diff --git a/Cargo.lock b/Cargo.lock
index a3cbdf7..34dec06 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -134,6 +134,20 @@ dependencies = [
  "inout",
 ]
 
+[[package]]
+name = "claude-connector"
+version = "0.1.0"
+dependencies = [
+ "libc",
+ "model-connector",
+ "rmp-serde",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror",
+ "zeroize",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
diff --git a/README.md b/README.md
index 596f571..339e793 100644
--- a/README.md
+++ b/README.md
@@ -4,8 +4,8 @@ The connector kit for GameCult minds: one typed, encrypted, replay-safe contract
 between a caller that needs a model turn and a daemon that holds the provider
 credential, so no project wires its own provider calls.
 
-Status: the `model-connector` crate is live. No connector binary exists yet
-(the Claude connector is first, then an OpenAI-compatible one).
+Status: the `model-connector` crate and the `claude-connector` backend crate are live. No
+connector binary exists yet (the Claude connector binary is first, then an OpenAI-compatible one).
 
 ## Entry points
 
@@ -32,6 +32,19 @@ Crate `crates/model-connector`:
   `ProviderBackend` trait. A connector binary implements `ProviderBackend` for its
   provider and calls `serve`; the kit names no provider.
 
+Crate `crates/claude-connector` (library only; the binary that wires it to `serve` is not written):
+
+- `ClaudeCodeBackend` implements `ProviderBackend` for provider `claude-code` by driving the
+  unmodified `claude` binary, one child per call, in print stream-json mode with no tools, no MCP
+  servers, no settings sources and the system prompt replaced. Tool-less turns only: a request
+  with tools, an output schema or a final tool result is refused before any spawn.
+- Reasoning state is a session handle (`ClaudeCodeHandle`); a handle that cannot be proven to
+  match the request re-seeds from the caller's transcript, and every resume forks.
+- `ProcessPort` is the one OS seam (`StdProcessPort`, unix, kills the child's whole process
+  group); `SessionStore` and `StderrSink` are the other ports. `ClaudeCodeConfig` is what the
+  binary hands in; the credential is read by name from the connector's own environment
+  (`CLAUDE_CODE_OAUTH_TOKEN`) and copied only into the child.
+
 Frame arithmetic is public in `src/envelope.rs`, measured on the carriage frame: `frame_bytes_for_payload(n)` is the frame a
 caller payload bound of `n` needs, `payload_bytes_for_frame(frame)` is the largest payload bound
 a frame allows, and `MAX_IDENTITY_BYTES` (256) bounds caller ids, request ids and model names.
diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml
new file mode 100644
index 0000000..a35bb4a
--- /dev/null
+++ b/crates/claude-connector/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "claude-connector"
+description = "Claude backend for the connector kit: drives the unmodified claude binary in print stream-json mode"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+publish = false
+
+[dependencies]
+model-connector = { path = "../model-connector", features = ["daemon"] }
+rmp-serde = "1"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+thiserror = "2"
+zeroize = "1"
+
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
diff --git a/crates/claude-connector/src/backend.rs b/crates/claude-connector/src/backend.rs
new file mode 100644
index 0000000..ad3fb8c
--- /dev/null
+++ b/crates/claude-connector/src/backend.rs
@@ -0,0 +1,263 @@
+use std::fs::File;
+use std::io;
+use std::time::Instant;
+
+use model_connector::{
+    FailureKind, InputItem, ProviderBackend, ProviderCall, ProviderRequest, TransportEvent,
+    TransportEventPayload, TransportOutcome, TransportResult, Usage,
+};
+use sha2::{Digest, Sha256};
+use zeroize::Zeroizing;
+
+use crate::config::{ClaudeCodeConfig, PROVIDER};
+use crate::handle::{ClaudeCodeHandle, SessionStore, plan, prefix_digest, stdin_bytes};
+use crate::launch::{PromptFile, TOKEN_VAR, argv, child_env};
+use crate::process::{ProcessPort, RunningChild, StdoutRead};
+use crate::stream::{Failure, Finished, Step, StreamState};
+
+/// How the backend reads its own environment.
+type EnvLookup = Box<dyn Fn(&str) -> Option<String> + Send + Sync>;
+
+/// Where the tail of a child's stderr goes. The backend never puts it in a
+/// result; the connector binary wires this to its log.
+pub trait StderrSink: Send + Sync {
+    fn stderr_tail(&self, tail: &[u8]);
+}
+
+/// Answers each call with one `claude` child process: never more than one per
+/// call, and a failed call is never run again.
+pub struct ClaudeCodeBackend {
+    config: ClaudeCodeConfig,
+    port: Box<dyn ProcessPort>,
+    sessions: Box<dyn SessionStore>,
+    sink: Box<dyn StderrSink>,
+    env_lookup: EnvLookup,
+}
+
+impl ClaudeCodeBackend {
+    /// The backend over real processes and the CLI's real session store.
+    #[cfg(unix)]
+    pub fn new(config: ClaudeCodeConfig, sink: Box<dyn StderrSink>) -> Self {
+        let port = Box::new(crate::process::StdProcessPort::new(config.limits));
+        let sessions = Box::new(crate::handle::FsSessionStore::new(
+            config.config_dir.clone(),
+        ));
+        Self::with_ports(config, port, sessions, sink)
+    }
+
+    pub fn with_ports(
+        config: ClaudeCodeConfig,
+        port: Box<dyn ProcessPort>,
+        sessions: Box<dyn SessionStore>,
+        sink: Box<dyn StderrSink>,
+    ) -> Self {
+        Self {
+            config,
+            port,
+            sessions,
+            sink,
+            env_lookup: Box::new(|name| std::env::var(name).ok()),
+        }
+    }
+
+    fn token(&self) -> Option<Zeroizing<String>> {
+        (self.env_lookup)(TOKEN_VAR)
+            .filter(|value| !value.is_empty())
+            .map(Zeroizing::new)
+    }
+
+    fn binary_matches_pin(&self) -> bool {
+        let Ok(mut file) = File::open(&self.config.claude_binary) else {
+            return false;
+        };
+        let mut hasher = Sha256::new();
+        io::copy(&mut file, &mut hasher).is_ok()
+            && <[u8; 32]>::from(hasher.finalize()) == self.config.claude_binary_sha256
+    }
+
+    fn run(&self, request: &ProviderRequest) -> (Vec<TransportEvent>, TransportOutcome) {
+        let plan = match plan(request, &self.config, self.sessions.as_ref()) {
+            Ok(plan) => plan,
+            Err(error) => {
+                return failed(
+                    FailureKind::InvalidRequest,
+                    error.to_string(),
+                    Some(zero_usage()),
+                );
+            }
+        };
+        let Some(token) = self.token() else {
+            return failed(
+                FailureKind::Authentication,
+                "claude-code: the connector has no credential to give the child".to_string(),
+                Some(zero_usage()),
+            );
+        };
+        let Ok(prompt) = PromptFile::create(&request.instructions) else {
+            return failure(Failure::unbilled(
+                FailureKind::Provider,
+                "claude-code: the system prompt could not be staged",
+            ));
+        };
+        let argv = argv(&self.config, request, &plan, prompt.path());
+        let env = child_env(&self.config, request, token);
+        let deadline = Instant::now() + self.config.limits.deadline;
+
+        let spawned = self.port.spawn(
+            &argv,
+            &env,
+            &self.config.work_dir,
+            stdin_bytes(plan.blocks()),
+        );
+        let Ok(mut child) = spawned else {
+            return failure(Failure::unbilled(
+                FailureKind::Provider,
+                "claude-code: the child could not be spawned",
+            ));
+        };
+        let finished = read_stream(child.as_mut(), deadline, &request.model);
+        child.kill();
+        child.wait();
+        let tail = child.stderr_tail();
+        if !tail.is_empty() {
+            self.sink.stderr_tail(&tail);
+        }
+
+        match finished {
+            Ok(finished) => self.completed(request, finished),
+            Err(failure_) => failure(failure_),
+        }
+    }
+
+    fn completed(
+        &self,
+        request: &ProviderRequest,
+        finished: Finished,
+    ) -> (Vec<TransportEvent>, TransportOutcome) {
+        let mut payloads: Vec<TransportEventPayload> = finished
+            .texts
+            .iter()
+            .map(|text| TransportEventPayload::TextDelta { text: text.clone() })
+            .collect();
+
+        let mut prefix = request.input.clone();
+        if !finished.texts.is_empty() {
+            prefix.push(InputItem::AssistantText {
+                text: finished.texts.concat(),
+            });
+        }
+        let handle = ClaudeCodeHandle::Ended {
+            session_id: finished.session_id,
+            instance: self.config.instance.clone(),
+            prefix_sha256: prefix_digest(&request.instructions, &request.model, &prefix),
+        };
+        payloads.push(TransportEventPayload::ReasoningState {
+            state: handle.encode(),
+        });
+
+        let events = payloads
+            .into_iter()
+            .enumerate()
+            .map(|(sequence, payload)| TransportEvent {
+                sequence: sequence as u64,
+                payload,
+            })
+            .collect();
+        (
+            events,
+            TransportOutcome::Completed {
+                provider_response_id: finished.message_id,
+                stop_reason: finished.stop_reason,
+                usage: finished.usage,
+            },
+        )
+    }
+}
+
+impl ProviderBackend for ClaudeCodeBackend {
+    fn ready(&self) -> bool {
+        self.config.work_dir.is_dir()
+            && self.config.config_dir.is_dir()
+            && self.token().is_some()
+            && self.binary_matches_pin()
+    }
+
+    fn provider(&self) -> &str {
+        PROVIDER
+    }
+
+    fn execute(&self, call: &ProviderCall) -> TransportResult {
+        let (events, outcome) = self.run(call.request());
+        call.transported(events, outcome)
+    }
+}
+
+fn read_stream(
+    child: &mut dyn RunningChild,
+    deadline: Instant,
+    model: &str,
+) -> Result<Finished, Failure> {
+    let mut state = StreamState::new(model);
+    let finished = loop {
+        match child.read_line(deadline) {
+            StdoutRead::Line(line) => {
+                if let Step::Done(done) = state.feed(&line) {
+                    break *done;
+                }
+            }
+            StdoutRead::Eof => {
+                return Err(Failure::unbilled(
+                    FailureKind::Provider,
+                    "claude-code: the stream ended without a result",
+                ));
+            }
+            StdoutRead::Timeout => {
+                return Err(Failure::unbilled(
+                    FailureKind::Timeout,
+                    "claude-code: the deadline passed before a result",
+                ));
+            }
+            StdoutRead::Breach => {
+                return Err(Failure::unbilled(
+                    FailureKind::Provider,
+                    "claude-code: the output passed its size cap",
+                ));
+            }
+        }
+    };
+    // The result is in; give the child until its deadline to close stdout.
+    while matches!(child.read_line(deadline), StdoutRead::Line(_)) {}
+    finished
+}
+
+fn zero_usage() -> Usage {
+    Usage {
+        input_tokens: 0,
+        cache_read_tokens: 0,
+        cache_write_tokens: 0,
+        output_tokens: 0,
+        reasoning_tokens: None,
+    }
+}
+
+fn failed(
+    kind: FailureKind,
+    message: String,
+    usage: Option<Usage>,
+) -> (Vec<TransportEvent>, TransportOutcome) {
+    (
+        Vec::new(),
+        TransportOutcome::Failed {
+            kind,
+            message,
+            usage,
+        },
+    )
+}
+
+fn failure(failure: Failure) -> (Vec<TransportEvent>, TransportOutcome) {
+    failed(failure.kind, failure.message.to_string(), failure.usage)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs
new file mode 100644
index 0000000..309e2d1
--- /dev/null
+++ b/crates/claude-connector/src/backend/tests.rs
@@ -0,0 +1,1851 @@
+use std::collections::VecDeque;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use model_connector::{
+    CallerAdmission, ModelPrice, PriceTable, Rates, ReasoningEffort, SpendCeiling, SpendWindowMs,
+    ToolDefinition, TransportAdmission, TransportDisposition, TransportInvocation, TransportKey,
+    TransportReceipt, TransportService, decrypt_result, encrypt_invocation,
+};
+
+use super::*;
+use crate::config::ClaudeCodeLimits;
+use crate::handle::{FsSessionStore, SessionStore};
+use crate::launch::ChildEnv;
+
+const CANARY_TOKEN: &str = "canary-oauth-token-value";
+const MODEL: &str = "claude-haiku-5-5";
+const INSTANCE: &str = "persona-a";
+const SESSION: &str = "11111111-2222-3333-4444-555555555555";
+const HEX_SESSION: &str = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+const OTHER_MODEL: &str = "claude-opus-5";
+const FORK: &str = "66666666-7777-8888-9999-000000000000";
+const FRAME: usize = 1 << 20;
+
+// ---- fixtures, written by hand from the fields the probes observed ----
+
+fn init_line(model: &str, session: &str) -> String {
+    format!(
+        r#"{{"type":"system","subtype":"init","session_id":"{session}","model":"{model}","tools":[],"apiKeySource":"none"}}"#
+    )
+}
+
+fn text_line(id: &str, text: &str) -> String {
+    format!(
+        r#"{{"type":"assistant","message":{{"id":"{id}","role":"assistant","content":[{{"type":"text","text":"{text}"}}],"stop_reason":null}},"session_id":"{SESSION}"}}"#
+    )
+}
+
+fn thinking_line(id: &str) -> String {
+    format!(
+        r#"{{"type":"assistant","message":{{"id":"{id}","role":"assistant","content":[{{"type":"thinking","thinking":"","signature":"sig"}}]}}}}"#
+    )
+}
+
+fn tool_use_line() -> String {
+    r#"{"type":"assistant","message":{"id":"msg_t","content":[{"type":"tool_use","id":"toolu_1","name":"x","input":{}}]}}"#.to_string()
+}
+
+fn rate_limit_line(status: &str) -> String {
+    format!(
+        r#"{{"type":"rate_limit_event","rate_limit_info":{{"status":"{status}","rateLimitType":"five_hour"}}}}"#
+    )
+}
+
+const USAGE: &str = r#"{"claude-haiku-5-5":{"inputTokens":2,"outputTokens":4,"cacheReadInputTokens":7,"cacheCreationInputTokens":1043,"thinkingTokens":3,"costUSD":0.5}}"#;
+
+/// What a resumed session's `modelUsage` says: every turn so far. Every result
+/// fixture carries it beside the turn's own `model_usage_since_last_result`,
+/// so reading the wrong field shows in a price.
+const CUMULATIVE: &str = r#"{"claude-haiku-5-5":{"inputTokens":900000,"outputTokens":900000,"cacheReadInputTokens":900000,"cacheCreationInputTokens":900000,"thinkingTokens":900000,"costUSD":99.0}}"#;
+
+fn result_line(stop_reason: &str, since_last: &str) -> String {
+    format!(
+        r#"{{"type":"result","subtype":"success","is_error":false,"stop_reason":"{stop_reason}","session_id":"{SESSION}","total_cost_usd":99.0,"modelUsage":{CUMULATIVE},"model_usage_since_last_result":{since_last}}}"#
+    )
+}
+
+fn error_result_line(extra: &str) -> String {
+    format!(
+        r#"{{"type":"result","subtype":"error_during_execution","is_error":true,"session_id":"{SESSION}","total_cost_usd":99.0,"modelUsage":{CUMULATIVE},"model_usage_since_last_result":{USAGE}{extra}}}"#
+    )
+}
+
+fn ok_script(session: &str, text: &str) -> Script {
+    Script::lines(vec![
+        init_line(MODEL, session),
+        text_line("msg_1", text),
+        rate_limit_line("allowed"),
+        result_line("end_turn", USAGE),
+    ])
+}
+
+fn usage(
+    input: u64,
+    cache_read: u64,
+    cache_write: u64,
+    output: u64,
+    reasoning: Option<u64>,
+) -> Usage {
+    Usage {
+        input_tokens: input,
+        cache_read_tokens: cache_read,
+        cache_write_tokens: cache_write,
+        output_tokens: output,
+        reasoning_tokens: reasoning,
+    }
+}
+
+fn user(text: &str) -> InputItem {
+    InputItem::UserText { text: text.into() }
+}
+
+fn assistant(text: &str) -> InputItem {
+    InputItem::AssistantText { text: text.into() }
+}
+
+fn request(input: Vec<InputItem>) -> ProviderRequest {
+    let mut request = ProviderRequest::new("req", "conv", MODEL, "Be terse.", 1024);
+    request.input = input;
+    request
+}
+
+// ---- the scripted port: replays fixture lines and records what it was given ----
+
+#[derive(Clone, Copy)]
+enum Terminal {
+    Eof,
+    Timeout,
+    Breach,
+}
+
+struct Script {
+    lines: Vec<String>,
+    terminal: Terminal,
+}
+
+impl Script {
+    fn lines(lines: Vec<String>) -> Self {
+        Self {
+            lines,
+            terminal: Terminal::Eof,
+        }
+    }
+
+    fn ending(mut self, terminal: Terminal) -> Self {
+        self.terminal = terminal;
+        self
+    }
+}
+
+#[derive(Clone, Default)]
+struct Seen {
+    argv: Vec<String>,
+    env: Vec<(String, String)>,
+    cwd: PathBuf,
+    stdin: Vec<u8>,
+    /// The file `--system-prompt-file` named, as it was when the child started.
+    prompt_file: Option<(PathBuf, String)>,
+    /// Every deadline the backend passed to a read of this child.
+    deadlines: Arc<Mutex<Vec<Instant>>>,
+}
+
+struct ScriptedPort {
+    scripts: Mutex<VecDeque<Script>>,
+    spawns: Arc<AtomicUsize>,
+    seen: Arc<Mutex<Seen>>,
+    stderr: Vec<u8>,
+}
+
+struct ScriptedChild {
+    lines: VecDeque<String>,
+    terminal: Terminal,
+    stderr: Vec<u8>,
+    deadlines: Arc<Mutex<Vec<Instant>>>,
+}
+
+impl ProcessPort for ScriptedPort {
+    fn spawn(
+        &self,
+        argv: &[String],
+        env: &ChildEnv,
+        cwd: &Path,
+        stdin: Vec<u8>,
+    ) -> io::Result<Box<dyn RunningChild>> {
+        self.spawns.fetch_add(1, Ordering::SeqCst);
+        let deadlines = Arc::new(Mutex::new(Vec::new()));
+        *self.seen.lock().unwrap() = Seen {
+            prompt_file: arg_after(argv, "--system-prompt-file").map(|path| {
+                (
+                    PathBuf::from(path),
+                    std::fs::read_to_string(path).expect("the prompt file exists at spawn"),
+                )
+            }),
+            deadlines: deadlines.clone(),
+            argv: argv.to_vec(),
+            env: env
+                .iter()
+                .map(|(k, v)| (k.to_string(), v.to_string()))
+                .collect(),
+            cwd: cwd.to_path_buf(),
+            stdin,
+        };
+        let script = self
+            .scripts
+            .lock()
+            .unwrap()
+            .pop_front()
+            .expect("the test scripted no further spawn");
+        Ok(Box::new(ScriptedChild {
+            lines: script.lines.into(),
+            terminal: script.terminal,
+            stderr: self.stderr.clone(),
+            deadlines,
+        }))
+    }
+}
+
+impl RunningChild for ScriptedChild {
+    fn read_line(&mut self, deadline: Instant) -> StdoutRead {
+        self.deadlines.lock().unwrap().push(deadline);
+        match self.lines.pop_front() {
+            Some(line) => StdoutRead::Line(line.into_bytes()),
+            None => match self.terminal {
+                Terminal::Eof => StdoutRead::Eof,
+                Terminal::Timeout => StdoutRead::Timeout,
+                Terminal::Breach => StdoutRead::Breach,
+            },
+        }
+    }
+    fn stderr_tail(&self) -> Vec<u8> {
+        self.stderr.clone()
+    }
+    fn kill(&mut self) {}
+    fn wait(&mut self) {}
+}
+
+struct Sessions(Vec<String>);
+
+impl SessionStore for Sessions {
+    fn exists(&self, session_id: &str) -> bool {
+        self.0.iter().any(|known| known == session_id)
+    }
+}
+
+#[derive(Clone, Default)]
+struct Sink(Arc<Mutex<Vec<u8>>>);
+
+impl StderrSink for Sink {
+    fn stderr_tail(&self, tail: &[u8]) {
+        self.0.lock().unwrap().extend_from_slice(tail);
+    }
+}
+
+fn config(instance: &str, limits: ClaudeCodeLimits) -> ClaudeCodeConfig {
+    ClaudeCodeConfig {
+        claude_binary: PathBuf::from("/opt/claude"),
+        claude_binary_sha256: [9; 32],
+        work_dir: PathBuf::from("/work"),
+        config_dir: PathBuf::from("/cfg"),
+        instance: instance.to_string(),
+        limits,
+    }
+}
+
+fn limits() -> ClaudeCodeLimits {
+    ClaudeCodeLimits {
+        deadline: Duration::from_secs(30),
+        max_line_bytes: 1 << 20,
+        max_total_bytes: 1 << 24,
+        stderr_tail_bytes: 4096,
+    }
+}
+
+fn with_canary_token(mut backend: ClaudeCodeBackend) -> ClaudeCodeBackend {
+    backend.env_lookup = Box::new(|name| (name == TOKEN_VAR).then(|| CANARY_TOKEN.to_string()));
+    backend
+}
+
+struct Rig {
+    backend: ClaudeCodeBackend,
+    spawns: Arc<AtomicUsize>,
+    seen: Arc<Mutex<Seen>>,
+    sink: Sink,
+}
+
+fn rig_for(instance: &str, scripts: Vec<Script>, sessions: &[&str], stderr: &[u8]) -> Rig {
+    let spawns = Arc::new(AtomicUsize::new(0));
+    let seen = Arc::new(Mutex::new(Seen::default()));
+    let sink = Sink::default();
+    let port = ScriptedPort {
+        scripts: Mutex::new(scripts.into()),
+        spawns: spawns.clone(),
+        seen: seen.clone(),
+        stderr: stderr.to_vec(),
+    };
+    let backend = with_canary_token(ClaudeCodeBackend::with_ports(
+        config(instance, limits()),
+        Box::new(port),
+        Box::new(Sessions(sessions.iter().map(|s| s.to_string()).collect())),
+        Box::new(sink.clone()),
+    ));
+    Rig {
+        backend,
+        spawns,
+        seen,
+        sink,
+    }
+}
+
+fn rig(scripts: Vec<Script>) -> Rig {
+    rig_for(INSTANCE, scripts, &[SESSION], b"")
+}
+
+impl Rig {
+    fn run(&self, request: ProviderRequest) -> TransportResult {
+        let mut door = Door::new();
+        let (claim, _) = door.begin(request);
+        self.backend.execute(claim.call())
+    }
+    fn seen(&self) -> Seen {
+        self.seen.lock().unwrap().clone()
+    }
+    fn spawns(&self) -> usize {
+        self.spawns.load(Ordering::SeqCst)
+    }
+}
+
+// ---- the kit's door, so a call is what serve would hand the backend ----
+
+static DOOR_SEQUENCE: AtomicUsize = AtomicUsize::new(0);
+
+struct Door {
+    dir: PathBuf,
+    service: TransportService,
+    key: TransportKey,
+}
+
+fn prices() -> PriceTable {
+    PriceTable::from([MODEL, OTHER_MODEL].map(|model| {
+        (
+            model.to_string(),
+            ModelPrice {
+                rates: Rates {
+                    input: 3_000_000,
+                    cache_write_short: 3_750_000,
+                    cache_write_long: 6_000_000,
+                    cache_read: 300_000,
+                    output: 15_000_000,
+                },
+                long_context: None,
+                overhead_tokens: 100,
+            },
+        )
+    }))
+}
+
+impl Door {
+    fn new() -> Self {
+        let dir = std::env::temp_dir().join(format!(
+            "claude-connector-door-{}-{}",
+            std::process::id(),
+            DOOR_SEQUENCE.fetch_add(1, Ordering::SeqCst)
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let caller = CallerAdmission::new(
+            "caller-1",
+            "caller-1-key",
+            1,
+            [MODEL.to_string(), OTHER_MODEL.to_string()],
+            4,
+            FRAME / 2,
+            32_768,
+            SpendCeiling(1 << 40),
+            SpendWindowMs(3_600_000),
+        )
+        .unwrap();
+        let service =
+            TransportService::open(&dir.join("replay.cc"), PROVIDER, prices(), [caller], 5_000)
+                .unwrap();
+        Self {
+            dir,
+            service,
+            key: TransportKey::from_connection_secret("caller-1-key").unwrap(),
+        }
+    }
+
+    fn begin(
+        &mut self,
+        request: ProviderRequest,
+    ) -> (model_connector::ExecutionClaim, TransportInvocation) {
+        let invocation =
+            TransportInvocation::new("caller-1", 2_000, [7; 32], 10_000_000, request).unwrap();
+        let envelope = encrypt_invocation(&invocation, &self.key).unwrap();
+        match self.service.begin(&envelope, 1_000, FRAME).unwrap() {
+            TransportAdmission::Execute(claim) => (*claim, invocation),
+            TransportAdmission::Reply(_) => panic!("the door answered instead of admitting"),
+        }
+    }
+}
+
+impl Drop for Door {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.dir);
+    }
+}
+
+fn parts(result: &TransportResult) -> (&[TransportEvent], &TransportReceipt) {
+    match &result.disposition {
+        TransportDisposition::Transported { events, receipt } => (events, receipt),
+        TransportDisposition::Refused(refusal) => panic!("refused: {refusal:?}"),
+    }
+}
+
+fn outcome(result: &TransportResult) -> &TransportOutcome {
+    &parts(result).1.outcome
+}
+
+fn failure_of(result: &TransportResult) -> (FailureKind, String, Option<Usage>) {
+    match outcome(result) {
+        TransportOutcome::Failed {
+            kind,
+            message,
+            usage,
+        } => (*kind, message.clone(), usage.clone()),
+        other => panic!("expected a failure, got {other:?}"),
+    }
+}
+
+fn arg_after<'a>(argv: &'a [String], flag: &str) -> Option<&'a str> {
+    let at = argv.iter().position(|arg| arg == flag)?;
+    argv.get(at + 1).map(String::as_str)
+}
+
+/// A second request that continues `first` with the transcript the kit itself
+/// derives from `result`.
+fn continuing(first: &ProviderRequest, result: &TransportResult, next: &str) -> ProviderRequest {
+    let mut input = first.input.clone();
+    input.extend(result.transcript_items());
+    input.push(user(next));
+    request(input)
+}
+
+// ---- argv and environment ----
+
+#[test]
+fn argv_is_the_fixed_hygiene_set() {
+    let rig = rig(vec![ok_script(SESSION, "hi")]);
+    rig.run(request(vec![user("hello")]));
+    let argv = rig.seen().argv;
+    let prompt_path = arg_after(&argv, "--system-prompt-file")
+        .expect("the prompt is passed as a file")
+        .to_string();
+    let expected: Vec<String> = [
+        "/opt/claude",
+        "-p",
+        "--output-format",
+        "stream-json",
+        "--verbose",
+        "--input-format",
+        "stream-json",
+        "--model",
+        MODEL,
+        "--system-prompt-file",
+        &prompt_path,
+        "--tools",
+        "",
+        "--strict-mcp-config",
+        "--setting-sources",
+        "",
+        "--disable-slash-commands",
+        "--permission-prompts",
+        "none",
+    ]
+    .iter()
+    .map(|s| s.to_string())
+    .collect();
+    assert_eq!(argv, expected);
+    assert!(!argv.iter().any(|arg| arg == "--system-prompt"));
+    for forbidden in [
+        "--bare",
+        "--fallback-model",
+        "--no-session-persistence",
+        "--dangerously-skip-permissions",
+        "--mcp-config",
+        "--add-dir",
+        "--agents",
+        "--plugin-dir",
+        "--settings",
+    ] {
+        assert!(!argv.iter().any(|arg| arg == forbidden), "{forbidden}");
+    }
+}
+
+#[test]
+fn reasoning_effort_is_passed_as_its_level() {
+    for (effort, level) in [
+        (ReasoningEffort::Low, "low"),
+        (ReasoningEffort::Medium, "medium"),
+        (ReasoningEffort::High, "high"),
+        (ReasoningEffort::Max, "max"),
+    ] {
+        let rig = rig(vec![ok_script(SESSION, "hi")]);
+        let mut asked = request(vec![user("hello")]);
+        asked.reasoning_effort = Some(effort);
+        rig.run(asked);
+        assert_eq!(arg_after(&rig.seen().argv, "--effort"), Some(level));
+    }
+}
+
+#[test]
+fn resume_always_forks() {
+    let rig = rig(vec![ok_script(SESSION, "hi"), ok_script(FORK, "again")]);
+    let first = request(vec![user("hello")]);
+    let result = rig.run(first.clone());
+    let seed_argv = rig.seen().argv;
+    assert!(
+        !seed_argv
+            .iter()
+            .any(|a| a == "--resume" || a == "--fork-session")
+    );
+
+    rig.run(continuing(&first, &result, "and then?"));
+    let argv = rig.seen().argv;
+    let at = argv.iter().position(|a| a == "--resume").expect("resumes");
+    assert_eq!(argv[at + 1], SESSION);
+    assert_eq!(argv[at + 2], "--fork-session");
+    assert_eq!(argv.iter().filter(|a| *a == "--fork-session").count(), 1);
+}
+
+#[test]
+fn child_env_is_cleared_and_names_only_the_token_var() {
+    let rig = rig(vec![ok_script(SESSION, "hi")]);
+    let result = rig.run(request(vec![user("hello")]));
+    let seen = rig.seen();
+    let mut env = seen.env.clone();
+    env.sort();
+    assert_eq!(
+        env,
+        vec![
+            (
+                "CLAUDE_CODE_MAX_OUTPUT_TOKENS".to_string(),
+                "1024".to_string()
+            ),
+            (
+                "CLAUDE_CODE_OAUTH_TOKEN".to_string(),
+                CANARY_TOKEN.to_string()
+            ),
+            ("CLAUDE_CONFIG_DIR".to_string(), "/cfg".to_string()),
+            ("HOME".to_string(), "/cfg".to_string()),
+            (
+                "PATH".to_string(),
+                "/usr/local/bin:/usr/bin:/bin".to_string()
+            ),
+        ]
+    );
+    assert_eq!(seen.cwd, PathBuf::from("/work"));
+    assert!(!format!("{result:?}").contains(CANARY_TOKEN));
+}
+
+#[test]
+fn the_token_never_reaches_a_message_an_event_or_a_debug_form() {
+    // A failing run, so a message is built, and the env's own Debug.
+    let rig = rig_for(
+        INSTANCE,
+        vec![Script::lines(vec![init_line(MODEL, SESSION)])],
+        &[SESSION],
+        CANARY_TOKEN.as_bytes(),
+    );
+    let result = rig.run(request(vec![user("hello")]));
+    let (_, message, _) = failure_of(&result);
+    assert!(!message.contains(CANARY_TOKEN));
+    assert!(!format!("{result:?}").contains(CANARY_TOKEN));
+    // The tail is the sink's alone.
+    assert_eq!(
+        rig.sink.0.lock().unwrap().as_slice(),
+        CANARY_TOKEN.as_bytes()
+    );
+
+    let env = child_env(
+        &config(INSTANCE, limits()),
+        &request(vec![user("x")]),
+        Zeroizing::new(CANARY_TOKEN.to_string()),
+    );
+    let shown = format!("{env:?}");
+    assert!(!shown.contains(CANARY_TOKEN));
+    assert!(shown.contains("CLAUDE_CODE_OAUTH_TOKEN"));
+}
+
+// ---- ready ----
+
+#[test]
+fn ready_checks_the_pinned_binary_digest() {
+    let dir = TempDir::new();
+    let (work, cfg) = (dir.path().join("work"), dir.path().join("cfg"));
+    std::fs::create_dir_all(&work).unwrap();
+    std::fs::create_dir_all(&cfg).unwrap();
+    let binary = dir.path().join("claude");
+    std::fs::write(&binary, b"the pinned bytes").unwrap();
+    let pin: [u8; 32] = Sha256::digest(b"the pinned bytes").into();
+
+    let ready = |sha: [u8; 32], binary: &Path, work: &Path, token: bool| {
+        let mut config = config(INSTANCE, limits());
+        config.claude_binary = binary.to_path_buf();
+        config.claude_binary_sha256 = sha;
+        config.work_dir = work.to_path_buf();
+        config.config_dir = cfg.clone();
+        let rig = rig(vec![]);
+        let mut backend = ClaudeCodeBackend::with_ports(
+            config,
+            Box::new(ScriptedPort {
+                scripts: Mutex::new(VecDeque::new()),
+                spawns: rig.spawns.clone(),
+                seen: rig.seen.clone(),
+                stderr: Vec::new(),
+            }),
+            Box::new(Sessions(vec![])),
+            Box::new(Sink::default()),
+        );
+        backend.env_lookup =
+            Box::new(move |name| (token && name == TOKEN_VAR).then(|| "t".to_string()));
+        let answer = backend.ready();
+        assert_eq!(rig.spawns(), 0, "ready runs nothing");
+        answer
+    };
+
+    assert!(ready(pin, &binary, &work, true));
+    assert!(!ready([0; 32], &binary, &work, true), "other pin");
+    assert!(
+        !ready(pin, &dir.path().join("absent"), &work, true),
+        "no binary"
+    );
+    assert!(
+        !ready(pin, &binary, &dir.path().join("absent"), true),
+        "no work dir"
+    );
+    assert!(!ready(pin, &binary, &work, false), "no token");
+    std::fs::write(&binary, b"other bytes").unwrap();
+    assert!(
+        !ready(pin, &binary, &work, true),
+        "bytes differ from the pin"
+    );
+}
+
+// ---- planning ----
+
+#[test]
+fn seed_renders_one_user_line_deterministically() {
+    let input = vec![
+        user("a"),
+        assistant("b"),
+        InputItem::ToolCall {
+            call_id: "call-1".into(),
+            name: "lookup".into(),
+            arguments: "{}".into(),
+        },
+        InputItem::ToolResult {
+            call_id: "call-1".into(),
+            output: "out".into(),
+        },
+        InputItem::ReasoningState {
+            provider: "other".into(),
+            model: "m".into(),
+            state: vec![1],
+        },
+        assistant("e"),
+        user("c"),
+        user("d"),
+    ];
+    let rig = rig(vec![ok_script(SESSION, "x"), ok_script(SESSION, "x")]);
+    rig.run(request(input.clone()));
+    let first = rig.seen().stdin;
+    rig.run(request(input));
+    assert_eq!(rig.seen().stdin, first);
+
+    let transcript = "The conversation so far, replayed as text because the earlier session cannot be continued:\\n\\n[user]\\na\\n\\n[assistant]\\nb\\n\\n[tool_call name=lookup id=call-1]\\n{}\\n\\n[tool_result id=call-1]\\nout\\n\\n[assistant]\\ne";
+    let expected = format!(
+        r#"{{"type":"user","message":{{"role":"user","content":[{{"type":"text","text":"{transcript}"}},{{"type":"text","text":"c"}},{{"type":"text","text":"d"}}]}},"parent_tool_use_id":null}}"#
+    ) + "\n";
+    assert_eq!(String::from_utf8(first).unwrap(), expected);
+}
+
+#[test]
+fn a_first_message_is_one_text_block_with_no_transcript() {
+    let rig = rig(vec![ok_script(SESSION, "x")]);
+    rig.run(request(vec![user("hello")]));
+    let stdin = String::from_utf8(rig.seen().stdin).unwrap();
+    assert_eq!(
+        stdin,
+        "{\"type\":\"user\",\"message\":{\"role\":\"user\",\"content\":[{\"type\":\"text\",\"text\":\"hello\"}]},\"parent_tool_use_id\":null}\n"
+    );
+}
+
+#[test]
+fn a_resume_sends_only_the_new_user_text() {
+    let rig = rig(vec![ok_script(SESSION, "hi"), ok_script(FORK, "again")]);
+    let first = request(vec![user("hello")]);
+    let result = rig.run(first.clone());
+    let mut next = continuing(&first, &result, "one");
+    next.input.push(user("two"));
+    rig.run(next);
+    let stdin = String::from_utf8(rig.seen().stdin).unwrap();
+    assert_eq!(
+        stdin,
+        "{\"type\":\"user\",\"message\":{\"role\":\"user\",\"content\":[{\"type\":\"text\",\"text\":\"one\"},{\"type\":\"text\",\"text\":\"two\"}]},\"parent_tool_use_id\":null}\n"
+    );
+}
+
+#[test]
+fn handle_round_trips_through_transcript_items() {
+    let rig = rig(vec![ok_script(SESSION, "hi"), ok_script(FORK, "again")]);
+    let first = request(vec![user("hello")]);
+    let result = rig.run(first.clone());
+    let items = result.transcript_items();
+    assert_eq!(items.len(), 2);
+    assert_eq!(items[0], assistant("hi"));
+    assert!(
+        matches!(&items[1], InputItem::ReasoningState { provider, model, .. }
+        if provider == PROVIDER && model == MODEL)
+    );
+
+    rig.run(continuing(&first, &result, "next"));
+    assert_eq!(arg_after(&rig.seen().argv, "--resume"), Some(SESSION));
+}
+
+#[test]
+fn a_result_with_no_text_still_resumes() {
+    let silent = Script::lines(vec![
+        init_line(MODEL, SESSION),
+        thinking_line("msg_1"),
+        result_line("end_turn", USAGE),
+    ]);
+    let rig = rig(vec![silent, ok_script(FORK, "again")]);
+    let first = request(vec![user("hello")]);
+    let result = rig.run(first.clone());
+    assert_eq!(result.transcript_items().len(), 1, "only the handle");
+    rig.run(continuing(&first, &result, "next"));
+    assert_eq!(arg_after(&rig.seen().argv, "--resume"), Some(SESSION));
+}
+
+#[test]
+fn changed_instructions_or_model_reseeds() {
+    let rig = rig(vec![
+        ok_script(SESSION, "hi"),
+        ok_script(FORK, "x"),
+        ok_script(FORK, "x"),
+    ]);
+    let first = request(vec![user("hello")]);
+    let result = rig.run(first.clone());
+
+    let mut other_instructions = continuing(&first, &result, "next");
+    other_instructions.instructions = "Be verbose.".into();
+    rig.run(other_instructions);
+    assert_eq!(arg_after(&rig.seen().argv, "--resume"), None);
+
+    let mut other_model = continuing(&first, &result, "next");
+    other_model.model = OTHER_MODEL.into();
+    let script = Script::lines(vec![
+        init_line(OTHER_MODEL, FORK),
+        result_line("end_turn", USAGE),
+    ]);
+    let rig2 = rig_for(INSTANCE, vec![script], &[SESSION], b"");
+    rig2.run(other_model);
+    assert_eq!(arg_after(&rig2.seen().argv, "--resume"), None);
+}
+
+#[test]
+fn foreign_instance_missing_session_or_edited_prefix_reseeds() {
+    let first = request(vec![user("hello"), assistant("earlier"), user("more")]);
+    let make = |instance: &str, sessions: &[&str]| {
+        let rig = rig_for(
+            instance,
+            vec![ok_script(SESSION, "hi"), ok_script(FORK, "x")],
+            sessions,
+            b"",
+        );
+        let result = rig.run(first.clone());
+        (rig, result)
+    };
+
+    // Control: the same instance with its session resumes.
+    let (rig_ok, result) = make(INSTANCE, &[SESSION]);
+    rig_ok.run(continuing(&first, &result, "next"));
+    assert_eq!(arg_after(&rig_ok.seen().argv, "--resume"), Some(SESSION));
+
+    // Another instance wrote the handle.
+    let (rig_a, result) = make("persona-b", &[SESSION]);
+    let handle_request = continuing(&first, &result, "next");
+    let rig_b = rig_for(INSTANCE, vec![ok_script(FORK, "x")], &[SESSION], b"");
+    rig_b.run(handle_request);
+    assert_eq!(arg_after(&rig_b.seen().argv, "--resume"), None);
+    drop(rig_a);
+
+    // The session file is gone.
+    let (rig_c, result) = make(INSTANCE, &[]);
+    rig_c.run(continuing(&first, &result, "next"));
+    assert_eq!(arg_after(&rig_c.seen().argv, "--resume"), None);
+
+    // An item before the handle was edited.
+    let (rig_d, result) = make(INSTANCE, &[SESSION]);
+    let mut edited = continuing(&first, &result, "next");
+    edited.input[1] = assistant("edited");
+    rig_d.run(edited);
+    assert_eq!(arg_after(&rig_d.seen().argv, "--resume"), None);
+}
+
+#[test]
+fn assistant_items_after_the_handle_reseed() {
+    for tail in [
+        vec![assistant("interjection"), user("next")],
+        vec![
+            InputItem::ToolCall {
+                call_id: "c".into(),
+                name: "n".into(),
+                arguments: "{}".into(),
+            },
+            user("next"),
+        ],
+    ] {
+        let rig = rig(vec![ok_script(SESSION, "hi"), ok_script(FORK, "x")]);
+        let first = request(vec![user("hello")]);
+        let result = rig.run(first.clone());
+        let mut input = first.input.clone();
+        input.extend(result.transcript_items());
+        input.extend(tail);
+        rig.run(request(input));
+        assert_eq!(arg_after(&rig.seen().argv, "--resume"), None);
+    }
+}
+
+#[test]
+fn the_last_own_handle_decides() {
+    let rig = rig_for(
+        INSTANCE,
+        vec![
+            ok_script(SESSION, "one"),
+            ok_script(FORK, "two"),
+            ok_script(SESSION, "three"),
+        ],
+        &[SESSION, FORK],
+        b"",
+    );
+    let first = request(vec![user("a")]);
+    let r1 = rig.run(first.clone());
+    let second = continuing(&first, &r1, "b");
+    let r2 = rig.run(second.clone());
+    let third = continuing(&second, &r2, "c");
+    rig.run(third);
+    // The newest handle names the fork of the first resume, not the first session.
+    assert_eq!(arg_after(&rig.seen().argv, "--resume"), Some(FORK));
+}
+
+#[test]
+fn undecodable_own_handle_fails_before_spawn() {
+    let rig = rig(vec![]);
+    let bad = request(vec![
+        user("a"),
+        InputItem::ReasoningState {
+            provider: PROVIDER.into(),
+            model: MODEL.into(),
+            state: vec![1, 2, 3],
+        },
+        user("b"),
+    ]);
+    let (kind, _, usage) = failure_of(&rig.run(bad));
+    assert_eq!(kind, FailureKind::InvalidRequest);
+    assert_eq!(usage, Some(usage_zero()));
+    assert_eq!(rig.spawns(), 0);
+}
+
+fn usage_zero() -> Usage {
+    usage(0, 0, 0, 0, None)
+}
+
+#[test]
+fn tools_schema_or_final_tool_result_fail_before_spawn() {
+    let mut with_tools = request(vec![user("a")]);
+    with_tools.tools.push(ToolDefinition {
+        name: "lookup".into(),
+        description: "d".into(),
+        parameters_json: "{}".into(),
+    });
+    let mut with_schema = request(vec![user("a")]);
+    with_schema.output_schema_json = Some("{}".into());
+    let final_tool_result = request(vec![
+        user("a"),
+        InputItem::ToolCall {
+            call_id: "c".into(),
+            name: "n".into(),
+            arguments: "{}".into(),
+        },
+        InputItem::ToolResult {
+            call_id: "c".into(),
+            output: "o".into(),
+        },
+    ]);
+    let ends_without_user_text = request(vec![user("a"), assistant("b")]);
+    let tool_result_beside_text = request(vec![
+        assistant("b"),
+        InputItem::ToolResult {
+            call_id: "c".into(),
+            output: "o".into(),
+        },
+        user("a"),
+    ]);
+
+    let rig = rig(vec![]);
+    let mut messages = Vec::new();
+    for refused in [
+        with_tools,
+        with_schema,
+        final_tool_result,
+        ends_without_user_text,
+        tool_result_beside_text,
+    ] {
+        let (kind, message, usage) = failure_of(&rig.run(refused));
+        assert_eq!(kind, FailureKind::InvalidRequest);
+        assert_eq!(usage, Some(usage_zero()));
+        messages.push(message);
+    }
+    assert_eq!(rig.spawns(), 0);
+    // Each refusal names what lifts it.
+    assert_eq!(messages[2], messages[4]);
+    let distinct: std::collections::HashSet<_> = messages.iter().collect();
+    assert_eq!(distinct.len(), 4, "{messages:?}");
+}
+
+// ---- the stream ----
+
+#[test]
+fn stream_maps_text_in_order_and_ends_with_the_handle() {
+    let script = Script::lines(vec![
+        init_line(MODEL, SESSION),
+        thinking_line("msg_0"),
+        text_line("msg_1", "Hel"),
+        text_line("msg_2", ""),
+        text_line("msg_3", "lo"),
+        r#"{"type":"system","subtype":"post_turn_summary","summary":"x"}"#.to_string(),
+        r#"{"type":"unheard_of","field":1}"#.to_string(),
+        result_line("end_turn", USAGE),
+    ]);
+    let rig = rig(vec![script]);
+    let result = rig.run(request(vec![user("hi")]));
+    let (events, receipt) = parts(&result);
+    let payloads: Vec<_> = events.iter().map(|e| e.payload.clone()).collect();
+    assert_eq!(payloads.len(), 3);
+    assert_eq!(
+        payloads[0],
+        TransportEventPayload::TextDelta { text: "Hel".into() }
+    );
+    assert_eq!(
+        payloads[1],
+        TransportEventPayload::TextDelta { text: "lo".into() }
+    );
+    assert!(matches!(
+        payloads[2],
+        TransportEventPayload::ReasoningState { .. }
+    ));
+    assert_eq!(
+        events.iter().map(|e| e.sequence).collect::<Vec<_>>(),
+        vec![0, 1, 2]
+    );
+    let TransportOutcome::Completed {
+        provider_response_id,
+        stop_reason,
+        usage: _,
+    } = &receipt.outcome
+    else {
+        panic!("completed expected");
+    };
+    assert_eq!(provider_response_id.as_deref(), Some("msg_3"));
+    assert_eq!(*stop_reason, model_connector::StopReason::EndTurn);
+}
+
+#[test]
+fn every_stop_reason_has_its_own_mapping() {
+    use model_connector::StopReason::*;
+    for (cli, expected) in [
+        ("end_turn", EndTurn),
+        ("max_tokens", MaxOutputTokens),
+        ("stop_sequence", StopSequence),
+        ("refusal", Refusal),
+        ("model_context_window_exceeded", ContextWindow),
+    ] {
+        let script = Script::lines(vec![init_line(MODEL, SESSION), result_line(cli, USAGE)]);
+        let result = rig(vec![script]).run(request(vec![user("hi")]));
+        let TransportOutcome::Completed { stop_reason, .. } = outcome(&result) else {
+            panic!("{cli} should complete");
+        };
+        assert_eq!(*stop_reason, expected, "{cli}");
+    }
+    for odd in ["tool_use", "pause_turn", ""] {
+        let script = Script::lines(vec![init_line(MODEL, SESSION), result_line(odd, USAGE)]);
+        let (kind, _, usage) = failure_of(&rig(vec![script]).run(request(vec![user("hi")])));
+        assert_eq!(kind, FailureKind::Provider);
+        assert!(usage.is_some());
+    }
+}
+
+#[test]
+fn usage_sums_model_usage_across_models() {
+    let two_models = r#"{"claude-haiku-5-5":{"inputTokens":2,"outputTokens":4,"cacheReadInputTokens":7,"cacheCreationInputTokens":1043,"thinkingTokens":3},"claude-sonnet-5":{"inputTokens":10,"outputTokens":20,"cacheReadInputTokens":30,"cacheCreationInputTokens":40,"thinkingTokens":5}}"#;
+    let run = |total_cost: &str| {
+        let result_line = format!(
+            r#"{{"type":"result","subtype":"success","is_error":false,"stop_reason":"end_turn","total_cost_usd":{total_cost},"model_usage_since_last_result":{two_models}}}"#
+        );
+        let script = Script::lines(vec![init_line(MODEL, SESSION), result_line]);
+        rig(vec![script]).run(request(vec![user("hi")]))
+    };
+    let (cheap, dear) = (run("0.000001"), run("99.5"));
+    let TransportOutcome::Completed { usage: summed, .. } = outcome(&cheap) else {
+        panic!("completed expected");
+    };
+    assert_eq!(*summed, usage(12, 37, 1083, 24, Some(8)));
+    // The receipt is priced from usage alone: 12*3 + 37*0.3 + 1083*6 + 24*15 micro-USD, rounded up.
+    assert_eq!(parts(&cheap).1.cost_micro_usd, 36 + 12 + 6498 + 360);
+    assert_eq!(
+        parts(&cheap).1.cost_micro_usd,
+        parts(&dear).1.cost_micro_usd
+    );
+
+    // No model reported thinking tokens: none is claimed.
+    let plain = r#"{"claude-haiku-5-5":{"inputTokens":1,"outputTokens":1,"cacheReadInputTokens":0,"cacheCreationInputTokens":0}}"#;
+    let script = Script::lines(vec![
+        init_line(MODEL, SESSION),
+        result_line("end_turn", plain),
+    ]);
+    let result = rig(vec![script]).run(request(vec![user("hi")]));
+    let TransportOutcome::Completed { usage, .. } = outcome(&result) else {
+        panic!("completed expected");
+    };
+    assert_eq!(*usage, self::usage(1, 0, 0, 1, None));
+}
+
+#[test]
+fn init_model_mismatch_is_a_provider_failure() {
+    let script = Script::lines(vec![
+        init_line("haiku", SESSION),
+        result_line("end_turn", USAGE),
+    ]);
+    let (kind, _, usage) = failure_of(&rig(vec![script]).run(request(vec![user("hi")])));
+    assert_eq!(kind, FailureKind::Provider);
+    assert_eq!(usage, None);
+}
+
+#[test]
+fn result_errors_map_to_failure_kinds_with_their_usage() {
+    let rate_limit_text = r#","result":"You have hit your rate limit""#;
+    let cases: Vec<(Vec<String>, FailureKind)> = vec![
+        (
+            vec![rate_limit_line("rejected"), error_result_line("")],
+            FailureKind::RateLimited,
+        ),
+        // The rejection latches: a later event that allows does not undo it.
+        (
+            vec![
+                rate_limit_line("rejected"),
+                rate_limit_line("allowed"),
+                error_result_line(""),
+            ],
+            FailureKind::RateLimited,
+        ),
+        (
+            vec![error_result_line(r#","api_error_status":429"#)],
+            FailureKind::RateLimited,
+        ),
+        (
+            vec![error_result_line(rate_limit_text)],
+            FailureKind::RateLimited,
+        ),
+        (
+            vec![error_result_line(r#","errors":["rate_limit_error"]"#)],
+            FailureKind::RateLimited,
+        ),
+        (
+            vec![error_result_line(r#","api_error_status":401"#)],
+            FailureKind::Authentication,
+        ),
+        (
+            vec![error_result_line(r#","api_error_status":403"#)],
+            FailureKind::Authentication,
+        ),
+        (
+            vec![error_result_line(r#","api_error_status":400"#)],
+            FailureKind::InvalidRequest,
+        ),
+        (
+            vec![error_result_line(r#","api_error_status":500"#)],
+            FailureKind::Unavailable,
+        ),
+        (
+            vec![error_result_line(r#","api_error_status":529"#)],
+            FailureKind::Unavailable,
+        ),
+        (
+            vec![error_result_line(r#","api_error_status":null"#)],
+            FailureKind::Provider,
+        ),
+        (
+            vec![rate_limit_line("allowed"), error_result_line("")],
+            FailureKind::Provider,
+        ),
+    ];
+    for (lines, expected) in cases {
+        let mut all = vec![init_line(MODEL, SESSION)];
+        all.extend(lines.clone());
+        let result = rig(vec![Script::lines(all)]).run(request(vec![user("hi")]));
+        let (kind, _, usage) = failure_of(&result);
+        assert_eq!(kind, expected, "{lines:?}");
+        assert!(
+            usage.is_some(),
+            "a result event carries its usage: {lines:?}"
+        );
+    }
+    // The usage of an error result is the sum the event reported.
+    let result = rig(vec![Script::lines(vec![
+        init_line(MODEL, SESSION),
+        error_result_line(""),
+    ])])
+    .run(request(vec![user("hi")]));
+    assert_eq!(failure_of(&result).2, Some(usage(2, 7, 1043, 4, Some(3))));
+}
+
+#[test]
+fn no_result_event_is_a_failure_with_unknown_usage() {
+    let ends: Vec<(Script, FailureKind)> = vec![
+        (
+            Script::lines(vec![init_line(MODEL, SESSION), text_line("m", "x")]),
+            FailureKind::Provider,
+        ),
+        (
+            Script::lines(vec![
+                init_line(MODEL, SESSION),
+                "not json at all".to_string(),
+            ]),
+            FailureKind::Provider,
+        ),
+        (
+            Script::lines(vec![init_line(MODEL, SESSION)]).ending(Terminal::Breach),
+            FailureKind::Provider,
+        ),
+        (
+            Script::lines(vec![init_line(MODEL, SESSION)]).ending(Terminal::Timeout),
+            FailureKind::Timeout,
+        ),
+    ];
+    let zero_billed = {
+        let (_, _, usage) = failure_of(&rig(vec![]).run({
+            let mut bad = request(vec![user("a")]);
+            bad.output_schema_json = Some("{}".into());
+            bad
+        }));
+        usage
+    };
+    assert_eq!(zero_billed, Some(usage_zero()));
+
+    let mut costs = Vec::new();
+    for (script, expected) in ends {
+        let rig = rig(vec![script]);
+        let result = rig.run(request(vec![user("hi")]));
+        let (kind, message, usage) = failure_of(&result);
+        assert_eq!(kind, expected);
+        assert_eq!(usage, None, "{message}");
+        assert!(result.transcript_items().is_empty());
+        costs.push(parts(&result).1.cost_micro_usd);
+    }
+    // Unknown usage is charged the reservation, which is far above a typical turn.
+    assert!(costs.iter().all(|cost| *cost >= 15_000), "{costs:?}");
+    assert_eq!(
+        parts(&rig(vec![]).run({
+            let mut bad = request(vec![user("a")]);
+            bad.output_schema_json = Some("{}".into());
+            bad
+        }))
+        .1
+        .cost_micro_usd,
+        0
+    );
+}
+
+#[test]
+fn tool_use_or_compaction_in_the_stream_is_a_provider_failure() {
+    for line in [
+        tool_use_line(),
+        r#"{"type":"system","subtype":"compact_boundary"}"#.to_string(),
+    ] {
+        let script = Script::lines(vec![
+            init_line(MODEL, SESSION),
+            text_line("m", "partial"),
+            line.clone(),
+            result_line("end_turn", USAGE),
+        ]);
+        let result = rig(vec![script]).run(request(vec![user("hi")]));
+        let (kind, _, usage) = failure_of(&result);
+        assert_eq!(kind, FailureKind::Provider, "{line}");
+        assert_eq!(usage, None);
+        assert!(
+            parts(&result).0.is_empty(),
+            "no partial reasoning is replayed"
+        );
+    }
+}
+
+#[test]
+fn a_result_before_any_init_names_no_session() {
+    let script = Script::lines(vec![result_line("end_turn", USAGE)]);
+    let (kind, _, usage) = failure_of(&rig(vec![script]).run(request(vec![user("hi")])));
+    assert_eq!(kind, FailureKind::Provider);
+    assert!(usage.is_some());
+}
+
+// ---- spawns ----
+
+#[test]
+fn one_spawn_per_execute() {
+    let scripts: Vec<(Script, usize)> = vec![
+        (ok_script(SESSION, "x"), 1),
+        (
+            Script::lines(vec![init_line(MODEL, SESSION), error_result_line("")]),
+            1,
+        ),
+        (Script::lines(vec![]).ending(Terminal::Eof), 1),
+        (Script::lines(vec![]).ending(Terminal::Timeout), 1),
+        (Script::lines(vec![]).ending(Terminal::Breach), 1),
+    ];
+    for (script, expected) in scripts {
+        let rig = rig(vec![script]);
+        rig.run(request(vec![user("hi")]));
+        assert_eq!(rig.spawns(), expected);
+    }
+}
+
+#[test]
+fn a_missing_token_fails_before_spawn() {
+    let mut rig = rig(vec![ok_script(SESSION, "x")]);
+    rig.backend.env_lookup = Box::new(|_| None);
+    let (kind, _, usage) = failure_of(&rig.run(request(vec![user("hi")])));
+    assert_eq!(kind, FailureKind::Authentication);
+    assert_eq!(usage, Some(usage_zero()));
+    assert_eq!(rig.spawns(), 0);
+}
+
+#[test]
+fn a_port_that_cannot_spawn_is_a_provider_failure() {
+    struct Refusing;
+    impl ProcessPort for Refusing {
+        fn spawn(
+            &self,
+            _: &[String],
+            _: &ChildEnv,
+            _: &Path,
+            _: Vec<u8>,
+        ) -> io::Result<Box<dyn RunningChild>> {
+            Err(io::Error::from(io::ErrorKind::NotFound))
+        }
+    }
+    let backend = with_canary_token(ClaudeCodeBackend::with_ports(
+        config(INSTANCE, limits()),
+        Box::new(Refusing),
+        Box::new(Sessions(vec![])),
+        Box::new(Sink::default()),
+    ));
+    let mut door = Door::new();
+    let (claim, _) = door.begin(request(vec![user("hi")]));
+    let (kind, message, usage) = failure_of(&backend.execute(claim.call()));
+    assert_eq!(kind, FailureKind::Provider);
+    assert_eq!(usage, None);
+    assert!(!message.contains("/opt/claude"), "no path in a message");
+}
+
+#[test]
+fn backend_end_to_end_through_the_service() {
+    let rig = rig(vec![ok_script(SESSION, "hello back")]);
+    let mut door = Door::new();
+    let (claim, invocation) = door.begin(request(vec![user("hello")]));
+    let result = rig.backend.execute(claim.call());
+    let sealed = door.service.complete(claim, result, FRAME).unwrap();
+    let opened = decrypt_result(&sealed, &door.key, &invocation).unwrap();
+    let (events, receipt) = parts(&opened);
+    assert_eq!(receipt.provider, "claude-code");
+    assert_eq!(receipt.model, MODEL);
+    // USAGE priced at the table: 2*3 + 7*0.3 + 1043*6 + 4*15 micro-USD, rounded up.
+    assert_eq!(receipt.cost_micro_usd, 6 + 3 + 6258 + 60);
+    assert_eq!(receipt.overrun_micro_usd, 0);
+    assert_eq!(events.len(), 2);
+    let items = opened.transcript_items();
+    assert_eq!(items[0], assistant("hello back"));
+    assert!(
+        matches!(&items[1], InputItem::ReasoningState { provider, .. } if provider == "claude-code")
+    );
+}
+
+// ---- usage: this turn's own, or unknown ----
+
+const USAGE_TURN_2: &str = r#"{"claude-haiku-5-5":{"inputTokens":3,"outputTokens":5,"cacheReadInputTokens":1100,"cacheCreationInputTokens":9}}"#;
+
+/// What a call whose usage is unknown is billed: the kit's reservation.
+fn reservation() -> u64 {
+    let result = rig(vec![Script::lines(vec![])]).run(request(vec![user("hi")]));
+    assert_eq!(failure_of(&result).2, None);
+    parts(&result).1.cost_micro_usd
+}
+
+#[test]
+fn a_resumed_turn_is_charged_only_its_own_usage() {
+    let rig = rig(vec![
+        ok_script(SESSION, "one"),
+        Script::lines(vec![
+            init_line(MODEL, FORK),
+            text_line("msg_2", "two"),
+            // The CLI's `modelUsage` here is the cumulative CUMULATIVE of
+            // result_line; only the turn's own field may be billed.
+            result_line("end_turn", USAGE_TURN_2),
+        ]),
+    ]);
+    let first_request = request(vec![user("hello")]);
+    let first = rig.run(first_request.clone());
+    let second = rig.run(continuing(&first_request, &first, "again"));
+    assert!(
+        rig.seen().argv.iter().any(|arg| arg == "--resume"),
+        "the second turn resumes"
+    );
+    let TransportOutcome::Completed { usage: billed, .. } = outcome(&second) else {
+        panic!("completed expected");
+    };
+    assert_eq!(*billed, usage(3, 1100, 9, 5, None));
+    // 3*3 + 1100*0.3 + 9*6 + 5*15 micro-USD.
+    assert_eq!(parts(&second).1.cost_micro_usd, 9 + 330 + 54 + 75);
+}
+
+#[test]
+fn usage_the_result_does_not_report_is_billed_the_reservation() {
+    let reservation = reservation();
+    assert!(reservation >= 15_000, "{reservation}");
+    let success = |fields: &str| {
+        format!(
+            r#"{{"type":"result","subtype":"success","is_error":false,"stop_reason":"end_turn","modelUsage":{CUMULATIVE}{fields}}}"#
+        )
+    };
+    let error = |fields: &str| {
+        format!(
+            r#"{{"type":"result","subtype":"error_during_execution","is_error":true,"modelUsage":{CUMULATIVE}{fields}}}"#
+        )
+    };
+    let renamed = r#","model_usage_since_last_result":{"claude-haiku-5-5":{"input_tokens":5000,"output_tokens":9000}}"#;
+    let no_cache_counts = r#","model_usage_since_last_result":{"claude-haiku-5-5":{"inputTokens":1,"outputTokens":1}}"#;
+    let cases = [
+        success(""),
+        success(r#","model_usage_since_last_result":{}"#),
+        success(r#","model_usage_since_last_result":null"#),
+        success(r#","model_usage_since_last_result":"none""#),
+        success(renamed),
+        success(no_cache_counts),
+        error(""),
+        error(r#","model_usage_since_last_result":{}"#),
+        error(renamed),
+    ];
+    // An empty report from a server error, or none from a refusal, is not a
+    // refusal at the door that reported nothing spent.
+    let by_status = [
+        (
+            r#","api_error_status":500,"model_usage_since_last_result":{}"#,
+            FailureKind::Unavailable,
+        ),
+        (r#","api_error_status":401"#, FailureKind::Authentication),
+    ];
+    for (fields, expected) in by_status {
+        let line = error(fields);
+        let result = rig(vec![Script::lines(vec![
+            init_line(MODEL, SESSION),
+            text_line("m", "work"),
+            line.clone(),
+        ])])
+        .run(request(vec![user("hi")]));
+        let (kind, _, usage) = failure_of(&result);
+        assert_eq!(kind, expected, "{line}");
+        assert_eq!(usage, None, "{line}");
+        assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{line}");
+    }
+    for line in cases {
+        let result = rig(vec![Script::lines(vec![
+            init_line(MODEL, SESSION),
+            text_line("m", "work"),
+            line.clone(),
+        ])])
+        .run(request(vec![user("hi")]));
+        let (kind, _, usage) = failure_of(&result);
+        assert_eq!(kind, FailureKind::Provider, "{line}");
+        assert_eq!(usage, None, "{line}");
+        assert_eq!(parts(&result).1.cost_micro_usd, reservation, "{line}");
+        assert!(result.transcript_items().is_empty(), "{line}");
+    }
+}
+
+#[test]
+fn a_refusal_at_the_door_is_billed_nothing() {
+    // Ruling spend-bills-on-identity-not-validity: a bound result is charged
+    // its true cost, and the provider bills nothing for a 401 or 403.
+    // The shape is a real claude 2.1.312 capture with a bogus token.
+    let retry = r#"{"type":"system","subtype":"api_retry","error":"authentication_failed"}"#;
+    let synthetic = r#"{"type":"assistant","api_error_status":401,"error":"authentication_failed","message":{"id":"e48001b7-cf4f-49b1-9810-db8fd7f73c73","model":"<synthetic>","stop_reason":"stop_sequence","content":[{"type":"text","text":"Failed to authenticate. API Error: 401 OAuth access token is invalid."}]}}"#;
+    for status in [401, 403] {
+        let result_line = format!(
+            r#"{{"type":"result","subtype":"success","is_error":true,"api_error_status":{status},"stop_reason":"stop_sequence","result":"Failed to authenticate.","modelUsage":{{}},"model_usage_since_last_result":{{}},"terminal_reason":"api_error"}}"#
+        );
+        let result = rig(vec![Script::lines(vec![
+            init_line(MODEL, SESSION),
+            retry.to_string(),
+            retry.to_string(),
+            synthetic.to_string(),
+            result_line,
+        ])])
+        .run(request(vec![user("hi")]));
+        let (kind, _, usage) = failure_of(&result);
+        assert_eq!(kind, FailureKind::Authentication, "{status}");
+        assert_eq!(usage, Some(usage_zero()), "{status}");
+        assert_eq!(parts(&result).1.cost_micro_usd, 0, "{status}");
+    }
+}
+
+#[test]
+fn the_deadline_is_the_configured_deadline() {
+    let rig = rig(vec![ok_script(SESSION, "x")]);
+    let (before, configured) = (Instant::now(), limits().deadline);
+    rig.run(request(vec![user("hi")]));
+    let after = Instant::now();
+    let deadlines = rig.seen().deadlines.lock().unwrap().clone();
+    assert!(deadlines.len() >= 2, "the result read and the drain read");
+    for deadline in deadlines {
+        // Neither clamped nor scaled: exactly `configured` after the call began.
+        assert!(
+            deadline >= before + configured,
+            "the deadline was shortened"
+        );
+        assert!(deadline <= after + configured, "the deadline was stretched");
+    }
+}
+
+#[test]
+fn the_system_prompt_goes_in_a_file_however_large() {
+    let instructions = "p".repeat(300 * 1024);
+    let rig = rig(vec![ok_script(SESSION, "x")]);
+    let mut big = request(vec![user("hi")]);
+    big.instructions = instructions.clone();
+    rig.run(big);
+    let seen = rig.seen();
+    assert!(
+        seen.argv.iter().all(|arg| arg.len() < 4096),
+        "no argument carries the instructions"
+    );
+    let (path, contents) = seen.prompt_file.expect("the argv names a prompt file");
+    assert_eq!(contents, instructions);
+    assert!(!path.exists(), "the backend removes the file it staged");
+}
+
+#[test]
+fn the_prompt_file_is_removed_when_the_call_fails() {
+    for script in [
+        Script::lines(vec![]).ending(Terminal::Eof),
+        Script::lines(vec![]).ending(Terminal::Timeout),
+        Script::lines(vec![init_line(MODEL, SESSION), error_result_line("")]),
+    ] {
+        let rig = rig(vec![script]);
+        rig.run(request(vec![user("hi")]));
+        let (path, _) = rig.seen().prompt_file.expect("a prompt file");
+        assert!(!path.exists());
+    }
+}
+
+#[test]
+fn the_provider_tag_is_claude_code() {
+    assert_eq!(rig(vec![]).backend.provider(), "claude-code");
+}
+
+// ---- the session store ----
+
+#[test]
+fn the_session_store_finds_only_canonical_session_files() {
+    let dir = TempDir::new();
+    let project = dir.path().join("projects").join("-work");
+    std::fs::create_dir_all(&project).unwrap();
+    std::fs::write(project.join(format!("{SESSION}.jsonl")), b"{}").unwrap();
+    std::fs::write(project.join(format!("{HEX_SESSION}.jsonl")), b"{}").unwrap();
+    // Files a loose check would find: one character short, one too long.
+    std::fs::write(project.join(format!("{}.jsonl", &SESSION[..35])), b"{}").unwrap();
+    std::fs::write(project.join(format!("{SESSION}0.jsonl")), b"{}").unwrap();
+    std::fs::write(dir.path().join("projects").join("secret.jsonl"), b"{}").unwrap();
+    let store = FsSessionStore::new(dir.path().to_path_buf());
+    assert!(store.exists(SESSION));
+    assert!(!store.exists(FORK));
+    assert!(!store.exists("secret"));
+    assert!(!store.exists("../secret"));
+    assert!(store.exists(HEX_SESSION));
+    assert!(!store.exists(&HEX_SESSION.to_uppercase()));
+    assert!(!store.exists("gggggggg-bbbb-cccc-dddd-eeeeeeeeeeee"));
+    assert!(!store.exists(&SESSION[..35]));
+    assert!(!store.exists(&format!("{SESSION}0")));
+    assert!(!store.exists("11111111_2222-3333-4444-555555555555"));
+    assert!(!FsSessionStore::new(dir.path().join("absent")).exists(SESSION));
+}
+
+// ---- real processes: a fake claude shell script (unix) ----
+
+struct TempDir(PathBuf);
+
+impl TempDir {
+    fn new() -> Self {
+        let path = std::env::temp_dir().join(format!(
+            "claude-connector-test-{}-{}",
+            std::process::id(),
+            DOOR_SEQUENCE.fetch_add(1, Ordering::SeqCst)
+        ));
+        std::fs::create_dir_all(&path).unwrap();
+        Self(path)
+    }
+    fn path(&self) -> &Path {
+        &self.0
+    }
+}
+
+impl Drop for TempDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+#[cfg(unix)]
+mod real {
+    use super::*;
+    use std::os::unix::fs::PermissionsExt;
+
+    /// Writing an executable and spawning it must not interleave with another
+    /// thread's fork (ETXTBSY), so every real-process test holds this.
+    static SPAWN_LOCK: Mutex<()> = Mutex::new(());
+
+    struct Fake {
+        _guard: std::sync::MutexGuard<'static, ()>,
+        dir: TempDir,
+        backend: ClaudeCodeBackend,
+        sink: Sink,
+    }
+
+    fn fake(body: &str, limits: ClaudeCodeLimits) -> Fake {
+        let guard = SPAWN_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let dir = TempDir::new();
+        let (work, cfg) = (dir.path().join("work"), dir.path().join("cfg"));
+        std::fs::create_dir_all(&work).unwrap();
+        std::fs::create_dir_all(&cfg).unwrap();
+        let binary = dir.path().join("claude");
+        std::fs::write(&binary, format!("#!/bin/sh\n{body}\n")).unwrap();
+        std::fs::set_permissions(&binary, std::fs::Permissions::from_mode(0o755)).unwrap();
+        let mut config = config(INSTANCE, limits);
+        config.claude_binary = binary;
+        config.work_dir = work;
+        config.config_dir = cfg;
+        let sink = Sink::default();
+        let backend = with_canary_token(ClaudeCodeBackend::new(config, Box::new(sink.clone())));
+        Fake {
+            _guard: guard,
+            dir,
+            backend,
+            sink,
+        }
+    }
+
+    impl Fake {
+        fn run(&self, request: ProviderRequest) -> TransportResult {
+            let mut door = Door::new();
+            let (claim, _) = door.begin(request);
+            self.backend.execute(claim.call())
+        }
+    }
+
+    fn printf_lines(lines: &[String]) -> String {
+        let quoted: Vec<String> = lines.iter().map(|l| format!("'{l}'")).collect();
+        format!("printf '%s\\n' {}", quoted.join(" "))
+    }
+
+    fn good_lines() -> Vec<String> {
+        vec![
+            init_line(MODEL, SESSION),
+            text_line("msg_1", "hi"),
+            result_line("end_turn", USAGE),
+        ]
+    }
+
+    fn alive(pid: &str) -> bool {
+        match std::fs::read_to_string(format!("/proc/{pid}/stat")) {
+            Ok(stat) => stat
+                .rsplit(')')
+                .next()
+                .is_some_and(|rest| !rest.trim_start().starts_with('Z')),
+            Err(_) => false,
+        }
+    }
+
+    #[test]
+    fn deadline_kills_the_process_group() {
+        let probe = TempDir::new();
+        let pidfile = probe.path().join("grandchild.pid");
+        let body = format!("sleep 300 &\necho $! > '{}'\nwait", pidfile.display());
+        let mut short = limits();
+        short.deadline = Duration::from_millis(700);
+        let fake = fake(&body, short);
+
+        let started = Instant::now();
+        let result = fake.run(request(vec![user("hi")]));
+        let (kind, _, usage) = failure_of(&result);
+        assert_eq!(kind, FailureKind::Timeout);
+        assert_eq!(usage, None);
+        assert!(started.elapsed() < Duration::from_secs(20));
+
+        let pid = std::fs::read_to_string(&pidfile)
+            .unwrap()
+            .trim()
+            .to_string();
+        assert!(!alive(&pid), "the grandchild {pid} outlived the call");
+    }
+
+    fn pid_in(file: &Path) -> String {
+        for _ in 0..200 {
+            if let Ok(pid) = std::fs::read_to_string(file)
+                && pid.ends_with('\n')
+            {
+                return pid.trim().to_string();
+            }
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        panic!("the fake claude never wrote its pid");
+    }
+
+    #[test]
+    fn the_child_is_reaped_when_the_call_ends() {
+        let probe = TempDir::new();
+        let pidfile = probe.path().join("child.pid");
+        let body = format!(
+            "echo $$ > '{}'\n{}",
+            pidfile.display(),
+            printf_lines(&good_lines())
+        );
+        let fake = fake(&body, limits());
+        let result = fake.run(request(vec![user("hi")]));
+        assert!(matches!(
+            outcome(&result),
+            TransportOutcome::Completed { .. }
+        ));
+        let pid = pid_in(&pidfile);
+        assert!(
+            !Path::new(&format!("/proc/{pid}")).exists(),
+            "the child {pid} was left unreaped"
+        );
+    }
+
+    #[test]
+    fn a_dropped_child_takes_its_group_with_it() {
+        let probe = TempDir::new();
+        let (leader, grandchild) = (
+            probe.path().join("leader.pid"),
+            probe.path().join("grandchild.pid"),
+        );
+        let body = format!(
+            "sleep 300 &\necho $! > '{}'\necho $$ > '{}'\nwait",
+            grandchild.display(),
+            leader.display()
+        );
+        let fake = fake(&body, limits());
+        let config = config(INSTANCE, limits());
+        let env = child_env(
+            &config,
+            &request(vec![user("x")]),
+            Zeroizing::new("t".to_string()),
+        );
+        let argv = vec![
+            fake.dir
+                .path()
+                .join("claude")
+                .to_string_lossy()
+                .into_owned(),
+        ];
+        let port = crate::process::StdProcessPort::new(limits());
+        let child = port
+            .spawn(&argv, &env, fake.dir.path(), Vec::new())
+            .unwrap();
+        let (leader_pid, grandchild_pid) = (pid_in(&leader), pid_in(&grandchild));
+        drop(child);
+        assert!(
+            !Path::new(&format!("/proc/{leader_pid}")).exists(),
+            "leader reaped"
+        );
+        assert!(
+            !alive(&grandchild_pid),
+            "the grandchild outlived the dropped child"
+        );
+    }
+
+    #[test]
+    fn stderr_stays_in_the_sink() {
+        let fake = fake("echo canary-stderr-text >&2\nexit 1", limits());
+        let result = fake.run(request(vec![user("hi")]));
+        let (kind, message, usage) = failure_of(&result);
+        assert_eq!(kind, FailureKind::Provider);
+        assert_eq!(usage, None);
+        assert!(!message.contains("canary-stderr-text"));
+        assert!(!format!("{result:?}").contains("canary-stderr-text"));
+        let sunk = String::from_utf8(fake.sink.0.lock().unwrap().clone()).unwrap();
+        assert!(sunk.contains("canary-stderr-text"), "{sunk:?}");
+    }
+
+    #[test]
+    fn the_real_port_clears_the_environment_and_delivers_stdin() {
+        static CANARY_PARENT: std::sync::Once = std::sync::Once::new();
+        CANARY_PARENT.call_once(|| {
+            // SAFETY: set once, before any child is spawned, to a value no test reads back.
+            unsafe { std::env::set_var("ANTHROPIC_API_KEY", "canary-api-key") };
+        });
+        let probe = TempDir::new();
+        let body = format!(
+            "env > '{d}/env'\npwd > '{d}/pwd'\ncat > '{d}/stdin'\n{}",
+            printf_lines(&good_lines()),
+            d = probe.path().display()
+        );
+        let fake = fake(&body, limits());
+        let result = fake.run(request(vec![user("hello")]));
+        assert!(matches!(
+            outcome(&result),
+            TransportOutcome::Completed { .. }
+        ));
+
+        let env = std::fs::read_to_string(probe.path().join("env")).unwrap();
+        assert!(!env.contains("canary-api-key") && !env.contains("ANTHROPIC_API_KEY"));
+        let mut names: Vec<&str> = env
+            .lines()
+            .filter_map(|l| l.split_once('=').map(|(n, _)| n))
+            // a shell adds these three to its own environment
+            .filter(|n| !matches!(*n, "PWD" | "OLDPWD" | "SHLVL" | "_"))
+            .collect();
+        names.sort();
+        assert_eq!(
+            names,
+            [
+                "CLAUDE_CODE_MAX_OUTPUT_TOKENS",
+                "CLAUDE_CODE_OAUTH_TOKEN",
+                "CLAUDE_CONFIG_DIR",
+                "HOME",
+                "PATH"
+            ]
+        );
+        assert!(env.contains(&format!("CLAUDE_CODE_OAUTH_TOKEN={CANARY_TOKEN}")));
+        let cwd = std::fs::read_to_string(probe.path().join("pwd")).unwrap();
+        assert_eq!(cwd.trim(), fake.dir.path().join("work").to_str().unwrap());
+        let stdin = std::fs::read_to_string(probe.path().join("stdin")).unwrap();
+        assert!(stdin.ends_with('\n') && stdin.matches('\n').count() == 1);
+        assert!(stdin.contains("\"text\":\"hello\""));
+    }
+
+    #[test]
+    fn the_output_caps_hold_at_their_exact_sizes() {
+        let lines = good_lines();
+        let longest = lines.iter().map(String::len).max().unwrap();
+        let total: usize = lines.iter().map(|l| l.len() + 1).sum();
+        let body = printf_lines(&lines);
+        let with = |line: usize, all: usize| ClaudeCodeLimits {
+            max_line_bytes: line,
+            max_total_bytes: all,
+            ..limits()
+        };
+
+        let at_both = fake(&body, with(longest, total)).run(request(vec![user("hi")]));
+        assert!(matches!(
+            outcome(&at_both),
+            TransportOutcome::Completed { .. }
+        ));
+
+        for (line, all) in [(longest - 1, total), (longest, total - 1)] {
+            let result = fake(&body, with(line, all)).run(request(vec![user("hi")]));
+            let (kind, _, usage) = failure_of(&result);
+            assert_eq!((kind, usage), (FailureKind::Provider, None), "{line} {all}");
+        }
+    }
+
+    #[test]
+    fn instructions_beyond_the_argument_limit_reach_the_child_in_a_private_file() {
+        // One argument is capped near 128 KiB on Linux; instructions are not.
+        let instructions = "i".repeat(300 * 1024);
+        let probe = TempDir::new();
+        let d = probe.path().display();
+        let body = format!(
+            "while [ $# -gt 0 ]; do\n\
+             if [ \"$1\" = --system-prompt-file ]; then\n\
+             cp \"$2\" '{d}/prompt'; stat -c %a \"$2\" > '{d}/mode'; echo \"$2\" > '{d}/path'\n\
+             fi\nshift\ndone\n{}",
+            printf_lines(&good_lines())
+        );
+        let fake = fake(&body, limits());
+        let mut big = request(vec![user("hi")]);
+        big.instructions = instructions.clone();
+        let result = fake.run(big);
+        assert!(matches!(
+            outcome(&result),
+            TransportOutcome::Completed { .. }
+        ));
+        assert_eq!(
+            std::fs::read_to_string(probe.path().join("prompt")).unwrap(),
+            instructions
+        );
+        assert_eq!(
+            std::fs::read_to_string(probe.path().join("mode"))
+                .unwrap()
+                .trim(),
+            "600"
+        );
+        let path = std::fs::read_to_string(probe.path().join("path")).unwrap();
+        assert!(!Path::new(path.trim()).exists(), "removed after the call");
+    }
+
+    #[test]
+    fn the_call_waits_for_the_child_to_close_stdout_after_its_result() {
+        // The CLI writes its session after the result; killing it at the
+        // result would lose the session a resume needs.
+        let probe = TempDir::new();
+        let body = format!(
+            "{}\nsleep 1\necho written > '{}/after-result'",
+            printf_lines(&good_lines()),
+            probe.path().display()
+        );
+        let result = fake(&body, limits()).run(request(vec![user("hi")]));
+        assert!(matches!(
+            outcome(&result),
+            TransportOutcome::Completed { .. }
+        ));
+        assert!(
+            probe.path().join("after-result").exists(),
+            "the child was killed before it finished"
+        );
+    }
+
+    #[test]
+    fn the_stderr_tail_is_complete_when_the_call_ends() {
+        let body = format!(
+            "head -c 300000 /dev/zero | tr '\\0' x >&2\necho END-OF-STDERR >&2\n{}",
+            printf_lines(&good_lines())
+        );
+        let fake = fake(&body, limits());
+        fake.run(request(vec![user("hi")]));
+        let sunk = String::from_utf8(fake.sink.0.lock().unwrap().clone()).unwrap();
+        assert!(sunk.trim_end().ends_with("END-OF-STDERR"), "{}", sunk.len());
+    }
+
+    #[test]
+    fn a_result_is_enough_even_if_the_child_keeps_stdout_open() {
+        let body = format!("{}\nexec sleep 300", printf_lines(&good_lines()));
+        let mut short = limits();
+        short.deadline = Duration::from_millis(500);
+        let result = fake(&body, short).run(request(vec![user("hi")]));
+        assert!(matches!(
+            outcome(&result),
+            TransportOutcome::Completed { .. }
+        ));
+    }
+}
diff --git a/crates/claude-connector/src/config.rs b/crates/claude-connector/src/config.rs
new file mode 100644
index 0000000..1dd0e8a
--- /dev/null
+++ b/crates/claude-connector/src/config.rs
@@ -0,0 +1,35 @@
+use std::path::PathBuf;
+use std::time::Duration;
+
+/// The provider tag the kit puts on every receipt and on the reasoning state
+/// of this backend. It is distinct from any Messages-API backend's tag, so the
+/// kit treats each backend's state as foreign to the other.
+pub(crate) const PROVIDER: &str = "claude-code";
+
+/// What the connector's binary hands the backend. Every path is absolute.
+#[derive(Debug, Clone)]
+pub struct ClaudeCodeConfig {
+    /// The `claude` executable.
+    pub claude_binary: PathBuf,
+    /// The SHA-256 the executable must have for [`ready`](model_connector::ProviderBackend::ready).
+    pub claude_binary_sha256: [u8; 32],
+    /// An empty directory the connector owns: the CLI writes its cwd, git state
+    /// and platform into the system prompt.
+    pub work_dir: PathBuf,
+    /// Passed to the child as `CLAUDE_CONFIG_DIR` and `HOME`; it holds the
+    /// CLI's session store.
+    pub config_dir: PathBuf,
+    /// The connector instance id written into every handle.
+    pub instance: String,
+    pub limits: ClaudeCodeLimits,
+}
+
+/// The bounds of one child process.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ClaudeCodeLimits {
+    /// The whole call, spawn to result.
+    pub deadline: Duration,
+    pub max_line_bytes: usize,
+    pub max_total_bytes: usize,
+    pub stderr_tail_bytes: usize,
+}
diff --git a/crates/claude-connector/src/handle.rs b/crates/claude-connector/src/handle.rs
new file mode 100644
index 0000000..c20fda0
--- /dev/null
+++ b/crates/claude-connector/src/handle.rs
@@ -0,0 +1,266 @@
+//! The reasoning state of this backend and the decision it drives: resume the
+//! CLI session a handle names, or start a fresh one seeded with the caller's
+//! transcript. The session is a cache of the caller's transcript; the
+//! transcript is the truth.
+
+use std::path::PathBuf;
+
+use model_connector::{InputItem, ProviderRequest};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+use crate::config::{ClaudeCodeConfig, PROVIDER};
+
+/// The state this backend hands a caller inside `ReasoningState`. A new
+/// variant is a new version.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) enum ClaudeCodeHandle {
+    /// The session a finished turn left behind. `prefix_sha256` is the digest
+    /// of the instructions, the model and every transcript item that precedes
+    /// this handle.
+    Ended {
+        session_id: String,
+        instance: String,
+        prefix_sha256: [u8; 32],
+    },
+}
+
+impl ClaudeCodeHandle {
+    pub(crate) fn encode(&self) -> Vec<u8> {
+        rmp_serde::to_vec_named(self).expect("a handle of strings and bytes encodes")
+    }
+
+    fn decode(state: &[u8]) -> Option<Self> {
+        rmp_serde::from_slice(state).ok()
+    }
+}
+
+/// The digest a handle binds: named MessagePack of the instructions, the model
+/// and the transcript items before the handle.
+pub(crate) fn prefix_digest(instructions: &str, model: &str, items: &[InputItem]) -> [u8; 32] {
+    let bytes =
+        rmp_serde::to_vec_named(&(instructions, model, items)).expect("strings and bytes encode");
+    Sha256::digest(bytes).into()
+}
+
+/// Whether the CLI's session store still holds a session.
+pub trait SessionStore: Send + Sync {
+    fn exists(&self, session_id: &str) -> bool;
+}
+
+/// Looks for `<config_dir>/projects/*/<session_id>.jsonl`. A session id that
+/// is not a canonical UUID never names a path.
+pub struct FsSessionStore {
+    config_dir: PathBuf,
+}
+
+impl FsSessionStore {
+    pub fn new(config_dir: PathBuf) -> Self {
+        Self { config_dir }
+    }
+}
+
+fn is_canonical_uuid(id: &str) -> bool {
+    id.len() == 36
+        && id.char_indices().all(|(at, c)| match at {
+            8 | 13 | 18 | 23 => c == '-',
+            _ => c.is_ascii_digit() || ('a'..='f').contains(&c),
+        })
+}
+
+impl SessionStore for FsSessionStore {
+    fn exists(&self, session_id: &str) -> bool {
+        if !is_canonical_uuid(session_id) {
+            return false;
+        }
+        let Ok(projects) = std::fs::read_dir(self.config_dir.join("projects")) else {
+            return false;
+        };
+        projects
+            .flatten()
+            .any(|project| project.path().join(format!("{session_id}.jsonl")).is_file())
+    }
+}
+
+/// Why a request cannot be answered by this backend; the text is the failure
+/// message and names what lifts it.
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum PlanError {
+    #[error("claude-code: tools are not supported by this backend yet")]
+    Tools,
+    #[error("claude-code: structured output is not supported by this backend yet")]
+    OutputSchema,
+    #[error("claude-code: tool results are not supported by this backend yet")]
+    ToolResult,
+    #[error("claude-code: the request ends without user text")]
+    NoUserText,
+    #[error("claude-code: the request carries a reasoning state this backend cannot read")]
+    UndecodableHandle,
+}
+
+/// How a call reaches the CLI. `blocks` are the text blocks of the one user
+/// message the child is given.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum Plan {
+    Resume {
+        session_id: String,
+        blocks: Vec<String>,
+    },
+    Seed {
+        blocks: Vec<String>,
+    },
+}
+
+impl Plan {
+    pub(crate) fn blocks(&self) -> &[String] {
+        match self {
+            Plan::Resume { blocks, .. } | Plan::Seed { blocks } => blocks,
+        }
+    }
+}
+
+pub(crate) fn plan(
+    request: &ProviderRequest,
+    config: &ClaudeCodeConfig,
+    sessions: &dyn SessionStore,
+) -> Result<Plan, PlanError> {
+    if !request.tools.is_empty() {
+        return Err(PlanError::Tools);
+    }
+    if request.output_schema_json.is_some() {
+        return Err(PlanError::OutputSchema);
+    }
+    let input = &request.input;
+    let run_start = input
+        .iter()
+        .rposition(|item| {
+            !matches!(
+                item,
+                InputItem::UserText { .. } | InputItem::ToolResult { .. }
+            )
+        })
+        .map_or(0, |at| at + 1);
+    let run = &input[run_start..];
+    if run
+        .iter()
+        .any(|item| matches!(item, InputItem::ToolResult { .. }))
+    {
+        return Err(PlanError::ToolResult);
+    }
+    let user_blocks: Vec<String> = run
+        .iter()
+        .filter_map(|item| match item {
+            InputItem::UserText { text } => Some(text.clone()),
+            _ => None,
+        })
+        .collect();
+    if user_blocks.is_empty() {
+        return Err(PlanError::NoUserText);
+    }
+
+    let last_own = input.iter().rposition(
+        |item| matches!(item, InputItem::ReasoningState { provider, .. } if provider == PROVIDER),
+    );
+    if let Some(at) = last_own {
+        let InputItem::ReasoningState { state, .. } = &input[at] else {
+            unreachable!("rposition matched a reasoning state");
+        };
+        let Some(ClaudeCodeHandle::Ended {
+            session_id,
+            instance,
+            prefix_sha256,
+        }) = ClaudeCodeHandle::decode(state)
+        else {
+            return Err(PlanError::UndecodableHandle);
+        };
+        let tail_is_user_text = input[at + 1..]
+            .iter()
+            .all(|item| matches!(item, InputItem::UserText { .. }));
+        let resumable = instance == config.instance
+            && tail_is_user_text
+            && prefix_sha256 == prefix_digest(&request.instructions, &request.model, &input[..at])
+            && sessions.exists(&session_id);
+        if resumable {
+            return Ok(Plan::Resume {
+                session_id,
+                blocks: user_blocks,
+            });
+        }
+    }
+
+    let mut blocks = Vec::new();
+    if let Some(transcript) = render_transcript(&input[..run_start]) {
+        blocks.push(transcript);
+    }
+    blocks.extend(user_blocks);
+    Ok(Plan::Seed { blocks })
+}
+
+/// The earlier conversation as one deterministic text, or `None` when nothing
+/// of it is renderable. Reasoning states are omitted.
+fn render_transcript(items: &[InputItem]) -> Option<String> {
+    let groups: Vec<String> = items
+        .iter()
+        .filter_map(|item| match item {
+            InputItem::UserText { text } => Some(format!("[user]\n{text}")),
+            InputItem::AssistantText { text } => Some(format!("[assistant]\n{text}")),
+            InputItem::ToolCall {
+                call_id,
+                name,
+                arguments,
+            } => Some(format!("[tool_call name={name} id={call_id}]\n{arguments}")),
+            InputItem::ToolResult { call_id, output } => {
+                Some(format!("[tool_result id={call_id}]\n{output}"))
+            }
+            InputItem::ReasoningState { .. } => None,
+        })
+        .collect();
+    if groups.is_empty() {
+        return None;
+    }
+    Some(format!(
+        "The conversation so far, replayed as text because the earlier session cannot be continued:\n\n{}",
+        groups.join("\n\n")
+    ))
+}
+
+#[derive(Serialize)]
+struct UserLine<'a> {
+    #[serde(rename = "type")]
+    kind: &'static str,
+    message: UserMessage<'a>,
+    parent_tool_use_id: Option<&'a str>,
+}
+
+#[derive(Serialize)]
+struct UserMessage<'a> {
+    role: &'static str,
+    content: Vec<TextBlock<'a>>,
+}
+
+#[derive(Serialize)]
+struct TextBlock<'a> {
+    #[serde(rename = "type")]
+    kind: &'static str,
+    text: &'a str,
+}
+
+/// The child's whole stdin: exactly one stream-json user line. Several lines
+/// would queue several turns.
+pub(crate) fn stdin_bytes(blocks: &[String]) -> Vec<u8> {
+    let line = UserLine {
+        kind: "user",
+        message: UserMessage {
+            role: "user",
+            content: blocks
+                .iter()
+                .map(|text| TextBlock { kind: "text", text })
+                .collect(),
+        },
+        parent_tool_use_id: None,
+    };
+    let mut bytes = serde_json::to_vec(&line).expect("typed strings encode");
+    bytes.push(b'\n');
+    bytes
+}
diff --git a/crates/claude-connector/src/launch.rs b/crates/claude-connector/src/launch.rs
new file mode 100644
index 0000000..22c8813
--- /dev/null
+++ b/crates/claude-connector/src/launch.rs
@@ -0,0 +1,148 @@
+//! The claude argv and the child environment: every flag and variable name
+//! this backend sends is a constant or built here, so a CLI upgrade is one
+//! place to re-probe.
+
+use std::fmt;
+use std::fs::OpenOptions;
+use std::io::{self, Write};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use model_connector::{ProviderRequest, ReasoningEffort};
+use zeroize::Zeroizing;
+
+use crate::config::ClaudeCodeConfig;
+use crate::handle::Plan;
+
+/// The one credential variable, copied by name from the connector's own
+/// environment into the child and nowhere else.
+pub(crate) const TOKEN_VAR: &str = "CLAUDE_CODE_OAUTH_TOKEN";
+const CHILD_PATH: &str = "/usr/local/bin:/usr/bin:/bin";
+
+/// The environment of the child: exactly these names and nothing inherited.
+/// Values are never formatted; `Debug` lists names only.
+pub struct ChildEnv(Vec<(&'static str, Zeroizing<String>)>);
+
+impl ChildEnv {
+    pub fn iter(&self) -> impl Iterator<Item = (&str, &str)> {
+        self.0.iter().map(|(name, value)| (*name, value.as_str()))
+    }
+}
+
+impl fmt::Debug for ChildEnv {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_list()
+            .entries(self.0.iter().map(|(name, _)| name))
+            .finish()
+    }
+}
+
+pub(crate) fn child_env(
+    config: &ClaudeCodeConfig,
+    request: &ProviderRequest,
+    token: Zeroizing<String>,
+) -> ChildEnv {
+    let config_dir = config.config_dir.to_string_lossy().into_owned();
+    ChildEnv(vec![
+        ("PATH", Zeroizing::new(CHILD_PATH.to_string())),
+        ("HOME", Zeroizing::new(config_dir.clone())),
+        ("CLAUDE_CONFIG_DIR", Zeroizing::new(config_dir)),
+        (
+            "CLAUDE_CODE_MAX_OUTPUT_TOKENS",
+            Zeroizing::new(request.max_output_tokens.to_string()),
+        ),
+        (TOKEN_VAR, token),
+    ])
+}
+
+/// The system prompt staged for one child: an exclusively created file only
+/// its owner can read, removed when this value drops, however the call ends.
+pub(crate) struct PromptFile(PathBuf);
+
+static PROMPT_FILES: AtomicU64 = AtomicU64::new(0);
+
+impl PromptFile {
+    pub(crate) fn create(instructions: &str) -> io::Result<Self> {
+        let name = format!(
+            "claude-connector-prompt-{}-{}",
+            std::process::id(),
+            PROMPT_FILES.fetch_add(1, Ordering::Relaxed)
+        );
+        let path = std::env::temp_dir().join(name);
+        let mut options = OpenOptions::new();
+        options.write(true).create_new(true);
+        #[cfg(unix)]
+        std::os::unix::fs::OpenOptionsExt::mode(&mut options, 0o600);
+        let mut file = options.open(&path)?;
+        let owned = Self(path);
+        file.write_all(instructions.as_bytes())?;
+        Ok(owned)
+    }
+
+    pub(crate) fn path(&self) -> &Path {
+        &self.0
+    }
+}
+
+impl Drop for PromptFile {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_file(&self.0);
+    }
+}
+
+fn effort(effort: ReasoningEffort) -> &'static str {
+    match effort {
+        ReasoningEffort::Low => "low",
+        ReasoningEffort::Medium => "medium",
+        ReasoningEffort::High => "high",
+        ReasoningEffort::Max => "max",
+    }
+}
+
+/// The program and its arguments. The system prompt is replaced, by a file
+/// rather than an argument because one argument is capped near 128 KiB
+/// (E2BIG) and instructions are not, the child has
+/// no tools, no MCP servers, no settings, no slash commands and nobody to ask
+/// for permission, and a resume always forks.
+pub(crate) fn argv(
+    config: &ClaudeCodeConfig,
+    request: &ProviderRequest,
+    plan: &Plan,
+    system_prompt_file: &Path,
+) -> Vec<String> {
+    let mut argv: Vec<String> = [
+        config.claude_binary.to_string_lossy().as_ref(),
+        "-p",
+        "--output-format",
+        "stream-json",
+        "--verbose",
+        "--input-format",
+        "stream-json",
+        "--model",
+        &request.model,
+        "--system-prompt-file",
+        &system_prompt_file.to_string_lossy(),
+        "--tools",
+        "",
+        "--strict-mcp-config",
+        "--setting-sources",
+        "",
+        "--disable-slash-commands",
+        "--permission-prompts",
+        "none",
+    ]
+    .into_iter()
+    .map(str::to_string)
+    .collect();
+    if let Some(level) = request.reasoning_effort {
+        argv.extend(["--effort".to_string(), effort(level).to_string()]);
+    }
+    if let Plan::Resume { session_id, .. } = plan {
+        argv.extend([
+            "--resume".to_string(),
+            session_id.clone(),
+            "--fork-session".to_string(),
+        ]);
+    }
+    argv
+}
diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs
new file mode 100644
index 0000000..28ad7f5
--- /dev/null
+++ b/crates/claude-connector/src/lib.rs
@@ -0,0 +1,19 @@
+//! The Claude backend of the connector kit. [`ClaudeCodeBackend`] answers each
+//! call by driving the unmodified `claude` binary once, in print mode with
+//! stream-json in and out, with every tool, MCP server, settings source and
+//! plugin switched off. A binary wires it to [`model_connector::serve`].
+
+mod backend;
+mod config;
+mod handle;
+mod launch;
+mod process;
+mod stream;
+
+pub use backend::{ClaudeCodeBackend, StderrSink};
+pub use config::{ClaudeCodeConfig, ClaudeCodeLimits};
+pub use handle::{FsSessionStore, SessionStore};
+pub use launch::ChildEnv;
+#[cfg(unix)]
+pub use process::StdProcessPort;
+pub use process::{ProcessPort, RunningChild, StdoutRead};
diff --git a/crates/claude-connector/src/process.rs b/crates/claude-connector/src/process.rs
new file mode 100644
index 0000000..450f388
--- /dev/null
+++ b/crates/claude-connector/src/process.rs
@@ -0,0 +1,232 @@
+//! The one OS seam: starting the child and reading its output.
+
+use std::io;
+use std::path::Path;
+use std::time::Instant;
+
+use crate::launch::ChildEnv;
+
+/// What one read of the child's stdout produced.
+#[derive(Debug, PartialEq, Eq)]
+pub enum StdoutRead {
+    /// One non-empty line, without its terminator.
+    Line(Vec<u8>),
+    /// The child closed its stdout.
+    Eof,
+    /// The deadline passed first.
+    Timeout,
+    /// A line or the total output passed its cap.
+    Breach,
+}
+
+/// Starts a `claude` child. `argv[0]` is the program; the environment is
+/// exactly `env`; `stdin` is written and closed.
+pub trait ProcessPort: Send + Sync {
+    fn spawn(
+        &self,
+        argv: &[String],
+        env: &ChildEnv,
+        cwd: &Path,
+        stdin: Vec<u8>,
+    ) -> io::Result<Box<dyn RunningChild>>;
+}
+
+/// A started child. The backend ends every child with `kill` then `wait`.
+pub trait RunningChild: Send {
+    fn read_line(&mut self, deadline: Instant) -> StdoutRead;
+    /// The last bytes the child wrote to stderr.
+    fn stderr_tail(&self) -> Vec<u8>;
+    /// Kills the child and everything it started.
+    fn kill(&mut self);
+    fn wait(&mut self);
+}
+
+#[cfg(unix)]
+pub use unix::StdProcessPort;
+
+#[cfg(unix)]
+mod unix {
+    use std::io::{self, BufRead, BufReader, Read, Write};
+    use std::os::unix::process::CommandExt;
+    use std::path::Path;
+    use std::process::{Child, Command, Stdio};
+    use std::sync::mpsc::{Receiver, RecvTimeoutError, channel};
+    use std::sync::{Arc, Mutex};
+    use std::thread;
+    use std::time::{Duration, Instant};
+
+    use super::{ProcessPort, RunningChild, StdoutRead};
+    use crate::config::ClaudeCodeLimits;
+    use crate::launch::ChildEnv;
+
+    /// Spawns each child in its own process group, so that killing the call
+    /// kills what the child started too.
+    pub struct StdProcessPort {
+        limits: ClaudeCodeLimits,
+    }
+
+    impl StdProcessPort {
+        pub fn new(limits: ClaudeCodeLimits) -> Self {
+            Self { limits }
+        }
+    }
+
+    impl ProcessPort for StdProcessPort {
+        fn spawn(
+            &self,
+            argv: &[String],
+            env: &ChildEnv,
+            cwd: &Path,
+            stdin: Vec<u8>,
+        ) -> io::Result<Box<dyn RunningChild>> {
+            let (program, args) = argv
+                .split_first()
+                .ok_or_else(|| io::Error::from(io::ErrorKind::InvalidInput))?;
+            let mut command = Command::new(program);
+            command
+                .args(args)
+                .env_clear()
+                .envs(env.iter())
+                .current_dir(cwd)
+                .stdin(Stdio::piped())
+                .stdout(Stdio::piped())
+                .stderr(Stdio::piped())
+                .process_group(0);
+            let mut child = command.spawn()?;
+            let (stdin_pipe, stdout, stderr) =
+                (child.stdin.take(), child.stdout.take(), child.stderr.take());
+
+            if let Some(mut pipe) = stdin_pipe {
+                thread::spawn(move || {
+                    let _ = pipe.write_all(&stdin);
+                });
+            }
+
+            let (lines, receiver) = channel();
+            if let Some(stdout) = stdout {
+                let limits = self.limits;
+                thread::spawn(move || {
+                    let mut reader = BufReader::new(stdout);
+                    let mut total = 0usize;
+                    loop {
+                        let mut line = Vec::new();
+                        let read = reader
+                            .by_ref()
+                            .take(limits.max_line_bytes as u64 + 1)
+                            .read_until(b'\n', &mut line);
+                        let Ok(read) = read else { break };
+                        if read == 0 {
+                            break;
+                        }
+                        total = total.saturating_add(read);
+                        let terminated = line.last() == Some(&b'\n');
+                        if terminated {
+                            line.pop();
+                        }
+                        if line.last() == Some(&b'\r') {
+                            line.pop();
+                        }
+                        if line.len() > limits.max_line_bytes || total > limits.max_total_bytes {
+                            let _ = lines.send(Piece::Breach);
+                            return;
+                        }
+                        if !line.is_empty() && lines.send(Piece::Line(line)).is_err() {
+                            return;
+                        }
+                    }
+                });
+            }
+
+            let tail = Arc::new(Mutex::new(Vec::new()));
+            let stderr_reader = stderr.map(|mut stderr| {
+                let (tail, keep) = (tail.clone(), self.limits.stderr_tail_bytes);
+                thread::spawn(move || {
+                    let mut chunk = [0u8; 4096];
+                    while let Ok(read) = stderr.read(&mut chunk) {
+                        if read == 0 {
+                            break;
+                        }
+                        let mut held = tail.lock().unwrap_or_else(|e| e.into_inner());
+                        held.extend_from_slice(&chunk[..read]);
+                        let excess = held.len().saturating_sub(keep);
+                        held.drain(..excess);
+                    }
+                })
+            });
+
+            Ok(Box::new(StdChild {
+                child,
+                receiver,
+                tail,
+                stderr_reader,
+                reaped: false,
+            }))
+        }
+    }
+
+    enum Piece {
+        Line(Vec<u8>),
+        Breach,
+    }
+
+    struct StdChild {
+        child: Child,
+        receiver: Receiver<Piece>,
+        tail: Arc<Mutex<Vec<u8>>>,
+        stderr_reader: Option<thread::JoinHandle<()>>,
+        reaped: bool,
+    }
+
+    impl RunningChild for StdChild {
+        fn read_line(&mut self, deadline: Instant) -> StdoutRead {
+            match self
+                .receiver
+                .recv_timeout(deadline.saturating_duration_since(Instant::now()))
+            {
+                Ok(Piece::Line(line)) => StdoutRead::Line(line),
+                Ok(Piece::Breach) => StdoutRead::Breach,
+                Err(RecvTimeoutError::Timeout) => StdoutRead::Timeout,
+                Err(RecvTimeoutError::Disconnected) => StdoutRead::Eof,
+            }
+        }
+
+        fn stderr_tail(&self) -> Vec<u8> {
+            self.tail.lock().unwrap_or_else(|e| e.into_inner()).clone()
+        }
+
+        fn kill(&mut self) {
+            // The group leader stays a zombie until `wait`, so its pid is
+            // still ours to signal.
+            if !self.reaped {
+                // SAFETY: killpg takes a process group id and no pointers.
+                unsafe {
+                    libc::killpg(self.child.id() as libc::pid_t, libc::SIGKILL);
+                }
+            }
+        }
+
+        fn wait(&mut self) {
+            let _ = self.child.wait();
+            self.reaped = true;
+            // Every writer to stderr died with the group, so the tail is
+            // complete once its reader sees the end. A process that escaped
+            // the group is not waited for.
+            if let Some(reader) = self.stderr_reader.take() {
+                for _ in 0..100 {
+                    if reader.is_finished() {
+                        let _ = reader.join();
+                        break;
+                    }
+                    thread::sleep(Duration::from_millis(2));
+                }
+            }
+        }
+    }
+
+    impl Drop for StdChild {
+        fn drop(&mut self) {
+            self.kill();
+            self.wait();
+        }
+    }
+}
diff --git a/crates/claude-connector/src/stream.rs b/crates/claude-connector/src/stream.rs
new file mode 100644
index 0000000..7bb336b
--- /dev/null
+++ b/crates/claude-connector/src/stream.rs
@@ -0,0 +1,295 @@
+//! Reading the CLI's stream-json output. The format is foreign and moves with
+//! the CLI, so every struct here ignores fields it does not name.
+
+use std::collections::BTreeMap;
+
+use model_connector::{FailureKind, StopReason, Usage};
+use serde::Deserialize;
+use serde_json::Value;
+
+/// A call that cannot complete, with the stage that failed. `usage` is `None`
+/// unless a result event reported it.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct Failure {
+    pub kind: FailureKind,
+    pub message: &'static str,
+    pub usage: Option<Usage>,
+}
+
+impl Failure {
+    pub(crate) fn unbilled(kind: FailureKind, message: &'static str) -> Self {
+        Self {
+            kind,
+            message,
+            usage: None,
+        }
+    }
+}
+
+/// What the stream said, once its result event arrived.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct Finished {
+    pub session_id: String,
+    /// The non-empty text blocks, in order.
+    pub texts: Vec<String>,
+    /// The id of the last assistant message.
+    pub message_id: Option<String>,
+    pub stop_reason: StopReason,
+    pub usage: Usage,
+}
+
+pub(crate) enum Step {
+    More,
+    Done(Box<Result<Finished, Failure>>),
+}
+
+#[derive(Deserialize)]
+struct Line {
+    #[serde(rename = "type")]
+    kind: String,
+    subtype: Option<String>,
+    session_id: Option<String>,
+    model: Option<String>,
+    message: Option<Message>,
+    rate_limit_info: Option<RateLimitInfo>,
+    is_error: Option<bool>,
+    stop_reason: Option<String>,
+    api_error_status: Option<Value>,
+    result: Option<Value>,
+    errors: Option<Value>,
+    /// What this turn alone consumed. `modelUsage` is deliberately not read:
+    /// on a resumed session it carries every earlier turn too.
+    model_usage_since_last_result: Option<Value>,
+}
+
+#[derive(Deserialize)]
+struct Message {
+    id: Option<String>,
+    content: Option<Vec<Block>>,
+}
+
+#[derive(Deserialize)]
+struct Block {
+    #[serde(rename = "type")]
+    kind: String,
+    text: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct RateLimitInfo {
+    status: Option<String>,
+}
+
+/// One model's entry. The four counts are required: an entry that lacks one
+/// is a shape this reader does not know, and unknown usage is never zero.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ModelUsage {
+    input_tokens: u64,
+    output_tokens: u64,
+    cache_read_input_tokens: u64,
+    cache_creation_input_tokens: u64,
+    thinking_tokens: Option<u64>,
+}
+
+/// One call's stream, line by line.
+pub(crate) struct StreamState<'a> {
+    model: &'a str,
+    session_id: Option<String>,
+    texts: Vec<String>,
+    message_id: Option<String>,
+    plan_rejected: bool,
+}
+
+impl<'a> StreamState<'a> {
+    pub(crate) fn new(model: &'a str) -> Self {
+        Self {
+            model,
+            session_id: None,
+            texts: Vec::new(),
+            message_id: None,
+            plan_rejected: false,
+        }
+    }
+
+    pub(crate) fn feed(&mut self, raw: &[u8]) -> Step {
+        let Ok(line) = serde_json::from_slice::<Line>(raw) else {
+            return fail(
+                FailureKind::Provider,
+                "claude-code: a stream line did not parse",
+            );
+        };
+        match line.kind.as_str() {
+            "system" => match line.subtype.as_deref() {
+                Some("init") => {
+                    if line.model.as_deref() != Some(self.model) {
+                        return fail(
+                            FailureKind::Provider,
+                            "claude-code: the session model differs from the request",
+                        );
+                    }
+                    self.session_id = line.session_id;
+                    Step::More
+                }
+                Some("compact_boundary") => fail(
+                    FailureKind::Provider,
+                    "claude-code: the session was compacted",
+                ),
+                _ => Step::More,
+            },
+            "assistant" => self.assistant(line.message),
+            "rate_limit_event" => {
+                self.plan_rejected |= line
+                    .rate_limit_info
+                    .and_then(|info| info.status)
+                    .is_some_and(|status| status == "rejected");
+                Step::More
+            }
+            "result" => Step::Done(Box::new(self.result(line))),
+            _ => Step::More,
+        }
+    }
+
+    fn assistant(&mut self, message: Option<Message>) -> Step {
+        let Some(message) = message else {
+            return Step::More;
+        };
+        if message.id.is_some() {
+            self.message_id = message.id;
+        }
+        for block in message.content.unwrap_or_default() {
+            match block.kind.as_str() {
+                "text" => {
+                    if let Some(text) = block.text.filter(|text| !text.is_empty()) {
+                        self.texts.push(text);
+                    }
+                }
+                "tool_use" => {
+                    return fail(
+                        FailureKind::Provider,
+                        "claude-code: the model called a tool in a tool-less turn",
+                    );
+                }
+                _ => {}
+            }
+        }
+        Step::More
+    }
+
+    fn result(&mut self, line: Line) -> Result<Finished, Failure> {
+        let success = line.subtype.as_deref() == Some("success") && line.is_error == Some(false);
+        let door_refusal = !success
+            && matches!(
+                line.api_error_status.as_ref().and_then(Value::as_u64),
+                Some(401 | 403)
+            );
+        let usage = read_usage(line.model_usage_since_last_result, door_refusal);
+        if !success {
+            return Err(Failure {
+                kind: self.error_kind(&line.api_error_status, &line.result, &line.errors),
+                message: "claude-code: the result reported an error",
+                usage,
+            });
+        }
+        let Some(usage) = usage else {
+            return Err(Failure {
+                kind: FailureKind::Provider,
+                message: "claude-code: the result did not report usable usage",
+                usage: None,
+            });
+        };
+        let stop_reason = match line.stop_reason.as_deref() {
+            Some("end_turn") => StopReason::EndTurn,
+            Some("max_tokens") => StopReason::MaxOutputTokens,
+            Some("stop_sequence") => StopReason::StopSequence,
+            Some("refusal") => StopReason::Refusal,
+            Some("model_context_window_exceeded") => StopReason::ContextWindow,
+            _ => {
+                return Err(Failure {
+                    kind: FailureKind::Provider,
+                    message: "claude-code: the result has an unknown stop reason",
+                    usage: Some(usage),
+                });
+            }
+        };
+        let Some(session_id) = self.session_id.take() else {
+            return Err(Failure {
+                kind: FailureKind::Provider,
+                message: "claude-code: the stream never announced its session",
+                usage: Some(usage),
+            });
+        };
+        Ok(Finished {
+            session_id,
+            texts: std::mem::take(&mut self.texts),
+            message_id: self.message_id.take(),
+            stop_reason,
+            usage,
+        })
+    }
+
+    fn error_kind(
+        &self,
+        status: &Option<Value>,
+        result: &Option<Value>,
+        errors: &Option<Value>,
+    ) -> FailureKind {
+        let status = status.as_ref().and_then(Value::as_u64);
+        let names_rate_limit = [result, errors].into_iter().flatten().any(|value| {
+            let text = value.to_string().to_lowercase();
+            text.contains("rate limit") || text.contains("rate_limit")
+        });
+        match status {
+            _ if self.plan_rejected || names_rate_limit || status == Some(429) => {
+                FailureKind::RateLimited
+            }
+            Some(401 | 403) => FailureKind::Authentication,
+            Some(400) => FailureKind::InvalidRequest,
+            Some(500..=599) => FailureKind::Unavailable,
+            _ => FailureKind::Provider,
+        }
+    }
+}
+
+fn fail(kind: FailureKind, message: &'static str) -> Step {
+    Step::Done(Box::new(Err(Failure::unbilled(kind, message))))
+}
+
+/// What this turn consumed, summed over every model it used (harness side
+/// calls included), or `None` when the result does not say: the field absent,
+/// of another shape, or empty. An empty report is believed only for a refusal
+/// at the door (401 or 403), which the provider cannot have billed; elsewhere
+/// the CLI also zeroes usage on crashes after real work. `None` is billed the
+/// reservation by the kit.
+fn read_usage(reported: Option<Value>, door_refusal: bool) -> Option<Usage> {
+    let models: BTreeMap<String, ModelUsage> = serde_json::from_value(reported?).ok()?;
+    if models.is_empty() {
+        return door_refusal.then(|| sum_usage(std::iter::empty()));
+    }
+    Some(sum_usage(models.into_values()))
+}
+
+fn sum_usage(models: impl Iterator<Item = ModelUsage>) -> Usage {
+    let mut usage = Usage {
+        input_tokens: 0,
+        cache_read_tokens: 0,
+        cache_write_tokens: 0,
+        output_tokens: 0,
+        reasoning_tokens: None,
+    };
+    for model in models {
+        usage.input_tokens = usage.input_tokens.saturating_add(model.input_tokens);
+        usage.cache_read_tokens = usage
+            .cache_read_tokens
+            .saturating_add(model.cache_read_input_tokens);
+        usage.cache_write_tokens = usage
+            .cache_write_tokens
+            .saturating_add(model.cache_creation_input_tokens);
+        usage.output_tokens = usage.output_tokens.saturating_add(model.output_tokens);
+        if let Some(thinking) = model.thinking_tokens {
+            usage.reasoning_tokens =
+                Some(usage.reasoning_tokens.unwrap_or(0).saturating_add(thinking));
+        }
+    }
+    usage
+}