diff --git a/platform/cluster/flux/apps/agents/README.md b/platform/cluster/flux/apps/agents/README.md
index 129c7ed7..ab927db8 100644
--- a/platform/cluster/flux/apps/agents/README.md
+++ b/platform/cluster/flux/apps/agents/README.md
@@ -23,12 +23,17 @@ via `nodeSelector: personal-stack/node: enschede-gtx-960m-1`. RWO
 permits multiple Pods on that single node to mount the volume
 simultaneously, so concurrent per-workspace runners + the long-lived
 bootstrap Pod + the refresh-ping CronJob still work, as long as they
-all land on the same node. The orchestrator default and every
+all land on the same node. The runner Pods also require
+`personal-stack/capability-docker-socket=true` because they mount
+that node's `/var/run/docker.sock` for Docker CLI and Testcontainers
+workflows. That mount is host-equivalent access; the namespace
+enforces Pod Security `privileged` explicitly because `baseline`
+forbids hostPath sockets. The orchestrator default and every
 manifest in this directory hard-codes that node; moving the agent
 host means flipping the selector in five places (the credential
 PVCs, the auth-bootstrap Pod, the refresh-ping and kb-install
 CronJobs, and the `AGENT_RUNTIME_NODE` env on the assistant-api
-Deployment).
+Deployment), plus the Docker socket gid and runner egress node IP.
 
 ## First-time auth bootstrap
 
diff --git a/platform/cluster/flux/apps/agents/namespace.yaml b/platform/cluster/flux/apps/agents/namespace.yaml
index 6a9028c9..6cfed8d6 100644
--- a/platform/cluster/flux/apps/agents/namespace.yaml
+++ b/platform/cluster/flux/apps/agents/namespace.yaml
@@ -6,10 +6,19 @@
 # NetworkPolicy uses the `app.kubernetes.io/part-of: agent-runner`
 # label to segregate runner egress from the bootstrap Pod's broader
 # allowance.
+#
+# Runner Pods intentionally mount /var/run/docker.sock so future
+# agent sessions can run Docker CLI commands and JVM Testcontainers
+# suites. That hostPath is host-equivalent access and violates the
+# baseline Pod Security profile, so this namespace enforces
+# `privileged` explicitly instead of failing admission by accident.
+# The compensating controls are node capability pinning, no projected
+# runner ServiceAccount token, and the runner NetworkPolicy below.
 apiVersion: v1
 kind: Namespace
 metadata:
   name: agents-system
   labels:
-    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted
diff --git a/platform/cluster/flux/apps/agents/network-policy/runner-egress.yaml b/platform/cluster/flux/apps/agents/network-policy/runner-egress.yaml
index a28e6a23..98e67cf9 100644
--- a/platform/cluster/flux/apps/agents/network-policy/runner-egress.yaml
+++ b/platform/cluster/flux/apps/agents/network-policy/runner-egress.yaml
@@ -97,6 +97,19 @@ spec:
       ports:
         - protocol: TCP
           port: 8082
+    # Testcontainers callback ports. The runner talks to the host Docker
+    # daemon through /var/run/docker.sock; containers started by that daemon
+    # expose random high ports on the node IP advertised through
+    # status.hostIP/TESTCONTAINERS_HOST_OVERRIDE. Keep this to the one
+    # Docker-socket-capable node from platform/inventory/fleet.yaml rather
+    # than reopening private RFC1918 egress generally.
+    - to:
+        - ipBlock:
+            cidr: 100.89.41.92/32
+      ports:
+        - protocol: TCP
+          port: 32768
+          endPort: 65535
     # Outbound HTTPS — needed for Anthropic, OpenAI, GitHub. Re-tighten
     # once an L7 gateway lands.
     - to:
diff --git a/platform/cluster/flux/apps/stateless/assistant-api/deployment-enschede-ws.yaml b/platform/cluster/flux/apps/stateless/assistant-api/deployment-enschede-ws.yaml
index e41ed3f2..c89c2d5e 100644
--- a/platform/cluster/flux/apps/stateless/assistant-api/deployment-enschede-ws.yaml
+++ b/platform/cluster/flux/apps/stateless/assistant-api/deployment-enschede-ws.yaml
@@ -194,6 +194,9 @@ spec:
             # Runner Pods must co-locate with the credential PVCs.
             - name: AGENT_RUNTIME_NODE
               value: enschede-gtx-960m-1
+            # Must match users.groups.docker.gid on the selected Nix host.
+            - name: AGENT_RUNTIME_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS
+              value: '131'
             # Read-only GitHub token for the deploy-key branch-protection
             # check. Sourced from the github-api-token Secret (key
             # `token`), which a VaultStaticSecret projects from Vault —
diff --git a/platform/cluster/flux/apps/stateless/assistant-api/deployment.yaml b/platform/cluster/flux/apps/stateless/assistant-api/deployment.yaml
index 1d428d84..c3685f05 100644
--- a/platform/cluster/flux/apps/stateless/assistant-api/deployment.yaml
+++ b/platform/cluster/flux/apps/stateless/assistant-api/deployment.yaml
@@ -182,6 +182,9 @@ spec:
             # Runner Pods must co-locate with the credential PVCs.
             - name: AGENT_RUNTIME_NODE
               value: enschede-gtx-960m-1
+            # Must match users.groups.docker.gid on the selected Nix host.
+            - name: AGENT_RUNTIME_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS
+              value: '131'
             # Read-only GitHub token for the deploy-key branch-protection
             # check. Sourced from the github-api-token Secret (key
             # `token`), which a VaultStaticSecret projects from Vault —
diff --git a/platform/inventory/fleet.yaml b/platform/inventory/fleet.yaml
index 409e85f5..5a7def14 100644
--- a/platform/inventory/fleet.yaml
+++ b/platform/inventory/fleet.yaml
@@ -80,6 +80,10 @@ nodes:
       - tailscale
       - lan-ingress
       - game-streaming
+      # agent-runner Pods mount this node's /var/run/docker.sock for
+      # Docker/Testcontainers. The matching k3s label is required by
+      # assistant-api before scheduling host-equivalent runner Pods here.
+      - docker-socket
       - nvidia
 
   enschede-t1000-1:
diff --git a/platform/nix/hosts/enschede-gtx-960m-1/default.nix b/platform/nix/hosts/enschede-gtx-960m-1/default.nix
index bb988358..f4c49c22 100644
--- a/platform/nix/hosts/enschede-gtx-960m-1/default.nix
+++ b/platform/nix/hosts/enschede-gtx-960m-1/default.nix
@@ -26,6 +26,7 @@
     "personal-stack/capability-tailscale" = "true";
     "personal-stack/capability-lan-ingress" = "true";
     "personal-stack/capability-game-streaming" = "true";
+    "personal-stack/capability-docker-socket" = "true";
     # capability-samba deliberately absent: the media drive (/srv/media)
     # is mounted on enschede-t1000-1, not here.
     # capability-adguard deliberately absent: AdGuard runs only on
@@ -35,5 +36,21 @@
     "personal-stack/gpu-model-gtx960m" = "true";
     "personal-stack/gpu-class-transcode" = "true";
   };
+  # Keep Testcontainers' status.hostIP callback stable and aligned with the
+  # runner NetworkPolicy's single allowed node IP.
+  services.k3s.extraFlags = [ "--node-ip=100.89.41.92" ];
+  # Testcontainers maps container ports onto random high ports on the host
+  # Docker daemon. Runner Pods reach those through status.hostIP, so allow
+  # callbacks from the pod bridge only; do not expose the range on LAN/tailnet.
+  networking.firewall.interfaces."cni0".allowedTCPPortRanges = [
+    {
+      from = 32768;
+      to = 65535;
+    }
+  ];
+  # Docker's socket group must be a repo-declared value, not a guessed
+  # distro default. assistant-api injects the same gid into runner Pods via
+  # AGENT_RUNTIME_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS.
+  users.groups.docker.gid = 131;
   system.stateVersion = "25.05";
 }
diff --git a/platform/tooling/src/test/kotlin/com/jorisjonkers/personalstack/platform/PlatformAgentMcpFluxTest.kt b/platform/tooling/src/test/kotlin/com/jorisjonkers/personalstack/platform/PlatformAgentMcpFluxTest.kt
index 1169e9ea..57c82e66 100644
--- a/platform/tooling/src/test/kotlin/com/jorisjonkers/personalstack/platform/PlatformAgentMcpFluxTest.kt
+++ b/platform/tooling/src/test/kotlin/com/jorisjonkers/personalstack/platform/PlatformAgentMcpFluxTest.kt
@@ -39,6 +39,82 @@ class PlatformAgentMcpFluxTest {
             .contains("port: 8082")
     }
 
+    @Test
+    fun `agents namespace explicitly admits docker socket runner pods`() {
+        val namespace =
+            repositoryRoot
+                .resolve("platform/cluster/flux/apps/agents/namespace.yaml")
+                .toFile()
+                .readText()
+
+        assertThat(namespace)
+            .contains("mount /var/run/docker.sock")
+            .contains("host-equivalent access")
+            .contains("pod-security.kubernetes.io/enforce: privileged")
+            .contains("pod-security.kubernetes.io/audit: restricted")
+            .contains("pod-security.kubernetes.io/warn: restricted")
+    }
+
+    @Test
+    fun `runner egress allows only docker node high ports for testcontainers callbacks`() {
+        val manifest =
+            repositoryRoot
+                .resolve("platform/cluster/flux/apps/agents/network-policy/runner-egress.yaml")
+                .toFile()
+                .readText()
+
+        assertThat(manifest)
+            .contains("TESTCONTAINERS_HOST_OVERRIDE")
+            .contains("cidr: 100.89.41.92/32")
+            .contains("port: 32768")
+            .contains("endPort: 65535")
+    }
+
+    @Test
+    fun `agent runner docker socket node capability and gid are pinned in platform config`() {
+        val inventory = repositoryRoot.resolve("platform/inventory/fleet.yaml").toFile().readText()
+        val host =
+            repositoryRoot
+                .resolve("platform/nix/hosts/enschede-gtx-960m-1/default.nix")
+                .toFile()
+                .readText()
+        val appConfig =
+            repositoryRoot
+                .resolve("services/assistant-api/src/main/resources/application.yml")
+                .toFile()
+                .readText()
+        val assistantApiDeployment =
+            repositoryRoot
+                .resolve("platform/cluster/flux/apps/stateless/assistant-api/deployment.yaml")
+                .toFile()
+                .readText()
+        val assistantApiWsDeployment =
+            repositoryRoot
+                .resolve("platform/cluster/flux/apps/stateless/assistant-api/deployment-enschede-ws.yaml")
+                .toFile()
+                .readText()
+
+        assertThat(inventory).contains("- docker-socket")
+        assertThat(host)
+            .contains("\"personal-stack/capability-docker-socket\" = \"true\"")
+            .contains("--node-ip=100.89.41.92")
+            .contains("networking.firewall.interfaces.\"cni0\".allowedTCPPortRanges")
+            .contains("to = 65535;")
+            .contains("users.groups.docker.gid = 131;")
+        assertThat(appConfig)
+            .contains("docker-socket-supplemental-groups: \${AGENT_RUNTIME_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS:131}")
+            .contains(
+                "'[personal-stack/capability-docker-socket]': " +
+                    "\${AGENT_RUNTIME_DOCKER_SOCKET_CAPABILITY:true}",
+            )
+        assertThat(assistantApiDeployment)
+            .contains("name: AGENT_RUNTIME_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS")
+            .contains("value: '131'")
+        assertThat(assistantApiWsDeployment)
+            .contains("name: AGENT_RUNTIME_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS")
+            .contains("value: '131'")
+    }
+
     @Test
     fun `agent runner wires github app token into gh github mcp and git push`() {
         val dockerfile =
@@ -73,6 +149,11 @@ class PlatformAgentMcpFluxTest {
                 .readText()
 
         assertThat(dockerfile)
+            .contains("docker-ce-cli")
+            .contains("docker-buildx-plugin")
+            .contains("docker-compose-plugin")
+            .contains("docker --version >/dev/null")
+            .contains("docker compose version >/dev/null")
             .contains("agent-github-token.sh /usr/local/bin/agent-github-token")
             .contains("gh-app-token-wrapper.sh /usr/local/bin/gh")
             .contains("git-credential-agent-gh-app.sh /usr/local/bin/git-credential-agent-gh-app")
@@ -91,6 +172,8 @@ class PlatformAgentMcpFluxTest {
             // Multi-repo: clone every REPO_URLS entry and bound the credential
             // helper to the workspace's repos via REPO_ALLOW.
             .contains("REPO_URLS")
+            .contains("clone_repo_into_workspace \"${'$'}REPO_URL\"")
+            .contains("_repo_target=\"${'$'}{WORKSPACE_ROOT}/${'$'}{_repo_name}\"")
             .contains("export REPO_ALLOW")
             .contains("register_repo_trust")
 
@@ -152,6 +235,12 @@ class PlatformAgentMcpFluxTest {
         assertThat(orchestrator)
             .contains("withName(\"AGENT_MCP_PROFILE\")")
             .contains("props.defaultMcpProfile")
+            .contains("DOCKER_HOST")
+            .contains("TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE")
+            .contains("TESTCONTAINERS_HOST_OVERRIDE")
+            .contains("withNewHostPath()")
+            .contains("withType(\"Socket\")")
+            .contains("withSupplementalGroups(podSupplementalGroups())")
         assertThat(entrypoint)
             .contains("AGENT_MCP_PROFILE=\"\${AGENT_MCP_PROFILE:-minimal}\"")
             .contains("claude-mcp-servers.\${AGENT_MCP_PROFILE}.json")
diff --git a/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/config/GatewayProperties.kt b/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/config/GatewayProperties.kt
index cf6f0be1..a158cdae 100644
--- a/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/config/GatewayProperties.kt
+++ b/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/config/GatewayProperties.kt
@@ -2,6 +2,9 @@ package com.jorisjonkers.personalstack.agentgateway.config
 
 import org.springframework.boot.context.properties.ConfigurationProperties
 
+private const val DEFAULT_LOG_CAP_BYTES = 8L * 1024 * 1024
+private const val DEFAULT_STAGED_INPUT_MAX_BYTES = 5L * 1024 * 1024
+
 @ConfigurationProperties(prefix = "agent-gateway")
 data class GatewayProperties(
     val workspaceRoot: String,
@@ -19,17 +22,18 @@ data class GatewayProperties(
         // The pipe-pane log is only a streaming conduit (the live screen
         // lives in tmux, scrollback in the browser), so it is truncated
         // once it outgrows this cap to keep the runner disk bounded.
-        val logCapBytes: Long = 8L * 1024 * 1024,
+        val logCapBytes: Long = DEFAULT_LOG_CAP_BYTES,
         val logTrimIntervalSeconds: Long = 30,
     )
 
     data class Cli(
         val claude: String,
         val codex: String,
-        // The runner container is the sandbox (unprivileged user, only a
-        // git deploy key, no host access), so the CLIs launch with every
-        // approval/permission/sandbox prompt bypassed. Kept as config so a
-        // flag rename upstream is a redeploy-free value flip.
+        // The runner Pod is the outer sandbox. Docker-socket-enabled runners
+        // are host-equivalent by design for Docker/Testcontainers, while the
+        // CLIs still launch with every approval/permission/sandbox prompt
+        // bypassed. Kept as config so a flag rename upstream is a
+        // redeploy-free value flip.
         val claudeArgs: List<String> = emptyList(),
         val codexArgs: List<String> = emptyList(),
     )
@@ -40,6 +44,6 @@ data class GatewayProperties(
 
     data class StagedInputs(
         val dirName: String = ".agent-inputs",
-        val maxBytes: Long = 5L * 1024 * 1024,
+        val maxBytes: Long = DEFAULT_STAGED_INPUT_MAX_BYTES,
     )
 }
diff --git a/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/git/GitClient.kt b/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/git/GitClient.kt
index 545d4391..eebc5381 100644
--- a/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/git/GitClient.kt
+++ b/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/git/GitClient.kt
@@ -14,8 +14,10 @@ import kotlin.io.path.Path
  * Wraps git + gh for the runner. The deploy key lives at
  * `agent-gateway.git.deploy-key-dir/private_key`; this client
  * materialises it into a private file with 0600 and exports
- * GIT_SSH_COMMAND so every clone/push uses it without polluting
- * ~/.ssh.
+ * GIT_SSH_COMMAND so SSH operations can use it without polluting
+ * ~/.ssh. Runner boot also rewrites GitHub SSH remotes to HTTPS,
+ * so live clones carry a one-repo App-token allow-list for the
+ * credential helper.
  *
  * `gh` is used for the PR open step because issuing a PAT for the
  * agent would be a wider blast radius than the per-repo deploy key
@@ -39,6 +41,10 @@ class GitClient(
         intoDir: String,
         branch: String? = null,
     ): String {
+        val target = Path(intoDir)
+        if (Files.isDirectory(target.resolve(".git"))) {
+            return intoDir
+        }
         val argv =
             mutableListOf("git", "clone", "--depth", "50").apply {
                 if (branch != null) {
@@ -48,7 +54,7 @@ class GitClient(
                 add(repoUrl)
                 add(intoDir)
             }
-        runner.run(argv, env = sshEnv(), timeoutSeconds = 300)
+        runner.run(argv, env = cloneEnv(repoUrl), timeoutSeconds = 300)
         return intoDir
     }
 
@@ -213,6 +219,24 @@ class GitClient(
         return mapOf("GIT_SSH_COMMAND" to sshOpts)
     }
 
+    private fun cloneEnv(repoUrl: String): Map<String, String> =
+        sshEnv().toMutableMap().also { env ->
+            env["AGENT_GITHUB_REPO_URL"] = repoUrl
+            githubSlug(repoUrl)?.let { env["REPO_ALLOW"] = it }
+        }
+
+    private fun githubSlug(repoUrl: String): String? {
+        val normalized =
+            when {
+                repoUrl.startsWith("git@github.com:") -> repoUrl.removePrefix("git@github.com:")
+                repoUrl.startsWith("ssh://git@github.com/") -> repoUrl.removePrefix("ssh://git@github.com/")
+                repoUrl.startsWith("https://github.com/") -> repoUrl.removePrefix("https://github.com/")
+                repoUrl.startsWith("http://github.com/") -> repoUrl.removePrefix("http://github.com/")
+                else -> return null
+            }.removeSuffix(".git")
+        return normalized.takeIf { it.contains('/') }
+    }
+
     private fun ghEnv(): Map<String, String> {
         val token = System.getenv("GH_TOKEN") ?: System.getenv("GITHUB_TOKEN") ?: ""
         return mapOf("GH_TOKEN" to token)
diff --git a/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/tmux/LogTailer.kt b/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/tmux/LogTailer.kt
index 88d35a3f..da89a5d7 100644
--- a/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/tmux/LogTailer.kt
+++ b/services/agent-gateway/src/main/kotlin/com/jorisjonkers/personalstack/agentgateway/tmux/LogTailer.kt
@@ -110,6 +110,21 @@ class LogTailer(
     companion object {
         const val MAX_CHUNK_CHARS = 1024
         private const val MAX_READ_BYTES = 64 * 1024
+        private const val BYTE_TO_UNSIGNED_MASK = 0xFF
+        private const val NO_UTF8_LEAD_BYTE = -1
+        private const val UTF8_CONTINUATION_MASK = 0xC0
+        private const val UTF8_CONTINUATION_PREFIX = 0x80
+        private const val UTF8_SINGLE_BYTE_LIMIT = 0x80
+        private const val UTF8_TWO_BYTE_LEAD_START = 0xC0
+        private const val UTF8_TWO_BYTE_LEAD_END = 0xDF
+        private const val UTF8_THREE_BYTE_LEAD_START = 0xE0
+        private const val UTF8_THREE_BYTE_LEAD_END = 0xEF
+        private const val UTF8_FOUR_BYTE_LEAD_START = 0xF0
+        private const val UTF8_FOUR_BYTE_LEAD_END = 0xF7
+        private const val UTF8_SINGLE_BYTE_SEQUENCE_LENGTH = 1
+        private const val UTF8_TWO_BYTE_SEQUENCE_LENGTH = 2
+        private const val UTF8_THREE_BYTE_SEQUENCE_LENGTH = 3
+        private const val UTF8_FOUR_BYTE_SEQUENCE_LENGTH = 4
         private val EMPTY = ByteArray(0)
 
         /**
@@ -120,25 +135,35 @@ class LogTailer(
          */
         internal fun completeUtf8Length(buf: ByteArray): Int {
             if (buf.isEmpty()) return 0
+            val leadIndex = trailingLeadByteIndex(buf)
+            if (leadIndex == NO_UTF8_LEAD_BYTE) return buf.size
+            val availableSequenceBytes = buf.size - leadIndex
+            val expectedSequenceBytes = utf8SequenceLength(buf[leadIndex].toUnsignedInt())
+            return if (availableSequenceBytes >= expectedSequenceBytes) buf.size else leadIndex
+        }
+
+        private fun trailingLeadByteIndex(buf: ByteArray): Int {
             var i = buf.size - 1
-            var continuations = 0
-            while (i >= 0 && (buf[i].toInt() and 0xC0) == 0x80) {
+            while (i >= 0 && buf[i].isUtf8Continuation()) {
                 i--
-                continuations++
             }
-            if (i < 0) return buf.size
-            val lead = buf[i].toInt() and 0xFF
-            val expected =
-                when {
-                    lead < 0x80 -> 1
-                    lead in 0xC0..0xDF -> 2
-                    lead in 0xE0..0xEF -> 3
-                    lead in 0xF0..0xF7 -> 4
-                    else -> 1
-                }
-            return if (continuations + 1 >= expected) buf.size else i
+            return i
         }
 
+        private fun Byte.isUtf8Continuation(): Boolean =
+            (toInt() and UTF8_CONTINUATION_MASK) == UTF8_CONTINUATION_PREFIX
+
+        private fun Byte.toUnsignedInt(): Int = toInt() and BYTE_TO_UNSIGNED_MASK
+
+        private fun utf8SequenceLength(lead: Int): Int =
+            when {
+                lead < UTF8_SINGLE_BYTE_LIMIT -> UTF8_SINGLE_BYTE_SEQUENCE_LENGTH
+                lead in UTF8_TWO_BYTE_LEAD_START..UTF8_TWO_BYTE_LEAD_END -> UTF8_TWO_BYTE_SEQUENCE_LENGTH
+                lead in UTF8_THREE_BYTE_LEAD_START..UTF8_THREE_BYTE_LEAD_END -> UTF8_THREE_BYTE_SEQUENCE_LENGTH
+                lead in UTF8_FOUR_BYTE_LEAD_START..UTF8_FOUR_BYTE_LEAD_END -> UTF8_FOUR_BYTE_SEQUENCE_LENGTH
+                else -> UTF8_SINGLE_BYTE_SEQUENCE_LENGTH
+            }
+
         /**
          * Feeds [text] to [action] in pieces of at most [maxChars],
          * never splitting a surrogate pair across two pieces.
diff --git a/services/agent-gateway/src/main/resources/application.yml b/services/agent-gateway/src/main/resources/application.yml
index 33a46955..82536d2f 100644
--- a/services/agent-gateway/src/main/resources/application.yml
+++ b/services/agent-gateway/src/main/resources/application.yml
@@ -40,8 +40,9 @@ agent-gateway:
   cli:
     claude: ${CLAUDE_BIN:claude}
     codex: ${CODEX_BIN:codex}
-    # The runner container is the sandbox, so agents launch with all
-    # approval/permission/sandbox prompts bypassed. Listed here so an
+    # The runner Pod is the outer sandbox. Docker-socket-enabled runners are
+    # host-equivalent for Docker/Testcontainers, while the CLIs still launch
+    # with approval/permission/sandbox prompts bypassed. Listed here so an
     # upstream flag rename is a config flip, not an image rebuild.
     claude-args:
       - --dangerously-skip-permissions
diff --git a/services/agent-gateway/src/test/kotlin/com/jorisjonkers/personalstack/agentgateway/git/GitClientVerifyTest.kt b/services/agent-gateway/src/test/kotlin/com/jorisjonkers/personalstack/agentgateway/git/GitClientVerifyTest.kt
index ca524ab6..1d66bb00 100644
--- a/services/agent-gateway/src/test/kotlin/com/jorisjonkers/personalstack/agentgateway/git/GitClientVerifyTest.kt
+++ b/services/agent-gateway/src/test/kotlin/com/jorisjonkers/personalstack/agentgateway/git/GitClientVerifyTest.kt
@@ -40,6 +40,7 @@ class GitClientVerifyTest {
         private val results: List<ProcessRunner.Result>,
     ) : ProcessRunner() {
         val calls = mutableListOf<List<String>>()
+        val envs = mutableListOf<Map<String, String>>()
         private var idx = 0
 
         override fun run(
@@ -50,6 +51,7 @@ class GitClientVerifyTest {
             checked: Boolean,
         ): Result {
             calls.add(argv)
+            envs.add(env)
             val result = results[idx.coerceAtMost(results.size - 1)]
             idx++
             if (checked && result.exitCode != 0) throw ProcessFailedException(argv, result)
@@ -65,6 +67,46 @@ class GitClientVerifyTest {
         "deadbeef00000000000000000000000000000000\tHEAD\n" +
             "deadbeef00000000000000000000000000000000\trefs/heads/main\n"
 
+    @Test
+    fun `clone skips an existing checkout`() {
+        val target = keyDir.resolve("workspace/repo")
+        Files.createDirectories(target.resolve(".git"))
+        val runner = FakeRunner(listOf(ok()))
+
+        val result = GitClient(runner, props()).clone(repoUrl, target.toString(), branch = "main")
+
+        assertThat(result).isEqualTo(target.toString())
+        assertThat(runner.calls).isEmpty()
+    }
+
+    @Test
+    fun `clone scopes the app-token helper to the requested repository`() {
+        val target = keyDir.resolve("workspace/extra")
+        val runner = FakeRunner(listOf(ok()))
+
+        val result =
+            GitClient(runner, props()).clone(
+                "git@github.com:owner/extra.git",
+                target.toString(),
+                branch = "main",
+            )
+
+        assertThat(result).isEqualTo(target.toString())
+        assertThat(runner.calls.single())
+            .containsExactly(
+                "git",
+                "clone",
+                "--depth",
+                "50",
+                "--branch",
+                "main",
+                "git@github.com:owner/extra.git",
+                target.toString(),
+            )
+        assertThat(runner.envs.single()["AGENT_GITHUB_REPO_URL"]).isEqualTo("git@github.com:owner/extra.git")
+        assertThat(runner.envs.single()["REPO_ALLOW"]).isEqualTo("owner/extra")
+    }
+
     @Test
     fun `read ok and write ok with HEAD when no branch given`() {
         val runner = FakeRunner(listOf(ok(lsRemoteHead), ok(), ok()))
diff --git a/services/agent-gateway/src/test/kotlin/com/jorisjonkers/personalstack/agentgateway/tmux/AgentSessionManagerTest.kt b/services/agent-gateway/src/test/kotlin/com/jorisjonkers/personalstack/agentgateway/tmux/AgentSessionManagerTest.kt
index 904aea00..af587a28 100644
--- a/services/agent-gateway/src/test/kotlin/com/jorisjonkers/personalstack/agentgateway/tmux/AgentSessionManagerTest.kt
+++ b/services/agent-gateway/src/test/kotlin/com/jorisjonkers/personalstack/agentgateway/tmux/AgentSessionManagerTest.kt
@@ -128,7 +128,9 @@ class AgentSessionManagerTest {
                             "--dangerously-bypass-approvals-and-sandbox",
                             "--dangerously-bypass-hook-trust",
                         ),
-                    ) && !cmd.contains("resume") && !cmd.contains("--last")
+                    ) &&
+                        !cmd.contains("resume") &&
+                        !cmd.contains("--last")
                 },
                 "/workspace",
             )
diff --git a/services/agent-runner/Dockerfile b/services/agent-runner/Dockerfile
index 2aff7f6e..334c1188 100644
--- a/services/agent-runner/Dockerfile
+++ b/services/agent-runner/Dockerfile
@@ -33,9 +33,9 @@ ARG GIT_SHA=unknown
 ENV SERVICE_VERSION=${GIT_SHA}
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Base tools. `gh` from the official apt source; node 22 LTS via the
-# nodesource one-liner; Temurin JDK 21 from the Adoptium apt source;
-# python from Debian.
+# Base tools. `gh` from the official apt source; Docker CLI / Compose
+# from Docker's apt source; node 22 LTS via the nodesource one-liner;
+# Temurin JDK 21 from the Adoptium apt source; python from Debian.
 #
 # Java must be 21, not Debian bookworm's `default-jdk` — that resolves
 # to openjdk-17, and the gateway jar is compiled to Java 21 bytecode
@@ -58,8 +58,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
        | gpg --dearmor -o /usr/share/keyrings/adoptium.gpg \
     && echo "deb [signed-by=/usr/share/keyrings/adoptium.gpg] https://packages.adoptium.net/artifactory/deb bookworm main" \
        > /etc/apt/sources.list.d/adoptium.list \
+    && curl -fsSL https://download.docker.com/linux/debian/gpg \
+       | gpg --dearmor -o /usr/share/keyrings/docker.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/debian bookworm stable" \
+       > /etc/apt/sources.list.d/docker.list \
     && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
-    && apt-get install -y --no-install-recommends gh nodejs temurin-21-jdk \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+      gh nodejs temurin-21-jdk \
+      docker-ce-cli docker-buildx-plugin docker-compose-plugin \
+    && docker --version >/dev/null \
+    && docker compose version >/dev/null \
     && rm -rf /var/lib/apt/lists/*
 
 # Claude Code + Codex CLIs. Both ship via npm; pin to the versions
@@ -188,6 +197,8 @@ RUN set -eu; \
     allow="$(REPO_URL='git@github.com:o/primary.git' REPO_URLS='https://github.com/o/extra.git#dev git@github.com:o/second.git' AGENT_RUNNER_ENTRYPOINT_SELF_TEST=repo-allow /opt/entrypoint.sh)"; \
     test "${allow}" = 'o/primary o/extra o/second'; \
     test -z "$(REPO_URL='' REPO_URLS='' AGENT_RUNNER_ENTRYPOINT_SELF_TEST=repo-allow /opt/entrypoint.sh)"; \
+    test "$(REPO_URL='git@github.com:o/personal-stack.git' AGENT_RUNNER_ENTRYPOINT_SELF_TEST=repo-dir /opt/entrypoint.sh)" = 'personal-stack'; \
+    test "$(REPO_URL='https://github.com/o/website.git' AGENT_RUNNER_ENTRYPOINT_SELF_TEST=repo-dir /opt/entrypoint.sh)" = 'website'; \
     rm -rf "${tmp}"
 
 # Shared token helper used by gh, GitHub MCP, and Git's credential
@@ -217,8 +228,14 @@ RUN chmod +x /usr/local/bin/gh-mcp-wrapper
 
 # Non-root agent user, with /workspace writable. /home/agent is the
 # anchor for ~/.claude, ~/.codex, ~/.gitconfig, ~/.ssh — all mounted
-# from PVCs/Secrets at runtime.
-RUN useradd -m -u 1000 -s /bin/bash agent \
+# from PVCs/Secrets at runtime. The runtime Pod also injects the host
+# Docker socket's supplemental group; the image-level docker group keeps
+# local/manual runs usable when the host happens to use the common GID.
+ARG DOCKER_GROUP_ID=999
+RUN if getent group docker >/dev/null; then :; \
+      elif getent group "${DOCKER_GROUP_ID}" >/dev/null; then groupadd docker; \
+      else groupadd --gid "${DOCKER_GROUP_ID}" docker; fi \
+    && useradd -m -u 1000 -G docker -s /bin/bash agent \
     && mkdir -p /workspace /home/agent/.claude /home/agent/.codex /home/agent/.ssh \
     && chown -R agent:agent /workspace /home/agent
 USER agent
diff --git a/services/agent-runner/agent-github-token.sh b/services/agent-runner/agent-github-token.sh
index 7638b240..215a90de 100755
--- a/services/agent-runner/agent-github-token.sh
+++ b/services/agent-runner/agent-github-token.sh
@@ -3,9 +3,10 @@
 # GH_TOKEN/GITHUB_PERSONAL_ACCESS_TOKEN wins; otherwise the helper mints
 # a short-lived GitHub App installation token through assistant-api and
 # caches it per repo until it is close to expiry. The target repo is the
-# first argument, else AGENT_GITHUB_REPO_URL, else REPO_URL, else the
-# workspace's origin — so the same helper serves every repo a multi-repo
-# workspace clones (the credential helper passes AGENT_GITHUB_REPO_URL).
+# first argument, else AGENT_GITHUB_REPO_URL, else the current git
+# remote, else REPO_URL. That keeps commands run inside
+# /workspace/<repo-name> scoped to that repo, while root-level commands
+# still fall back to the primary repository.
 set -u
 
 CACHE_DIR="${GH_APP_TOKEN_CACHE_DIR:-/tmp}"
@@ -44,13 +45,17 @@ target_repo_url() {
     printf '%s' "$AGENT_GITHUB_REPO_URL"
     return 0
   fi
+  if git -C "$WORKSPACE_ROOT" remote get-url origin 2>/dev/null; then
+    return 0
+  fi
+  if git remote get-url origin 2>/dev/null; then
+    return 0
+  fi
   if [ -n "${REPO_URL:-}" ]; then
     printf '%s' "$REPO_URL"
     return 0
   fi
-  git -C "$WORKSPACE_ROOT" remote get-url origin 2>/dev/null ||
-    git remote get-url origin 2>/dev/null ||
-    return 1
+  return 1
 }
 
 REPO_URL_RESOLVED="$(target_repo_url "${1:-}")" || exit 1
diff --git a/services/agent-runner/entrypoint.sh b/services/agent-runner/entrypoint.sh
index 4d6774b2..5ea6c346 100755
--- a/services/agent-runner/entrypoint.sh
+++ b/services/agent-runner/entrypoint.sh
@@ -48,6 +48,10 @@ repo_slug() {
     -e 's#\.git$##'
 }
 
+repo_dir_name() {
+  basename "$1" .git
+}
+
 # The credential-helper allow-list: owner/repo slugs for the primary REPO_URL
 # plus every REPO_URLS entry ("url[#branch]"). Bounding the helper to exactly
 # the workspace's repos keeps the App token's blast radius the same as the old
@@ -98,6 +102,11 @@ if [ "${AGENT_RUNNER_ENTRYPOINT_SELF_TEST:-}" = "repo-allow" ]; then
   exit 0
 fi
 
+if [ "${AGENT_RUNNER_ENTRYPOINT_SELF_TEST:-}" = "repo-dir" ]; then
+  repo_dir_name "${REPO_URL:-}"
+  exit 0
+fi
+
 check_agent_kit_manifests
 
 # Bootstrap git identity — assistant-api injects GIT_AUTHOR_NAME /
@@ -311,21 +320,56 @@ if [ -f /var/run/secrets/agents/github-deploy-key/private_key ]; then
   fi
 fi
 
-# Clone the repo into the workspace at boot. The orchestrator passes
-# REPO_URL (+ optional REPO_BRANCH) for repo-backed workspaces. Cloning
-# here — with the deploy key staged above — avoids the race that left
-# repo-backed workspaces empty: the old create-time gateway.clone fired
-# before this gateway was up and was lost. Idempotent — only clones into
-# an empty workspace, so a Pod restart on a populated PVC never re-clones.
-# Failure is non-fatal so the gateway still starts and the repo can be
-# cloned by hand.
-if [ -n "${REPO_URL:-}" ] && [ -z "$(ls -A "$WORKSPACE_ROOT" 2>/dev/null || true)" ]; then
-  export GIT_SSH_COMMAND="ssh -i /tmp/agent-deploy-key -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=${HOME}/.ssh/known_hosts"
-  if [ -n "${REPO_BRANCH:-}" ]; then
-    git clone --branch "$REPO_BRANCH" "$REPO_URL" "$WORKSPACE_ROOT" || echo "[entrypoint] WARN: clone of $REPO_URL failed; starting gateway anyway"
+clone_repo_into_workspace() {
+  _repo_url="$1"
+  _repo_branch="${2:-}"
+  _repo_name="$(repo_dir_name "$_repo_url")"
+  _repo_target="${WORKSPACE_ROOT}/${_repo_name}"
+
+  if [ -d "${_repo_target}/.git" ]; then
+    echo "[entrypoint] ${_repo_name} already present; skipping clone"
+    register_repo_trust "$_repo_target"
+    return
+  fi
+
+  # Migrate legacy single-repo PVCs that cloned the primary directly
+  # into /workspace. Keep staged inputs at the multi-repo root; move
+  # the git checkout into /workspace/<repo-name>.
+  if [ -d "${WORKSPACE_ROOT}/.git" ] && [ ! -e "$_repo_target" ]; then
+    echo "[entrypoint] migrating legacy workspace root clone into ${_repo_target}"
+    mkdir -p "$_repo_target"
+    find "$WORKSPACE_ROOT" -mindepth 1 -maxdepth 1 \
+      ! -name "$_repo_name" \
+      ! -name ".agent-inputs" \
+      -exec mv {} "$_repo_target/" \;
+    register_repo_trust "$_repo_target"
+    return
+  fi
+
+  if [ -e "$_repo_target" ]; then
+    echo "[entrypoint] WARN: ${_repo_target} exists but is not a git checkout; skipping clone of ${_repo_url}"
+    return
+  fi
+
+  if [ -n "$_repo_branch" ]; then
+    git clone --branch "$_repo_branch" "$_repo_url" "$_repo_target" \
+      || echo "[entrypoint] WARN: clone of ${_repo_url} failed; continuing"
   else
-    git clone "$REPO_URL" "$WORKSPACE_ROOT" || echo "[entrypoint] WARN: clone of $REPO_URL failed; starting gateway anyway"
+    git clone "$_repo_url" "$_repo_target" \
+      || echo "[entrypoint] WARN: clone of ${_repo_url} failed; continuing"
+  fi
+  if [ -d "${_repo_target}/.git" ]; then
+    register_repo_trust "$_repo_target"
   fi
+}
+
+# Clone every workspace repository into its own named folder under
+# /workspace. The orchestrator passes REPO_URL (+ optional REPO_BRANCH)
+# for the primary repository and REPO_URLS for additional repositories.
+# /workspace itself remains the multi-repo root where agents start.
+if [ -n "${REPO_URL:-}" ]; then
+  export GIT_SSH_COMMAND="ssh -i /tmp/agent-deploy-key -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=${HOME}/.ssh/known_hosts"
+  clone_repo_into_workspace "$REPO_URL" "${REPO_BRANCH:-}"
 fi
 
 # Keep boot-time clone on the deploy-key path above, then make every
@@ -348,25 +392,13 @@ fi
 # Multi-repo workspaces: clone every repo in REPO_URLS (space/newline/semicolon
 # separated, each "url[#branch]") into its own subdir of the workspace over
 # HTTPS, authenticated by the App-token credential helper — no per-repo deploy
-# key needed. The primary REPO_URL clone above stays on the deploy-key SSH path
-# for back-compat. Idempotent: a repo already cloned is left alone.
+# key needed. Idempotent: a repo already cloned is left alone.
 if [ -n "${REPO_URLS:-}" ]; then
   for entry in $(printf '%s' "$REPO_URLS" | tr ';\n' '  '); do
     repo_clone_url="${entry%%#*}"
     repo_branch=""
     case "$entry" in *"#"*) repo_branch="${entry#*#}" ;; esac
-    repo_name="$(basename "$repo_clone_url" .git)"
-    repo_target="${WORKSPACE_ROOT}/${repo_name}"
-    if [ -d "${repo_target}/.git" ]; then
-      echo "[entrypoint] ${repo_name} already present; skipping clone"
-    elif [ -n "$repo_branch" ]; then
-      git clone --branch "$repo_branch" "$repo_clone_url" "$repo_target" \
-        || echo "[entrypoint] WARN: clone of ${repo_clone_url} failed; continuing"
-    else
-      git clone "$repo_clone_url" "$repo_target" \
-        || echo "[entrypoint] WARN: clone of ${repo_clone_url} failed; continuing"
-    fi
-    register_repo_trust "$repo_target"
+    clone_repo_into_workspace "$repo_clone_url" "$repo_branch"
   done
 fi
 
diff --git a/services/agent-runner/gh-mcp-wrapper.sh b/services/agent-runner/gh-mcp-wrapper.sh
index e9ed194b..02d6aa8e 100755
--- a/services/agent-runner/gh-mcp-wrapper.sh
+++ b/services/agent-runner/gh-mcp-wrapper.sh
@@ -42,8 +42,8 @@ if [ -z "$TOKEN" ]; then
 [gh-mcp-wrapper] ERROR: no GitHub token available for github-mcp-server.
 [gh-mcp-wrapper] Set GITHUB_PERSONAL_ACCESS_TOKEN/GH_TOKEN, or provide
 [gh-mcp-wrapper] GITHUB_APP_TOKEN_URL and GITHUB_APP_TOKEN_BEARER. The
-[gh-mcp-wrapper] runner also needs REPO_URL or a git remote in /workspace
-[gh-mcp-wrapper] so it can mint a repo-scoped installation token.
+[gh-mcp-wrapper] runner also needs REPO_URL or a current git remote inside
+[gh-mcp-wrapper] /workspace/<repo-name> so it can mint a repo-scoped token.
 EOF
   exit 78
 fi
diff --git a/services/assistant-api/openapi.json b/services/assistant-api/openapi.json
index 716d9dff..781e2b2c 100644
--- a/services/assistant-api/openapi.json
+++ b/services/assistant-api/openapi.json
@@ -241,8 +241,8 @@
           "required" : true
         },
         "responses" : {
-          "200" : {
-            "description" : "OK"
+          "204" : {
+            "description" : "No Content"
           }
         }
       }
@@ -1213,6 +1213,17 @@
             "type" : [ "string", "null" ],
             "format" : "uuid"
           },
+          "primaryRepositoryId" : {
+            "type" : [ "string", "null" ],
+            "format" : "uuid"
+          },
+          "repositoryIds" : {
+            "type" : [ "array", "null" ],
+            "items" : {
+              "type" : "string",
+              "format" : "uuid"
+            }
+          },
           "githubLinkId" : {
             "type" : [ "string", "null" ],
             "format" : "uuid",
@@ -1825,6 +1836,13 @@
           "name" : {
             "type" : "string"
           },
+          "isPrimary" : {
+            "type" : "boolean"
+          },
+          "attachedAt" : {
+            "type" : "string",
+            "format" : "date-time"
+          },
           "repoUrl" : {
             "type" : "string"
           },
@@ -1857,7 +1875,7 @@
             } ]
           }
         },
-        "required" : [ "createdAt", "defaultBranch", "id", "name", "repoUrl", "updatedAt", "vaultKeyPath" ]
+        "required" : [ "attachedAt", "createdAt", "defaultBranch", "id", "isPrimary", "name", "repoUrl", "updatedAt", "vaultKeyPath" ]
       },
       "WorkspaceWithRepositoriesResponse" : {
         "type" : "object",
diff --git a/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/flow/WorkspaceRepositoryFlowIntegrationTest.kt b/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/flow/WorkspaceRepositoryFlowIntegrationTest.kt
index e5569006..596f5214 100644
--- a/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/flow/WorkspaceRepositoryFlowIntegrationTest.kt
+++ b/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/flow/WorkspaceRepositoryFlowIntegrationTest.kt
@@ -57,6 +57,40 @@ class WorkspaceRepositoryFlowIntegrationTest : IntegrationTestBase() {
             .containsExactlyInAnyOrder("primary-$unique", "extra-one-$unique", "extra-two-$unique")
     }
 
+    @Test
+    fun `workspace creation accepts multi-repository selection with explicit primary`() {
+        val unique = unique()
+        val primaryId = createRepository("primary-$unique")
+        val extraOneId = createRepository("extra-one-$unique")
+        val extraTwoId = createRepository("extra-two-$unique")
+
+        val result =
+            mockMvc
+                .perform(
+                    post("/api/v1/workspaces")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content(
+                            objectMapper.writeValueAsString(
+                                mapOf(
+                                    "name" to "workspace-$unique",
+                                    "kind" to "REPO_BACKED",
+                                    "primaryRepositoryId" to primaryId,
+                                    "repositoryIds" to listOf(extraOneId, primaryId, extraTwoId),
+                                ),
+                            ),
+                        ),
+                ).andExpect(status().isCreated)
+                .andExpect(jsonPath("$.repositoryId").value(primaryId))
+                .andReturn()
+        val workspaceId = objectMapper.readTree(result.response.contentAsString)["id"].asText()
+
+        val repositories = getWorkspaceDetail(workspaceId)["workspace"]["repositories"]
+        assertThat(repositories.map { it["id"].asText() })
+            .containsExactlyInAnyOrder(primaryId, extraOneId, extraTwoId)
+        assertThat(repositories.single { it["isPrimary"].asBoolean() }["id"].asText())
+            .isEqualTo(primaryId)
+    }
+
     @Test
     fun `attach and detach endpoints mutate workspace detail repositories`() {
         val unique = unique()
diff --git a/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/k8s/Fabric8AgentRunnerOrchestratorIntegrationTest.kt b/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/k8s/Fabric8AgentRunnerOrchestratorIntegrationTest.kt
index bd05963c..0b543c11 100644
--- a/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/k8s/Fabric8AgentRunnerOrchestratorIntegrationTest.kt
+++ b/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/k8s/Fabric8AgentRunnerOrchestratorIntegrationTest.kt
@@ -144,6 +144,14 @@ class Fabric8AgentRunnerOrchestratorIntegrationTest {
         // IS_SANDBOX tells Claude Code it is sandboxed so it skips the
         // bypass-permissions warning/acceptance.
         assertThat(env.single { it.name == "IS_SANDBOX" }.value).isEqualTo("1")
+        assertThat(env.single { it.name == "DOCKER_HOST" }.value).isEqualTo("unix:///var/run/docker.sock")
+        assertThat(env.single { it.name == "TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE" }.value)
+            .isEqualTo("/var/run/docker.sock")
+        val nodeHostIp = env.single { it.name == "AGENT_RUNNER_NODE_HOST_IP" }
+        assertThat(nodeHostIp.value).isNull()
+        assertThat(nodeHostIp.valueFrom.fieldRef.fieldPath).isEqualTo("status.hostIP")
+        assertThat(env.single { it.name == "TESTCONTAINERS_HOST_OVERRIDE" }.value)
+            .isEqualTo("$(AGENT_RUNNER_NODE_HOST_IP)")
         // REPO_URL + REPO_BRANCH drive the entrypoint's boot-time clone
         // (adHocWorkspace is repo-backed with a branch).
         assertThat(env.single { it.name == "REPO_URL" }.value).isEqualTo("git@github.com:example/repo.git")
@@ -170,6 +178,9 @@ class Fabric8AgentRunnerOrchestratorIntegrationTest {
                 .inNamespace(K3sTestSupport.AGENTS_NAMESPACE)
                 .withName("agent-runner-${workspace.id.short()}")
                 .get()
+        assertThat(pod.spec.nodeSelector)
+            .containsEntry("personal-stack/node", "enschede-gtx-960m-1")
+            .containsEntry("personal-stack/capability-docker-socket", "true")
         val mcpMount =
             pod.spec.containers
                 .single()
@@ -179,12 +190,24 @@ class Fabric8AgentRunnerOrchestratorIntegrationTest {
         val mcpVol = pod.spec.volumes.single { it.name == "mcp-config" }
         assertThat(mcpVol.configMap.name).isEqualTo("agents-mcp-servers")
         assertThat(mcpVol.configMap.optional).isTrue()
+        val dockerMount =
+            pod.spec.containers
+                .single()
+                .volumeMounts
+                .single { it.name == "docker-socket" }
+        assertThat(dockerMount.mountPath).isEqualTo("/var/run/docker.sock")
+        val dockerVol = pod.spec.volumes.single { it.name == "docker-socket" }
+        assertThat(dockerVol.hostPath.path).isEqualTo("/var/run/docker.sock")
+        assertThat(dockerVol.hostPath.type).isEqualTo("Socket")
 
         // The runner must hold no Kubernetes API credential: cluster reads
         // go through the read-only MCP server, never the SA token. An
         // unsandboxed agent therefore cannot reach the API server to
         // modify or delete any Pod.
         assertThat(pod.spec.automountServiceAccountToken).isFalse()
+        assertThat(pod.spec.securityContext.supplementalGroups)
+            .contains(131L)
+            .doesNotContain(998L, 999L)
 
         // A startup probe must gate liveness so the gateway's JVM cold
         // start is not killed mid-boot (which re-provisioned the runner
diff --git a/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/k8s/K3sTestSupport.kt b/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/k8s/K3sTestSupport.kt
index 59cd1b61..6769952a 100644
--- a/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/k8s/K3sTestSupport.kt
+++ b/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/k8s/K3sTestSupport.kt
@@ -94,17 +94,21 @@ object K3sTestSupport {
      * apply); safe to call once per test.
      */
     fun bootstrapNamespacesAndServiceAccount(admin: KubernetesClient) {
-        listOf(AGENTS_NAMESPACE, ASSISTANT_NAMESPACE).forEach { ns ->
+        val agentsNamespace = repoRoot().resolve("platform/cluster/flux/apps/agents/namespace.yaml")
+        Files.newInputStream(agentsNamespace).use { stream ->
             admin
-                .namespaces()
-                .resource(
-                    NamespaceBuilder()
-                        .withNewMetadata()
-                        .withName(ns)
-                        .endMetadata()
-                        .build(),
-                ).serverSideApply()
+                .load(stream)
+                .serverSideApply()
         }
+        admin
+            .namespaces()
+            .resource(
+                NamespaceBuilder()
+                    .withNewMetadata()
+                    .withName(ASSISTANT_NAMESPACE)
+                    .endMetadata()
+                    .build(),
+            ).serverSideApply()
         admin
             .serviceAccounts()
             .inNamespace(ASSISTANT_NAMESPACE)
diff --git a/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/persistence/JooqWorkspaceRepositoryRepositoryIntegrationTest.kt b/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/persistence/JooqWorkspaceRepositoryRepositoryIntegrationTest.kt
index cba63690..f0aa90c9 100644
--- a/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/persistence/JooqWorkspaceRepositoryRepositoryIntegrationTest.kt
+++ b/services/assistant-api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/assistant/persistence/JooqWorkspaceRepositoryRepositoryIntegrationTest.kt
@@ -73,6 +73,22 @@ class JooqWorkspaceRepositoryRepositoryIntegrationTest : IntegrationTestBase() {
         assertThat(junction.findAllByWorkspaceId(w.id)).hasSize(1)
     }
 
+    @Test
+    fun `attaching a repository as primary promotes it and clears previous primary`() {
+        val w = workspace()
+        val r1 = repository()
+        val r2 = repository()
+        junction.attach(w.id, r1.id, isPrimary = true)
+        junction.attach(w.id, r2.id)
+
+        val promoted = junction.attach(w.id, r2.id, isPrimary = true)
+
+        assertThat(promoted.isPrimary).isTrue
+        val links = junction.findAllByWorkspaceId(w.id)
+        assertThat(links.filter { it.isPrimary }.map { it.repositoryId }).containsExactly(r2.id)
+        assertThat(links.first().repositoryId).isEqualTo(r2.id)
+    }
+
     @Test
     fun `detach removes the row`() {
         val w = workspace()
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommand.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommand.kt
index 7e9c9480..0702e1a0 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommand.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommand.kt
@@ -5,9 +5,9 @@ import com.jorisjonkers.personalstack.assistant.domain.model.WorkspaceId
 import com.jorisjonkers.personalstack.common.command.Command
 
 /**
- * Attach an additional repository to a workspace. The repo is cloned
- * alongside the primary (it becomes part of REPO_URLS) the next time the
- * runner Pod boots; running pods are not re-provisioned.
+ * Attach an additional repository to a workspace. The link becomes part
+ * of REPO_URLS for future runner boots, and a currently running gateway
+ * is asked to clone it immediately into /workspace/<repo-name>.
  */
 data class AttachWorkspaceRepositoryCommand(
     val workspaceId: WorkspaceId,
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommandHandler.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommandHandler.kt
index 834ebd4e..661e5d4a 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommandHandler.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommandHandler.kt
@@ -1,5 +1,6 @@
 package com.jorisjonkers.personalstack.assistant.application.command
 
+import com.jorisjonkers.personalstack.assistant.domain.port.AgentGatewayClient
 import com.jorisjonkers.personalstack.assistant.domain.port.RepositoryRepository
 import com.jorisjonkers.personalstack.assistant.domain.port.WorkspaceRepository
 import com.jorisjonkers.personalstack.assistant.domain.port.WorkspaceRepositoryRepository
@@ -12,13 +13,19 @@ class AttachWorkspaceRepositoryCommandHandler(
     private val workspaces: WorkspaceRepository,
     private val repositories: RepositoryRepository,
     private val links: WorkspaceRepositoryRepository,
+    private val gateway: AgentGatewayClient,
 ) : CommandHandler<AttachWorkspaceRepositoryCommand> {
     @Transactional
     override fun handle(command: AttachWorkspaceRepositoryCommand) {
-        workspaces.findById(command.workspaceId)
-            ?: throw NoSuchElementException("workspace not found: ${command.workspaceId}")
-        repositories.findById(command.repositoryId)
-            ?: throw NoSuchElementException("repository not found: ${command.repositoryId}")
+        val workspace =
+            workspaces.findById(command.workspaceId)
+                ?: throw NoSuchElementException("workspace not found: ${command.workspaceId}")
+        val repository =
+            repositories.findById(command.repositoryId)
+                ?: throw NoSuchElementException("repository not found: ${command.repositoryId}")
         links.attach(command.workspaceId, command.repositoryId, isPrimary = false)
+        if (workspace.gatewayEndpoint != null && gateway.isReady(workspace)) {
+            gateway.clone(workspace, repository.repoUrl, repository.defaultBranch)
+        }
     }
 }
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommand.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommand.kt
index f1eb9eba..d6231760 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommand.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommand.kt
@@ -36,6 +36,13 @@ data class CreateWorkspaceCommand(
     val kind: WorkspaceKind = WorkspaceKind.REPO_BACKED,
     val projectId: ProjectId? = null,
     val repositoryId: RepositoryId? = null,
+    /**
+     * Ordered repository selection for multi-repo workspaces. The
+     * first entry becomes the primary repository when [repositoryId]
+     * is omitted; all other distinct entries are attached as
+     * additional repositories before the runner is provisioned.
+     */
+    val repositoryIds: List<RepositoryId> = emptyList(),
     @Deprecated(
         "Use repositoryId — kept for the V9 migration window so existing UI " +
             "callers continue to work until PR F migrates them.",
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommandHandler.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommandHandler.kt
index ddc9919e..5b23f238 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommandHandler.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommandHandler.kt
@@ -24,7 +24,7 @@ import java.time.Instant
  * Creates the workspace record and provisions the runner Pod. For a
  * repo-backed workspace the clone happens inside the runner at boot
  * (the orchestrator passes REPO_URL/REPO_BRANCH and the entrypoint
- * clones into /workspace with the mounted deploy key) — not from here.
+ * clones into /workspace/<repo-name> with the mounted deploy key) — not from here.
  * An earlier create-time `gateway.clone` raced the runner's startup:
  * it fired before the gateway was up, failed, and was swallowed,
  * leaving the workspace empty.
@@ -81,7 +81,7 @@ class CreateWorkspaceCommandHandler(
             verifyOrFail(resolved.repoUrl, resolved.branch, resolved.repositoryId)
         }
         val workspace = persistInitial(command, resolved)
-        seedRepositoryMembership(workspace)
+        seedRepositoryMembership(workspace, command)
         val withPod = provisionAndUpdate(workspace)
         log.info("workspace {} provisioned as pod {}", workspace.id, withPod.podName)
     }
@@ -137,25 +137,53 @@ class CreateWorkspaceCommandHandler(
         return workspace
     }
 
-    private fun seedRepositoryMembership(workspace: Workspace) {
+    private fun seedRepositoryMembership(
+        workspace: Workspace,
+        command: CreateWorkspaceCommand,
+    ) {
         val repoId = workspace.repositoryId ?: return
+        val repoPort = repositories.ifAvailable ?: return
         val realPrimaryRepoId =
-            repositories
-                .ifAvailable
-                ?.findById(repoId)
+            repoPort
+                .findById(repoId)
                 ?.id
                 ?: return
 
         workspaceRepositories.attach(workspace.id, realPrimaryRepoId, isPrimary = true)
-        workspace.projectId
-            ?.let { projectRepositories.findAllByProjectId(it) }
-            .orEmpty()
-            .map { it.repositoryId }
-            .filterNot { it == realPrimaryRepoId }
-            .distinct()
-            .forEach { workspaceRepositories.attach(workspace.id, it, isPrimary = false) }
+        selectedExtraRepositoryIds(command, realPrimaryRepoId)
+            .forEach { repositoryId ->
+                val repository = requireRepository(repoPort, repositoryId)
+                workspaceRepositories.attach(
+                    workspace.id,
+                    repository.id,
+                    isPrimary = false,
+                )
+            }
+    }
+
+    private fun selectedExtraRepositoryIds(
+        command: CreateWorkspaceCommand,
+        primaryRepoId: RepositoryId,
+    ): List<RepositoryId> {
+        val extras =
+            if (command.repositoryIds.isNotEmpty()) {
+                command.repositoryIds.filterNot { it == primaryRepoId }
+            } else {
+                command.projectId
+                    ?.let { projectRepositories.findAllByProjectId(it) }
+                    .orEmpty()
+                    .map { it.repositoryId }
+                    .filterNot { it == primaryRepoId }
+            }
+        return extras.distinct()
     }
 
+    private fun requireRepository(
+        repos: RepositoryRepository,
+        repositoryId: RepositoryId,
+    ) = repos.findById(repositoryId)
+        ?: throw NoSuchElementException("repository not found: repositoryId=${repositoryId.value}")
+
     private fun provisionAndUpdate(workspace: Workspace): Workspace {
         val handle = orchestrator.provision(workspace)
         val withPod =
@@ -175,13 +203,18 @@ class CreateWorkspaceCommandHandler(
         val legacyLinkId: GithubLinkId?,
     )
 
-    private fun resolveRepo(command: CreateWorkspaceCommand): ResolvedRepo =
-        when {
+    private fun resolveRepo(command: CreateWorkspaceCommand): ResolvedRepo {
+        val primaryRepositoryId = primaryRepositoryId(command)
+        return when {
             command.kind == WorkspaceKind.SCRATCH -> ResolvedRepo(null, null, null, null)
-            command.repositoryId != null -> resolveFromRepository(command, command.repositoryId)
+            primaryRepositoryId != null -> resolveFromRepository(command, primaryRepositoryId)
             command.githubLinkId != null -> resolveFromLegacyLink(command, command.githubLinkId)
             else -> ResolvedRepo(command.repoUrl, command.branch, null, null)
         }
+    }
+
+    private fun primaryRepositoryId(command: CreateWorkspaceCommand): RepositoryId? =
+        command.repositoryId ?: command.repositoryIds.firstOrNull()
 
     private fun resolveFromRepository(
         command: CreateWorkspaceCommand,
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/query/GetWorkspaceQueryService.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/query/GetWorkspaceQueryService.kt
index adb92b39..ac01f64a 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/query/GetWorkspaceQueryService.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/application/query/GetWorkspaceQueryService.kt
@@ -9,6 +9,7 @@ import com.jorisjonkers.personalstack.assistant.domain.port.WorkspaceAgentSessio
 import com.jorisjonkers.personalstack.assistant.domain.port.WorkspaceRepository
 import com.jorisjonkers.personalstack.assistant.domain.port.WorkspaceRepositoryRepository
 import org.springframework.stereotype.Service
+import java.time.Instant
 
 @Service
 class GetWorkspaceQueryService(
@@ -20,22 +21,43 @@ class GetWorkspaceQueryService(
     data class WorkspaceView(
         val workspace: Workspace,
         val sessions: List<WorkspaceAgentSession>,
-        val repositories: List<Repository>,
+        val repositories: List<WorkspaceRepositoryView>,
+    )
+
+    data class WorkspaceRepositoryView(
+        val repository: Repository,
+        val isPrimary: Boolean,
+        val attachedAt: Instant,
     )
 
     fun getSummary(id: WorkspaceId): Workspace? = workspaces.findById(id)
 
     fun get(id: WorkspaceId): WorkspaceView? {
         val workspace = workspaces.findById(id) ?: return null
+        val links = repositoryLinks(workspace)
         val resolvedRepositories =
-            workspaceRepositories
-                .findAllByWorkspaceId(id)
-                .map { link ->
+            links.map { link ->
+                val repository =
                     repositories.findById(link.repositoryId)
                         ?: throw IllegalStateException(
                             "Workspace ${id.value} references missing repository ${link.repositoryId.value}",
                         )
-                }
+                WorkspaceRepositoryView(repository, link.isPrimary, link.attachedAt)
+            }
         return WorkspaceView(workspace, sessions.findAllByWorkspaceId(id), resolvedRepositories)
     }
+
+    private fun repositoryLinks(workspace: Workspace): List<WorkspaceRepositoryRepository.Link> {
+        val links = workspaceRepositories.findAllByWorkspaceId(workspace.id)
+        val primaryRepositoryId = workspace.repositoryId ?: return links
+        if (links.any { it.repositoryId == primaryRepositoryId }) return links
+        val primaryLink =
+            WorkspaceRepositoryRepository.Link(
+                workspaceId = workspace.id,
+                repositoryId = primaryRepositoryId,
+                isPrimary = true,
+                attachedAt = workspace.createdAt,
+            )
+        return listOf(primaryLink) + links
+    }
 }
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/config/AgentRuntimeProperties.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/config/AgentRuntimeProperties.kt
index 782d9a3b..43814c00 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/config/AgentRuntimeProperties.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/config/AgentRuntimeProperties.kt
@@ -2,6 +2,17 @@ package com.jorisjonkers.personalstack.assistant.config
 
 import org.springframework.boot.context.properties.ConfigurationProperties
 
+private const val NIXOS_DOCKER_GROUP_GID = 131L
+
+private val DEFAULT_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS =
+    listOf(NIXOS_DOCKER_GROUP_GID)
+
+private val DEFAULT_NODE_SELECTOR =
+    mapOf(
+        "personal-stack/node" to "enschede-gtx-960m-1",
+        "personal-stack/capability-docker-socket" to "true",
+    )
+
 /**
  * Properties that drive Pod creation for workspaces. All sourced from
  * application.yml so the manifests need no rebuild when the image
@@ -35,7 +46,15 @@ data class AgentRuntimeProperties(
     // MCP server profile selected by the runner entrypoint. Keep the
     // default narrow; wider diagnostic profiles are explicit opt-ins.
     val defaultMcpProfile: String = "minimal",
-    val nodeSelector: Map<String, String> = mapOf("personal-stack/node" to "enschede-gtx-960m-1"),
+    // Mount the host Docker socket into runner Pods so agent sessions can run
+    // Docker CLI commands and JVM Testcontainers suites from inside /workspace.
+    // This is host-equivalent access. The supplemental group default is pinned
+    // in platform/nix/hosts/enschede-gtx-960m-1/default.nix; override both the
+    // Nix host and this property together when moving runners to another node.
+    val dockerSocketEnabled: Boolean = true,
+    val dockerSocketPath: String = "/var/run/docker.sock",
+    val dockerSocketSupplementalGroups: List<Long> = DEFAULT_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS,
+    val nodeSelector: Map<String, String> = DEFAULT_NODE_SELECTOR,
     val gatewayConnectTimeoutMs: Long = 5_000,
     val gatewayReadTimeoutMs: Long = 60_000,
     // Base URL of the standing agent-gateway used for the
@@ -80,6 +99,12 @@ data class AgentRuntimeProperties(
                 VALID_MCP_PROFILES.joinToString(", ") +
                 "; got '$defaultMcpProfile'"
         }
+        require(dockerSocketPath.startsWith("/")) {
+            "agent-runtime.docker-socket-path must be an absolute path; got '$dockerSocketPath'"
+        }
+        require(dockerSocketSupplementalGroups.all { it > 0L }) {
+            "agent-runtime.docker-socket-supplemental-groups must contain positive numeric gids"
+        }
     }
 
     companion object {
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/k8s/Fabric8AgentRunnerOrchestrator.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/k8s/Fabric8AgentRunnerOrchestrator.kt
index 255f8974..cb966bcf 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/k8s/Fabric8AgentRunnerOrchestrator.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/k8s/Fabric8AgentRunnerOrchestrator.kt
@@ -18,6 +18,8 @@ import io.fabric8.kubernetes.api.model.Quantity
 import io.fabric8.kubernetes.api.model.Secret
 import io.fabric8.kubernetes.api.model.SecretBuilder
 import io.fabric8.kubernetes.api.model.ServiceBuilder
+import io.fabric8.kubernetes.api.model.Volume
+import io.fabric8.kubernetes.api.model.VolumeBuilder
 import io.fabric8.kubernetes.api.model.VolumeMountBuilder
 import io.fabric8.kubernetes.client.KubernetesClient
 import org.slf4j.LoggerFactory
@@ -32,7 +34,9 @@ import java.util.Base64
  * (`workspace-<short-id>`), one ClusterIP Service so the gateway has
  * a stable in-cluster name. Adversarial use is anticipated, so the
  * Pod runs as UID 1000, with read-only mounts for the credential
- * PVCs that the agent itself doesn't need to write.
+ * PVCs that the agent itself doesn't need to write. Docker socket
+ * access is intentionally host-equivalent and exists so repo tests
+ * using Testcontainers can run inside future agent sessions.
  *
  * Per-workspace deploy-key isolation: when the workspace's
  * `githubLinkId` is set, the orchestrator looks up the link, reads
@@ -298,6 +302,7 @@ class Fabric8AgentRunnerOrchestrator(
             .withRunAsUser(RUN_AS_UID)
             .withRunAsGroup(RUN_AS_GID)
             .withFsGroup(FS_GROUP)
+            .withSupplementalGroups(podSupplementalGroups())
             .endSecurityContext()
             .addNewContainer()
             .withName("agent-runner")
@@ -364,16 +369,18 @@ class Fabric8AgentRunnerOrchestrator(
                     .build(),
             )
             add(EnvVarBuilder().withName("OTEL_EXPORTER_OTLP_PROTOCOL").withValue("http/protobuf").build())
-            // The runner Pod is the sandbox (unprivileged, no host access,
-            // only its deploy key). IS_SANDBOX tells Claude Code so that
-            // --dangerously-skip-permissions runs without the bypass-mode
-            // warning + acceptance prompt.
+            // The runner Pod is the outer sandbox for the agent process.
+            // Docker socket access is the explicit host-equivalent exception
+            // for Testcontainers and Docker CLI workflows. IS_SANDBOX tells
+            // Claude Code so that --dangerously-skip-permissions runs without
+            // the bypass-mode warning + acceptance prompt.
             add(EnvVarBuilder().withName("IS_SANDBOX").withValue("1").build())
             add(EnvVarBuilder().withName("AGENT_MCP_PROFILE").withValue(props.defaultMcpProfile).build())
+            addAll(dockerEnv())
             addAll(knowledgeEnv())
             addAll(githubAppTokenEnv())
             // REPO_URL/REPO_BRANCH drive the entrypoint's boot-time clone
-            // into /workspace. Cloning in the runner removes the race that
+            // into /workspace/<repo-name>. Cloning in the runner removes the race that
             // left repo-backed workspaces empty: the old create-time
             // gateway.clone fired before the runner gateway was up and was
             // swallowed. Only repo-backed workspaces carry a repoUrl.
@@ -382,10 +389,9 @@ class Fabric8AgentRunnerOrchestrator(
                 workspace.branch?.let { add(EnvVarBuilder().withName("REPO_BRANCH").withValue(it).build()) }
             }
             // REPO_URLS carries the workspace's additional repos (everything
-            // attached that is not the primary). The entrypoint clones each
-            // into its own subdir over the App-token credential helper. Only
-            // emitted when there are extras, so single-repo workspaces look
-            // identical to before to an older runner image.
+            // attached that is not the primary), as url#branch entries. The
+            // entrypoint clones each into /workspace/<repo-name> over the
+            // App-token credential helper.
             additionalRepoUrls(workspace).takeIf { it.isNotEmpty() }?.let { urls ->
                 add(EnvVarBuilder().withName("REPO_URLS").withValue(urls.joinToString(" ")).build())
             }
@@ -397,9 +403,36 @@ class Fabric8AgentRunnerOrchestrator(
         return links
             .findAllByWorkspaceId(workspace.id)
             .filterNot { it.isPrimary }
-            .mapNotNull { repos.findById(it.repositoryId)?.repoUrl }
+            .mapNotNull { link ->
+                repos.findById(link.repositoryId)?.let { repo -> "${repo.repoUrl}#${repo.defaultBranch}" }
+            }
     }
 
+    private fun dockerEnv() =
+        if (!props.dockerSocketEnabled) {
+            emptyList()
+        } else {
+            listOf(
+                EnvVarBuilder().withName("DOCKER_HOST").withValue("unix://${props.dockerSocketPath}").build(),
+                EnvVarBuilder()
+                    .withName("TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE")
+                    .withValue(props.dockerSocketPath)
+                    .build(),
+                EnvVarBuilder()
+                    .withName("AGENT_RUNNER_NODE_HOST_IP")
+                    .withNewValueFrom()
+                    .withNewFieldRef()
+                    .withFieldPath("status.hostIP")
+                    .endFieldRef()
+                    .endValueFrom()
+                    .build(),
+                EnvVarBuilder()
+                    .withName("TESTCONTAINERS_HOST_OVERRIDE")
+                    .withValue("$(AGENT_RUNNER_NODE_HOST_IP)")
+                    .build(),
+            )
+        }
+
     // KB_URL + KB_BEARER_TOKEN are the exact names the knowledge-system
     // install.sh hooks read; without the bearer every hook short-circuits
     // to a no-op and the knowledge.* MCP tools are unreachable.
@@ -435,59 +468,95 @@ class Fabric8AgentRunnerOrchestrator(
         )
 
     private fun podVolumeMounts() =
-        listOf(
-            VolumeMountBuilder().withName("workspace").withMountPath("/workspace").build(),
-            VolumeMountBuilder().withName("claude-credentials").withMountPath("/home/agent/.claude").build(),
-            VolumeMountBuilder().withName("codex-credentials").withMountPath("/home/agent/.codex").build(),
-            VolumeMountBuilder()
-                .withName("github-deploy-key")
-                .withMountPath("/var/run/secrets/agents/github-deploy-key")
-                .withReadOnly(true)
-                .build(),
+        buildList {
+            add(VolumeMountBuilder().withName("workspace").withMountPath("/workspace").build())
+            add(VolumeMountBuilder().withName("claude-credentials").withMountPath("/home/agent/.claude").build())
+            add(VolumeMountBuilder().withName("codex-credentials").withMountPath("/home/agent/.codex").build())
+            if (props.dockerSocketEnabled) {
+                add(
+                    VolumeMountBuilder()
+                        .withName(DOCKER_SOCKET_VOLUME)
+                        .withMountPath(props.dockerSocketPath)
+                        .build(),
+                )
+            }
+            add(
+                VolumeMountBuilder()
+                    .withName("github-deploy-key")
+                    .withMountPath("/var/run/secrets/agents/github-deploy-key")
+                    .withReadOnly(true)
+                    .build(),
+            )
             // Declarative MCP server set; the entrypoint seeds it into
             // ~/.claude.json. Optional volume, so an absent ConfigMap
             // leaves the runner with no managed MCP servers.
-            VolumeMountBuilder()
-                .withName("mcp-config")
-                .withMountPath("/etc/agent-mcp")
-                .withReadOnly(true)
-                .build(),
-        )
+            add(
+                VolumeMountBuilder()
+                    .withName("mcp-config")
+                    .withMountPath("/etc/agent-mcp")
+                    .withReadOnly(true)
+                    .build(),
+            )
+        }
 
     private fun podVolumes(
         workspacePvc: String,
         deployKeySecret: String,
-    ) = listOf(
-        pvcVolume("workspace", workspacePvc),
-        pvcVolume("claude-credentials", props.claudeCredentialsPvc),
-        pvcVolume("codex-credentials", props.codexCredentialsPvc),
-        io.fabric8.kubernetes.api.model
-            .VolumeBuilder()
+    ) = buildList {
+        add(pvcVolume("workspace", workspacePvc))
+        add(pvcVolume("claude-credentials", props.claudeCredentialsPvc))
+        add(pvcVolume("codex-credentials", props.codexCredentialsPvc))
+        dockerSocketVolume()?.let(::add)
+        add(githubDeployKeyVolume(deployKeySecret))
+        add(mcpConfigVolume())
+    }
+
+    private fun pvcVolume(
+        name: String,
+        claim: String,
+    ) = VolumeBuilder()
+        .withName(name)
+        .withNewPersistentVolumeClaim()
+        .withClaimName(claim)
+        .endPersistentVolumeClaim()
+        .build()
+
+    private fun dockerSocketVolume(): Volume? =
+        if (!props.dockerSocketEnabled) {
+            null
+        } else {
+            VolumeBuilder()
+                .withName(DOCKER_SOCKET_VOLUME)
+                .withNewHostPath()
+                .withPath(props.dockerSocketPath)
+                .withType("Socket")
+                .endHostPath()
+                .build()
+        }
+
+    private fun githubDeployKeyVolume(deployKeySecret: String): Volume =
+        VolumeBuilder()
             .withName("github-deploy-key")
             .withNewSecret()
             .withSecretName(deployKeySecret)
             .endSecret()
-            .build(),
-        io.fabric8.kubernetes.api.model
-            .VolumeBuilder()
+            .build()
+
+    private fun mcpConfigVolume(): Volume =
+        VolumeBuilder()
             .withName("mcp-config")
             .withNewConfigMap()
             .withName(props.mcpServersConfigMap)
             .withOptional(true)
             .endConfigMap()
-            .build(),
-    )
+            .build()
 
-    private fun pvcVolume(
-        name: String,
-        claim: String,
-    ) = io.fabric8.kubernetes.api.model
-        .VolumeBuilder()
-        .withName(name)
-        .withNewPersistentVolumeClaim()
-        .withClaimName(claim)
-        .endPersistentVolumeClaim()
-        .build()
+    private fun podSupplementalGroups(): List<Long> =
+        if (props.dockerSocketEnabled) {
+            (listOf(RUN_AS_GID) + props.dockerSocketSupplementalGroups).distinct()
+        } else {
+            listOf(RUN_AS_GID)
+        }
 
     private fun service(
         name: String,
@@ -513,6 +582,7 @@ class Fabric8AgentRunnerOrchestrator(
         private const val RUN_AS_UID = 1000L
         private const val RUN_AS_GID = 1000L
         private const val FS_GROUP = 1000L
+        private const val DOCKER_SOCKET_VOLUME = "docker-socket"
 
         // Resource sizing. One Pod hosts the gateway JVM, the agent CLIs
         // (Claude Code, Codex) and the workspace's own processes in a
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/persistence/JooqWorkspaceRepositoryRepository.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/persistence/JooqWorkspaceRepositoryRepository.kt
index c026cea1..840d40a3 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/persistence/JooqWorkspaceRepositoryRepository.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/persistence/JooqWorkspaceRepositoryRepository.kt
@@ -22,16 +22,51 @@ class JooqWorkspaceRepositoryRepository(
         isPrimary: Boolean,
     ): WorkspaceRepositoryRepository.Link {
         val now = Instant.now()
+        if (isPrimary) {
+            attachPrimary(workspaceId, repositoryId, now)
+        } else {
+            attachSecondary(workspaceId, repositoryId, now)
+        }
+        return findLink(workspaceId, repositoryId)
+            ?: WorkspaceRepositoryRepository.Link(workspaceId, repositoryId, isPrimary, now)
+    }
+
+    private fun attachPrimary(
+        workspaceId: WorkspaceId,
+        repositoryId: RepositoryId,
+        now: Instant,
+    ) {
+        dsl
+            .update(JUNCTION)
+            .set(IS_PRIMARY, false)
+            .where(WORKSPACE_ID.eq(workspaceId.value))
+            .execute()
         dsl
             .insertInto(JUNCTION)
             .set(WORKSPACE_ID, workspaceId.value)
             .set(REPOSITORY_ID, repositoryId.value)
-            .set(IS_PRIMARY, isPrimary)
+            .set(IS_PRIMARY, true)
+            .set(ATTACHED_AT, now.atOffset(ZoneOffset.UTC))
+            .onConflict(WORKSPACE_ID, REPOSITORY_ID)
+            .doUpdate()
+            .set(IS_PRIMARY, true)
+            .execute()
+    }
+
+    private fun attachSecondary(
+        workspaceId: WorkspaceId,
+        repositoryId: RepositoryId,
+        now: Instant,
+    ) {
+        dsl
+            .insertInto(JUNCTION)
+            .set(WORKSPACE_ID, workspaceId.value)
+            .set(REPOSITORY_ID, repositoryId.value)
+            .set(IS_PRIMARY, false)
             .set(ATTACHED_AT, now.atOffset(ZoneOffset.UTC))
             .onConflict(WORKSPACE_ID, REPOSITORY_ID)
             .doNothing()
             .execute()
-        return WorkspaceRepositoryRepository.Link(workspaceId, repositoryId, isPrimary, now)
     }
 
     override fun detach(
@@ -49,10 +84,21 @@ class JooqWorkspaceRepositoryRepository(
         dsl
             .selectFrom(JUNCTION)
             .where(WORKSPACE_ID.eq(workspaceId.value))
-            .orderBy(ATTACHED_AT.asc())
+            .orderBy(IS_PRIMARY.desc(), ATTACHED_AT.asc())
             .fetch()
             .map { it.toLink() }
 
+    private fun findLink(
+        workspaceId: WorkspaceId,
+        repositoryId: RepositoryId,
+    ): WorkspaceRepositoryRepository.Link? =
+        dsl
+            .selectFrom(JUNCTION)
+            .where(WORKSPACE_ID.eq(workspaceId.value))
+            .and(REPOSITORY_ID.eq(repositoryId.value))
+            .fetchOne()
+            ?.toLink()
+
     private fun Record.toLink(): WorkspaceRepositoryRepository.Link =
         WorkspaceRepositoryRepository.Link(
             workspaceId = WorkspaceId(this[WORKSPACE_ID]),
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/WorkspaceController.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/WorkspaceController.kt
index 0f542acb..1ef2e368 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/WorkspaceController.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/WorkspaceController.kt
@@ -15,6 +15,7 @@ import com.jorisjonkers.personalstack.assistant.infrastructure.web.dto.CreateWor
 import com.jorisjonkers.personalstack.assistant.infrastructure.web.dto.WorkspaceDetailResponse
 import com.jorisjonkers.personalstack.assistant.infrastructure.web.dto.WorkspaceResponse
 import com.jorisjonkers.personalstack.common.command.CommandBus
+import io.swagger.v3.oas.annotations.responses.ApiResponse
 import jakarta.validation.Valid
 import org.springframework.http.HttpStatus
 import org.springframework.http.ResponseEntity
@@ -40,6 +41,7 @@ class WorkspaceController(
         @Valid @RequestBody req: CreateWorkspaceRequest,
     ): ResponseEntity<WorkspaceResponse> {
         val id = WorkspaceId.random()
+        val primaryRepositoryId = primaryRepositoryId(req)
         commandBus.dispatch(
             CreateWorkspaceCommand(
                 workspaceId = id,
@@ -48,7 +50,8 @@ class WorkspaceController(
                 branch = req.branch,
                 kind = req.kind,
                 projectId = req.projectId?.let { ProjectId(it) },
-                repositoryId = req.repositoryId?.let { RepositoryId(it) },
+                repositoryId = primaryRepositoryId?.let { RepositoryId(it) },
+                repositoryIds = selectedRepositoryIds(req, primaryRepositoryId).map { RepositoryId(it) },
                 githubLinkId = req.githubLinkId?.let { GithubLinkId(it) },
             ),
         )
@@ -72,6 +75,7 @@ class WorkspaceController(
     }
 
     @PostMapping("/{id}/repositories")
+    @ApiResponse(responseCode = "204", description = "No Content")
     fun attachRepository(
         @PathVariable id: UUID,
         @Valid @RequestBody req: AttachWorkspaceRepositoryRequest,
@@ -106,4 +110,24 @@ class WorkspaceController(
         commandBus.dispatch(DestroyWorkspaceCommand(WorkspaceId(id)))
         return ResponseEntity.noContent().build()
     }
+
+    private fun primaryRepositoryId(req: CreateWorkspaceRequest): UUID? {
+        if (req.repositoryId != null &&
+            req.primaryRepositoryId != null &&
+            req.repositoryId != req.primaryRepositoryId
+        ) {
+            throw IllegalArgumentException("repositoryId and primaryRepositoryId must match when both are supplied")
+        }
+        return req.repositoryId ?: req.primaryRepositoryId ?: req.repositoryIds.orEmpty().firstOrNull()
+    }
+
+    private fun selectedRepositoryIds(
+        req: CreateWorkspaceRequest,
+        primaryRepositoryId: UUID?,
+    ): List<UUID> {
+        val repositoryIds = req.repositoryIds.orEmpty()
+        if (repositoryIds.isEmpty()) return emptyList()
+        return (listOfNotNull(primaryRepositoryId) + repositoryIds)
+            .distinct()
+    }
 }
diff --git a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/dto/WorkspaceDtos.kt b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/dto/WorkspaceDtos.kt
index 67daca1f..650790fa 100644
--- a/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/dto/WorkspaceDtos.kt
+++ b/services/assistant-api/src/main/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/dto/WorkspaceDtos.kt
@@ -1,5 +1,7 @@
 package com.jorisjonkers.personalstack.assistant.infrastructure.web.dto
 
+import com.fasterxml.jackson.annotation.JsonProperty
+import com.jorisjonkers.personalstack.assistant.application.query.GetWorkspaceQueryService.WorkspaceRepositoryView
 import com.jorisjonkers.personalstack.assistant.domain.model.Repository
 import com.jorisjonkers.personalstack.assistant.domain.model.Turn
 import com.jorisjonkers.personalstack.assistant.domain.model.Workspace
@@ -34,6 +36,20 @@ data class CreateWorkspaceRequest(
      * Repository row.
      */
     val repositoryId: UUID? = null,
+    /**
+     * Primary repo for the multi-repository request shape. Kept
+     * separate from [repositoryIds] so clients can submit an ordered
+     * or unordered selected set without relying on list position.
+     * [repositoryId] remains the backwards-compatible alias and wins
+     * when both fields match.
+     */
+    val primaryRepositoryId: UUID? = null,
+    /**
+     * Selected repositories for a multi-repo workspace. When no
+     * primary field is set, the first entry becomes the primary and
+     * the remaining distinct ids are attached as extras.
+     */
+    val repositoryIds: List<UUID>? = null,
     /**
      * Deprecated alias for [repositoryId]. Kept until PR F migrates
      * the assistant-ui to the new field. The server prefers
@@ -87,6 +103,9 @@ data class WorkspaceResponse(
 data class WorkspaceRepositoryResponse(
     val id: UUID,
     val name: String,
+    @get:JsonProperty("isPrimary")
+    val isPrimary: Boolean,
+    val attachedAt: Instant,
     val repoUrl: String,
     val defaultBranch: String,
     val vaultKeyPath: String,
@@ -97,10 +116,30 @@ data class WorkspaceRepositoryResponse(
     val verification: AccessVerificationResponse?,
 ) {
     companion object {
+        fun of(view: WorkspaceRepositoryView): WorkspaceRepositoryResponse {
+            val r = view.repository
+            return WorkspaceRepositoryResponse(
+                id = r.id.value,
+                name = r.name,
+                isPrimary = view.isPrimary,
+                attachedAt = view.attachedAt,
+                repoUrl = r.repoUrl,
+                defaultBranch = r.defaultBranch,
+                vaultKeyPath = r.vaultKeyPath,
+                deployKeyFingerprint = r.deployKeyFingerprint,
+                deployKeyAddedAt = r.deployKeyAddedAt,
+                createdAt = r.createdAt,
+                updatedAt = r.updatedAt,
+                verification = r.verification?.let(AccessVerificationResponse::of),
+            )
+        }
+
         fun of(r: Repository) =
             WorkspaceRepositoryResponse(
                 id = r.id.value,
                 name = r.name,
+                isPrimary = false,
+                attachedAt = r.createdAt,
                 repoUrl = r.repoUrl,
                 defaultBranch = r.defaultBranch,
                 vaultKeyPath = r.vaultKeyPath,
@@ -133,7 +172,7 @@ data class WorkspaceWithRepositoriesResponse(
     companion object {
         fun of(
             w: Workspace,
-            repositories: List<Repository>,
+            repositories: List<WorkspaceRepositoryView>,
         ) = WorkspaceWithRepositoriesResponse(
             id = w.id.value,
             name = w.name,
@@ -160,7 +199,7 @@ data class WorkspaceDetailResponse(
     companion object {
         fun of(
             workspace: Workspace,
-            repositories: List<Repository>,
+            repositories: List<WorkspaceRepositoryView>,
             sessions: List<WorkspaceAgentSession>,
         ) = WorkspaceDetailResponse(
             workspace = WorkspaceWithRepositoriesResponse.of(workspace, repositories),
diff --git a/services/assistant-api/src/main/resources/application.yml b/services/assistant-api/src/main/resources/application.yml
index 41398009..aec70736 100644
--- a/services/assistant-api/src/main/resources/application.yml
+++ b/services/assistant-api/src/main/resources/application.yml
@@ -116,6 +116,14 @@ agent-runtime:
   # Runner MCP profile. Keep default tool count low; wider profiles are
   # opt-ins via AGENT_RUNTIME_DEFAULT_MCP_PROFILE.
   default-mcp-profile: ${AGENT_RUNTIME_DEFAULT_MCP_PROFILE:minimal}
+  # Runner Pods mount the host Docker socket so future agent sessions can run
+  # Docker CLI commands and JVM Testcontainers suites. This is host-equivalent
+  # access. The default gid is pinned in the Nix host definition for the
+  # Docker-socket-capable runner node; override both values together when
+  # moving runners.
+  docker-socket-enabled: ${AGENT_RUNTIME_DOCKER_SOCKET_ENABLED:true}
+  docker-socket-path: ${AGENT_RUNTIME_DOCKER_SOCKET_PATH:/var/run/docker.sock}
+  docker-socket-supplemental-groups: ${AGENT_RUNTIME_DOCKER_SOCKET_SUPPLEMENTAL_GROUPS:131}
   # Pinning to a single node is mandatory because the shared
   # credential PVCs (claude-credentials / codex-credentials) are
   # backed by local-path RWO — every runner Pod must land on the
@@ -131,6 +139,7 @@ agent-runtime:
   # https://docs.spring.io/spring-boot/reference/features/external-config.html#features.external-config.typesafe-configuration-properties.relaxed-binding.maps
   node-selector:
     '[personal-stack/node]': ${AGENT_RUNTIME_NODE:enschede-gtx-960m-1}
+    '[personal-stack/capability-docker-socket]': ${AGENT_RUNTIME_DOCKER_SOCKET_CAPABILITY:true}
   # Idle scale-down. A workspace whose last observed activity is
   # older than `idle-after-seconds` gets its Pod + Service + per-
   # workspace Secret deleted; the workspace PVC survives so a
diff --git a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommandHandlerTest.kt b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommandHandlerTest.kt
index e581563d..4e9fdfa0 100644
--- a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommandHandlerTest.kt
+++ b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/command/AttachWorkspaceRepositoryCommandHandlerTest.kt
@@ -4,6 +4,8 @@ import com.jorisjonkers.personalstack.assistant.domain.model.Repository
 import com.jorisjonkers.personalstack.assistant.domain.model.RepositoryId
 import com.jorisjonkers.personalstack.assistant.domain.model.Workspace
 import com.jorisjonkers.personalstack.assistant.domain.model.WorkspaceId
+import com.jorisjonkers.personalstack.assistant.domain.model.WorkspaceStatus
+import com.jorisjonkers.personalstack.assistant.domain.port.AgentGatewayClient
 import com.jorisjonkers.personalstack.assistant.domain.port.RepositoryRepository
 import com.jorisjonkers.personalstack.assistant.domain.port.WorkspaceRepository
 import com.jorisjonkers.personalstack.assistant.domain.port.WorkspaceRepositoryRepository
@@ -12,25 +14,56 @@ import io.mockk.mockk
 import io.mockk.verify
 import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.assertThrows
+import java.time.Instant
 
 class AttachWorkspaceRepositoryCommandHandlerTest {
     private val workspaces = mockk<WorkspaceRepository>()
     private val repositories = mockk<RepositoryRepository>()
     private val links = mockk<WorkspaceRepositoryRepository>(relaxed = true)
-    private val handler = AttachWorkspaceRepositoryCommandHandler(workspaces, repositories, links)
+    private val gateway = mockk<AgentGatewayClient>(relaxed = true)
+    private val handler = AttachWorkspaceRepositoryCommandHandler(workspaces, repositories, links, gateway)
 
     private val workspaceId = WorkspaceId.random()
     private val repositoryId = RepositoryId.random()
     private val command = AttachWorkspaceRepositoryCommand(workspaceId, repositoryId)
 
     @Test
-    fun `attaches a non-primary link when both exist`() {
-        every { workspaces.findById(workspaceId) } returns mockk<Workspace>()
-        every { repositories.findById(repositoryId) } returns mockk<Repository>()
+    fun `attaches a non-primary link and clones into a running workspace`() {
+        val workspace = workspace()
+        val repository = repository()
+        every { workspaces.findById(workspaceId) } returns workspace
+        every { repositories.findById(repositoryId) } returns repository
+        every { gateway.isReady(workspace) } returns true
 
         handler.handle(command)
 
         verify { links.attach(workspaceId, repositoryId, isPrimary = false) }
+        verify { gateway.clone(workspace, repository.repoUrl, repository.defaultBranch) }
+    }
+
+    @Test
+    fun `attaches without live clone when workspace has no gateway yet`() {
+        val workspace = workspace(gatewayEndpoint = null)
+        every { workspaces.findById(workspaceId) } returns workspace
+        every { repositories.findById(repositoryId) } returns repository()
+
+        handler.handle(command)
+
+        verify { links.attach(workspaceId, repositoryId, isPrimary = false) }
+        verify(exactly = 0) { gateway.clone(any(), any(), any()) }
+    }
+
+    @Test
+    fun `attaches without live clone when gateway is not ready`() {
+        val workspace = workspace()
+        every { workspaces.findById(workspaceId) } returns workspace
+        every { repositories.findById(repositoryId) } returns repository()
+        every { gateway.isReady(workspace) } returns false
+
+        handler.handle(command)
+
+        verify { links.attach(workspaceId, repositoryId, isPrimary = false) }
+        verify(exactly = 0) { gateway.clone(any(), any(), any()) }
     }
 
     @Test
@@ -43,10 +76,37 @@ class AttachWorkspaceRepositoryCommandHandlerTest {
 
     @Test
     fun `rejects an unknown repository`() {
-        every { workspaces.findById(workspaceId) } returns mockk<Workspace>()
+        every { workspaces.findById(workspaceId) } returns workspace()
         every { repositories.findById(repositoryId) } returns null
 
         assertThrows<NoSuchElementException> { handler.handle(command) }
         verify(exactly = 0) { links.attach(any(), any(), any()) }
     }
+
+    private fun workspace(gatewayEndpoint: String? = "http://runner:8090") =
+        Workspace(
+            id = workspaceId,
+            name = "workspace",
+            repoUrl = "git@github.com:o/primary.git",
+            branch = "main",
+            podName = "pod",
+            pvcName = "pvc",
+            gatewayEndpoint = gatewayEndpoint,
+            status = WorkspaceStatus.READY,
+            createdAt = Instant.now(),
+            updatedAt = Instant.now(),
+        )
+
+    private fun repository() =
+        Repository(
+            id = repositoryId,
+            name = "website",
+            repoUrl = "git@github.com:o/website.git",
+            defaultBranch = "main",
+            vaultKeyPath = "secret/data/agents/repositories/${repositoryId.value}",
+            deployKeyFingerprint = null,
+            deployKeyAddedAt = null,
+            createdAt = Instant.now(),
+            updatedAt = Instant.now(),
+        )
 }
diff --git a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommandHandlerTest.kt b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommandHandlerTest.kt
index c601db88..21c82cc9 100644
--- a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommandHandlerTest.kt
+++ b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/command/CreateWorkspaceCommandHandlerTest.kt
@@ -264,6 +264,8 @@ class CreateWorkspaceCommandHandlerTest {
                 updatedAt = Instant.now(),
             )
         every { repositories.findById(primaryRepoId) } returns repository
+        every { repositories.findById(extraRepoId) } returns repository(extraRepoId, "extra-one")
+        every { repositories.findById(secondExtraRepoId) } returns repository(secondExtraRepoId, "extra-two")
         every { githubLinks.findById(GithubLinkId(primaryRepoId.value)) } returns null
         every { projectRepositoryLinks.findAllByProjectId(projectId) } returns
             listOf(
@@ -296,6 +298,41 @@ class CreateWorkspaceCommandHandlerTest {
         }
     }
 
+    @Test
+    fun `repositoryIds-only create treats first selected repository as primary and attaches distinct extras`() {
+        val primaryRepoId = RepositoryId.random()
+        val extraRepoId = RepositoryId.random()
+        val secondExtraRepoId = RepositoryId.random()
+        every { repositories.findById(primaryRepoId) } returns repository(primaryRepoId, "primary")
+        every { repositories.findById(extraRepoId) } returns repository(extraRepoId, "extra")
+        every { repositories.findById(secondExtraRepoId) } returns repository(secondExtraRepoId, "docs")
+        every { githubLinks.findById(GithubLinkId(primaryRepoId.value)) } returns null
+        val saved = mutableListOf<Workspace>()
+        every { workspaces.save(capture(saved)) } answers { firstArg() }
+        every { orchestrator.provision(any()) } returns
+            AgentRunnerOrchestrator.RunnerHandle("p", "v", "http://p.svc:8090")
+        val workspaceId = WorkspaceId.random()
+
+        handler.handle(
+            CreateWorkspaceCommand(
+                workspaceId = workspaceId,
+                name = "demo",
+                repoUrl = null,
+                branch = null,
+                repositoryIds = listOf(primaryRepoId, extraRepoId, primaryRepoId, secondExtraRepoId),
+            ),
+        )
+
+        assertThat(saved.first().repositoryId).isEqualTo(primaryRepoId)
+        verifyOrder {
+            workspaces.save(match { it.id == workspaceId && it.repositoryId == primaryRepoId })
+            workspaceRepositoryLinks.attach(workspaceId, primaryRepoId, isPrimary = true)
+            workspaceRepositoryLinks.attach(workspaceId, extraRepoId, isPrimary = false)
+            workspaceRepositoryLinks.attach(workspaceId, secondExtraRepoId, isPrimary = false)
+            orchestrator.provision(match { it.id == workspaceId })
+        }
+    }
+
     @Test
     fun `handle leaves legacy linkId null when no github_links mirror exists`() {
         // Regression for the production workspace 500: post-V9
@@ -667,4 +704,19 @@ class CreateWorkspaceCommandHandlerTest {
 
         verify(exactly = 0) { verifyAccess.verify(any(), any()) }
     }
+
+    private fun repository(
+        id: RepositoryId,
+        name: String,
+    ) = Repository(
+        id = id,
+        name = name,
+        repoUrl = "git@github.com:ExtraToast/$name.git",
+        defaultBranch = "main",
+        vaultKeyPath = "secret/data/agents/repositories/$id",
+        deployKeyFingerprint = null,
+        deployKeyAddedAt = null,
+        createdAt = Instant.now(),
+        updatedAt = Instant.now(),
+    )
 }
diff --git a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/query/GetWorkspaceQueryServiceTest.kt b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/query/GetWorkspaceQueryServiceTest.kt
index 74b56b2f..2408b343 100644
--- a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/query/GetWorkspaceQueryServiceTest.kt
+++ b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/application/query/GetWorkspaceQueryServiceTest.kt
@@ -57,7 +57,25 @@ class GetWorkspaceQueryServiceTest {
 
         assertThat(result.workspace).isEqualTo(w)
         assertThat(result.sessions).isEmpty()
-        assertThat(result.repositories).containsExactly(r1, r2)
+        assertThat(result.repositories.map { it.repository }).containsExactly(r1, r2)
+        assertThat(result.repositories.map { it.isPrimary }).containsExactly(true, false)
+    }
+
+    @Test
+    fun `get includes denormalized primary repository when junction row is missing`() {
+        val repoId = RepositoryId.random()
+        val w = workspace(repositoryId = repoId)
+        val r = repository(id = repoId)
+        every { workspaces.findById(w.id) } returns w
+        every { sessions.findAllByWorkspaceId(w.id) } returns emptyList()
+        every { workspaceRepositories.findAllByWorkspaceId(w.id) } returns emptyList()
+        every { repositories.findById(repoId) } returns r
+
+        val result = service.get(w.id) ?: error("expected workspace detail")
+
+        assertThat(result.repositories.map { it.repository }).containsExactly(r)
+        assertThat(result.repositories.single().isPrimary).isTrue
+        assertThat(result.repositories.single().attachedAt).isEqualTo(w.createdAt)
     }
 
     @Test
@@ -87,19 +105,22 @@ class GetWorkspaceQueryServiceTest {
             .hasMessageContaining("references missing repository ${missingRepositoryId.value}")
     }
 
-    private fun workspace(id: WorkspaceId = WorkspaceId.random()) =
-        Workspace(
-            id = id,
-            name = "demo",
-            repoUrl = "git@github.com:owner/repo.git",
-            branch = "main",
-            podName = "pod",
-            pvcName = "pvc",
-            gatewayEndpoint = "http://endpoint:8090",
-            status = WorkspaceStatus.READY,
-            createdAt = Instant.now(),
-            updatedAt = Instant.now(),
-        )
+    private fun workspace(
+        id: WorkspaceId = WorkspaceId.random(),
+        repositoryId: RepositoryId? = null,
+    ) = Workspace(
+        id = id,
+        name = "demo",
+        repoUrl = "git@github.com:owner/repo.git",
+        branch = "main",
+        podName = "pod",
+        pvcName = "pvc",
+        gatewayEndpoint = "http://endpoint:8090",
+        status = WorkspaceStatus.READY,
+        createdAt = Instant.now(),
+        updatedAt = Instant.now(),
+        repositoryId = repositoryId,
+    )
 
     private fun repository(
         id: RepositoryId = RepositoryId.random(),
diff --git a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/config/AgentRuntimePropertiesBindingTest.kt b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/config/AgentRuntimePropertiesBindingTest.kt
index e1014a24..7eb8a531 100644
--- a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/config/AgentRuntimePropertiesBindingTest.kt
+++ b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/config/AgentRuntimePropertiesBindingTest.kt
@@ -100,6 +100,29 @@ class AgentRuntimePropertiesBindingTest {
             .hasMessageContaining("frontned")
     }
 
+    @Test
+    fun `docker socket defaults keep testcontainers available in runner pods`() {
+        val props = bind(base)
+
+        assertThat(props.dockerSocketEnabled).isTrue()
+        assertThat(props.dockerSocketPath).isEqualTo("/var/run/docker.sock")
+        assertThat(props.dockerSocketSupplementalGroups).containsExactly(131L)
+        assertThat(props.nodeSelector).containsEntry("personal-stack/capability-docker-socket", "true")
+    }
+
+    @Test
+    fun `docker socket supplemental groups bind from comma separated environment value`() {
+        val props =
+            bind(
+                base +
+                    mapOf(
+                        "agent-runtime.docker-socket-supplemental-groups" to "44,45",
+                    ),
+            )
+
+        assertThat(props.dockerSocketSupplementalGroups).containsExactly(44L, 45L)
+    }
+
     private fun bind(properties: Map<String, String>): AgentRuntimeProperties {
         val source = MapConfigurationPropertySource(properties)
         return Binder(source)
diff --git a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/WorkspaceControllerTest.kt b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/WorkspaceControllerTest.kt
index 3eeddb13..6d474bfa 100644
--- a/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/WorkspaceControllerTest.kt
+++ b/services/assistant-api/src/test/kotlin/com/jorisjonkers/personalstack/assistant/infrastructure/web/WorkspaceControllerTest.kt
@@ -2,6 +2,7 @@ package com.jorisjonkers.personalstack.assistant.infrastructure.web
 
 import com.fasterxml.jackson.databind.ObjectMapper
 import com.jorisjonkers.personalstack.assistant.application.command.AttachWorkspaceRepositoryCommand
+import com.jorisjonkers.personalstack.assistant.application.command.CreateWorkspaceCommand
 import com.jorisjonkers.personalstack.assistant.application.command.DetachWorkspaceRepositoryCommand
 import com.jorisjonkers.personalstack.assistant.application.query.GetWorkspaceQueryService
 import com.jorisjonkers.personalstack.assistant.application.query.ListWorkspacesQueryService
@@ -110,6 +111,65 @@ class WorkspaceControllerTest {
         verify { commandBus.dispatch(any()) }
     }
 
+    @Test
+    fun `POST creates a workspace with primary and extra repository ids`() {
+        val primaryRepositoryId = RepositoryId.random()
+        val extraRepositoryId = RepositoryId.random()
+        val w = workspace(kind = WorkspaceKind.REPO_BACKED, repositoryId = primaryRepositoryId)
+        every { getQuery.getSummary(any()) } returns w
+
+        mockMvc
+            .perform(
+                post("/api/v1/workspaces")
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .content(
+                        objectMapper.writeValueAsString(
+                            mapOf(
+                                "name" to "demo",
+                                "kind" to "REPO_BACKED",
+                                "primaryRepositoryId" to primaryRepositoryId.value.toString(),
+                                "repositoryIds" to
+                                    listOf(
+                                        extraRepositoryId.value.toString(),
+                                        primaryRepositoryId.value.toString(),
+                                        extraRepositoryId.value.toString(),
+                                    ),
+                            ),
+                        ),
+                    ),
+            ).andExpect(status().isCreated)
+            .andExpect(jsonPath("$.repositoryId").value(primaryRepositoryId.value.toString()))
+
+        verify {
+            commandBus.dispatch(
+                match<CreateWorkspaceCommand> {
+                    it.repositoryId == primaryRepositoryId &&
+                        it.repositoryIds == listOf(primaryRepositoryId, extraRepositoryId)
+                },
+            )
+        }
+    }
+
+    @Test
+    fun `POST rejects conflicting primary repository fields`() {
+        mockMvc
+            .perform(
+                post("/api/v1/workspaces")
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .content(
+                        objectMapper.writeValueAsString(
+                            mapOf(
+                                "name" to "demo",
+                                "repositoryId" to UUID.randomUUID().toString(),
+                                "primaryRepositoryId" to UUID.randomUUID().toString(),
+                            ),
+                        ),
+                    ),
+            ).andExpect(status().isBadRequest)
+
+        verify(exactly = 0) { commandBus.dispatch(any()) }
+    }
+
     @Test
     fun `POST returns error on blank name`() {
         mockMvc
@@ -140,13 +200,25 @@ class WorkspaceControllerTest {
     fun `GET by id returns workspace detail with repositories under workspace`() {
         val w = workspace()
         val r = repository()
-        every { getQuery.get(w.id) } returns GetWorkspaceQueryService.WorkspaceView(w, emptyList(), listOf(r))
+        every { getQuery.get(w.id) } returns
+            GetWorkspaceQueryService.WorkspaceView(
+                w,
+                emptyList(),
+                listOf(
+                    GetWorkspaceQueryService.WorkspaceRepositoryView(
+                        repository = r,
+                        isPrimary = true,
+                        attachedAt = Instant.now(),
+                    ),
+                ),
+            )
         mockMvc
             .perform(get("/api/v1/workspaces/${w.id.value}"))
             .andExpect(status().isOk)
             .andExpect(jsonPath("$.workspace.id").value(w.id.value.toString()))
             .andExpect(jsonPath("$.workspace.repositories[0].id").value(r.id.value.toString()))
             .andExpect(jsonPath("$.workspace.repositories[0].name").value("personal-stack"))
+            .andExpect(jsonPath("$.workspace.repositories[0].isPrimary").value(true))
             .andExpect(jsonPath("$.sessions").isArray)
     }
 
diff --git a/services/assistant-ui/src/api/generated.ts b/services/assistant-ui/src/api/generated.ts
index 5dba7530..b77d15b1 100644
--- a/services/assistant-ui/src/api/generated.ts
+++ b/services/assistant-ui/src/api/generated.ts
@@ -491,6 +491,9 @@ export interface components {
             projectId?: string | null;
             /** Format: uuid */
             repositoryId?: string | null;
+            /** Format: uuid */
+            primaryRepositoryId?: string | null;
+            repositoryIds?: string[] | null;
             /**
              * Format: uuid
              * @deprecated
@@ -721,6 +724,9 @@ export interface components {
             /** Format: uuid */
             id: string;
             name: string;
+            isPrimary: boolean;
+            /** Format: date-time */
+            attachedAt: string;
             repoUrl: string;
             defaultBranch: string;
             vaultKeyPath: string;
@@ -927,8 +933,8 @@ export interface operations {
             };
         };
         responses: {
-            /** @description OK */
-            200: {
+            /** @description No Content */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
diff --git a/services/assistant-ui/src/features/sessions/__tests__/CreateWorkspaceWizard.test.ts b/services/assistant-ui/src/features/sessions/__tests__/CreateWorkspaceWizard.test.ts
new file mode 100644
index 00000000..33ce0bee
--- /dev/null
+++ b/services/assistant-ui/src/features/sessions/__tests__/CreateWorkspaceWizard.test.ts
@@ -0,0 +1,215 @@
+import type { Project, ProjectDetail } from '@/features/projects'
+import type { Repository, RepositoryDetail } from '@/features/repositories'
+import type { Workspace } from '@/features/workspaces'
+import { mount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createMemoryHistory, createRouter } from 'vue-router'
+import CreateWorkspaceWizard from '../components/CreateWorkspaceWizard.vue'
+
+vi.mock('@personal-stack/vue-common', () => ({
+  FormErrors: {
+    props: ['error'],
+    template: '<div v-if="error">{{ error }}</div>',
+  },
+  FormField: {
+    props: ['label'],
+    template: '<label><span>{{ label }}</span><slot :id="label" /></label>',
+  },
+  SubmitButton: {
+    props: ['disabled', 'label', 'type'],
+    emits: ['click'],
+    template:
+      '<button v-bind="$attrs" :type="type || \'button\'" :disabled="disabled" @click="$emit(\'click\')">{{ label }}</button>',
+  },
+  useFormErrors: () => ({
+    general: { value: null },
+    clear: vi.fn(),
+    captureFromCatch: vi.fn(),
+    fieldErrorFor: vi.fn(() => null),
+  }),
+  useMutationState: () => ({
+    status: { value: 'idle' },
+    run: async (fn: () => Promise<void>) => fn(),
+  }),
+  useToast: () => ({
+    success: vi.fn(),
+    errorFromCatch: vi.fn(),
+  }),
+}))
+
+const listProjects = vi.fn<() => Promise<Project[]>>()
+const getProject = vi.fn<(id: string) => Promise<ProjectDetail>>()
+vi.mock('@/features/projects/services/projectsService', () => ({
+  listProjects: () => listProjects(),
+  getProject: (id: string) => getProject(id),
+  createProject: vi.fn(),
+  linkRepository: vi.fn(),
+  unlinkRepository: vi.fn(),
+  addLink: vi.fn(),
+  removeLink: vi.fn(),
+  attachKey: vi.fn(),
+}))
+
+const getRepository = vi.fn<(id: string) => Promise<RepositoryDetail>>()
+vi.mock('@/features/repositories/services/repositoriesService', () => ({
+  listRepositories: vi.fn(),
+  getRepository: (id: string) => getRepository(id),
+  createRepository: vi.fn(),
+  attachDeployKey: vi.fn(),
+  deleteRepository: vi.fn(),
+  verifyRepositoryAccess: vi.fn(),
+}))
+
+const createWorkspace = vi.fn()
+const attachRepository = vi.fn()
+vi.mock('@/features/workspaces/services/workspaceService', () => ({
+  listWorkspaces: vi.fn(),
+  getWorkspace: vi.fn(),
+  createWorkspace: (...args: unknown[]) => createWorkspace(...args),
+  destroyWorkspace: vi.fn(),
+  attachRepository: (...args: unknown[]) => attachRepository(...args),
+  detachRepository: vi.fn(),
+  startSession: vi.fn(),
+  stopSession: vi.fn(),
+  getTurns: vi.fn(),
+  sendInput: vi.fn(),
+}))
+
+function fakeProject(over: Partial<Project> = {}): Project {
+  return {
+    id: 'project-1',
+    name: 'Project One',
+    slug: 'project-one',
+    description: '',
+    createdAt: '2026-05-20T10:00:00Z',
+    updatedAt: '2026-05-20T10:00:00Z',
+    ...over,
+  }
+}
+
+function fakeRepository(over: Partial<Repository> = {}): Repository {
+  return {
+    id: 'repo-primary',
+    name: 'primary',
+    repoUrl: 'git@github.com:owner/primary.git',
+    defaultBranch: 'main',
+    vaultKeyPath: 'secret/data/agents/repositories/repo-primary',
+    deployKeyFingerprint: 'SHA256:primary',
+    deployKeyAddedAt: '2026-05-20T10:00:00Z',
+    createdAt: '2026-05-20T10:00:00Z',
+    updatedAt: '2026-05-20T10:00:00Z',
+    ...over,
+  }
+}
+
+function fakeWorkspace(over: Partial<Workspace> = {}): Workspace {
+  return {
+    id: 'ws-new',
+    name: 'workspace',
+    repoUrl: 'git@github.com:owner/primary.git',
+    branch: 'trunk',
+    podName: null,
+    gatewayEndpoint: null,
+    status: 'PENDING',
+    kind: 'REPO_BACKED',
+    projectId: 'project-1',
+    repositoryId: 'repo-primary',
+    githubLinkId: null,
+    createdAt: '2026-05-20T10:00:00Z',
+    updatedAt: '2026-05-20T10:00:00Z',
+    ...over,
+  }
+}
+
+async function mountWizard() {
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      { path: '/sessions', component: { template: '<div />' } },
+      { path: '/sessions/workspace/:id', component: { template: '<div />' } },
+      { path: '/projects', component: { template: '<div />' } },
+      { path: '/repositories', component: { template: '<div />' } },
+      { path: '/repositories/:id', component: { template: '<div />' } },
+    ],
+  })
+  await router.push('/sessions')
+  await router.isReady()
+
+  const wrapper = mount(CreateWorkspaceWizard, {
+    props: { open: true },
+    global: { plugins: [router] },
+  })
+  await flush()
+  return { router, wrapper }
+}
+
+describe('createWorkspaceWizard', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    listProjects.mockReset()
+    getProject.mockReset()
+    getRepository.mockReset()
+    createWorkspace.mockReset()
+    attachRepository.mockReset()
+  })
+
+  it('creates with a primary repository and selected repository ids', async () => {
+    const project = fakeProject()
+    const primary = fakeRepository({ defaultBranch: 'trunk' })
+    const extra = fakeRepository({
+      id: 'repo-extra',
+      name: 'extra',
+      repoUrl: 'git@github.com:owner/extra.git',
+      vaultKeyPath: 'secret/data/agents/repositories/repo-extra',
+      deployKeyFingerprint: 'SHA256:extra',
+    })
+    const skipped = fakeRepository({
+      id: 'repo-skipped',
+      name: 'skipped',
+      repoUrl: 'git@github.com:owner/skipped.git',
+      vaultKeyPath: 'secret/data/agents/repositories/repo-skipped',
+      deployKeyFingerprint: 'SHA256:skipped',
+    })
+    listProjects.mockResolvedValue([project])
+    getProject.mockResolvedValue({ project, links: [], repositories: [primary, extra, skipped] })
+    getRepository.mockResolvedValue({ repository: primary, attachedProjects: [] })
+    createWorkspace.mockResolvedValue(fakeWorkspace())
+
+    const { router, wrapper } = await mountWizard()
+
+    await wrapper.get('[data-testid="wizard-project-project-1"]').setValue()
+    await flush()
+    await wrapper.get('[data-testid="wizard-step1-next"]').trigger('click')
+    await flush()
+    await wrapper.get('[data-testid="wizard-repo-primary-repo-primary"]').setValue()
+    await flush()
+    await wrapper.get('[data-testid="wizard-repo-checkbox-repo-extra"]').setValue(true)
+    await flush()
+    await wrapper.get('[data-testid="wizard-step2-next"]').trigger('click')
+    await flush()
+    await wrapper.get('[data-testid="wizard-name"]').setValue('workspace')
+    await wrapper.get('[data-testid="wizard-submit"]').trigger('click')
+    await flush()
+
+    expect(createWorkspace).toHaveBeenCalledWith({
+      name: 'workspace',
+      kind: 'REPO_BACKED',
+      projectId: 'project-1',
+      repositoryId: 'repo-primary',
+      primaryRepositoryId: 'repo-primary',
+      repositoryIds: ['repo-primary', 'repo-extra'],
+      branch: 'trunk',
+    })
+    expect(attachRepository).not.toHaveBeenCalled()
+    await vi.waitFor(() => {
+      expect(router.currentRoute.value.fullPath).toBe('/sessions/workspace/ws-new')
+    })
+  })
+})
+
+async function flush(): Promise<void> {
+  await Promise.resolve()
+  await Promise.resolve()
+  await Promise.resolve()
+}
diff --git a/services/assistant-ui/src/features/sessions/components/CreateWorkspaceWizard.vue b/services/assistant-ui/src/features/sessions/components/CreateWorkspaceWizard.vue
index 6c8515d9..503d0f0d 100644
--- a/services/assistant-ui/src/features/sessions/components/CreateWorkspaceWizard.vue
+++ b/services/assistant-ui/src/features/sessions/components/CreateWorkspaceWizard.vue
@@ -32,7 +32,8 @@ const toast = useToast()
 
 const step = ref<'pick-project' | 'pick-repo' | 'pick-branch'>('pick-project')
 const selectedProjectId = ref<string | null>(null)
-const selectedRepositoryId = ref<string | null>(null)
+const selectedPrimaryRepositoryId = ref<string | null>(null)
+const selectedRepositoryIds = ref<string[]>([])
 const branch = ref('main')
 const name = ref('')
 
@@ -53,7 +54,8 @@ onMounted(async () => {
 
 watch(selectedProjectId, async (id) => {
   if (!id) return
-  selectedRepositoryId.value = null
+  selectedPrimaryRepositoryId.value = null
+  selectedRepositoryIds.value = []
   try {
     await projects.open(id)
   } catch (e) {
@@ -61,7 +63,7 @@ watch(selectedProjectId, async (id) => {
   }
 })
 
-watch(selectedRepositoryId, async (id) => {
+watch(selectedPrimaryRepositoryId, async (id) => {
   if (!id) return
   // Load detail so we can read the default branch + key state.
   try {
@@ -77,13 +79,54 @@ watch(selectedRepositoryId, async (id) => {
 })
 
 const projectRepos = computed(() => projects.repositories)
-const selectedRepo = computed(() =>
-  selectedRepositoryId.value ? (repos.detailById[selectedRepositoryId.value]?.repository ?? null) : null,
+const selectedRepo = computed(() => {
+  const primaryId = selectedPrimaryRepositoryId.value
+  if (!primaryId) return null
+
+  const loadedRepo = repos.detailById[primaryId]?.repository
+  if (loadedRepo) return loadedRepo
+
+  return projectRepos.value.find((r) => r.id === primaryId) ?? null
+})
+const selectedRepositories = computed(() => {
+  const ids = new Set(selectedRepositoryIds.value)
+  return projectRepos.value.filter((r) => ids.has(r.id))
+})
+const additionalRepositoriesMissingKeys = computed(() =>
+  selectedRepositories.value.filter((r) => r.id !== selectedPrimaryRepositoryId.value && !r.deployKeyFingerprint),
 )
 const keyAttached = computed(() => Boolean(selectedRepo.value?.deployKeyFingerprint))
+const selectedRepositoryCount = computed(() => selectedRepositoryIds.value.length)
+
+function ensureRepositorySelected(repositoryId: string): void {
+  if (selectedRepositoryIds.value.includes(repositoryId)) return
+  selectedRepositoryIds.value = [...selectedRepositoryIds.value, repositoryId]
+}
+
+function checked(event: Event): boolean {
+  return event.target instanceof HTMLInputElement && event.target.checked
+}
+
+function onRepositorySelectionChange(repositoryId: string, isSelected: boolean): void {
+  if (isSelected) {
+    ensureRepositorySelected(repositoryId)
+    if (!selectedPrimaryRepositoryId.value) selectedPrimaryRepositoryId.value = repositoryId
+    return
+  }
+
+  selectedRepositoryIds.value = selectedRepositoryIds.value.filter((id) => id !== repositoryId)
+  if (selectedPrimaryRepositoryId.value === repositoryId) {
+    selectedPrimaryRepositoryId.value = selectedRepositoryIds.value[0] ?? null
+  }
+}
+
+function onPrimaryRepositoryChange(repositoryId: string): void {
+  selectedPrimaryRepositoryId.value = repositoryId
+  ensureRepositorySelected(repositoryId)
+}
 
 async function onSubmit(): Promise<void> {
-  if (!selectedProjectId.value || !selectedRepositoryId.value || !name.value.trim()) return
+  if (!selectedProjectId.value || !selectedPrimaryRepositoryId.value || !name.value.trim()) return
   formErrors.clear()
   try {
     await create.run(async () => {
@@ -91,7 +134,9 @@ async function onSubmit(): Promise<void> {
         name: name.value.trim(),
         kind: 'REPO_BACKED',
         projectId: selectedProjectId.value,
-        repositoryId: selectedRepositoryId.value,
+        repositoryId: selectedPrimaryRepositoryId.value,
+        primaryRepositoryId: selectedPrimaryRepositoryId.value,
+        repositoryIds: selectedRepositoryIds.value,
         branch: branch.value.trim() || 'main',
       })
       emit('created', ws.id)
@@ -101,7 +146,8 @@ async function onSubmit(): Promise<void> {
     // Reset for next time.
     step.value = 'pick-project'
     selectedProjectId.value = null
-    selectedRepositoryId.value = null
+    selectedPrimaryRepositoryId.value = null
+    selectedRepositoryIds.value = []
     branch.value = 'main'
     name.value = ''
   } catch (e) {
@@ -119,7 +165,7 @@ async function onSubmit(): Promise<void> {
     <ol class="flex items-center gap-2 text-xs text-[var(--color-text-muted)]">
       <li :class="step === 'pick-project' ? 'text-[var(--color-accent-light)]' : ''">1. Project</li>
       <span>→</span>
-      <li :class="step === 'pick-repo' ? 'text-[var(--color-accent-light)]' : ''">2. Repository</li>
+      <li :class="step === 'pick-repo' ? 'text-[var(--color-accent-light)]' : ''">2. Repositories</li>
       <span>→</span>
       <li :class="step === 'pick-branch' ? 'text-[var(--color-accent-light)]' : ''">3. Branch + name</li>
     </ol>
@@ -166,7 +212,8 @@ async function onSubmit(): Promise<void> {
 
     <section v-else-if="step === 'pick-repo'" class="space-y-3">
       <p class="text-sm text-[var(--color-text-muted)]">
-        Pick a repository from the project's pool. Need a different one?
+        Select the repositories to clone into this workspace, then choose one primary repository for the branch and
+        split workflow defaults. Need a different one?
         <RouterLink to="/repositories" class="text-[var(--color-accent-light)] underline">
           Add a repository
         </RouterLink>
@@ -174,25 +221,37 @@ async function onSubmit(): Promise<void> {
       </p>
       <ul v-if="projectRepos.length > 0" class="space-y-2 max-h-72 overflow-y-auto">
         <li v-for="r in projectRepos" :key="r.id">
-          <label
-            class="flex items-baseline gap-3 rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-card)] p-3 cursor-pointer hover:border-[var(--color-accent)]"
-          >
-            <input
-              v-model="selectedRepositoryId"
-              type="radio"
-              :value="r.id"
-              class="mt-1"
-              :data-testid="`wizard-repo-${r.id}`"
-            />
-            <div class="flex-1">
-              <div class="flex items-baseline justify-between">
-                <span class="font-semibold">{{ r.name }}</span>
-                <span v-if="!r.deployKeyFingerprint" class="text-xs text-amber-400">no key yet</span>
-                <span v-else class="text-xs text-emerald-400">key attached</span>
+          <div class="rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-card)] p-3">
+            <label class="flex cursor-pointer items-start gap-3">
+              <input
+                :checked="selectedRepositoryIds.includes(r.id)"
+                type="checkbox"
+                :value="r.id"
+                class="mt-1"
+                :data-testid="`wizard-repo-checkbox-${r.id}`"
+                @change="onRepositorySelectionChange(r.id, checked($event))"
+              />
+              <div class="min-w-0 flex-1">
+                <div class="flex items-baseline justify-between">
+                  <span class="font-semibold">{{ r.name }}</span>
+                  <span v-if="!r.deployKeyFingerprint" class="text-xs text-amber-400">no key yet</span>
+                  <span v-else class="text-xs text-emerald-400">key attached</span>
+                </div>
+                <p class="font-mono text-xs text-[var(--color-text-muted)]">{{ r.repoUrl }}</p>
               </div>
-              <p class="font-mono text-xs text-[var(--color-text-muted)]">{{ r.repoUrl }}</p>
-            </div>
-          </label>
+            </label>
+            <label class="mt-3 flex cursor-pointer items-center gap-2 pl-7 text-xs text-[var(--color-text-muted)]">
+              <input
+                :checked="selectedPrimaryRepositoryId === r.id"
+                type="radio"
+                name="workspace-primary-repository"
+                :value="r.id"
+                :data-testid="`wizard-repo-primary-${r.id}`"
+                @change="onPrimaryRepositoryChange(r.id)"
+              />
+              Primary repository
+            </label>
+          </div>
         </li>
       </ul>
       <p v-else class="text-sm text-[var(--color-text-muted)] italic">No repositories linked to this project yet.</p>
@@ -202,17 +261,27 @@ async function onSubmit(): Promise<void> {
         class="rounded-md border border-amber-500/40 bg-amber-500/5 p-3 text-sm text-amber-300"
         data-testid="wizard-missing-key-warning"
       >
-        The selected repository has no deploy key yet — the runner Pod won't be able to clone it.
-        <RouterLink :to="`/repositories/${selectedRepositoryId}`" class="underline">Attach a key</RouterLink>
+        The primary repository has no deploy key yet — the runner Pod won't be able to clone it.
+        <RouterLink :to="`/repositories/${selectedPrimaryRepositoryId}`" class="underline">Attach a key</RouterLink>
         first.
       </div>
 
+      <div
+        v-if="additionalRepositoriesMissingKeys.length > 0"
+        class="rounded-md border border-amber-500/40 bg-amber-500/5 p-3 text-sm text-amber-300"
+        data-testid="wizard-missing-selected-keys-warning"
+      >
+        {{ additionalRepositoriesMissingKeys.length }} selected
+        {{ additionalRepositoriesMissingKeys.length === 1 ? 'repository has' : 'repositories have' }} no deploy key yet;
+        additional repositories clone with the GitHub App token when the runner starts.
+      </div>
+
       <div class="flex justify-end gap-2">
         <SubmitButton type="button" variant="secondary" label="Back" @click="step = 'pick-project'" />
         <SubmitButton
           type="button"
-          label="Next"
-          :disabled="!selectedRepositoryId || !keyAttached"
+          :label="selectedRepositoryCount > 1 ? `Next (${selectedRepositoryCount} repos)` : 'Next'"
+          :disabled="!selectedPrimaryRepositoryId || !keyAttached"
           data-testid="wizard-step2-next"
           @click="step = 'pick-branch'"
         />
diff --git a/services/assistant-ui/src/features/workspaces/__tests__/SessionTabs.test.ts b/services/assistant-ui/src/features/workspaces/__tests__/SessionTabs.test.ts
index 016baab2..5bc639ae 100644
--- a/services/assistant-ui/src/features/workspaces/__tests__/SessionTabs.test.ts
+++ b/services/assistant-ui/src/features/workspaces/__tests__/SessionTabs.test.ts
@@ -75,4 +75,18 @@ describe('sessionTabs', () => {
     await wrapper.find('[data-testid="session-tab-rename"]').trigger('click')
     expect(wrapper.emitted('select')).toBeUndefined()
   })
+
+  it('renders vertical session controls without nesting the stop action in the selector', async () => {
+    const session = fakeSession()
+    const wrapper = mount(SessionTabs, {
+      props: { sessions: [session], activeId: session.id, orientation: 'vertical' },
+    })
+
+    await wrapper.get(`[data-testid="session-tab-${session.id}"]`).trigger('click')
+    await wrapper.get(`[data-testid="session-tab-stop-${session.id}"]`).trigger('click')
+
+    expect(wrapper.get('[data-testid="session-tabs"]').attributes('aria-label')).toBe('Agent sessions')
+    expect(wrapper.emitted('select')).toEqual([[session.id]])
+    expect(wrapper.emitted('stop')).toEqual([[session.id]])
+  })
 })
diff --git a/services/assistant-ui/src/features/workspaces/__tests__/WorkspaceView.test.ts b/services/assistant-ui/src/features/workspaces/__tests__/WorkspaceView.test.ts
index 32d6a251..de23195d 100644
--- a/services/assistant-ui/src/features/workspaces/__tests__/WorkspaceView.test.ts
+++ b/services/assistant-ui/src/features/workspaces/__tests__/WorkspaceView.test.ts
@@ -159,7 +159,6 @@ async function mountView() {
   const wrapper = mount(WorkspaceView, {
     global: {
       plugins: [router],
-      stubs: { AgentKindPicker: true, SessionTabs: true },
     },
   })
   await flush()
@@ -263,6 +262,24 @@ describe('workspaceView terminal persistence', () => {
     expect(sendInput.mock.calls[0]?.[2]).not.toContain('large document')
   })
 
+  it('keeps workspace controls in the sidebar', async () => {
+    getWorkspace.mockResolvedValue(detail([fakeSession({ id: 'sess-a', gatewayAgentId: 'abc12345' })]))
+
+    const wrapper = await mountView()
+    const sidebar = wrapper.get('[data-testid="workspace-sidebar"]')
+
+    expect(wrapper.get('[data-testid="workspace-view-header"]').find('[data-testid="stage-input-open"]').exists()).toBe(
+      false,
+    )
+    expect(sidebar.find('[data-testid="workspace-agent-panel"]').exists()).toBe(true)
+    expect(sidebar.find('[data-testid="workspace-new-agent"]').exists()).toBe(true)
+    expect(sidebar.find('[data-testid="workspace-tools-panel"]').exists()).toBe(true)
+    expect(sidebar.find('[data-testid="stage-input-open"]').exists()).toBe(true)
+    expect(sidebar.find('[data-testid="workspace-sessions-panel"]').exists()).toBe(true)
+    expect(sidebar.find('[data-testid="session-tabs"]').exists()).toBe(true)
+    expect(sidebar.find('[data-testid="workspace-repositories-panel"]').exists()).toBe(true)
+  })
+
   it('renders attached repositories, marks the primary, and shows split guidance', async () => {
     const primary = fakeWorkspaceRepository({ id: 'repo-primary', name: 'primary', isPrimary: true })
     const destination = fakeWorkspaceRepository({
@@ -281,7 +298,7 @@ describe('workspaceView terminal persistence', () => {
     expect(wrapper.find('[data-testid="workspace-detach-repository-repo-primary"]').exists()).toBe(false)
     expect(wrapper.find('[data-testid="workspace-detach-repository-repo-dest"]').exists()).toBe(true)
     expect(wrapper.find('[data-testid="workspace-split-command"]').text()).toBe(
-      'council split --path path/to/subtree --dest owner/split-dest',
+      'cd /workspace/primary && council split --path path/to/subtree --dest owner/split-dest',
     )
     expect(wrapper.find('[data-testid="split-follow-up"]').text()).toContain(
       'Keep owner/split-dest linked in the project repository pool',
@@ -307,6 +324,29 @@ describe('workspaceView terminal persistence', () => {
     )
   })
 
+  it('sends the split command to the active running session', async () => {
+    const primary = fakeWorkspaceRepository({ id: 'repo-primary', name: 'primary', isPrimary: true })
+    const destination = fakeWorkspaceRepository({
+      id: 'repo-dest',
+      name: 'split-dest',
+      repoUrl: 'git@github.com:owner/split-dest.git',
+    })
+    getWorkspace.mockResolvedValue(
+      detail([fakeSession({ id: 'sess-a', gatewayAgentId: 'abc12345' })], { repositories: [primary, destination] }),
+    )
+
+    const wrapper = await mountView()
+    await wrapper.find('[data-testid="split-send-command"]').trigger('click')
+    await flush()
+
+    expect(sendInput).toHaveBeenCalledWith(
+      'ws-1',
+      'sess-a',
+      'cd /workspace/primary && council split --path path/to/subtree --dest owner/split-dest',
+      true,
+    )
+  })
+
   it('loads candidate repositories, filters attached repositories, and attaches the selected one', async () => {
     const primary = fakeWorkspaceRepository({ id: 'repo-primary', name: 'primary', isPrimary: true })
     const extra = fakeWorkspaceRepository({
@@ -321,7 +361,7 @@ describe('workspaceView terminal persistence', () => {
       fakeRepository({ id: 'repo-primary', name: 'primary' }),
       fakeRepository({ id: 'repo-extra', name: 'extra', repoUrl: 'git@github.com:owner/extra.git' }),
     ])
-    attachRepository.mockResolvedValue([extra])
+    attachRepository.mockResolvedValue(undefined)
     const wrapper = await mountView()
 
     await wrapper.find('[data-testid="workspace-add-repository"]').trigger('click')
diff --git a/services/assistant-ui/src/features/workspaces/__tests__/workspaces.store.test.ts b/services/assistant-ui/src/features/workspaces/__tests__/workspaces.store.test.ts
index 9b347f37..778607c0 100644
--- a/services/assistant-ui/src/features/workspaces/__tests__/workspaces.store.test.ts
+++ b/services/assistant-ui/src/features/workspaces/__tests__/workspaces.store.test.ts
@@ -178,9 +178,9 @@ describe('useWorkspacesStore', () => {
     expect(store.activeWorkspace).toBeNull()
   })
 
-  it('attachRepository attaches to the active workspace and refreshes detail', async () => {
+  it('attachRepository refreshes detail without reading an attach response body', async () => {
     const repo = fakeRepository({ id: 'repo-a' })
-    mocked.attachRepository.mockResolvedValue([repo])
+    mocked.attachRepository.mockResolvedValue()
     mocked.getWorkspace.mockResolvedValue({
       workspace: { ...fakeWorkspace(), repositories: [repo] },
       sessions: [],
diff --git a/services/assistant-ui/src/features/workspaces/components/AgentKindPicker.vue b/services/assistant-ui/src/features/workspaces/components/AgentKindPicker.vue
index b04291e7..cae90e57 100644
--- a/services/assistant-ui/src/features/workspaces/components/AgentKindPicker.vue
+++ b/services/assistant-ui/src/features/workspaces/components/AgentKindPicker.vue
@@ -1,7 +1,9 @@
 <script setup lang="ts">
 import type { AgentKind } from '../types'
 
-defineProps<{ modelValue: AgentKind }>()
+const props = withDefaults(defineProps<{ modelValue: AgentKind; compact?: boolean }>(), {
+  compact: false,
+})
 const emit = defineEmits<{ 'update:modelValue': [value: AgentKind] }>()
 
 const options: { value: AgentKind; label: string; description: string }[] = [
@@ -12,17 +14,25 @@ const options: { value: AgentKind; label: string; description: string }[] = [
 </script>
 
 <template>
-  <div class="grid grid-cols-1 sm:grid-cols-3 gap-2" data-testid="agent-kind-picker">
+  <div
+    class="grid gap-2"
+    :class="props.compact ? 'grid-cols-1' : 'grid-cols-1 sm:grid-cols-3'"
+    data-testid="agent-kind-picker"
+    aria-label="Agent kind"
+  >
     <button
       v-for="opt in options"
       :key="opt.value"
       type="button"
-      class="rounded-lg border p-3 text-left transition-colors"
-      :class="
-        modelValue === opt.value
-          ? 'border-blue-500 bg-blue-500/10'
-          : 'border-[var(--color-surface-border)] hover:border-[var(--color-text-muted)]'
-      "
+      class="rounded-md border text-left transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)]"
+      :class="[
+        props.compact ? 'p-2.5' : 'p-3',
+        props.modelValue === opt.value
+          ? 'border-[var(--color-accent-light)] bg-[var(--color-surface-elevated)] text-[var(--color-text-primary)]'
+          : 'border-[var(--color-surface-border)] bg-[var(--color-surface)] text-[var(--color-text-primary)] hover:border-[var(--color-accent-light)]',
+      ]"
+      :aria-pressed="props.modelValue === opt.value"
+      :aria-label="opt.label"
       @click="emit('update:modelValue', opt.value)"
     >
       <div class="font-semibold">{{ opt.label }}</div>
diff --git a/services/assistant-ui/src/features/workspaces/components/SessionTabs.vue b/services/assistant-ui/src/features/workspaces/components/SessionTabs.vue
index af5b70d9..3941e4a4 100644
--- a/services/assistant-ui/src/features/workspaces/components/SessionTabs.vue
+++ b/services/assistant-ui/src/features/workspaces/components/SessionTabs.vue
@@ -1,15 +1,25 @@
 <script setup lang="ts">
 import type { AgentSession } from '../types'
-import { nextTick, ref } from 'vue'
+import { computed, nextTick, ref } from 'vue'
 import { useSessionLabelsStore } from '../stores/sessionLabels'
 
-defineProps<{ sessions: AgentSession[]; activeId: string | null }>()
+interface Props {
+  sessions: AgentSession[]
+  activeId: string | null
+  orientation?: 'horizontal' | 'vertical'
+}
+
+const props = withDefaults(defineProps<Props>(), {
+  orientation: 'horizontal',
+})
+
 const emit = defineEmits<{
   select: [id: string]
   stop: [id: string]
 }>()
 
 const labels = useSessionLabelsStore()
+const isVertical = computed(() => props.orientation === 'vertical')
 
 const kindBadge: Record<AgentSession['kind'], string> = {
   CLAUDE: 'bg-orange-500/20 text-orange-300',
@@ -50,50 +60,100 @@ function focusInput(el: unknown): void {
     el.select()
   }
 }
+
+function sessionShellClasses(s: AgentSession): string[] {
+  const active = props.activeId === s.id
+  const base = [
+    'min-w-0 flex-1 items-center gap-2 text-sm transition-colors',
+    'focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)]',
+    'focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)]',
+  ].join(' ')
+
+  if (isVertical.value) {
+    return [
+      base,
+      'flex rounded-md border px-3 py-2 text-left',
+      active
+        ? 'border-[var(--color-accent-light)] bg-[var(--color-surface-elevated)] text-[var(--color-text-primary)]'
+        : 'border-[var(--color-surface-border)] bg-[var(--color-surface)] text-[var(--color-text-muted)] hover:border-[var(--color-accent-light)] hover:text-[var(--color-text-primary)]',
+    ]
+  }
+
+  return [
+    base,
+    'flex border-b-2 px-3 py-2',
+    active
+      ? 'border-[var(--color-accent-light)] text-[var(--color-text-primary)]'
+      : 'border-transparent text-[var(--color-text-muted)] hover:text-[var(--color-text-primary)]',
+  ]
+}
 </script>
 
 <template>
-  <div class="flex gap-1 border-b border-[var(--color-surface-border)] px-2" data-testid="session-tabs">
-    <button
-      v-for="s in sessions"
-      :key="s.id"
-      type="button"
-      class="flex items-center gap-2 px-3 py-2 text-sm border-b-2 transition-colors"
-      :class="
-        activeId === s.id
-          ? 'border-blue-500 text-white'
-          : 'border-transparent text-[var(--color-text-muted)] hover:text-[var(--color-text-primary)]'
-      "
-      @click="emit('select', s.id)"
-      @contextmenu.prevent="startEdit(s)"
-      @dblclick.prevent="startEdit(s)"
-    >
-      <span class="px-2 py-0.5 rounded text-xs font-semibold" :class="kindBadge[s.kind]">{{ s.kind }}</span>
-      <input
-        v-if="editingId === s.id"
-        :ref="(el) => focusInput(el)"
-        v-model="draft"
-        type="text"
-        :placeholder="s.id.slice(0, 8)"
-        data-testid="session-tab-rename"
-        class="w-28 bg-transparent border-b border-blue-500 font-mono text-sm focus:outline-none"
-        @click.stop
-        @keydown.enter.prevent="commit(s.id)"
-        @keydown.esc.prevent="cancel"
-        @blur="commit(s.id)"
-      />
-      <span v-else class="font-mono" :title="s.id">{{ tabLabel(s) }}</span>
-      <span class="text-xs" :class="s.status === 'RUNNING' ? 'text-green-400' : 'text-[var(--color-text-muted)]'">{{
-        s.status
-      }}</span>
-      <button
-        v-if="s.status === 'RUNNING'"
-        type="button"
-        class="text-red-400 hover:text-red-300 text-xs ml-1"
-        @click.stop="emit('stop', s.id)"
-      >
-        ×
-      </button>
-    </button>
-  </div>
+  <nav
+    :class="isVertical ? 'space-y-2' : 'border-b border-[var(--color-surface-border)] px-2'"
+    data-testid="session-tabs"
+    aria-label="Agent sessions"
+  >
+    <p v-if="props.sessions.length === 0" class="text-sm italic text-[var(--color-text-muted)]">No sessions yet.</p>
+    <ul v-else :class="isVertical ? 'space-y-2' : 'flex gap-1 overflow-x-auto'">
+      <li v-for="s in props.sessions" :key="s.id" class="flex min-w-0 items-stretch gap-1">
+        <div v-if="editingId === s.id" :class="sessionShellClasses(s)">
+          <span class="shrink-0 rounded px-2 py-0.5 text-xs font-semibold" :class="kindBadge[s.kind]">
+            {{ s.kind }}
+          </span>
+          <input
+            :ref="(el) => focusInput(el)"
+            v-model="draft"
+            type="text"
+            :placeholder="s.id.slice(0, 8)"
+            data-testid="session-tab-rename"
+            class="min-w-0 flex-1 border-b border-[var(--color-accent-light)] bg-transparent font-mono text-sm focus:outline-none"
+            @click.stop
+            @keydown.enter.prevent="commit(s.id)"
+            @keydown.esc.prevent="cancel"
+            @blur="commit(s.id)"
+          />
+          <span
+            class="shrink-0 text-xs"
+            :class="s.status === 'RUNNING' ? 'text-green-400' : 'text-[var(--color-text-muted)]'"
+          >
+            {{ s.status }}
+          </span>
+        </div>
+        <button
+          v-else
+          type="button"
+          :class="sessionShellClasses(s)"
+          :aria-current="props.activeId === s.id ? 'true' : undefined"
+          :data-testid="`session-tab-${s.id}`"
+          @click="emit('select', s.id)"
+          @contextmenu.prevent="startEdit(s)"
+          @dblclick.prevent="startEdit(s)"
+        >
+          <span class="shrink-0 rounded px-2 py-0.5 text-xs font-semibold" :class="kindBadge[s.kind]">
+            {{ s.kind }}
+          </span>
+          <span class="min-w-0 flex-1 truncate font-mono" :title="s.id">{{ tabLabel(s) }}</span>
+          <span
+            class="shrink-0 text-xs"
+            :class="s.status === 'RUNNING' ? 'text-green-400' : 'text-[var(--color-text-muted)]'"
+          >
+            {{ s.status }}
+          </span>
+        </button>
+        <button
+          v-if="s.status === 'RUNNING'"
+          type="button"
+          class="shrink-0 rounded-md border border-transparent px-2 text-sm text-red-400 transition-colors hover:border-red-500/40 hover:bg-red-500/10 hover:text-red-300 focus:outline-none focus-visible:ring-2 focus-visible:ring-red-400 focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)]"
+          :class="isVertical ? 'self-stretch' : 'py-2'"
+          :aria-label="`Stop session ${tabLabel(s)}`"
+          :data-testid="`session-tab-stop-${s.id}`"
+          @click="emit('stop', s.id)"
+        >
+          ×
+        </button>
+      </li>
+    </ul>
+  </nav>
 </template>
diff --git a/services/assistant-ui/src/features/workspaces/components/WorkspaceRepositoriesPanel.vue b/services/assistant-ui/src/features/workspaces/components/WorkspaceRepositoriesPanel.vue
index 65ced754..82d24893 100644
--- a/services/assistant-ui/src/features/workspaces/components/WorkspaceRepositoriesPanel.vue
+++ b/services/assistant-ui/src/features/workspaces/components/WorkspaceRepositoriesPanel.vue
@@ -33,12 +33,12 @@ const sortedRepositories = computed(() =>
       <div>
         <h2 class="text-sm font-semibold">Repositories</h2>
         <p class="mt-1 text-xs text-[var(--color-text-muted)]">
-          Attached repositories are available to this workspace. The primary repository is the runner clone.
+          Attached repositories are cloned under /workspace by repository name. The primary repository drives defaults.
         </p>
       </div>
       <button
         type="button"
-        class="shrink-0 rounded bg-blue-600 px-3 py-2 text-xs text-white disabled:cursor-not-allowed disabled:opacity-60"
+        class="shrink-0 rounded-md bg-[var(--color-accent)] px-3 py-2 text-xs font-medium text-white transition-colors hover:bg-[var(--color-accent-light)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
         :disabled="attachPending"
         data-testid="workspace-add-repository"
         @click="emit('add')"
@@ -85,7 +85,7 @@ const sortedRepositories = computed(() =>
           <button
             v-if="!r.isPrimary"
             type="button"
-            class="shrink-0 rounded border border-red-500/60 px-2.5 py-1.5 text-xs text-red-300 disabled:cursor-not-allowed disabled:opacity-60"
+            class="shrink-0 rounded-md border border-red-500/60 px-2.5 py-1.5 text-xs text-red-300 transition-colors hover:bg-red-500/10 focus:outline-none focus-visible:ring-2 focus-visible:ring-red-400 focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
             :disabled="detachPendingId === r.id"
             :data-testid="`workspace-detach-repository-${r.id}`"
             @click="emit('detach', r.id, r.name)"
diff --git a/services/assistant-ui/src/features/workspaces/components/WorkspaceRepositoryPicker.vue b/services/assistant-ui/src/features/workspaces/components/WorkspaceRepositoryPicker.vue
index be5baadd..03739483 100644
--- a/services/assistant-ui/src/features/workspaces/components/WorkspaceRepositoryPicker.vue
+++ b/services/assistant-ui/src/features/workspaces/components/WorkspaceRepositoryPicker.vue
@@ -43,8 +43,8 @@ function onSubmit(): void {
 <template>
   <div class="space-y-4" data-testid="workspace-repository-picker">
     <p class="text-sm text-[var(--color-text-muted)]">
-      Attach an existing repository to this workspace. It becomes available to future runner starts for this workspace,
-      but the primary clone stays unchanged.
+      Attach an existing repository to this workspace. It will be cloned into /workspace by repository name on the next
+      runner start.
       <RouterLink to="/repositories" class="text-[var(--color-accent-light)] underline">Add a repository</RouterLink>
       first if it is missing.
     </p>
@@ -85,7 +85,7 @@ function onSubmit(): void {
     <div class="flex justify-end gap-2">
       <button
         type="button"
-        class="rounded border border-[var(--color-surface-border)] px-4 py-2 text-sm disabled:cursor-not-allowed disabled:opacity-60"
+        class="rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-elevated)] px-4 py-2 text-sm transition-colors hover:bg-[var(--color-surface-border)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
         :disabled="pending"
         @click="emit('cancel')"
       >
@@ -93,7 +93,7 @@ function onSubmit(): void {
       </button>
       <button
         type="button"
-        class="rounded bg-blue-600 px-4 py-2 text-sm text-white disabled:cursor-not-allowed disabled:opacity-60"
+        class="rounded-md bg-[var(--color-accent)] px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-[var(--color-accent-light)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
         :disabled="!selected || pending"
         data-testid="repository-picker-submit"
         @click="onSubmit"
diff --git a/services/assistant-ui/src/features/workspaces/components/WorkspaceSplitGuidance.vue b/services/assistant-ui/src/features/workspaces/components/WorkspaceSplitGuidance.vue
index cc9f518d..abe231ea 100644
--- a/services/assistant-ui/src/features/workspaces/components/WorkspaceSplitGuidance.vue
+++ b/services/assistant-ui/src/features/workspaces/components/WorkspaceSplitGuidance.vue
@@ -5,10 +5,17 @@ import { computed, ref, watch } from 'vue'
 interface Props {
   repositories: WorkspaceRepository[]
   projectId: string | null
+  canSend?: boolean
+  sendPending?: boolean
 }
 
 const props = defineProps<Props>()
 
+const emit = defineEmits<{
+  addDestination: []
+  sendCommand: [command: string]
+}>()
+
 const splitPath = ref('path/to/subtree')
 const selectedDestinationId = ref<string | null>(null)
 
@@ -34,12 +41,26 @@ watch(
 )
 
 const destinationSlug = computed(() => (selectedDestination.value ? repositorySlug(selectedDestination.value) : null))
+const primaryRepositoryDir = computed(() =>
+  primaryRepository.value ? repositoryDirName(primaryRepository.value) : '<primary-repo>',
+)
 const commandPath = computed(() => splitPath.value.trim() || '<p>')
 const splitCommand = computed(() =>
-  destinationSlug.value ? `council split --path ${commandPath.value} --dest ${destinationSlug.value}` : '',
+  destinationSlug.value
+    ? `cd /workspace/${primaryRepositoryDir.value} && council split --path ${commandPath.value} --dest ${destinationSlug.value}`
+    : '',
 )
 const inProject = computed(() => Boolean(props.projectId))
-const primaryRepositoryName = computed(() => primaryRepository.value?.name ?? '')
+
+function repositoryDirName(repository: WorkspaceRepository): string {
+  return (
+    repository.repoUrl
+      .trim()
+      .replace(/\.git$/, '')
+      .split('/')
+      .pop() || repository.name
+  )
+}
 
 function repositorySlug(repository: WorkspaceRepository): string {
   const trimmed = repository.repoUrl.trim().replace(/\.git$/, '')
@@ -63,9 +84,19 @@ function repositorySlug(repository: WorkspaceRepository): string {
       Attach a primary repository before preparing a split.
     </p>
 
-    <p v-else-if="destinationRepositories.length === 0" class="mt-3 text-sm text-[var(--color-text-muted)] italic">
-      Attach a destination repository to build a split command.
-    </p>
+    <div v-else-if="destinationRepositories.length === 0" class="mt-3 space-y-3">
+      <p class="text-sm text-[var(--color-text-muted)] italic">
+        Attach a destination repository to build a split command.
+      </p>
+      <button
+        type="button"
+        class="w-full rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-elevated)] px-3 py-2 text-sm font-medium text-[var(--color-text-primary)] transition-colors hover:bg-[var(--color-surface-border)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
+        data-testid="split-attach-destination"
+        @click="emit('addDestination')"
+      >
+        Attach destination repository
+      </button>
+    </div>
 
     <div v-else class="mt-3 space-y-3">
       <label class="block space-y-1 text-xs">
@@ -95,8 +126,18 @@ function repositorySlug(repository: WorkspaceRepository): string {
         class="overflow-x-auto rounded bg-[#0b0e14] p-3 font-mono text-xs text-[var(--color-terminal-cyan)]"
       ><code data-testid="workspace-split-command">{{ splitCommand }}</code></pre>
 
+      <button
+        type="button"
+        class="w-full rounded-md bg-[var(--color-accent)] px-3 py-2 text-sm font-medium text-white transition-colors hover:bg-[var(--color-accent-light)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
+        :disabled="!canSend || sendPending"
+        data-testid="split-send-command"
+        @click="emit('sendCommand', splitCommand)"
+      >
+        {{ sendPending ? 'Sending...' : 'Paste command into session' }}
+      </button>
+
       <ol class="list-decimal space-y-1 pl-4 text-xs text-[var(--color-text-muted)]" data-testid="split-follow-up">
-        <li>Run the command from the primary clone, {{ primaryRepositoryName }}.</li>
+        <li>Run the command from the primary clone, /workspace/{{ primaryRepositoryDir }}.</li>
         <li v-if="inProject">
           Keep {{ destinationSlug }} linked in the project repository pool before opening follow-up workspaces.
         </li>
diff --git a/services/assistant-ui/src/features/workspaces/services/workspaceService.ts b/services/assistant-ui/src/features/workspaces/services/workspaceService.ts
index 39baa7df..4626b9f3 100644
--- a/services/assistant-ui/src/features/workspaces/services/workspaceService.ts
+++ b/services/assistant-ui/src/features/workspaces/services/workspaceService.ts
@@ -1,4 +1,4 @@
-import type { AgentKind, StagedInput, Turn, Workspace, WorkspaceDetail, WorkspaceRepository } from '../types'
+import type { AgentKind, StagedInput, Turn, Workspace, WorkspaceDetail } from '../types'
 import { ApiError, useApiWithAuth } from '@personal-stack/vue-common'
 
 function getApi(): ReturnType<typeof useApiWithAuth> {
@@ -42,6 +42,10 @@ export interface CreateWorkspaceInput {
    * repository row.
    */
   repositoryId?: string | null
+  /** Primary repository for multi-repo workspace creation. */
+  primaryRepositoryId?: string | null
+  /** Selected repositories for multi-repo workspace creation. */
+  repositoryIds?: string[]
   /**
    * Optional project context. Set when the workspace was opened from
    * a project's UI; null for ad-hoc / scratch work.
@@ -67,8 +71,8 @@ export async function destroyWorkspace(id: string): Promise<void> {
   return getApi().del(`/workspaces/${id}`)
 }
 
-export async function attachRepository(workspaceId: string, repositoryId: string): Promise<WorkspaceRepository[]> {
-  return getApi().post<WorkspaceRepository[]>(`/workspaces/${workspaceId}/repositories`, { repositoryId })
+export async function attachRepository(workspaceId: string, repositoryId: string): Promise<void> {
+  await getApi().post(`/workspaces/${workspaceId}/repositories`, { repositoryId })
 }
 
 export async function detachRepository(workspaceId: string, repositoryId: string): Promise<void> {
diff --git a/services/assistant-ui/src/features/workspaces/stores/workspaces.ts b/services/assistant-ui/src/features/workspaces/stores/workspaces.ts
index d31576d4..43b22048 100644
--- a/services/assistant-ui/src/features/workspaces/stores/workspaces.ts
+++ b/services/assistant-ui/src/features/workspaces/stores/workspaces.ts
@@ -158,10 +158,7 @@ export const useWorkspacesStore = defineStore('workspaces', () => {
   async function attachRepository(repositoryId: string): Promise<void> {
     const ws = activeWorkspace.value
     if (!ws) return
-    activeWorkspace.value = {
-      ...ws,
-      repositories: await workspaceService.attachRepository(ws.id, repositoryId),
-    }
+    await workspaceService.attachRepository(ws.id, repositoryId)
     await open(ws.id)
   }
 
diff --git a/services/assistant-ui/src/features/workspaces/views/WorkspaceView.vue b/services/assistant-ui/src/features/workspaces/views/WorkspaceView.vue
index 9a4d8eaf..35f9688b 100644
--- a/services/assistant-ui/src/features/workspaces/views/WorkspaceView.vue
+++ b/services/assistant-ui/src/features/workspaces/views/WorkspaceView.vue
@@ -24,6 +24,7 @@ const showRepositoryPicker = ref(false)
 const stageName = ref('source.txt')
 const stageContent = ref('')
 const isStaging = ref(false)
+const isSendingSplitCommand = ref(false)
 const isAttachingRepository = ref(false)
 const detachingRepositoryId = ref<string | null>(null)
 const repositoryActionError = ref<string | null>(null)
@@ -37,6 +38,14 @@ const activeStageSession = computed(() => {
   const session = activeLiveSession.value
   return session?.status === 'RUNNING' && session.gatewayAgentId ? session : null
 })
+const agentKindLabels: Record<AgentKind, string> = {
+  CLAUDE: 'Claude Code',
+  CODEX: 'Codex',
+  SHELL: 'shell',
+}
+const spawnButtonLabel = computed(() =>
+  store.startingSession ? 'Starting runner…' : `Start ${agentKindLabels[pickerKind.value]}`,
+)
 
 onMounted(async () => {
   await store.open(workspaceId.value)
@@ -75,6 +84,21 @@ async function onStageInput(): Promise<void> {
   }
 }
 
+async function onSendSplitCommand(command: string): Promise<void> {
+  const ws = store.activeWorkspace
+  const session = activeStageSession.value
+  if (!ws || !session || !command.trim()) return
+  isSendingSplitCommand.value = true
+  try {
+    await sendInput(ws.id, session.id, command.trim(), true)
+    toast.success('Split command sent')
+  } catch (e) {
+    toast.errorFromCatch('Could not send split command', e)
+  } finally {
+    isSendingSplitCommand.value = false
+  }
+}
+
 async function onAttachRepository(repositoryId: string): Promise<void> {
   repositoryActionError.value = null
   isAttachingRepository.value = true
@@ -112,8 +136,11 @@ async function onDetachRepository(repositoryId: string, repositoryName: string):
        of the terminal's own scroll. Sizing to the remaining space keeps
        a single scroll region (the xterm viewport). -->
   <div class="flex flex-col h-[calc(100vh-3.5rem)] overflow-hidden">
-    <header class="border-b border-[var(--color-surface-border)] px-6 py-3 flex items-center justify-between">
-      <div>
+    <header
+      class="flex items-center border-b border-[var(--color-surface-border)] px-6 py-3"
+      data-testid="workspace-view-header"
+    >
+      <div class="min-w-0">
         <button
           type="button"
           class="text-sm text-[var(--color-text-muted)] hover:text-[var(--color-text-primary)] mb-1"
@@ -124,41 +151,14 @@ async function onDetachRepository(repositoryId: string, repositoryName: string):
         <h1 class="text-xl font-bold">
           {{ store.activeWorkspace?.name ?? 'Loading…' }}
         </h1>
-        <p v-if="store.activeWorkspace?.repoUrl" class="text-xs text-[var(--color-text-muted)] font-mono">
+        <p v-if="store.activeWorkspace?.repoUrl" class="truncate text-xs text-[var(--color-text-muted)] font-mono">
           {{ store.activeWorkspace.repoUrl }}
         </p>
       </div>
-      <div class="flex items-center gap-2">
-        <button
-          type="button"
-          class="rounded border border-[var(--color-surface-border)] px-3 py-2 text-sm text-[var(--color-text-primary)] disabled:cursor-not-allowed disabled:opacity-60"
-          :disabled="!activeStageSession || isStaging"
-          data-testid="stage-input-open"
-          @click="showStageInput = true"
-        >
-          Stage text
-        </button>
-        <AgentKindPicker v-model="pickerKind" />
-        <button
-          type="button"
-          class="rounded bg-blue-600 hover:bg-blue-700 px-3 py-2 text-sm text-white disabled:cursor-not-allowed disabled:opacity-60"
-          :disabled="store.startingSession"
-          @click="onSpawn"
-        >
-          {{ store.startingSession ? 'Starting runner…' : 'New agent' }}
-        </button>
-      </div>
     </header>
 
-    <SessionTabs
-      :sessions="store.sessions"
-      :active-id="store.activeSessionId"
-      @select="store.selectSession"
-      @stop="onStopSession"
-    />
-
-    <main class="flex flex-1 gap-3 overflow-hidden p-4">
-      <section class="flex min-w-0 flex-1 flex-col overflow-hidden">
+    <main class="flex min-h-0 flex-1 flex-col overflow-hidden lg:flex-row">
+      <section class="flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden p-4">
         <!-- One terminal per live session, all kept mounted; v-show (not
              v-if/:key) so switching tabs preserves each xterm buffer and
              its WebSocket. A session leaving the live set (stopped/failed)
@@ -170,12 +170,82 @@ async function onDetachRepository(repositoryId: string, repositoryName: string):
           :session-id="s.id"
           :active="s.id === store.activeSessionId"
         />
-        <div v-if="liveSessions.length === 0" class="py-4 text-center italic text-[var(--color-text-muted)]">
-          Pick an agent kind above and click "New agent" to start.
+        <div
+          v-if="liveSessions.length === 0"
+          class="flex flex-1 items-center justify-center rounded-md border border-dashed border-[var(--color-surface-border)] text-center text-sm italic text-[var(--color-text-muted)]"
+        >
+          Start an agent from the sidebar.
         </div>
       </section>
 
-      <aside v-if="store.activeWorkspace" class="flex w-96 shrink-0 flex-col gap-3 overflow-y-auto">
+      <aside
+        v-if="store.activeWorkspace"
+        class="flex min-h-0 w-full shrink-0 flex-col gap-4 overflow-y-auto border-t border-[var(--color-surface-border)] bg-[var(--color-surface-card)] p-4 lg:w-[23rem] lg:border-l lg:border-t-0"
+        data-testid="workspace-sidebar"
+        aria-label="Workspace controls"
+      >
+        <section
+          class="rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-card)] p-4"
+          data-testid="workspace-agent-panel"
+        >
+          <div class="mb-3 flex items-center justify-between gap-3">
+            <h2 class="text-sm font-semibold">Agents</h2>
+            <span
+              class="rounded border border-[var(--color-surface-border)] px-2 py-0.5 text-xs text-[var(--color-text-muted)]"
+            >
+              {{ liveSessions.length }} live
+            </span>
+          </div>
+          <AgentKindPicker v-model="pickerKind" compact />
+          <button
+            type="button"
+            class="mt-3 inline-flex min-h-11 w-full items-center justify-center rounded-md border border-transparent bg-[var(--color-accent)] px-4 py-2 text-sm font-medium text-white shadow-sm transition-colors hover:bg-[var(--color-accent-light)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
+            :disabled="store.startingSession"
+            data-testid="workspace-new-agent"
+            aria-label="Start a new agent session"
+            @click="onSpawn"
+          >
+            {{ spawnButtonLabel }}
+          </button>
+        </section>
+
+        <section
+          class="rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-card)] p-4"
+          data-testid="workspace-tools-panel"
+        >
+          <h2 class="text-sm font-semibold">Tools</h2>
+          <p id="stage-input-hint" class="sr-only">
+            Stage text is available when the active session is running and attached to a gateway.
+          </p>
+          <button
+            type="button"
+            class="mt-3 inline-flex min-h-10 w-full items-center justify-center rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-elevated)] px-3 py-2 text-sm font-medium text-[var(--color-text-primary)] transition-colors hover:bg-[var(--color-surface-border)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
+            :disabled="!activeStageSession || isStaging"
+            data-testid="stage-input-open"
+            aria-describedby="stage-input-hint"
+            @click="showStageInput = true"
+          >
+            {{ isStaging ? 'Staging…' : 'Stage text' }}
+          </button>
+        </section>
+
+        <section
+          class="rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-card)] p-4"
+          data-testid="workspace-sessions-panel"
+        >
+          <div class="mb-3 flex items-center justify-between gap-3">
+            <h2 class="text-sm font-semibold">Sessions</h2>
+            <span class="text-xs text-[var(--color-text-muted)]">{{ store.sessions.length }}</span>
+          </div>
+          <SessionTabs
+            :sessions="store.sessions"
+            :active-id="store.activeSessionId"
+            orientation="vertical"
+            @select="store.selectSession"
+            @stop="onStopSession"
+          />
+        </section>
+
         <WorkspaceRepositoriesPanel
           :repositories="store.activeWorkspace.repositories ?? []"
           :attach-pending="isAttachingRepository"
@@ -187,6 +257,10 @@ async function onDetachRepository(repositoryId: string, repositoryName: string):
         <WorkspaceSplitGuidance
           :repositories="store.activeWorkspace.repositories ?? []"
           :project-id="store.activeWorkspace.projectId"
+          :can-send="Boolean(activeStageSession)"
+          :send-pending="isSendingSplitCommand"
+          @add-destination="showRepositoryPicker = true"
+          @send-command="onSendSplitCommand"
         />
       </aside>
     </main>
@@ -222,7 +296,7 @@ async function onDetachRepository(repositoryId: string, repositoryName: string):
         <div class="flex justify-end gap-2">
           <button
             type="button"
-            class="rounded border border-[var(--color-surface-border)] px-4 py-2 text-sm"
+            class="rounded-md border border-[var(--color-surface-border)] bg-[var(--color-surface-elevated)] px-4 py-2 text-sm transition-colors hover:bg-[var(--color-surface-border)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
             :disabled="isStaging"
             @click="closeStageInput"
           >
@@ -230,7 +304,7 @@ async function onDetachRepository(repositoryId: string, repositoryName: string):
           </button>
           <button
             type="submit"
-            class="rounded bg-blue-600 px-4 py-2 text-sm text-white disabled:cursor-not-allowed disabled:opacity-60"
+            class="rounded-md bg-[var(--color-accent)] px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-[var(--color-accent-light)] focus:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-accent-light)] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-surface-dark)] disabled:cursor-not-allowed disabled:opacity-60"
             :disabled="isStaging || stageContent.length === 0"
             data-testid="stage-input-submit"
           >