Per-project host selection (Local Docker or AWS), AWS-CLI-style login, tiered permission check, detect-then-join-or-deploy environments, strict per-user tenancy by default, Secrets Manager delivery, Hybrid EFS/ephemeral storage, in-container agent over SSM port forwarding, and a phased plan starting with a ProjectHost abstraction refactor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>