Wire the confidential verifier hook to the RA-TLS transport, add the attested-channel pool and loopback forwarder, and keep readiness probes state-only. Route local/OpenHands egress through the forwarder, align confidential lane gating, and update fail-closed tests around the new transport seam.