@@ -83,5 +83,6 @@ evalexpr = { workspace = true }
 nix = { version = "0.31", default-features = false, features = ["signal", "user"] }
 
 [dev-dependencies]
+axum = { workspace = true }
 tokio = { workspace = true, features = ["test-util"] }
 httparse = "1"
@@ -80,6 +80,11 @@ verify the document's author. File/stdin input does not need a signature.
 - Do not automatically publish final text. Use task reporting instructions and
   tools. Do not retry the task after failure, timeout, or uncertain execution.
 
+Launch configuration preparation (including prompt-file reads) has a separate
+ten-second bound. A blocked configuration read reports `configuration_timeout`
+with exit 2; SIGINT/SIGTERM during that read reports `cancelled` with exit
+130/143 and a null `taskId`. No adapter is started during this phase.
+
 The execution deadline covers adapter startup, memory loading, session setup,
 and the task turn. SIGINT/SIGTERM cancel the invocation. If a prompt is active,
 allow up to five seconds for cooperative cancellation, then kill and reap the
 
@@ -142,12 +142,8 @@ pub(crate) async fn run() -> i32 {
     args.launch.heartbeat_prompt = None;
     args.launch.heartbeat_prompt_file = None;
     args.launch.turn_liveness_secs = 0;
-    let config = match Config::from_args(args.launch) {
-        Ok(config) if config.max_turn_duration_secs > 0 => config,
-        _ => return emit(Terminal::new("invalid", Some("invalid_configuration")), 2),
-    };
     let (signal_tx, mut signal_rx) = tokio::sync::oneshot::channel();
-    // Register signal handlers before reading input or spawning the adapter.
+    // Register before configuration: launch prompt files can also block on I/O.
     #[cfg(unix)]
     let signals = (
         tokio::signal::unix::signal(tokio::signal::unix::SignalKind::interrupt()),
@@ -166,6 +162,27 @@ pub(crate) async fn run() -> i32 {
         let _ = tokio::signal::ctrl_c().await;
         let _ = signal_tx.send(130);
     });
+    // Config owns synchronous prompt-file reads. Keep them off the async worker
+    // so signals and the preparation bound remain live, including for FIFOs.
+    // This worker only builds configuration; it cannot spawn an agent or create
+    // runtime resources. On cancellation/timeout the CLI's bounded runtime
+    // shutdown and process exit also retire a still-blocked read.
+    let configuration = tokio::task::spawn_blocking(move || Config::from_args(args.launch));
+    let config = tokio::select! {
+        biased;
+        code = &mut signal_rx => return emit(Terminal::new("cancelled", None), code.unwrap_or(1)),
+        result = tokio::time::timeout(INPUT_TIMEOUT, configuration) => match result {
+            Ok(Ok(Ok(config))) if config.max_turn_duration_secs > 0 => config,
+            Err(_) => {
+                signal_task.abort();
+                return emit(Terminal::new("invalid", Some("configuration_timeout")), 2);
+            }
+            _ => {
+                signal_task.abort();
+                return emit(Terminal::new("invalid", Some("invalid_configuration")), 2);
+            }
+        },
+    };
     let task = tokio::select! {
         biased;
         code = &mut signal_rx => return emit(Terminal::new("cancelled", None), code.unwrap_or(1)),
 
@@ -248,11 +248,7 @@ fn invalid_input_never_spawns() {
         command.args(["--task", source]);
         terminal(&wait(command.spawn().unwrap()), 2, "invalid");
     }
-    for bytes in [
-        b"{} {}".to_vec(),
-        b"{".to_vec(),
-        vec![b' '; 1024 * 1024 + 1],
-    ] {
+    for bytes in [b"{} {}".to_vec(), b"{".to_vec()] {
         let mut command = f.command();
         command.args(["--task", "-"]);
         let mut child = command.spawn().unwrap();
@@ -262,6 +258,90 @@ fn invalid_input_never_spawns() {
     assert!(f.wire().is_empty());
 }
 
+#[test]
+fn oversized_file_and_stdin_report_task_too_large_before_spawn() {
+    let f = Fixture::new();
+    let bytes = vec![b' '; 1024 * 1024 + 1];
+    fs::write(f.dir.join("oversized.json"), &bytes).unwrap();
+    for stdin in [false, true] {
+        let mut command = f.command();
+        command.arg("--task").arg(if stdin {
+            PathBuf::from("-")
+        } else {
+            f.dir.join("oversized.json")
+        });
+        let mut child = command.spawn().unwrap();
+        if stdin {
+            child.stdin.take().unwrap().write_all(&bytes).unwrap();
+        }
+        let result = terminal(&wait(child), 2, "invalid");
+        assert_eq!(result["error"], "task_too_large");
+        assert_eq!(result["taskId"], Value::Null);
+        assert!(f.wire().is_empty());
+    }
+}
+
+#[test]
+fn blocked_configuration_reads_are_cancellable_and_bounded() {
+    use nix::{
+        sys::signal::{kill, Signal},
+        unistd::Pid,
+    };
+    use std::os::unix::fs::OpenOptionsExt;
+
+    for flag in ["--system-prompt-file", "--base-prompt-file"] {
+        for signal in [Some(Signal::SIGINT), Some(Signal::SIGTERM), None] {
+            let f = Fixture::new();
+            let fifo = f.dir.join("prompt.fifo");
+            assert!(Command::new("mkfifo")
+                .arg(&fifo)
+                .status()
+                .unwrap()
+                .success());
+            let started = Instant::now();
+            let child = f
+                .command()
+                .arg(flag)
+                .arg(&fifo)
+                .args(["--no-memory", "--task", "-"])
+                .spawn()
+                .unwrap();
+            // A successful nonblocking writer open proves Config has opened
+            // this FIFO for reading. Hold it without data, so read_to_string
+            // cannot finish. No sleep-based assumption about startup readiness.
+            let until = Instant::now() + Duration::from_secs(5);
+            let writer = loop {
+                match fs::OpenOptions::new()
+                    .write(true)
+                    .custom_flags(nix::libc::O_NONBLOCK)
+                    .open(&fifo)
+                {
+                    Ok(writer) => break writer,
+                    Err(error) if error.raw_os_error() == Some(nix::libc::ENXIO) => {
+                        assert!(Instant::now() < until, "configuration never opened FIFO");
+                        std::thread::sleep(Duration::from_millis(10));
+                    }
+                    Err(error) => panic!("FIFO writer: {error}"),
+                }
+            };
+            if let Some(signal) = signal {
+                let signalled = Instant::now();
+                kill(Pid::from_raw(child.id() as i32), signal).unwrap();
+                let code = if signal == Signal::SIGINT { 130 } else { 143 };
+                let result = terminal(&wait(child), code, "cancelled");
+                assert_eq!(result["taskId"], Value::Null);
+                assert!(signalled.elapsed() < Duration::from_secs(3));
+            } else {
+                let result = terminal(&wait(child), 2, "invalid");
+                assert_eq!(result["error"], "configuration_timeout");
+                assert!(started.elapsed() < Duration::from_secs(15));
+            }
+            drop(writer);
+            assert!(f.wire().is_empty());
+        }
+    }
+}
+
 #[test]
 fn stop_reasons_failures_and_permission_exchange_are_explicit() {
     for (mode, reason, code, status) in [
@@ -384,61 +464,51 @@ fn signals_cancel_startup_turn_and_pending_stdin_without_hanging() {
     }
 }
 
-#[test]
-fn memory_is_loaded_before_session_and_opt_out_makes_no_request() {
-    use std::{
-        io::Read,
-        net::TcpListener,
-        sync::{
-            atomic::{AtomicUsize, Ordering},
-            Arc,
-        },
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn memory_is_loaded_before_session_and_opt_out_makes_no_request() {
+    use axum::{body::Bytes, http::HeaderMap, routing::post, Router};
+    use std::sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc,
     };
+
     for (body, expected) in [("[]", true), ("not-json", false)] {
-        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-        listener.set_nonblocking(true).unwrap();
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
         let url = format!("ws://{}", listener.local_addr().unwrap());
         let calls = Arc::new(AtomicUsize::new(0));
         let observed = calls.clone();
-        let done = Arc::new(std::sync::atomic::AtomicBool::new(false));
-        let stop = done.clone();
-        let server = std::thread::spawn(move || {
-            while !stop.load(Ordering::SeqCst) {
-                if let Ok((mut stream, _)) = listener.accept() {
-                    stream
-                        .set_read_timeout(Some(Duration::from_secs(2)))
-                        .unwrap();
-                    let mut request = Vec::new();
-                    let mut byte = [0];
-                    while !request.ends_with(b"\r\n\r\n") {
-                        stream.read_exact(&mut byte).unwrap();
-                        request.push(byte[0]);
+        let unexpected = Arc::new(AtomicUsize::new(0));
+        let rejected = unexpected.clone();
+        // Use the real HTTP parser rather than byte-wise timed socket reads.
+        // Idle connections and partial packets cannot block another request.
+        let app = Router::new()
+            .route(
+                "/query",
+                post(move |headers: HeaderMap, bytes: Bytes| {
+                    let observed = observed.clone();
+                    async move {
+                        assert!(headers["authorization"]
+                            .to_str()
+                            .unwrap()
+                            .starts_with("Nostr "));
+                        assert!(String::from_utf8(bytes.to_vec()).unwrap().contains("30174"));
+                        observed.fetch_add(1, Ordering::SeqCst);
+                        body
                     }
-                    let headers = String::from_utf8(request).unwrap();
-                    assert!(
-                        headers.starts_with("POST /query "),
-                        "unexpected service access: {headers}"
-                    );
-                    assert!(headers.to_lowercase().contains("authorization: nostr "));
-                    let len: usize = headers
-                        .lines()
-                        .find_map(|s| {
-                            s.to_lowercase()
-                                .strip_prefix("content-length: ")
-                                .map(str::to_owned)
-                        })
-                        .unwrap()
-                        .parse()
-                        .unwrap();
-                    let mut bytes = vec![0; len];
-                    stream.read_exact(&mut bytes).unwrap();
-                    assert!(String::from_utf8(bytes).unwrap().contains("30174"));
-                    observed.fetch_add(1, Ordering::SeqCst);
-                    write!(stream, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}", body.len(), body).unwrap();
-                } else {
-                    std::thread::sleep(Duration::from_millis(5));
-                }
-            }
+                }),
+            )
+            .fallback(move || {
+                rejected.fetch_add(1, Ordering::SeqCst);
+                async { axum::http::StatusCode::NOT_FOUND }
+            });
+        let (stop, stopped) = tokio::sync::oneshot::channel();
+        let mut server = tokio::spawn(async move {
+            axum::serve(listener, app)
+                .with_graceful_shutdown(async {
+                    let _ = stopped.await;
+                })
+                .await
+                .unwrap();
         });
         for disabled in [false, true] {
             let f = Fixture::new();
@@ -491,7 +561,19 @@ fn memory_is_loaded_before_session_and_opt_out_makes_no_request() {
                 expected && !disabled
             );
         }
-        done.store(true, Ordering::SeqCst);
-        server.join().unwrap();
+        assert_eq!(
+            unexpected.load(Ordering::SeqCst),
+            0,
+            "unexpected service access"
+        );
+        stop.send(()).unwrap();
+        match tokio::time::timeout(Duration::from_secs(2), &mut server).await {
+            Ok(result) => result.unwrap(),
+            Err(_) => {
+                server.abort();
+                let _ = server.await;
+                panic!("memory server did not drain");
+            }
+        }
     }
 }