Resolves #16911

npm run cockpit now composes a session whose browser page obtains the fleet bearer ITSELF: the launcher arms a handshake redemption on the transport it spawns (NEO_FLEET_BEARER_HANDSHAKE), the ingress guard admits GET /fleet/handshake on Host + a present-and-allowlisted browser Origin (the single deliberate pre-bearer admission — refused absent/foreign Origins, refused entirely while unarmed), and the app module redeems the secret pre-boot via top-level await into the designed globalThis.AgentOS.fleet.bearerToken slot — so installFleetBridge sees the bearer exactly as if Electron main or the Neural Link had placed it, with no agent in the loop. A per-window lazy retry in onStart heals the boot race (plane admission can take seconds) and SharedWorker reloads via the documented idempotent re-install. Default posture is unchanged everywhere: the leaf ships false, a standalone npm run ai:fleet-server exposes zero new surface, and every non-success redemption path resolves null into the existing fail-closed boot.

The custody decision is named in the leaf JSDoc and the ticket: while armed, browser-caller authentication deliberately collapses to exact-Origin (browsers cannot forge Origin) — the opt-in Option-B dev-mode widening; the packaged Electron path keeps strict custody. Redemptions log origin + timestamp, never the bearer.

Evidence: L3 (live composed run on the operator machine — armed transport with plane-verified viewer, agentless browser redemption logged at 2026-08-10T19:56:25Z for origin http://localhost:8080, live 9-agent roster rendering containerized-plane presence bands) → L3 required (close-target ACs). No residuals.

Deltas from ticket

• The onStart lazy retry (per joining window) was added beyond the ticket's module-level redemption: the live run proved the race is real — the window the launcher auto-opens can beat the fleet child's plane admission, and a SharedWorker reload re-enters onStart without re-running module scope. installFleetBridge's documented additive+idempotent contract makes the in-place upgrade safe.
• resolveFleetUrl() extracted in apps/agentos/app.mjs so the boot install and the redemption derive from the ONE endpoint authority instead of duplicating the query-param resolution.
• The spine-banner incoherence observed during the live receipt (live grid under a sample activity stream renders "showing the static roster") is a pre-existing surface-conflation defect in deriveSpineBanner, filed separately with tonight's evidence — deliberately not folded into this PR.

Test Evidence

• npm run test-unit -- test/playwright/unit/ai/services/fleet/fleetBridgeServer.spec.mjs test/playwright/unit/apps/agentos/fleet/redeemFleetBearerHandshake.spec.mjs test/playwright/unit/apps/agentos/fleet/installFleetBridge.spec.mjs test/playwright/unit/apps/agentos/app.spec.mjs → 47 passed. New handshake battery: unarmed 401/404 with no new surface; armed exact-origin redemption with no-store + Vary: Origin + connection-close; absent/foreign/null-Origin 403 with no CORS grant and no bearer in any refusal body; spoofed-Host 403; sibling-path and POST fall through to the bearer gate; multi-redemption while armed (reload semantics).
• npm run test-unit -- test/playwright/unit/ai/buildScripts/devCockpit.spec.mjs → 9 passed, including the composed-boot witness extended end-to-end: the REAL launcher spawn arms the fixture child via env, a browser-Origin fetch redeems a canonical bearer, and the redeemed value is proven by USE against the constant-time gate on /fleet/probe (redeem → use, no agent seam).
• apps/agentos/fleet/redeemFleetBearerHandshake.mjs: new spec covers URL derivation + no-store shape, the one-endpoint-authority rule, and null on refusal/ok:false/malformed-token/non-JSON/refused-connection/hung-listener/malformed-URL paths.
• Live composed receipt (operator machine): NEO_FLEET_PLANE_BASE=http://127.0.0.1:3102 NEO_FLEET_PLANE_BEARER=$NEO_MCP_REMOTE_TOKEN npm run cockpit → boot log mailbox/compose/catch-up seams bound to the containerized plane (viewer @neo-fable-clio verified plane-side) → [fleet] bearer handshake redeemed by origin http://localhost:8080 with zero Neural-Link/Electron involvement → cockpit renders FLEET · 9 AGENTS with live presence bands (4 online / 1 idle / 4 dark, matching plane who_is_online truth; the rendered set differs from the static sample — 9 registry agents vs the sample's 10 including neo-gemini-pro, and the sample carries no presence fields — proving the rows are wire data, not seeds).

Post-Merge Validation

• Operator-run reproduction of the one-command flow from dev (the umbrella #16694 receipt lands there; this branch's live run is the same code pre-merge).
• .claude/launch.json cockpit entry fronts the composed flow from a fresh session.

Commits (if multi-commit)

Single commit.

Authored by Clio (Fable 5, Claude Code). Session ff94e740-acb8-4f25-a94b-b614bdd91ea1.

Addressed Review Feedback

Responding to the review above (cycle 1, CHANGES_REQUESTED):

• [ADDRESSED] Preserve Fleet's authenticated reuse invariant before a browser can redeem an incumbent bearer. For an occupied port, either prove the existing process is same token + same viewer using the established probeExistingFleetServer authority before starting the page, or refuse reuse and name the remediation. Add a real-ingress falsifier with an armed incumbent bound to viewer/token A and a second launcher representing viewer/token B: it must not start a credential-redeeming page or adopt A. Retain a same-token + same-viewer positive control if reuse remains supported. Commit: 8ae302b639 Details: The catch is accepted in full — the unauthenticated protocol probe had silently become the page's credential authority, exactly as the review's [RETROSPECTIVE] line states ("a handshake may widen browser custody without widening process selection"). The repair: planCockpitBoot now takes a reuseProof and partitions the fleet branch — reusable: true (the probeExistingFleetServer shape) reuses with the verified viewer + pid named in the note; anything else REFUSES with both the unverifiable-incumbent reason and the remediation (stop the process, or pin the incumbent's exact NEO_FLEET_BEARER), spawning nothing. main() attempts the proof only when this environment pins a canonical NEO_FLEET_BEARER (the coordinated-launch mode), resolving the expected viewer through the established resolveFleetViewerClaim chain (Neo namespace bootstrapped on this rare branch only, the fleet-entrypoint pattern); no pin → fail-closed refusal, no second resolver invented. The demanded real-ingress falsifier pair is in devCockpit.spec.mjs: an ARMED incumbent bound to viewer/token A vs a launcher child pinned to token B / @viewer-b → exit 1, REFUSED, and the webpack stub marker provably absent (no credential-redeeming page); the positive control (token A + @cockpit-witness) proves VERIFIED same token, same viewer and only then opens the page. The spec file is serialized (mode: 'serial') because two witnesses now own the real :8083 endpoint and the loser of a parallel port race would refuse correctly and fail the wrong test. 11/11 locally.

Fact corrections mapped to the Rhetorical-Drift finding (own-artifact updates, disclosed here per the response protocol's fact-vs-position rule): ticket #16911 Fix step 4's "reuse inherits the incumbent's arming state honestly" sentence is corrected in the body to the authenticated-proof contract with a pointer to this comment — the original wording omitted that adoption also inherited credential + server-bound viewer without proof, which was the defect, not a framing nuance.

CI is running on 8ae302b639 at the time of this comment — the formal re-review request follows once the head is green, per the CI-green routing gate.

Origin Session ID: ff94e740-acb8-4f25-a94b-b614bdd91ea1

— Clio (@neo-fable-clio; Fable 5, Claude Code) 📜