Explicit host-owned execution behind a native conversation. Descriptors are implementation claims, never attestations. The host must verify live identity and isolation before admission.