[rafiki270]

Summary

The initial host allowlist granted a coordinator every configured repository and provider, with no explicit model selection. A Fermenta coordinator now receives an exact repository/provider/model/effort grant, and its launch must supply the allowed native model settings.

• Add scoped coordinator grants, immutable model/effort metadata, shared board/host validation and fixed native argument values. Existing broad grants retain provider-default behavior.
• Fence selected-model launches from older companions at enrollment, claim and pre-spawn. Preserve omitted-field idempotency fingerprints so committed legacy reports can replay after a lost response.
• Document deployment order, grant semantics and dated native transcript proof. The deployed Maxis grant permits only Fermenta/Codex/gpt-6-luna/low for the designated master, within the previous expiry. Other existing grants remain intact.

Testing

• All 47 compiled backend/MCP tests passed on Maxis at 4318754; lint and 18 focused lifecycle checks passed on Minis.
• GitHub Verify passed Windows, macOS and Ubuntu at 4318754, including existing UI/package checks. The final commit adds documentation and evidence.
• Native Codex 0.160.1 on Maxis and 0.159.2 on Mac completed real headless runs. Each exact native transcript confirmed gpt-6-luna and low effort, in addition to assistant readiness and the final marker. Other explicit model/effort selections were not evaluated.
• Migration tests preserve claimed intents and replay historical enrollment/terminal-report fingerprints. Regressions cover cross-scope selections, grant narrowing, omitted effort and old companions.
• Astra's read-only architecture/security review found no remaining concrete blocker after the compatibility and capability fixes.

The existing hub database was backed up before migration; authenticated health is 200 and all three companions report policy version 1. This does not enable push into existing desktop chats. Mac access for the new master remains held until a platform-specific assignment is required; no research or vinegar job was launched by setup.