Imported from YishenTu/claudian (src/app/collab/bootstrap/AGENTS.md). Install upstream with npx skills add YishenTu/claudian --skill bootstrap. Copyright stays with the author.

Private Cloud bootstrap

Authority transfer

• This scope owns only the retained private two-client readiness/report fixture, former-Host stop fence, development activation request/replay, and client-local binding transition. Production authority transfer, semantic checkpoint capture/import, transfer claims, source relinquishment, target generation, and terminal responders belong to ../authority-transfer/ and must never call or wrap this module.
• Persist the non-restart Host fence and token-suspend Project admission and work sessions before the source Host begins bootstrap. Work-session suspension performs its own close and drain; bootstrap must not terminally drain that suspended Project, and cancellation fails closed unless the exact work-session and admission tokens both resume. If admission resume fails after consuming the work-session token, immediately replace and retain the paired suspension before reporting recovery-required so retry never uses a stale token; the recovery dispatcher retries that exact compensated failure until terminal cleanup is checkpointed. Transition creation and updates return only after the transition directory and its parent entry are durably synced; directory-sync failure fails closed. The single LanHostCoordinator.startProject authority applies the durable transition guard to every caller, including explicit start, restoration, Project creation, and Host-transfer recovery. Before the composition root publishes the feature service, startup catalogs every valid Project-keyed transition file and fences every corrupt or terminally incomplete Project; a terminally completed activation or cancellation record is already settled and must not be re-fenced. Artifact and remote transition recovery remain background work after that local barrier. An unreadable, oversized, or corrupt record suspends ordinary Project work as well as failing Host start closed, while valid Projects continue independently. Revalidate the complete captured authority and Git-ref snapshot after quiescence and before the first Cloud operation; cancellation cannot advance another local or durable handoff. Only a durably observed pre-activation cancellation may resume the exact suspension tokens, without auto-starting LAN. Activated recovery drives the binding phases forward, reopens the exact suspended Project only after Cloud membership is authoritative, and then checkpoints terminal cleanup; only a cancelled record with that checkpoint may be archived and replaced. The source Host's derived bundle is attempt-owned temporary data with a startup-enumerable intent persisted before capture. Preserve an exact transition-owned bundle and discard capturing, unowned, cancelled, or activated artifacts through that one intent owner. Step 5 may complete with Cloud activated and both clients still holding pending local transition intent; terminal binding waits for step 6 snapshot and upload-pack.
• Both Members submit independent actor-bound reports. Quiesced admission proves only that new Project work is stopped: readiness must still inspect every durable lifecycle owner, including treating a non-null publication operation and an offered or acknowledged Manager-responsibility receipt as nonterminal. The source Host cannot attest for the other Member, and no path uploads SQLite, credentials, CA material, Project-directory archives, unpublished files, local-only commits, or private drafts.

Binding lifecycle

• One transition record is the sole phase authority and advances only through intent, readiness-confirmed, origin-rotated, cloud-verified, membership-replaced, index-repaired, lan-authority-retired, and fence-terminal.
• membership-replaced atomically installs the strict tagged Cloud membership and is the adapter-selection boundary. The separate Project index is reconstructed from every authoritative active membership and repaired afterward; neither file duplicates the transition phase or hides an unrelated Project.
• lan-authority-retired atomically moves only the former Host's exact inactive authority directory to an attempt-scoped private directory on the same filesystem and durably syncs every created destination parent plus both rename parents before checkpointing. The other client records a no-op. Retained data is inert diagnostic state and is never opened, auto-started, or treated as rollback authority.
• Recovery re-reads the exact Cloud attempt and matches its activation operation, placement generation, activation timestamp, Project, manifest, and attempt identity before every post-activation phase; it also revalidates exact old/new URLs, repository identity, membership, index, and retired-authority observations. After Cloud activation, recovery only moves forward or remains visibly pending; it never restores LAN authority or clears the terminal non-restart fence.
• Preserve unpublished files, local commits, private drafts, and cache-rebuild ability throughout binding. The Cloud membership contains server URL, binding/wire versions, derived Git URL, and development actor ID only; it contains no active LAN credential, CA, Host ownership, or recovery phase.