history_size ?? 0) < history.current.size) throw new Error(zh ? "原会话历史已更新，请重新连接。" : "Original history changed; reconnect to read it.");
+        setMessages(previous => [...new Map([...(next.messages ?? []), ...previous].map(row => [row.id, row])).values()].sort((a,b) => Number(a.id) - Number(b.id)).slice(0,1000));
+        setBefore(next.before ?? null);
+      }
+    } catch (failure) {if (current === generation.current) setError(String(failure));}
+    finally {if (current === generation.current) setLoadingOlder(false);}
+  }
+
+  async function send() {
+    if (!binding || sending || error || recoveryError || !snapshot?.can_reply || !draft.trim() || awaitingReceipt) return;
+    const current = generation.current;
+    const pending = {operation_id: crypto.randomUUID(), text: draft, status: "pending"};
+    try {sessionStorage.setItem(cacheKey, JSON.stringify(pending));}
+    catch {setError(zh ? "无法保存回复回执，未发送。" : "Cannot save reply recovery; nothing was sent."); return;}
+    receiptGeneration.current++;
+    setSubmission(pending); setSending(true);
+    try {
+      const result = await request<{status: string}>("/api/chat/codex-attached", {method: "POST", headers: {"Content-Type":"application/json"}, body: JSON.stringify({operation_id: pending.operation_id, text: pending.text, goal_id: goalId, agent_id: binding.agent_id, binding_ref: binding.binding_ref})});
+      if (current === generation.current) {
+        const delivered = {...pending, status: result.status};
+        sessionStorage.setItem(cacheKey, JSON.stringify(delivered)); setSubmission(delivered);
+        if (result.status === "delivered") setDraft("");
+        else void readReceipt(pending, current);
+        revision.current = "";
+      }
+    } catch (failure) {if (current === generation.current) {setError(String(failure)); void readReceipt(pending, current);}}
+    finally {if (current === generation.current) setSending(false);}
+  }
+  async function readReceipt(pending = submission, current = generation.current) {
+    // Recover from existing evidence only. Never retry the native effect.
+    if (!query || !pending || current !== generation.current) return;
+    const receiptVersion = receiptGeneration.current;
+    const params = new URLSearchParams(query); params.set("operation_id", pending.operation_id);
+    try {
+      const receipt = await request<{status: string}>(`/api/chat/codex-attached?${params}`);
+      if (current === generation.current && receiptVersion === receiptGeneration.current) {
+        const next = {...pending, status: receipt.status};
+        sessionStorage.setItem(cacheKey, JSON.stringify(next)); setSubmission(next);
+        setRecoveryError("");
+        if (receipt.status === "delivered") {receiptGeneration.current++; setDraft("");}
+      }
+    } catch (failure) {if (current === generation.current && receiptVersion === receiptGeneration.current) setRecoveryError(String(failure));}
+  }
+  function nextReply() {
+    try {sessionStorage.removeItem(cacheKey); receiptGeneration.current++; setSubmission(null); setDraft(""); setError(""); setRecoveryError("");}
+    catch {setError(zh ? "无法清理回复回执。" : "Reply recovery could not be cleared.");}
+  }
+  return <section className="attached-agent-conversations">
+    <button type="button" className="attached-conversation-entry" onClick={() => setOpen(true)}>{zh ? "与 Codex App 原会话对话" : "Talk to original Codex App conversations"}</button>
+    <dialog ref={dialog} className="attached-conversation-dialog" aria-label={zh ? "Codex App 原会话" : "Original Codex App conversations"} onClose={() => setOpen(false)}>
+    <header className="attached-conversation-heading"><h2>{zh ? "Codex App 原会话" : "Original Codex App conversations"}</h2><button type="button" onClick={() => setOpen(false)}>{zh ? "返回工作台" : "Return to workspace"}</button></header>
+    <div className="attached-conversation-content">
+      <p>{zh ? "每秒同步原会话已保存的消息；逐字流和审批仍在 Codex App。" : "Saved messages sync every second; token streaming and approvals remain in Codex App."}</p>
+      {agents.length ? <label>{zh ? "Agent" : "Agent"}<select aria-label={zh ? "选择原会话 Agent" : "Original conversation Agent"} value={selected} disabled={sending} onChange={event => setSelected(event.target.value)}>{agents.map(agent => <option key={agent.binding_ref} value={agent.agent_id}>{agent.agent_id}</option>)}</select></label> : !error ? <p>{zh ? "此 Goal 暂无已绑定的本机 Codex App 会话。" : "This Goal has no bound local Codex App conversation."}</p> : null}
+      {recoveryError ? <p role="alert">{recoveryError} <button type="button" disabled={sending} onClick={nextReply}>{zh ? "已在原 App 核对，清理本页回执" : "Checked in original App; clear this receipt"}</button></p> : null}
+      {error ? <p role="alert">{error} <button type="button" onClick={() => setRefresh(value => value + 1)}>{zh ? "重新连接" : "Reconnect"}</button></p> : null}
+      {binding ? <>
+        <p role="status">{!snapshot ? (zh ? "正在连接或连接不可用" : "Connecting or unavailable") : snapshot.can_reply ? (zh ? "原会话可回复" : "Original conversation accepts replies") : snapshot.activity.state === "turn_open" ? (zh ? "原会话有未结束执行；可在原 App 中追加输入" : "The original conversation has an unfinished turn; add input in the original App") : (zh ? "历史可读；回复连接或执行状态尚未确认" : "History available; reply connection or execution state unconfirmed")}</p>
+        <button type="button" className="attached-conversation-open" aria-disabled={opening} aria-busy={opening} onClick={() => void openOriginal()}>{zh ? "在 Codex App 中打开" : "Open in Codex App"}</button>
+        {openRequested ? <p role="status">{zh ? "已请求打开原会话，请在 Codex App 中查看。" : "Requested opening the original conversation; check Codex App."}</p> : null}
+        {openError ? <p role="alert">{openError}</p> : null}
+        {before !== null ? <button type="button" disabled={loadingOlder || messages.length >= 1000} onClick={() => void older()}>{zh ? "读取更早的消息" : "Read earlier messages"}</button> : null}
+        <div className="attached-conversation-messages" ref={transcript} aria-label={zh ? "原会话消息" : "Original conversation messages"}>
+          {messages.map(message => <article key={message.id} data-role={message.role}><header><strong>{message.role === "user" ? (zh ? "你" : "You") : binding.agent_id}</strong> {message.timestamp ? <time>{new Date(message.timestamp).toLocaleString()}</time> : null}</header><MarkdownText text={message.text}/>{message.truncated ? <p>{zh ? "此消息已截短；完整内容见原 App。" : "Message shortened; open the original App for full content."}</p> : null}</article>)}
+          {!messages.length && snapshot ? <p>{zh ? "当前有界历史窗口内没有可显示的消息，可读取更早记录。" : "No displayable messages in this bounded window; read earlier records."}</p> : null}
+        </div>
+        {submission?.status ? <p role="status">{submission.status === "delivered" ? (zh ? "已由原 App 接纳；等待 Agent 结果。" : "Accepted by the original App; awaiting the Agent result.") : (zh ? "投递尚未确认，请先在原 App 核对，不会自动重发。" : "Delivery unconfirmed; check the original App. No automatic resend.")} {submission.status === "pending" ? <button type="button" disabled={sending} onClick={() => void readReceipt()}>{zh ? "重读投递回执" : "Recheck delivery receipt"}</button> : null}{awaitingReceipt ? <button type="button" disabled={sending} onClick={nextReply}>{zh ? "已核对，写下一条" : "Checked; write another"}</button> : null}</p> : null}
+        {!awaitingReceipt ? <form onSubmit={event => {event.preventDefault(); void send();}}><label>{zh ? `回复 ${binding.agent_id}` : `Reply to ${binding.agent_id}`}<textarea value={draft} maxLength={24000} disabled={sending} onChange={event => {setDraft(event.target.value); setSubmission(null);}}/></label><button type="submit" disabled={sending || Boolean(error || recoveryError) || !snapshot?.can_reply || !draft.trim()}>{sending ? (zh ? "正在交给原 App…" : "Sending to original App…") : (zh ? "发送到原会话" : "Send to original conversation")}</button></form> : null}
+      </> : null}
+    </div>
+    </dialog>
+  </section>;
+}
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-page.tsx b/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-page.tsx
index 7184d1fd5f..85df233936 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-page.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-page.tsx
@@ -51,6 +51,7 @@ import { MessageActivity } from "./message-activity";
 import { ChannelTimeline } from "./channel-timeline";
 import { ContextDrawer } from "./context-drawer";
 import { monitorScheduleReadback } from "./monitor-readback";
+import { AttachedAgentConversations } from "./attached-agent-conversations";
 import { GoalSidebar } from "./goal-sidebar";
 import { GoalTasksView } from "./goal-tasks-view";
 import { GoalOverview, goalOverviewAttentionId } from "./goal-overview";
@@ -2191,6 +2192,7 @@ export function PersonalWorkspacePage({
               followConversationRef.current = nearBottom;
               setShowLatestMessage(!nearBottom);
             }}>
+            {selectedGoalId && selectedGoalTab === "chat" && !readOnly ? <AttachedAgentConversations key={selectedGoalId} goalId={selectedGoalId} zh={locale === "zh-CN"}/> : null}
             {selectedGoalId && selectedGoalTab === "chat" && !readOnly && selectedAgentId === "codex" && conversationSessionId && loopxMode?.settings.execution_config && loopxMode.settings.agent_id ? <GoalTeamResults
               key={`${conversationSessionId}:${loopxMode.settings.agent_id}:${loopxMode.settings.execution_config}`}
               sessionId={conversationSessionId} zh={locale === "zh-CN"}
diff --git a/docs/architecture/rfcs/desktop-execution-frontends-v0.md b/docs/architecture/rfcs/desktop-execution-frontends-v0.md
index 0aab6384d4..ba557239cd 100644
--- a/docs/architecture/rfcs/desktop-execution-frontends-v0.md
+++ b/docs/architecture/rfcs/desktop-execution-frontends-v0.md
@@ -1022,6 +1022,23 @@ authoritative or require the document provider to become a task database.
 This is the short path for adopting Desktop around work that is already
 running.
 
+Bounded provider checkpoint: the local Goal Chat can inspect a registered
+Codex App Agent's original saved conversation and offer an idle-only plain-text
+reply through the existing Desktop owner. It keeps bounded source windows and
+one-second saved-message observations instead of resuming another app-server.
+See the [provider boundary and operation](../../integrations/session-runtime-control-plane-adapter.md#experimental-owner-local-codex-app-conversations).
+This is an experimental provider proposal, not full Slice B acceptance:
+token deltas, busy-turn steering/queueing, approval callbacks, native live-send
+qualification, Windows transport and installed adoption remain separate gaps.
+Its bounded user task is following up with a specific Agent while reviewing
+Goal work. Confirmed input leaves the composer ready without a redundant
+acknowledgement. Interrupted responses recover from existing receipts without
+resubmitting; genuinely uncertain input still requires recovery before another send.
+The separate conversation window remains an interim entry. Evaluate subsequent
+integration against selecting the original conversation in Codex App, including
+target discovery, correction and result readback; transport success alone does
+not establish a shorter task path, independent acceptance or G1 completion.
+
 ### Slice C: managed reference vertical
 
 1. a provider-neutral managed-runtime and managed-provider interface;
diff --git a/docs/integrations/session-runtime-control-plane-adapter.md b/docs/integrations/session-runtime-control-plane-adapter.md
index c2425c5e9c..17c48f1a10 100644
--- a/docs/integrations/session-runtime-control-plane-adapter.md
+++ b/docs/integrations/session-runtime-control-plane-adapter.md
@@ -96,6 +96,80 @@ LoopX says a goal is still blocked, the projection must explain the
 reconcile rule: missing gate, missing validation, failed outcome, stale
 artifact, or human decision not yet recorded.
 
+## Experimental owner-local Codex App conversations
+
+This is a follow-up path for an owner already reviewing a Goal: read a specific
+Agent's result, give it a correction and keep the original conversation. It is
+not the general Goal entrypoint or a replacement for the native App. The useful
+product comparison is the complete task, including finding the right Agent,
+understanding its result and recovering an interrupted reply. An additional
+chat window or successful transport alone does not establish a better experience
+than working in Codex App. Goal progress and acceptance still come from their
+existing owners, never from the transcript or an input acknowledgement.
+
+The Goal **Chat** view can open **Original Codex App conversations**, select a
+registered Agent, read its original saved messages and send a plain-text reply
+when that conversation is observed idle. Closing the dialog stops observation;
+the original App keeps its executor, conversation, model and approval settings.
+There is no separate Agent process, automatic resume/fork or permission change.
+
+This is an experimental Desktop provider within the existing native Chat
+boundary, not a second generic session authority. Binding selection reuses
+`thread_agent_binding`; activity reuses the existing Codex host observer. The
+provider reads the uniquely matching local Codex home and bounded read-only
+SQLite/JSONL windows. It returns user/assistant text to the local owner UI,
+excluding tool output and reasoning; it does not read authentication files.
+Original message text can contain private content and stays owner-local. Reading older windows
+is explicit. One-second observation of saved messages is **not token streaming**.
+Full history is not loaded into the App or copied into LoopX run history.
+
+Reply uses Codex Desktop's version-sensitive follower IPC, requires its original
+owner to advertise support for external input, and retains the original thread
+settings. It does not use the app-tools pipe or impersonate a model tool caller.
+Busy, unknown, ambiguous, rebound and disconnected conversations cannot send
+through this surface. Continue such work in the original App. Tool approvals,
+questions and active-turn steering remain there; this stage does not claim the
+complete attached-session acceptance or Lark parity.
+
+Input receipts contain an operation id, binding, content fingerprint and native
+acknowledgement, without copying the message body. The same operation cannot be
+sent twice. A confirmed submission clears the draft and leaves the next reply
+composer available, including after reload; it does not require a second human
+acknowledgement. Sending again still requires an explicit new message and a fresh
+idle observation. After an interrupted response or reopening with a pending
+submission, the page automatically reads its existing receipt once. A recorded
+acknowledgement restores the composer without another user step; genuinely
+unconfirmed delivery remains pending and never silently retries a native effect.
+Check the original App before discarding an uncertain receipt. Late reads cannot
+restore a discarded operation over a new draft. The UI keeps only its reply recovery
+record in the current browser session. Replies are explicit local owner actions;
+a registered binding or observer does not authorize an Agent to message peers.
+
+The local presentation API is `/api/chat/codex-attached`: GET requires the
+registered Goal, then the exact Agent/binding for history or a receipt; POST
+requires that same binding, one operation id and text. It cannot select arbitrary
+host threads, paths, RPC methods, approvals, models or permissions. Existing
+loopback Origin checks still protect effects. Native send is unavailable on
+Windows in this stage. **Open in Codex App** uses an explicit same-origin POST to
+`/api/chat/codex-attached/open` with only Goal, Agent and binding. The provider
+rechecks the accepted binding and local conversation, then requests macOS open
+the fixed Codex bundle with that conversation's canonical UUID. It cannot launch
+arbitrary URLs or commands, submit input or bypass the desktop navigation fence.
+The UI reports OS dispatch, not proof that the App displayed the thread; errors
+are visible and retry requires another explicit click. Other hosts report this
+operation unavailable. Close the dialog to stop reads; rolling back the runtime
+removes this UI/provider without editing native sessions, credentials or App
+startup configuration. Do not expose this owner-only API through a shared sink.
+
+Source research: official [app-server transports and history](https://learn.chatgpt.com/docs/app-server),
+[codex-monitor](https://github.com/lucianlamp/codex-monitor) (loaded owner selection),
+[CodexMonitor](https://github.com/Dimillian/CodexMonitor) (a separately owned
+app-server UI), [codex-bridge](https://github.com/hitsmaxft/codex-bridge) (writer
+ownership and explicit Desktop interposition), and
+[codex-web's follower IPC](https://github.com/i-am-BT/codex-web/blob/c401ea7f33cbfff227e154b8d817b150d39256fc/desktop-ipc-client.mjs).
+The provider is independently implemented; none of these projects is installed,
+vendored or allowed to replace the owner's App/runtime automatically.
+
 ## Adapter Phases
 
 ### Phase 1: Read-Only Projection
diff --git a/examples/personal-workspace-browser/attached-host-follow-up.mjs b/examples/personal-workspace-browser/attached-host-follow-up.mjs
index 039d93d743..40557adcd9 100644
--- a/examples/personal-workspace-browser/attached-host-follow-up.mjs
+++ b/examples/personal-workspace-browser/attached-host-follow-up.mjs
@@ -1,3 +1,4 @@
+import { runCodexAttached } from "./codex-attached.mjs";
 import { openWorkspacePage } from "./scenario-context.mjs";
 
 // An attached_host Session queues a follow-up while its host runs a Turn
@@ -21,6 +22,7 @@ function runningSession(goalId, mode) {
 export const attachedHostFollowUpScenario = {
   id: "attached-host-follow-up",
   async run({ browser, collectCoverage, url }) {
+    await runCodexAttached(browser);
     const heldStreams = [];
     const posts = [];
     const context = await openWorkspacePage(browser, url, {
diff --git a/examples/personal-workspace-browser/codex-attached.mjs b/examples/personal-workspace-browser/codex-attached.mjs
new file mode 100644
index 0000000000..707b5bbaeb
--- /dev/null
+++ b/examples/personal-workspace-browser/codex-attached.mjs
@@ -0,0 +1,179 @@
+import assert from 'node:assert/strict';
+import {spawn} from 'node:child_process';
+import {once} from 'node:events';
+import {resolve} from 'node:path';
+import {createInterface} from 'node:readline';
+import {repoRoot, outputDir} from './fixture.mjs';
+import {openWorkspacePage} from './scenario-context.mjs';
+import {testPythonCommand} from '../../scripts/test-python.mjs';
+
+export async function runCodexAttached(browser) {
+  if (process.platform === "win32") return; // Windows has no qualified Desktop follower transport.
+  await runConversation(browser, false);
+  await runConversation(browser, true);
+}
+
+async function runConversation(browser, uncertain) {
+  const fixturePath = resolve(repoRoot, 'examples/personal-workspace-browser/codex_attached_fixture.py');
+  const python = testPythonCommand(`import runpy, sys\nsys.argv = [${JSON.stringify(fixturePath)}, ${JSON.stringify(uncertain ? '--uncertain' : '--confirmed')}]\nrunpy.run_path(${JSON.stringify(fixturePath)}, run_name="__main__")`, {repoRoot});
+  const child = spawn(python.command, python.args, {cwd: repoRoot, env: process.env, stdio: ['ignore','pipe','pipe']});
+  let stderr = '';
+  child.stderr.on('data', value => {stderr += value;});
+  const lines = createInterface({input: child.stdout});
+  let context, timer;
+  try {
+    const [line] = await Promise.race([once(lines,'line'), once(child,'exit').then(() => {throw new Error(stderr);}), new Promise((_, reject) => {timer = setTimeout(() => reject(new Error('Native fixture did not start')), 30_000);})]);
+    clearTimeout(timer);
+    const {url} = JSON.parse(line);
+    context = await openWorkspacePage(browser, url, {gotoWaitUntil: 'domcontentloaded', apiOptions: {fixturePort: new URL(url).port}, beforeGoto: async (_api, page) => {
+      // Unrelated Goal/status APIs use the public synthetic workspace. The
+      // original-conversation route always reaches the real production owner.
+      await page.route('**/api/chat/codex-attached**', route => route.continue());
+    }});
+    const {page} = context;
+    await page.locator('.personal-goal-link').filter({hasText:'Product Release'}).click();
+    await page.getByRole('navigation',{name:'Goal 视图'}).getByRole('button',{name:'对话',exact:true}).click();
+    const panel = page.getByRole('dialog', {name:'Codex App 原会话',exact:true});
+    await page.screenshot({path:resolve(outputDir,'attached-codex-entry-desktop.png'),animations:'disabled'});
+    await page.getByRole('button',{name:'与 Codex App 原会话对话',exact:true}).click();
+    await panel.getByText('Original result',{exact:true}).waitFor();
+    await panel.getByText('原会话可回复',{exact:true}).waitFor();
+    const inputCount = async () => (await (await page.request.get(new URL('/fixture/inputs',url).href)).json()).count;
+    const composer = panel.getByRole('textbox', {name:'回复 worker',exact:true});
+    const send = panel.getByRole('button', {name:'发送到原会话',exact:true});
+    const sentOperations = [];
+    page.on('request', request => {
+      if (request.method() === 'POST' && new URL(request.url()).pathname === '/api/chat/codex-attached') sentOperations.push(request.postDataJSON().operation_id);
+    });
+    if (uncertain) {
+      await composer.fill('核对一次投递，不要自动重发。');
+      const submitted = page.waitForResponse(response => response.request().method() === 'POST' && new URL(response.url()).pathname === '/api/chat/codex-attached');
+      await send.click();
+      await submitted;
+      await panel.getByText('投递尚未确认，请先在原 App 核对，不会自动重发。',{exact:false}).waitFor();
+      assert.equal(await inputCount(),1);
+      await page.reload();
+      await page.getByRole('button',{name:'与 Codex App 原会话对话',exact:true}).click();
+      await panel.getByRole('button',{name:'重读投递回执',exact:true}).click();
+      assert.equal(await composer.count(),0, 'Unconfirmed input must not expose another send');
+      assert.equal(await inputCount(),1, 'Reload and receipt reads must not repeat the effect');
+      assert.equal(sentOperations.length,1);
+      await panel.getByRole('button',{name:'已核对，写下一条',exact:true}).waitFor();
+      await page.screenshot({path:resolve(outputDir,'attached-codex-pending-desktop.png'),animations:'disabled'});
+      let releaseReceipt;
+      const holdReceipt = new Promise(resolve => {releaseReceipt = resolve;});
+      let receiptStarted;
+      const readingReceipt = new Promise(resolve => {receiptStarted = resolve;});
+      await page.route('**/api/chat/codex-attached?*operation_id=*', async route => {
+        const response = await route.fetch();
+        receiptStarted();
+        await holdReceipt;
+        await route.fulfill({response});
+      });
+      await panel.getByRole('button',{name:'重读投递回执',exact:true}).click();
+      await readingReceipt;
+      await panel.getByRole('button',{name:'已核对，写下一条',exact:true}).click();
+      await composer.fill('这是核对后新写的草稿。');
+      const lateReceipt = page.waitForResponse(response => new URL(response.url()).searchParams.has('operation_id'));
+      releaseReceipt();
+      await lateReceipt;
+      await page.evaluate(() => new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve))));
+      assert.equal(await composer.inputValue({timeout:2000}),'这是核对后新写的草稿。', 'Late receipt reads must not revive a discarded operation');
+      assert.equal(await inputCount(),1);
+      return;
+    }
+    assert.equal((await (await page.request.get(new URL('/fixture/opened',url).href)).json()).count,0);
+    const openOriginal = panel.getByRole('button',{name:'在 Codex App 中打开',exact:true});
+    await page.request.post(new URL('/fixture/fail-open',url).href);
+    await openOriginal.focus();
+    await page.keyboard.press('Enter');
+    await panel.getByRole('alert').filter({hasText:'Codex App could not be opened'}).waitFor();
+    await page.screenshot({path:resolve(outputDir,'attached-codex-open-error-desktop.png'),animations:'disabled'});
+    assert.equal((await (await page.request.get(new URL('/fixture/opened',url).href)).json()).count,0);
+    await openOriginal.click();
+    await panel.getByText('已请求打开原会话，请在 Codex App 中查看。',{exact:true}).waitFor();
+    assert.equal((await (await page.request.get(new URL('/fixture/opened',url).href)).json()).count,1);
+    assert.equal(await panel.getByRole('alert').count(),0);
+    assert.equal(await panel.locator('a[href^="codex:"]').count(),0);
+    assert.equal(await panel.evaluate(node => node.contains(document.activeElement)), true);
+    await page.keyboard.press('Escape');
+    assert.equal(await panel.isVisible(), false);
+    await page.getByRole('button',{name:'与 Codex App 原会话对话',exact:true}).click();
+    await panel.getByText('Original result',{exact:true}).waitFor();
+    await page.request.post(new URL('/fixture/append',url).href);
+    await panel.getByText('原 Agent 的新结果：已保留原会话。',{exact:true}).waitFor();
+    await panel.getByLabel('回复 worker',{exact:true}).fill('请沿用当前原会话补充验证。');
+    await panel.getByRole('button',{name:'发送到原会话',exact:true}).click();
+    await panel.getByText('已由原 App 接纳；等待 Agent 结果。',{exact:false}).waitFor();
+    await panel.locator('.attached-conversation-messages').getByText('请沿用当前原会话补充验证。',{exact:true}).waitFor();
+    assert.equal(await composer.count(),1, 'A confirmed reply must leave the next composer available');
+    assert.equal(await composer.inputValue(),'');
+    assert.equal(await panel.getByRole('button',{name:'已核对，写下一条',exact:true}).count(),0);
+    await page.reload();
+    await page.getByRole('button',{name:'与 Codex App 原会话对话',exact:true}).click();
+    await panel.getByText('已由原 App 接纳；等待 Agent 结果。',{exact:false}).waitFor();
+    assert.equal(await composer.inputValue(),'', 'Reload must not turn a confirmed message back into a draft');
+    assert.equal(await inputCount(),1, 'Reload must not submit anything');
+    await page.screenshot({path:resolve(outputDir,'attached-codex-conversation-desktop.png'),animations:'disabled'});
+    await page.setViewportSize({width:390,height:844});
+    await page.emulateMedia({reducedMotion:'reduce'});
+    await panel.getByRole('heading',{name:'Codex App 原会话',exact:true}).scrollIntoViewIfNeeded();
+    assert.ok(await panel.boundingBox());
+    assert.equal(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth),true);
+    await page.screenshot({path:resolve(outputDir,'attached-codex-conversation-phone.png'),animations:'disabled'});
+    await page.request.post(new URL('/fixture/busy',url).href);
+    await panel.getByText('原会话有未结束执行；可在原 App 中追加输入',{exact:true}).waitFor();
+    await composer.fill('继续检查这份结果。');
+    assert.equal(await send.isDisabled(),true, 'Keeping the composer must not bypass host activity');
+    await page.request.post(new URL('/fixture/append',url).href);
+    await panel.getByText('原会话可回复',{exact:true}).waitFor();
+    await send.focus();
+    await page.keyboard.press('Enter');
+    await panel.getByText('已由原 App 接纳；等待 Agent 结果。',{exact:false}).waitFor();
+    assert.equal(await inputCount(),2);
+    assert.equal(sentOperations.length,2);
+    assert.equal(new Set(sentOperations).size,2, 'Each explicit new reply needs its own operation');
+    assert.equal(await composer.inputValue(),'');
+    let receiptReadUnavailable = true;
+    await page.route('**/api/chat/codex-attached**', async route => {
+      if (new URL(route.request().url()).pathname !== '/api/chat/codex-attached') return route.continue();
+      if (receiptReadUnavailable && new URL(route.request().url()).searchParams.has('operation_id')) return route.abort('failed');
+      if (route.request().method() !== 'POST') return route.continue();
+      const response = await route.fetch();
+      assert.equal((await response.json()).status, 'delivered');
+      // The original owner and receipt store accepted the input, but the
+      // browser lost the HTTP acknowledgement. Recovery must only read it.
+      await route.abort('failed');
+    });
+    await composer.fill('响应丢失后沿用原回执恢复。');
+    const lostResponse = page.waitForEvent('requestfailed', request => request.method() === 'POST');
+    await send.click();
+    await lostResponse;
+    assert.equal(await inputCount(),3);
+    assert.equal(await page.evaluate(() => JSON.parse(Object.entries(sessionStorage).find(([key]) => key.startsWith('loopx-attached-input:'))[1]).status),'pending');
+    receiptReadUnavailable = false;
+    await page.reload();
+    await page.getByRole('button',{name:'与 Codex App 原会话对话',exact:true}).click();
+    await panel.getByText('已由原 App 接纳；等待 Agent 结果。',{exact:false}).waitFor({timeout:5000});
+    assert.equal(await composer.inputValue(),'');
+    assert.equal(await inputCount(),3, 'Automatic recovery must not submit another input');
+    assert.equal(sentOperations.length,3);
+    await composer.fill('本页也自动读取成功回执。');
+    await send.click();
+    await panel.getByText('已由原 App 接纳；等待 Agent 结果。',{exact:false}).waitFor();
+    assert.equal(await composer.inputValue(),'');
+    assert.equal(await inputCount(),4, 'In-page recovery must only read the receipt');
+    assert.equal(new Set(sentOperations).size,4);
+    await page.setViewportSize({width:1512,height:982});
+    await page.request.post(new URL('/fixture/rebind',url).href);
+    await panel.getByRole('alert').waitFor();
+    await openOriginal.click();
+    await panel.getByRole('alert').filter({hasText:'binding is invalid or changed'}).waitFor();
+    assert.equal((await (await page.request.get(new URL('/fixture/opened',url).href)).json()).count,1);
+    assert.equal(await panel.getByRole('button',{name:'发送到原会话',exact:true}).isDisabled(),true);
+  } finally {
+    clearTimeout(timer); lines.close();
+    if (context) await context.close();
+    if (child.exitCode === null) {child.kill(); await once(child,'exit');}
+  }
+}
diff --git a/examples/personal-workspace-browser/codex_attached_fixture.py b/examples/personal-workspace-browser/codex_attached_fixture.py
new file mode 100644
index 0000000000..b3c9ea4e47
--- /dev/null
+++ b/examples/personal-workspace-browser/codex_attached_fixture.py
@@ -0,0 +1,120 @@
+"""Disposable original-owner protocol peer shared with the HTTP regression."""
+
+import json
+from pathlib import Path
+import sys
+import signal
+import subprocess
+import tempfile
+import threading
+
+from contextlib import ExitStack
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from loopx.chat_server import ChatRequestHandler, default_chat_assets_dir
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from codex_attached_peer import append_message, fixture, provider
+
+stop = threading.Event()
+signal.signal(signal.SIGTERM, lambda *_: stop.set())
+with (
+    tempfile.TemporaryDirectory(prefix="lx-ui-", dir="/tmp") as directory,
+    ExitStack() as patches,
+):
+    with fixture(
+        Path(directory), goal_id="product-release", uncertain="--uncertain" in sys.argv
+    ) as (
+        request,
+        rollout,
+        _methods,
+        _inputs,
+        registry,
+        _home,
+    ):
+        launches = []
+        patches.enter_context(
+            patch.object(provider, "sys", SimpleNamespace(platform="darwin"))
+        )
+        fail_next_open = False
+
+        def open_spy(argv, **options):
+            global fail_next_open
+            if fail_next_open:
+                fail_next_open = False
+                raise OSError("synthetic unavailable App")
+            launches.append((argv, options))
+
+        patches.enter_context(
+            patch.object(
+                provider,
+                "subprocess",
+                SimpleNamespace(
+                    run=open_spy, SubprocessError=subprocess.SubprocessError
+                ),
+            )
+        )
+
+        class Handler(ChatRequestHandler):
+            def do_GET(self):
+                if self.path == "/fixture/opened":
+                    self._send_json({"ok": True, "count": len(launches)})
+                elif self.path == "/fixture/inputs":
+                    self._send_json({"ok": True, "count": len(_inputs)})
+                else:
+                    super().do_GET()
+
+            def do_POST(self):
+                global fail_next_open
+                if self.path == "/fixture/append":
+                    append_message(
+                        rollout, "assistant", "原 Agent 的新结果：已保留原会话。"
+                    )
+                    with rollout.open("a") as stream:
+                        stream.write(
+                            json.dumps(
+                                {
+                                    "type": "event_msg",
+                                    "timestamp": "2026-01-01T00:00:03Z",
+                                    "payload": {"type": "task_complete"},
+                                }
+                            )
+                            + "\n"
+                        )
+                    self._send_json({"ok": True})
+                elif self.path == "/fixture/busy":
+                    with rollout.open("a") as stream:
+                        stream.write(
+                            json.dumps(
+                                {
+                                    "type": "event_msg",
+                                    "timestamp": "2026-01-01T00:00:02Z",
+                                    "payload": {"type": "task_started"},
+                                }
+                            )
+                            + "\n"
+                        )
+                    self._send_json({"ok": True})
+                elif self.path == "/fixture/rebind":
+                    value = json.loads(registry.read_text())
+                    value["goals"][0]["coordination"]["thread_agent_bindings"][0][
+                        "thread_id"
+                    ] = "22222222-2222-4222-8222-222222222222"
+                    registry.write_text(json.dumps(value))
+                    self._send_json({"ok": True})
+                elif self.path == "/fixture/fail-open":
+                    fail_next_open = True
+                    self._send_json({"ok": True})
+                else:
+                    super().do_POST()
+
+        request.server.RequestHandlerClass = Handler
+        request.server.assets_dir = default_chat_assets_dir()
+        print(
+            json.dumps(
+                {"url": f"http://127.0.0.1:{request.server.server_address[1]}/chat/"}
+            ),
+            flush=True,
+        )
+        stop.wait()
diff --git a/examples/personal-workspace-browser/codex_attached_peer.py b/examples/personal-workspace-browser/codex_attached_peer.py
new file mode 100644
index 0000000000..a918099549
--- /dev/null
+++ b/examples/personal-workspace-browser/codex_attached_peer.py
@@ -0,0 +1,224 @@
+"""Disposable local Desktop owner for HTTP and installed-package UI validation.
+
+This is a standard-library fixture, not a production transport or executor.
+"""
+
+from contextlib import contextmanager
+import http.client
+import json
+import os
+from pathlib import Path
+import socket
+import sqlite3
+import struct
+import tempfile
+import threading
+import unittest
+from unittest.mock import patch
+
+from loopx.chat_server import ChatHTTPServer, ChatRequestHandler
+from loopx.capabilities.native_chat import codex_attached as provider
+
+THREAD = "11111111-1111-4111-8111-111111111111"
+
+
+def frame(connection):
+    def take(size):
+        value = b""
+        while len(value) < size:
+            data = connection.recv(size - len(value))
+            if not data:
+                raise EOFError
+            value += data
+        return value
+
+    size = struct.unpack("<I", take(4))[0]
+    return json.loads(take(size))
+
+
+def emit(connection, value):
+    raw = json.dumps(value).encode()
+    connection.sendall(struct.pack("<I", len(raw)) + raw)
+
+
+def append_message(path, role, text):
+    with path.open("a") as stream:
+        stream.write(
+            json.dumps(
+                {
+                    "type": "response_item",
+                    "timestamp": "2026-01-01T00:00:00Z",
+                    "payload": {
+                        "type": "message",
+                        "role": role,
+                        "content": [
+                            {
+                                "type": "input_text"
+                                if role == "user"
+                                else "output_text",
+                                "text": text,
+                            }
+                        ],
+                    },
+                }
+            )
+            + "\n"
+        )
+
+
+@contextmanager
+def fixture(tmp_path, *, uncertain=False, goal_id="sample-goal"):
+    if os.name != "posix":
+        raise unittest.SkipTest("The native Desktop peer requires a Unix owner socket")
+    with tempfile.TemporaryDirectory(prefix="lxca-", dir="/tmp") as directory:
+        home = Path(directory)
+        with patch.object(provider, "codex_homes", lambda: [home]):
+            (home / "sessions").mkdir(parents=True)
+            (home / "ipc").mkdir(mode=0o700)
+            rollout = home / "sessions" / "bound.jsonl"
+            append_message(rollout, "user", "Original request")
+            append_message(rollout, "assistant", "Original result")
+            with rollout.open("a") as stream:
+                stream.write(
+                    json.dumps(
+                        {
+                            "type": "event_msg",
+                            "timestamp": "2026-01-01T00:00:01Z",
+                            "payload": {"type": "task_complete"},
+                        }
+                    )
+                    + "\n"
+                )
+            connection = sqlite3.connect(home / "state_5.sqlite")
+            connection.execute(
+                "CREATE TABLE threads(id TEXT, rollout_path TEXT, archived INTEGER)"
+            )
+            connection.execute(
+                "INSERT INTO threads VALUES(?,?,0)", (THREAD, str(rollout))
+            )
+            connection.commit()
+            connection.close()
+            registry = tmp_path / "registry.json"
+            registry.write_text(
+                json.dumps(
+                    {
+                        "goals": [
+                            {
+                                "id": goal_id,
+                                "repo": str(tmp_path),
+                                "coordination": {
+                                    "registered_agents": ["worker"],
+                                    "thread_agent_bindings": [
+                                        {
+                                            "agent_id": "worker",
+                                            "host_surface": "codex-app",
+                                            "thread_id": THREAD,
+                                        }
+                                    ],
+                                },
+                            }
+                        ]
+                    }
+                )
+            )
+            listener = socket.socket(socket.AF_UNIX)
+            listener.bind(str(home / "ipc" / "ipc.sock"))
+            (home / "ipc" / "ipc.sock").chmod(0o600)
+            listener.listen()
+            listener.settimeout(0.1)
+            methods = []
+            inputs = []
+            stop = threading.Event()
+
+            def host():
+                while not stop.is_set():
+                    try:
+                        client, _ = listener.accept()
+                    except TimeoutError:
+                        continue
+                    except OSError:
+                        return
+                    with client:
+                        client.settimeout(2)
+                        try:
+                            while True:
+                                message = frame(client)
+                                methods.append(message["method"])
+                                if message["method"] == "initialize":
+                                    result = {"clientId": "loopx-client"}
+                                elif message["method"] == "thread-owner-discovery":
+                                    result = {"supportsUntrustedAppInput": True}
+                                elif message["method"] == "thread-follower-start-turn":
+                                    inputs.append(message["params"])
+                                    assert message["targetClientId"] == "original-owner"
+                                    if uncertain:
+                                        break
+                                    append_message(
+                                        rollout,
+                                        "user",
+                                        message["params"]["turnStart"]["request"][
+                                            "input"
+                                        ][0]["text"],
+                                    )
+                                    result = {
+                                        "result": {
+                                            "turn": {"id": "original-native-turn"}
+                                        }
+                                    }
+                                else:
+                                    raise AssertionError("Unexpected host operation")
+                                emit(
+                                    client,
+                                    {
+                                        "type": "response",
+                                        "requestId": message["requestId"],
+                                        "resultType": "success",
+                                        "handledByClientId": "original-owner",
+                                        "result": result,
+                                    },
+                                )
+                        except (EOFError, TimeoutError, OSError):
+                            pass
+
+            host_thread = threading.Thread(target=host, daemon=True)
+            host_thread.start()
+            server = ChatHTTPServer(("127.0.0.1", 0), ChatRequestHandler)
+            server.registry_path = registry
+            server.runtime_root = tmp_path / "runtime"
+            server.verbose = False
+            http_thread = threading.Thread(target=server.serve_forever, daemon=True)
+            http_thread.start()
+
+            def request(
+                method="GET",
+                body=None,
+                query="?goal_id=sample-goal",
+                origin=None,
+                path="/api/chat/codex-attached",
+            ):
+                client = http.client.HTTPConnection(*server.server_address, timeout=8)
+                headers = {"Content-Type": "application/json"}
+                if origin:
+                    headers["Origin"] = origin
+                client.request(
+                    method,
+                    path + query,
+                    json.dumps(body) if body else None,
+                    headers,
+                )
+                response = client.getresponse()
+                status = response.status
+                value = json.loads(response.read())
+                client.close()
+                return status, value
+
+            request.server = server
+            try:
+                yield request, rollout, methods, inputs, registry, home
+            finally:
+                server.shutdown()
+                server.server_close()
+                http_thread.join()
+                stop.set()
+                listener.close()
+                host_thread.join(timeout=3)
diff --git a/examples/personal-workspace-browser/screenshots/codex-attached/README.md b/examples/personal-workspace-browser/screenshots/codex-attached/README.md
new file mode 100644
index 0000000000..6bb5692318
--- /dev/null
+++ b/examples/personal-workspace-browser/screenshots/codex-attached/README.md
@@ -0,0 +1,19 @@
+# Original Codex App conversation UI
+
+Public synthetic visual evidence from the packaged browser regression. All Goals,
+Agent messages and native owner acknowledgements are disposable fixtures. These
+images do not depict a real account, installation or native live send.
+
+Reproduce from the repository root after building the Chat frontend:
+
+```sh
+LOOPX_PERSONAL_WORKSPACE_PACKAGED=1 \
+LOOPX_PERSONAL_WORKSPACE_SCENARIO=attached-host-follow-up \
+node examples/personal-workspace-browser-smoke.mjs
+```
+
+The scenario writes current screenshots under `output/playwright/personal-workspace`.
+The checked-in images document the proposed entry, desktop conversation, narrow
+conversation, explicit open-failure state and unconfirmed delivery; they are not
+golden pixel oracles. Confirmed delivery keeps an empty composer available;
+unconfirmed delivery exposes receipt recovery and never automatically resends.
diff --git a/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-conversation-desktop.png b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-conversation-desktop.png
new file mode 100644
index 0000000000..56aae62a18
Binary files /dev/null and b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-conversation-desktop.png differ
diff --git a/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-conversation-phone.png b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-conversation-phone.png
new file mode 100644
index 0000000000..b3a5895461
Binary files /dev/null and b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-conversation-phone.png differ
diff --git a/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-entry-desktop.png b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-entry-desktop.png
new file mode 100644
index 0000000000..f8b6b89c98
Binary files /dev/null and b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-entry-desktop.png differ
diff --git a/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-open-error-desktop.png b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-open-error-desktop.png
new file mode 100644
index 0000000000..c1c61d9439
Binary files /dev/null and b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-open-error-desktop.png differ
diff --git a/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-pending-desktop.png b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-pending-desktop.png
new file mode 100644
index 0000000000..8e01ef186b
Binary files /dev/null and b/examples/personal-workspace-browser/screenshots/codex-attached/attached-codex-pending-desktop.png differ
diff --git a/loopx/capabilities/native_chat/codex_attached.py b/loopx/capabilities/native_chat/codex_attached.py
new file mode 100644
index 0000000000..bb9bdef327
--- /dev/null
+++ b/loopx/capabilities/native_chat/codex_attached.py
@@ -0,0 +1,331 @@
+"""Owner-local Codex Desktop transport. Never starts/resumes an executor.
+
+The Desktop follower IPC is private and version-sensitive. Protocol discovery
+comes from codex-web; this independent adapter implements only discovery and
+owner-routed input. History stays in the host store, read in bounded windows.
+"""
+
+from __future__ import annotations
+
+from contextlib import closing
+import hashlib
+import json
+import os
+from pathlib import Path
+import socket
+import sqlite3
+import stat
+import struct
+import subprocess
+import sys
+import time
+from typing import Any
+from uuid import UUID, uuid4
+
+from ...codex_app_thread_activity import codex_homes, observe_codex_threads
+
+WINDOW_BYTES = 2 * 1024 * 1024
+MAX_FRAME_BYTES = 8 * 1024 * 1024
+
+
+class DesktopUnavailable(RuntimeError):
+    pass
+
+
+class DesktopUncertain(RuntimeError):
+    """A submitted input has no acknowledgement; never retry automatically."""
+
+
+def open_conversation(thread_id: str) -> None:
+    """Request OS navigation to an already validated binding, without host input."""
+    if str(UUID(thread_id)) != thread_id:
+        raise ValueError("Conversation identity is not canonical")
+    if sys.platform != "darwin":
+        raise DesktopUnavailable("Opening Codex App is not supported on this host")
+    try:
+        subprocess.run(
+            ["/usr/bin/open", "-b", "com.openai.codex", f"codex://threads/{thread_id}"],
+            check=True,
+            timeout=3,
+            capture_output=True,
+        )
+    except (OSError, subprocess.SubprocessError) as exc:
+        raise DesktopUnavailable("Codex App could not be opened") from exc
+
+
+class DesktopClient:
+    def __init__(self, home: Path):
+        self.path = home / "ipc" / "ipc.sock"
+        self.socket: socket.socket | None = None
+        self.client_id = "initializing-client"
+        self.deadline = 0.0
+
+    def __enter__(self) -> DesktopClient:
+        if os.name != "posix" or not hasattr(socket, "AF_UNIX"):
+            raise DesktopUnavailable(
+                "This host does not expose the local Desktop transport"
+            )
+        try:
+            info = self.path.lstat()
+            if (
+                not stat.S_ISSOCK(info.st_mode)
+                or info.st_uid != os.getuid()
+                or info.st_mode & 0o077
+            ):
+                raise DesktopUnavailable(
+                    "Desktop connection is not private to this user"
+                )
+            self.socket = socket.socket(socket.AF_UNIX)
+            self.socket.settimeout(3)
+            self.socket.connect(str(self.path))
+            result = self.call("initialize", {"clientType": "loopx"}, version=0)
+            self.client_id = result["result"]["clientId"]
+            if not isinstance(self.client_id, str) or not self.client_id:
+                raise DesktopUnavailable("Desktop client identity is unsupported")
+            return self
+        except (OSError, KeyError, TypeError, ValueError, DesktopUnavailable) as exc:
+            self.__exit__(None, None, None)
+            raise DesktopUnavailable("Codex App connection is unavailable") from exc
+
+    def __exit__(self, *_args: Any) -> None:
+        if self.socket is not None:
+            self.socket.close()
+
+    def _send(self, value: dict[str, Any]) -> None:
+        assert self.socket is not None
+        raw = json.dumps(value).encode()
+        if len(raw) > MAX_FRAME_BYTES:
+            raise DesktopUnavailable("Desktop input exceeds the bounded frame")
+        self.socket.sendall(struct.pack("<I", len(raw)) + raw)
+
+    def _take(self, length: int) -> bytes:
+        assert self.socket is not None
+        out = bytearray()
+        while len(out) < length:
+            remaining = self.deadline - time.monotonic()
+            if remaining <= 0:
+                raise DesktopUnavailable("Desktop response timed out")
+            self.socket.settimeout(remaining)
+            chunk = self.socket.recv(length - len(out))
+            if not chunk:
+                raise DesktopUnavailable("Desktop disconnected")
+            out.extend(chunk)
+        return bytes(out)
+
+    def call(
+        self,
+        method: str,
+        params: dict[str, Any],
+        *,
+        version: int,
+        target: str | None = None,
+    ) -> dict[str, Any]:
+        self.deadline = time.monotonic() + 3
+        request_id = str(uuid4())
+        self._send(
+            {
+                "type": "request",
+                "requestId": request_id,
+                "sourceClientId": self.client_id,
+                "method": method,
+                "version": version,
+                "params": params,
+                "timeoutMs": 2500,
+                **({"targetClientId": target} if target else {}),
+            }
+        )
+        for _ in range(128):
+            length = struct.unpack("<I", self._take(4))[0]
+            if not 0 < length <= MAX_FRAME_BYTES:
+                raise DesktopUnavailable("Desktop frame is unsupported")
+            value = json.loads(self._take(length))
+            if not isinstance(value, dict):
+                raise DesktopUnavailable("Desktop frame has an unsupported shape")
+            if value.get("type") == "client-discovery-request":
+                self._send(
+                    {
+                        "type": "client-discovery-response",
+                        "requestId": value["requestId"],
+                        "response": {"canHandle": False},
+                    }
+                )
+            if value.get("type") == "response" and value.get("requestId") == request_id:
+                if value.get("resultType") != "success":
+                    raise DesktopUnavailable("Desktop did not accept this operation")
+                return value
+        raise DesktopUnavailable("Desktop response exceeded the bounded event window")
+
+    def owner(self, thread_id: str) -> str:
+        value = self.call(
+            "thread-owner-discovery",
+            {"hostId": "local", "conversationId": thread_id},
+            version=1,
+        )
+        owner = value.get("handledByClientId")
+        result = value.get("result")
+        if (
+            not isinstance(owner, str)
+            or not 0 < len(owner) <= 160
+            or not isinstance(result, dict)
+            or result.get("supportsUntrustedAppInput") is not True
+        ):
+            raise DesktopUnavailable(
+                "The original App owner does not support external input"
+            )
+        return owner
+
+    def send(self, thread_id: str, text: str, owner: str) -> str:
+        # The host keeps model, tool, sandbox and approval settings. No resume,
+        # fork, steer, permission decision or second app-server is available.
+        try:
+            value = self.call(
+                "thread-follower-start-turn",
+                {
+                    "conversationId": thread_id,
+                    "turnStart": {
+                        "request": {
+                            "threadId": thread_id,
+                            "input": [
+                                {"type": "text", "text": text, "text_elements": []}
+                            ],
+                        },
+                        "context": {
+                            "attachments": [],
+                            "commentAttachments": [],
+                            "inheritThreadSettings": True,
+                            "useAppServerPermissionDefault": True,
+                        },
+                    },
+                },
+                version=2,
+                target=owner,
+            )
+            if value.get("handledByClientId") != owner:
+                raise DesktopUncertain("Delivery owner was not confirmed")
+            result = value.get("result")
+            result = result.get("result") if isinstance(result, dict) else None
+            turn = result.get("turn") if isinstance(result, dict) else None
+            turn_id = turn.get("id") if isinstance(turn, dict) else None
+            if not isinstance(turn_id, str) or not turn_id:
+                raise DesktopUncertain(
+                    "Desktop acknowledgement is incomplete; check the original conversation before sending again"
+                )
+            return turn_id
+        except (OSError, ValueError, DesktopUnavailable) as exc:
+            raise DesktopUncertain(
+                "Delivery is unconfirmed; check the original conversation before sending again"
+            ) from exc
+
+
+def locate_thread(thread_id: str, homes: list[Path] | None = None) -> tuple[Path, Path]:
+    matches: list[tuple[Path, Path]] = []
+    for home in homes if homes is not None else codex_homes():
+        versions = [
+            (int(p.stem.split("_")[-1]), p)
+            for p in home.glob("state_*.sqlite")
+            if p.stem.split("_")[-1].isdigit()
+        ]
+        if not versions:
+            continue
+        try:
+            with closing(
+                sqlite3.connect(
+                    max(versions)[1].as_uri() + "?mode=ro", uri=True, timeout=0.3
+                )
+            ) as connection:
+                row = connection.execute(
+                    "SELECT rollout_path, archived FROM threads WHERE id=?",
+                    (thread_id,),
+                ).fetchone()
+            if not row or row[1]:
+                continue
+            path = Path(row[0]).resolve(strict=True)
+            # The host DB is not permission to read an arbitrary local file.
+            if not any(
+                path.is_relative_to((home / folder).resolve())
+                for folder in ["sessions", "archived_sessions"]
+            ):
+                continue
+            matches.append((home, path))
+        except (OSError, sqlite3.Error, TypeError, ValueError):
+            continue
+    if len(matches) != 1:
+        raise DesktopUnavailable(
+            "The bound conversation is missing or ambiguous on this host"
+        )
+    return matches[0]
+
+
+def history_revision(stamp: os.stat_result) -> str:
+    # Replacing a rollout must invalidate offset-based message identities.
+    return f"{stamp.st_dev}:{stamp.st_ino}:{stamp.st_size}:{stamp.st_mtime_ns}"
+
+
+def read_messages(path: Path, *, before: int | None = None) -> dict[str, Any]:
+    with path.open("rb") as stream:
+        stamp = os.fstat(stream.fileno())
+        size = stamp.st_size
+        end = min(size, before) if before is not None else size
+        if end < 0:
+            raise ValueError("History position must be nonnegative")
+        start = max(0, end - WINDOW_BYTES)
+        stream.seek(start)
+        if start:
+            stream.readline(WINDOW_BYTES)  # Never parse a partial first record.
+        older_cursor = min(stream.tell(), end) if start else 0
+        if older_cursor >= end and start:
+            older_cursor = start
+        messages = []
+        while stream.tell() < end:
+            offset = stream.tell()
+            raw = stream.readline(min(WINDOW_BYTES, end - offset))
+            if not raw.endswith(b"\n"):
+                continue  # A partial append is retried on the next observation.
+            try:
+                record = json.loads(raw)
+                item = record.get("payload", {})
+                if (
+                    record.get("type") != "response_item"
+                    or item.get("type") != "message"
+                    or item.get("role") not in ["user", "assistant"]
+                ):
+                    continue
+                text = "\n".join(
+                    part["text"]
+                    for part in item.get("content", [])
+                    if isinstance(part, dict)
+                    and part.get("type") in ["input_text", "output_text"]
+                    and isinstance(part.get("text"), str)
+                )
+                if text:
+                    messages.append(
+                        {
+                            "id": str(offset),
+                            "role": item["role"],
+                            "text": text[:24000],
+                            "truncated": len(text) > 24000,
+                            "timestamp": record.get("timestamp"),
+                        }
+                    )
+            except (ValueError, TypeError, AttributeError):
+                continue
+    if len(messages) > 100:
+        older_cursor = int(messages[-100]["id"])
+    return {
+        "messages": messages[-100:],
+        "before": older_cursor if older_cursor else None,
+        "revision": history_revision(stamp),
+        "source_ref": hashlib.sha256(
+            f"{stamp.st_dev}:{stamp.st_ino}".encode()
+        ).hexdigest(),
+        "history_size": size,
+        "bounded": bool(start) or len(messages) > 100,
+    }
+
+
+def activity(home: Path, thread_id: str) -> dict[str, Any]:
+    return observe_codex_threads([thread_id], homes=[home])[thread_id].to_payload()
+
+
+def input_fingerprint(binding: str, text: str) -> str:
+    return hashlib.sha256((binding + "\0" + text).encode()).hexdigest()
diff --git a/loopx/presentation/codex_attached_api.py b/loopx/presentation/codex_attached_api.py
new file mode 100644
index 0000000000..c823a65825
--- /dev/null
+++ b/loopx/presentation/codex_attached_api.py
@@ -0,0 +1,306 @@
+"""Owner-only projection and explicit input for registered Desktop conversations."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, Protocol, cast
+from urllib.parse import parse_qs, urlparse
+
+from ..agent_registry import registered_agent_ids_for_goal
+from ..attached_session import load_attached_session_registry
+from ..chat_attachments import CHAT_JSON_MAX_BYTES
+from ..capabilities.native_chat.codex_attached import (
+    DesktopClient,
+    DesktopUnavailable,
+    DesktopUncertain,
+    activity,
+    history_revision,
+    input_fingerprint,
+    locate_thread,
+    open_conversation,
+    read_messages,
+)
+from ..file_lock import exclusive_file_lock
+from ..registry import atomic_write_json, find_registry_goal
+from ..thread_agent_binding import collect_accepted_bindings
+from .goal_source_routing import source_registry_for_goal
+
+CODEX_ATTACHED_PATH = "/api/chat/codex-attached"
+CODEX_ATTACHED_OPEN_PATH = f"{CODEX_ATTACHED_PATH}/open"
+
+
+def receipt_readback(receipt: dict[str, Any]) -> dict[str, Any]:
+    # Content hashes are private journal bookkeeping, not presentation data.
+    return {
+        "ok": True,
+        **{
+            key: receipt[key]
+            for key in ["operation_id", "status", "turn_id"]
+            if key in receipt
+        },
+    }
+
+
+def bound_conversations(goal: dict[str, Any]) -> list[dict[str, str]]:
+    registered = registered_agent_ids_for_goal(goal)
+    rows = [
+        row
+        for row in collect_accepted_bindings([goal])
+        if row["host_surface"] == "codex-app" and row["agent_id"] in registered
+    ]
+    return [
+        {
+            **row,
+            "binding_ref": hashlib.sha256(
+                json.dumps([goal.get("goal_instance_id"), row], sort_keys=True).encode()
+            ).hexdigest(),
+        }
+        for row in rows
+    ]
+
+
+def current_binding(goal: dict[str, Any], agent: str, expected: str) -> dict[str, str]:
+    rows = [row for row in bound_conversations(goal) if row["agent_id"] == agent]
+    if len(rows) != 1 or rows[0]["binding_ref"] != expected:
+        raise ValueError(
+            "The Agent conversation binding changed or is ambiguous. Choose it again."
+        )
+    return rows[0]
+
+
+class _AttachedHTTP(Protocol):
+    """HTTP operations supplied by the composed handler, not mixin overrides."""
+
+    def _send_json(self, payload: dict[str, Any], *, status: int = 200) -> None: ...
+
+    def _send_error(self, message: str, *, status: int = 400) -> None: ...
+
+    def _read_json(self, *, max_bytes: int = CHAT_JSON_MAX_BYTES) -> dict[str, Any]: ...
+
+
+if TYPE_CHECKING:
+    from ..chat_server import ChatRequestHandler
+
+    # Check the real composition as well as the adapter's local call sites.
+    _attached_http_contract: type[_AttachedHTTP] = ChatRequestHandler
+
+
+class CodexAttachedRequestMixin:
+    server: Any
+    path: str
+
+    def _codex_goal(self, goal_id: str) -> dict[str, Any]:
+        if not goal_id or len(goal_id) > 160:
+            raise ValueError("Choose one registered Goal")
+        selected = getattr(self.server, "selected_goal_id", None)
+        if selected and selected != goal_id:
+            raise ValueError("Goal is outside this workspace")
+        source = source_registry_for_goal(self.server.registry_path, goal_id)
+        goal = find_registry_goal(load_attached_session_registry(source), goal_id)
+        if goal is None:
+            raise ValueError("Goal is not available")
+        return goal
+
+    def _input_receipt_path(
+        self, goal_id: str, agent_id: str, operation_id: str
+    ) -> Path:
+        if not 8 <= len(operation_id) <= 100:
+            raise ValueError("Reply operation is invalid")
+        key = hashlib.sha256(
+            json.dumps([goal_id, agent_id, operation_id]).encode()
+        ).hexdigest()
+        return (
+            Path(self.server.runtime_root)
+            / "native_chat"
+            / "attached-input-receipts"
+            / f"{key}.json"
+        )
+
+    def _codex_attached_read(self) -> None:
+        http = cast(_AttachedHTTP, self)
+        try:
+            query = parse_qs(urlparse(self.path).query, keep_blank_values=True)
+            if set(query) - {
+                "goal_id",
+                "agent_id",
+                "binding_ref",
+                "before",
+                "revision",
+                "operation_id",
+            } or any(len(v) != 1 for v in query.values()):
+                raise ValueError("Conversation query is invalid")
+            goal = self._codex_goal(query.get("goal_id", [""])[0])
+            if "agent_id" not in query:
+                http._send_json({"ok": True, "agents": bound_conversations(goal)})
+                return
+            binding = current_binding(
+                goal, query["agent_id"][0], query.get("binding_ref", [""])[0]
+            )
+            if "operation_id" in query:
+                receipt_path = self._input_receipt_path(
+                    query["goal_id"][0], query["agent_id"][0], query["operation_id"][0]
+                )
+                if not receipt_path.exists():
+                    http._send_error(
+                        "No delivery receipt is recorded for this input.", status=404
+                    )
+                    return
+                receipt = json.loads(receipt_path.read_text())
+                if receipt.get("binding_ref") != binding["binding_ref"]:
+                    raise ValueError("Delivery belongs to an older binding")
+                http._send_json(receipt_readback(receipt))
+                return
+            home, path = locate_thread(binding["thread_id"])
+            before = int(query["before"][0]) if "before" in query else None
+            stamp = path.stat()
+            revision = history_revision(stamp)
+            state = activity(home, binding["thread_id"])
+            connected = False
+            try:
+                with DesktopClient(home) as client:
+                    connected = bool(client.owner(binding["thread_id"]))
+            except (OSError, ValueError, DesktopUnavailable):
+                pass  # Persisted history remains readable when Desktop closes.
+            can_reply = connected and state["state"] == "idle"
+            # Do not repeatedly reparse megabytes when no host append changed.
+            if before is None and query.get("revision", [""])[0] == revision:
+                http._send_json(
+                    {
+                        "ok": True,
+                        "unchanged": True,
+                        "revision": revision,
+                        "activity": state,
+                        "connected": connected,
+                        "can_reply": can_reply,
+                    }
+                )
+                return
+            view = read_messages(path, before=before)
+            http._send_json(
+                {
+                    "ok": True,
+                    **binding,
+                    **view,
+                    "activity": state,
+                    "connected": connected,
+                    "can_reply": can_reply,
+                }
+            )
+        except (ValueError, KeyError):
+            http._send_error(
+                "Conversation binding is unavailable or changed. Choose the Agent again.",
+                status=409,
+            )
+        except (OSError, DesktopUnavailable):
+            http._send_error(
+                "Original Codex conversation is unavailable on this host.", status=503
+            )
+
+    def _codex_attached_open(self) -> None:
+        http = cast(_AttachedHTTP, self)
+        try:
+            body = http._read_json(max_bytes=4096)
+            if set(body) != {"goal_id", "agent_id", "binding_ref"} or any(
+                not isinstance(value, str) for value in body.values()
+            ):
+                raise ValueError("Conversation fields are invalid")
+            binding = current_binding(
+                self._codex_goal(body["goal_id"]),
+                body["agent_id"],
+                body["binding_ref"],
+            )
+            locate_thread(binding["thread_id"])
+            current_binding(
+                self._codex_goal(body["goal_id"]),
+                body["agent_id"],
+                body["binding_ref"],
+            )
+            open_conversation(binding["thread_id"])
+            # OS dispatch is not proof of a displayed conversation or a new turn.
+            http._send_json({"ok": True, "requested": True})
+        except (ValueError, KeyError, TypeError):
+            http._send_error(
+                "Conversation binding is invalid or changed. Choose the Agent again.",
+                status=409,
+            )
+        except (OSError, DesktopUnavailable):
+            http._send_error(
+                "Codex App could not be opened on this host. Check it is installed, then try again.",
+                status=503,
+            )
+
+    def _codex_attached_send(self) -> None:
+        http = cast(_AttachedHTTP, self)
+        try:
+            # 24,000 characters also fit when a caller JSON-escapes Unicode.
+            body = http._read_json(max_bytes=160 * 1024)
+            if set(body) != {
+                "goal_id",
+                "agent_id",
+                "binding_ref",
+                "operation_id",
+                "text",
+            } or any(not isinstance(value, str) for value in body.values()):
+                raise ValueError("Reply fields are invalid")
+            if (
+                not body["text"].strip()
+                or len(body["text"]) > 24000
+                or not 8 <= len(body["operation_id"]) <= 100
+            ):
+                raise ValueError("Reply is empty or exceeds the input limit")
+            goal = self._codex_goal(body["goal_id"])
+            binding = current_binding(goal, body["agent_id"], body["binding_ref"])
+            home, _ = locate_thread(binding["thread_id"])
+            path = self._input_receipt_path(
+                body["goal_id"], body["agent_id"], body["operation_id"]
+            )
+            fingerprint = input_fingerprint(body["binding_ref"], body["text"])
+            with exclusive_file_lock(path):
+                if path.exists():
+                    receipt = json.loads(path.read_text())
+                    if receipt["fingerprint"] != fingerprint:
+                        raise ValueError("Operation id belongs to a different input")
+                    http._send_json(receipt_readback(receipt))
+                    return
+                if activity(home, binding["thread_id"])["state"] != "idle":
+                    http._send_error(
+                        "The Agent is busy or its state is unknown. Continue in the original App; this surface does not interrupt it.",
+                        status=409,
+                    )
+                    return
+                with DesktopClient(home) as client:
+                    owner = client.owner(binding["thread_id"])
+                    # Recheck the authoritative binding after discovery, before effect.
+                    current_binding(
+                        self._codex_goal(body["goal_id"]),
+                        body["agent_id"],
+                        body["binding_ref"],
+                    )
+                    receipt = {
+                        "operation_id": body["operation_id"],
+                        "fingerprint": fingerprint,
+                        "binding_ref": binding["binding_ref"],
+                        "status": "pending",
+                    }
+                    atomic_write_json(path, receipt)
+                    try:
+                        receipt["turn_id"] = client.send(
+                            binding["thread_id"], body["text"], owner
+                        )
+                        receipt["status"] = "delivered"
+                        atomic_write_json(path, receipt)
+                    except DesktopUncertain:
+                        pass  # Pending is durable; retrying this id never resends.
+                    http._send_json(receipt_readback(receipt))
+        except (ValueError, KeyError, TypeError):
+            http._send_error(
+                "Reply or conversation binding is invalid. Choose the Agent again.",
+                status=409,
+            )
+        except (OSError, DesktopUnavailable):
+            http._send_error(
+                "Reply was not confirmed. Check the original App before trying again.",
+                status=503,
+            )
diff --git a/loopx/presentation/configuration_api.py b/loopx/presentation/configuration_api.py
index f5542a477b..179b925d65 100644
--- a/loopx/presentation/configuration_api.py
+++ b/loopx/presentation/configuration_api.py
@@ -2,6 +2,7 @@
 
 from collections.abc import Callable
 
+from . import codex_attached_api as attached_api
 from . import workspace_preferences_api as preferences_api
 from . import configuration_backup_api as backup_api
 from . import goal_ownership_api as ownership_api
@@ -17,6 +18,7 @@
 
 
 class ChatConfigurationRequestMixin(
+    attached_api.CodexAttachedRequestMixin,
     request_api.RequestControlMixin,
     preferences_api.WorkspacePreferencesRequestMixin,
     amendment_api.GoalAmendmentRequestMixin,
@@ -34,6 +36,7 @@ class ChatConfigurationRequestMixin(
 
     def _configuration_get_routes(self) -> dict[str, Callable[[], None]]:
         return {
+            attached_api.CODEX_ATTACHED_PATH: self._codex_attached_read,
             request_api.REQUEST_CONTROL_PATH: self._request_control_read,
             preferences_api.SIDEBAR_GOAL_ORDER_PATH: self._sidebar_order_read,
             amendment_api.CHAT_GOAL_AMENDMENT_PATH: self._amendment_inspect,
@@ -49,6 +52,8 @@ def _configuration_get_routes(self) -> dict[str, Callable[[], None]]:
 
     def _configuration_post_routes(self) -> dict[str, Callable[[], None]]:
         return {
+            attached_api.CODEX_ATTACHED_PATH: self._codex_attached_send,
+            attached_api.CODEX_ATTACHED_OPEN_PATH: self._codex_attached_open,
             request_api.REQUEST_CONTROL_PATH: self._request_control_write,
             preferences_api.SIDEBAR_GOAL_ORDER_PATH: self._sidebar_order_save,
             amendment_api.CHAT_GOAL_AMENDMENT_PATH: self._amendment_configure,
diff --git a/tests/presentation/test_codex_attached_conversation.py b/tests/presentation/test_codex_attached_conversation.py
new file mode 100644
index 0000000000..ac01dea546
--- /dev/null
+++ b/tests/presentation/test_codex_attached_conversation.py
@@ -0,0 +1,387 @@
+"""Real HTTP + SQLite/JSONL + a disposable Desktop-owner Unix protocol peer."""
+
+import importlib.util
+import json
+from pathlib import Path
+import sqlite3
+import subprocess
+from types import SimpleNamespace
+
+import pytest
+
+from loopx.capabilities.native_chat import codex_attached as provider
+
+_spec = importlib.util.spec_from_file_location(
+    "codex_attached_peer",
+    Path(__file__).resolve().parents[2]
+    / "examples/personal-workspace-browser/codex_attached_peer.py",
+)
+assert _spec and _spec.loader
+_peer = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_peer)
+THREAD = _peer.THREAD
+append_message = _peer.append_message
+fixture = _peer.fixture
+
+
+def target(request):
+    status, result = request()
+    assert status == 200
+    binding = result["agents"][0]
+    return {
+        **binding,
+        "goal_id": "sample-goal",
+    }, f"?goal_id=sample-goal&agent_id=worker&binding_ref={binding['binding_ref']}"
+
+
+def body(binding, text="Owner follow-up"):
+    return {
+        "goal_id": "sample-goal",
+        "agent_id": "worker",
+        "binding_ref": binding["binding_ref"],
+        "operation_id": "same-operation",
+        "text": text,
+    }
+
+
+def opener_spy(monkeypatch, *, platform="darwin", failure=None):
+    calls = []
+
+    def launch(argv, **options):
+        calls.append((argv, options))
+        if failure:
+            raise failure
+
+    monkeypatch.setattr(
+        provider, "sys", SimpleNamespace(platform=platform), raising=False
+    )
+    monkeypatch.setattr(
+        provider,
+        "subprocess",
+        SimpleNamespace(run=launch, SubprocessError=subprocess.SubprocessError),
+        raising=False,
+    )
+    return calls
+
+
+def open_body(binding):
+    return {key: binding[key] for key in ("goal_id", "agent_id", "binding_ref")}
+
+
+def test_explicit_open_uses_bound_local_thread_without_executing(tmp_path, monkeypatch):
+    calls = opener_spy(monkeypatch)
+    with fixture(tmp_path) as (request, _, methods, inputs, _, _):
+        binding, query = target(request)
+        assert request(query=query)[0] == 200
+        assert calls == []  # Reading never opens another application.
+        status, result = request(
+            "POST", open_body(binding), query="", path="/api/chat/codex-attached/open"
+        )
+        assert status == 200
+        assert result == {"ok": True, "requested": True}
+        assert calls == [
+            (
+                [
+                    "/usr/bin/open",
+                    "-b",
+                    "com.openai.codex",
+                    f"codex://threads/{THREAD}",
+                ],
+                {"check": True, "timeout": 3, "capture_output": True},
+            )
+        ]
+        assert inputs == []
+        assert "thread-follower-start-turn" not in methods
+        assert not (request.server.runtime_root / "native_chat").exists()
+
+
+def test_reply_character_limit_accepts_full_unicode_input(tmp_path, monkeypatch):
+    with fixture(tmp_path) as (request, _, _, inputs, _, _):
+        binding, _ = target(request)
+        text = "验" * 24000
+        status, _ = request("POST", body(binding, text), query="")
+        assert status == 200
+        assert inputs[0]["turnStart"]["request"]["input"][0]["text"] == text
+        assert request("POST", body(binding, text + "验"), query="")[0] == 409
+        assert len(inputs) == 1
+
+
+def test_open_rejects_forged_stale_archived_and_cross_origin(tmp_path, monkeypatch):
+    calls = opener_spy(monkeypatch)
+    with fixture(tmp_path) as (request, _, _, _, registry, home):
+        binding, _ = target(request)
+        payload = open_body(binding)
+        for extra in ("url", "thread_id", "path", "command"):
+            assert (
+                request(
+                    "POST",
+                    {**payload, extra: "attacker"},
+                    query="",
+                    path="/api/chat/codex-attached/open",
+                )[0]
+                == 409
+            )
+        for changed in ({"agent_id": "other"}, {"binding_ref": "old"}):
+            assert (
+                request(
+                    "POST",
+                    {**payload, **changed},
+                    query="",
+                    path="/api/chat/codex-attached/open",
+                )[0]
+                == 409
+            )
+        assert (
+            request(
+                "POST",
+                payload,
+                query="",
+                origin="https://foreign.example",
+                path="/api/chat/codex-attached/open",
+            )[0]
+            == 403
+        )
+        with sqlite3.connect(home / "state_5.sqlite") as db:
+            db.execute("UPDATE threads SET archived=1")
+        assert (
+            request("POST", payload, query="", path="/api/chat/codex-attached/open")[0]
+            == 503
+        )
+        with sqlite3.connect(home / "state_5.sqlite") as db:
+            db.execute("UPDATE threads SET archived=0")
+        value = json.loads(registry.read_text())
+        value["goals"][0]["coordination"]["thread_agent_bindings"][0]["thread_id"] = (
+            "other"
+        )
+        registry.write_text(json.dumps(value))
+        assert (
+            request("POST", payload, query="", path="/api/chat/codex-attached/open")[0]
+            == 409
+        )
+        assert calls == []
+
+
+@pytest.mark.parametrize(
+    "platform,failure",
+    [
+        ("linux", None),
+        ("darwin", OSError("unavailable")),
+        ("darwin", subprocess.TimeoutExpired("open", 3)),
+        ("darwin", subprocess.CalledProcessError(1, "open")),
+    ],
+)
+def test_open_host_failure_is_explicit(tmp_path, monkeypatch, platform, failure):
+    calls = opener_spy(monkeypatch, platform=platform, failure=failure)
+    with fixture(tmp_path) as (request, _, _, inputs, _, _):
+        binding, _ = target(request)
+        status, result = request(
+            "POST", open_body(binding), query="", path="/api/chat/codex-attached/open"
+        )
+        assert status == 503
+        assert result["ok"] is False
+        assert inputs == []
+        assert len(calls) == (0 if platform == "linux" else 1)
+
+
+def test_open_validates_uuid_and_rechecks_binding_before_dispatch(
+    tmp_path, monkeypatch
+):
+    calls = opener_spy(monkeypatch)
+    for value in ("--args", "11111111111141118111111111111111", THREAD + "/other"):
+        with pytest.raises((ValueError, provider.DesktopUnavailable)):
+            provider.open_conversation(value)
+    with fixture(tmp_path) as (request, _, _, _, registry, _):
+        binding, _ = target(request)
+        from loopx.presentation import codex_attached_api as api
+
+        locate = api.locate_thread
+
+        def changed_during_lookup(thread_id):
+            result = locate(thread_id)
+            value = json.loads(registry.read_text())
+            value["goals"][0]["coordination"]["thread_agent_bindings"] = []
+            registry.write_text(json.dumps(value))
+            return result
+
+        monkeypatch.setattr(api, "locate_thread", changed_during_lookup)
+        assert (
+            request(
+                "POST",
+                open_body(binding),
+                query="",
+                path="/api/chat/codex-attached/open",
+            )[0]
+            == 409
+        )
+        assert calls == []
+
+
+def test_original_history_incremental_append_and_idempotent_owner_input(
+    tmp_path, monkeypatch
+):
+    with fixture(tmp_path) as (
+        request,
+        rollout,
+        methods,
+        inputs,
+        _,
+        _home,
+    ):
+        binding, query = target(request)
+        status, initial = request(query=query)
+        assert status == 200 and initial["can_reply"]
+        assert [message["text"] for message in initial["messages"]] == [
+            "Original request",
+            "Original result",
+        ]
+        assert request(query=query + "&revision=" + initial["revision"])[1]["unchanged"]
+        append_message(rollout, "assistant", "Later result")
+        assert (
+            request(query=query + "&revision=" + initial["revision"])[1]["messages"][
+                -1
+            ]["text"]
+            == "Later result"
+        )
+        assert request("POST", body(binding))[1]["status"] == "delivered"
+        assert request("POST", body(binding))[1]["turn_id"] == "original-native-turn"
+        assert (
+            request(query=query + "&operation_id=same-operation")[1]["status"]
+            == "delivered"
+        )
+        assert len(inputs) == 1
+        assert inputs[0]["turnStart"]["context"] == {
+            "attachments": [],
+            "commentAttachments": [],
+            "inheritThreadSettings": True,
+            "useAppServerPermissionDefault": True,
+        }
+        assert set(methods) == {
+            "initialize",
+            "thread-owner-discovery",
+            "thread-follower-start-turn",
+        }
+        assert request("POST", body(binding, "Changed content"))[0] == 409
+
+
+def test_uncertain_delivery_never_replays_the_effect(tmp_path, monkeypatch):
+    with fixture(tmp_path, uncertain=True) as (
+        request,
+        _,
+        _,
+        inputs,
+        _,
+        _home,
+    ):
+        binding, query = target(request)
+        assert request("POST", body(binding))[1]["status"] == "pending"
+        assert request("POST", body(binding))[1]["status"] == "pending"
+        assert (
+            request(query=query + "&operation_id=same-operation")[1]["status"]
+            == "pending"
+        )
+        assert len(inputs) == 1
+
+
+def test_busy_stale_binding_foreign_origin_and_unbound_agent_create_no_input(
+    tmp_path, monkeypatch
+):
+    with fixture(tmp_path) as (
+        request,
+        rollout,
+        _,
+        inputs,
+        registry,
+        _home,
+    ):
+        binding, query = target(request)
+        assert request("POST", body(binding), origin="https://example.com")[0] == 403
+        assert (
+            request(query=query.replace("agent_id=worker", "agent_id=foreign"))[0]
+            == 409
+        )
+        with rollout.open("a") as stream:
+            stream.write(
+                json.dumps(
+                    {
+                        "type": "event_msg",
+                        "timestamp": "2026-01-01T00:00:02Z",
+                        "payload": {"type": "task_started"},
+                    }
+                )
+                + "\n"
+            )
+        assert request("POST", body(binding))[0] == 409
+        saved = json.loads(registry.read_text())
+        saved["goals"][0]["coordination"]["thread_agent_bindings"][0]["thread_id"] = (
+            "22222222-2222-4222-8222-222222222222"
+        )
+        registry.write_text(json.dumps(saved))
+        assert request(query=query)[0] == 409
+        assert request("POST", body(binding))[0] == 409
+        assert not inputs
+
+
+def test_history_is_bounded_ignores_tools_and_private_paths_do_not_escape(
+    tmp_path, monkeypatch
+):
+    with fixture(tmp_path) as (request, rollout, _, _, _, home):
+        binding, query = target(request)
+        with rollout.open("a") as stream:
+            for _ in range(400):
+                stream.write(
+                    json.dumps(
+                        {
+                            "type": "response_item",
+                            "payload": {
+                                "type": "function_call_output",
+                                "output": "private-tool-output" * 512,
+                            },
+                        }
+                    )
+                    + "\n"
+                )
+        append_message(rollout, "assistant", "Visible recent result")
+        status, result = request(query=query)
+        assert status == 200 and result["bounded"] and result["before"] is not None
+        assert [row["text"] for row in result["messages"]] == ["Visible recent result"]
+        assert "private-tool-output" not in json.dumps(result)
+        assert str(home) not in json.dumps(result)
+        (home / "ipc" / "ipc.sock").chmod(0o666)
+        status, readonly = request(query=query)
+        assert status == 200 and not readonly["can_reply"] and not readonly["connected"]
+        assert request("POST", body(binding))[0] == 503
+
+
+def test_history_pages_do_not_skip_messages_at_the_display_limit(tmp_path):
+    rollout = tmp_path / "history.jsonl"
+    for number in range(235):
+        append_message(rollout, "assistant", f"Message {number}")
+    newest = provider.read_messages(rollout)
+    middle = provider.read_messages(rollout, before=newest["before"])
+    oldest = provider.read_messages(rollout, before=middle["before"])
+    assert oldest["before"] is None
+    assert [
+        row["text"] for page in [oldest, middle, newest] for row in page["messages"]
+    ] == [f"Message {number}" for number in range(235)]
+
+
+def test_replaced_rollout_invalidates_revision_and_offset_identities(tmp_path):
+    rollout = tmp_path / "history.jsonl"
+    append_message(rollout, "assistant", "Old result")
+    old = provider.read_messages(rollout)
+    replacement = tmp_path / "replacement.jsonl"
+    append_message(replacement, "assistant", "New result")
+    replacement.replace(rollout)
+    new = provider.read_messages(rollout)
+    assert old["source_ref"] != new["source_ref"]
+    assert old["revision"] != new["revision"]
+    assert [row["text"] for row in new["messages"]] == ["New result"]
+
+
+def test_unbound_goal_does_not_probe_native_conversations(tmp_path, monkeypatch):
+    with fixture(tmp_path) as (request, _, methods, inputs, registry, _):
+        saved = json.loads(registry.read_text())
+        saved["goals"][0]["coordination"]["thread_agent_bindings"] = []
+        registry.write_text(json.dumps(saved))
+        assert request()[1] == {"ok": True, "agents": []}
+        assert not methods and not inputs