diff --git a/.github/workflows/java-sdk-tests.yml b/.github/workflows/java-sdk-tests.yml
index bd0a34bd25..918e6ce10f 100644
--- a/.github/workflows/java-sdk-tests.yml
+++ b/.github/workflows/java-sdk-tests.yml
@@ -40,10 +40,13 @@ jobs:
         with:
           node-version: 22
 
+      - name: Validate Linux glibc native host
+        run: node copilot-native/scripts/validate-native-host.mjs linux-x64
+
       - name: Run Java SDK tests (InProcess)
         env:
           CI: "true"
-        run: mvn clean verify -Pinprocess
+        run: mvn clean verify -Pinprocess -Dcopilot.native.skip.download=false
 
       - name: Generate Test Report Summary
         if: always()
@@ -125,7 +128,9 @@ jobs:
         if: matrix.test-jdk == '25'
         env:
           CI: "true"
-        run: mvn verify -Dskip.test.harness=true
+        run: |
+          node copilot-native/scripts/validate-native-host.mjs linux-x64
+          mvn verify -Dskip.test.harness=true -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=false
 
       - name: Switch to JDK 17
         if: matrix.test-jdk == '17'
diff --git a/java/README.md b/java/README.md
index 2f8ca3dfa3..6c6124e959 100644
--- a/java/README.md
+++ b/java/README.md
@@ -487,6 +487,45 @@ mvn verify -Dskip.test.harness=true
 mvn jacoco:prepare-agent@wire-up-coverage-instrumentation antrun:run@print-test-jdk-banner surefire:test failsafe:integration-test failsafe:verify jacoco:report@build-coverage-report-from-tests -Denforcer.skip=true
 ```
 
+#### Development Setup for native embedding
+
+Run native-runtime Maven commands from the `java` directory. Native packaging requires Node.js and npm in addition to JDK 25 and Maven because `copilot-native/scripts/fetch-native.mjs` retrieves the pinned npm runtime package.
+
+Validated on a native Linux x64 glibc host: Maven activates the `native-linux-x64` profile on Linux `amd64` when `copilot.native.libc=glibc` is set. The build validates the host before downloading or packaging native files. The profile runs the native script tests, fetches the pinned `@github/copilot-linux-x64` package during `generate-resources`, packages the `linux-x64` classifier JAR during `package`, and verifies its native contents. An absent or explicitly false `copilot.native.skip.download` value preserves normal native packaging. Ensure npm can authenticate to the package registry before running the build.
+
+Before opting in, validate that Node.js reports glibc for the build host:
+
+```bash
+node copilot-native/scripts/validate-native-host.mjs linux-x64
+mvn -pl copilot-native clean verify -Dcopilot.native.libc=glibc
+```
+
+The `inprocess` test profile performs the same validation and native packaging automatically, so the full in-process test command remains:
+
+```bash
+mvn -Pinprocess clean verify
+```
+
+On macOS, Windows, Linux ARM64, Linux x64 musl, and other unsupported hosts, do not set `copilot.native.libc=glibc`. A normal build produces only the OS-neutral primary, sources, and Javadoc JARs; it does not run the Linux x64 native script tests, download or stage Linux native files, or produce a `linux-x64` classifier JAR.
+
+To build only the OS-neutral artifacts on any host, or override the glibc opt-in, disable native download and packaging:
+
+```bash
+mvn -pl copilot-native clean package -DskipTests -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=true
+```
+
+The verified Linux x64 checks are:
+
+```bash
+node --test copilot-native/scripts/fetch-native.test.mjs copilot-native/scripts/validate-native-host.test.mjs
+mvn -pl copilot-native help:active-profiles -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=false
+mvn -pl copilot-native test -Dcopilot.native.libc=glibc
+mvn clean verify -Dcopilot.native.libc=glibc
+mvn clean package -pl copilot-native -DskipTests -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=true
+```
+
+On a supported Linux x64 host, the classifier JAR contains `native/linux-x64/runtime.node`, `native/linux-x64/platform.properties`, and `native/linux-x64/copilot`. The placeholder JAR remains OS-neutral and contains no native binaries. Unsupported hosts retain the placeholder-only behavior without producing a `-linux-x64.jar`.
+
 ## License
 
 MIT — see [LICENSE](sdk/LICENSE) for details.
diff --git a/java/copilot-native/pom.xml b/java/copilot-native/pom.xml
index 642f9171a4..775fad47da 100644
--- a/java/copilot-native/pom.xml
+++ b/java/copilot-native/pom.xml
@@ -17,7 +17,7 @@
     <packaging>jar</packaging>
 
     <name>GitHub Copilot SDK :: Java :: Native Runtime</name>
-    <description>Native runtime binaries for the GitHub Copilot Java SDK, published as per-platform classifier JARs</description>
+    <description>Native runtime artifacts for the GitHub Copilot Java SDK, with host-matched platform classifier JARs</description>
     <url>https://github.com/github/copilot-sdk</url>
 
     <scm>
@@ -35,12 +35,6 @@
             its SHA-512 integrity hash.
         -->
         <copilot.sdk.root>${project.basedir}/../..</copilot.sdk.root>
-        <!--
-            Phase 4 hard invariant: linux-x64 is the only supported platform.
-            Additional classifiers are added in a later phase, each with its own
-            fetch execution and maven-jar-plugin execution.
-        -->
-        <copilot.native.classifier>linux-x64</copilot.native.classifier>
         <copilot.native.staging>${project.build.directory}/native-staging</copilot.native.staging>
         <!--
             The native runtime is downloaded from npm; this module is published
@@ -64,20 +58,35 @@
         </resources>
         <plugins>
             <!--
-                Download and verify the native runtime binary. The helper script
-                reads the pinned version and SHA-512 integrity hash for
-                @github/copilot-<classifier> from nodejs/package-lock.json,
-                runs `npm pack`, verifies the tarball against that hash, and
-                extracts runtime.node into the staging directory. Requires
-                Node.js and npm — already required for the Java E2E tests.
+                On a supported build host, download and verify the matching native
+                runtime binary. The helper script reads the pinned version and
+                SHA-512 integrity hash for @github/copilot-<classifier> from
+                nodejs/package-lock.json, runs `npm pack`, verifies the tarball
+                against that hash, and extracts runtime.node into the staging
+                directory. Requires Node.js and npm — already required for the
+                Java E2E tests.
             -->
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>exec-maven-plugin</artifactId>
                 <executions>
                     <execution>
-                        <id>fetch-native-linux-x64</id>
-                        <phase>generate-resources</phase>
+                        <id>validate-native-host</id>
+                        <phase>none</phase>
+                        <goals>
+                            <goal>exec</goal>
+                        </goals>
+                        <configuration>
+                            <executable>node</executable>
+                            <arguments>
+                                <argument>${project.basedir}/scripts/validate-native-host.mjs</argument>
+                                <argument>${copilot.native.classifier}</argument>
+                            </arguments>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <id>fetch-native</id>
+                        <phase>none</phase>
                         <goals>
                             <goal>exec</goal>
                         </goals>
@@ -93,15 +102,17 @@
                     </execution>
                     <execution>
                         <id>test-fetch-native</id>
-                        <phase>test</phase>
+                        <phase>none</phase>
                         <goals>
                             <goal>exec</goal>
                         </goals>
                         <configuration>
+                            <skip>${skipTests}</skip>
                             <executable>node</executable>
                             <arguments>
                                 <argument>--test</argument>
                                 <argument>${project.basedir}/scripts/fetch-native.test.mjs</argument>
+                                <argument>${project.basedir}/scripts/validate-native-host.test.mjs</argument>
                             </arguments>
                         </configuration>
                     </execution>
@@ -118,8 +129,8 @@
                         native/<classifier>/platform.properties.
                     -->
                     <execution>
-                        <id>jar-linux-x64</id>
-                        <phase>package</phase>
+                        <id>jar-native</id>
+                        <phase>none</phase>
                         <goals>
                             <goal>jar</goal>
                         </goals>
@@ -173,7 +184,7 @@
                 <executions>
                     <execution>
                         <id>verify-native-jars</id>
-                        <phase>package</phase>
+                        <phase>none</phase>
                         <goals>
                             <goal>run</goal>
                         </goals>
@@ -193,10 +204,10 @@
                                 <fail unless="native.properties.present" message="Classifier JAR is missing native/${copilot.native.classifier}/platform.properties" />
                                 <condition property="native.cli.present">
                                     <resourceexists>
-                                        <zipentry zipfile="${project.build.directory}/${project.build.finalName}-${copilot.native.classifier}.jar" name="native/${copilot.native.classifier}/copilot" />
+                                        <zipentry zipfile="${project.build.directory}/${project.build.finalName}-${copilot.native.classifier}.jar" name="native/${copilot.native.classifier}/${copilot.native.cli.filename}" />
                                     </resourceexists>
                                 </condition>
-                                <fail unless="native.cli.present" message="Classifier JAR is missing native/${copilot.native.classifier}/copilot" />
+                                <fail unless="native.cli.present" message="Classifier JAR is missing native/${copilot.native.classifier}/${copilot.native.cli.filename}" />
                                 <condition property="placeholder.jar.polluted">
                                     <resourceexists>
                                         <zipentry zipfile="${project.build.directory}/${project.build.finalName}.jar" name="native/${copilot.native.classifier}/runtime.node" />
@@ -221,6 +232,124 @@
     </build>
 
     <profiles>
+        <!--
+            Bind native packaging only when the build host matches an implemented
+            classifier. Add sibling profiles as additional platforms are supported.
+        -->
+        <profile>
+            <id>native-linux-x64</id>
+            <activation>
+                <os>
+                    <name>Linux</name>
+                    <arch>amd64</arch>
+                </os>
+                <property>
+                    <name>copilot.native.libc</name>
+                    <value>glibc</value>
+                </property>
+            </activation>
+            <properties>
+                <copilot.native.classifier>linux-x64</copilot.native.classifier>
+                <copilot.native.cli.filename>copilot</copilot.native.cli.filename>
+            </properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>exec-maven-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>validate-native-host</id>
+                                <phase>validate</phase>
+                            </execution>
+                            <execution>
+                                <id>fetch-native</id>
+                                <phase>generate-resources</phase>
+                            </execution>
+                            <execution>
+                                <id>test-fetch-native</id>
+                                <phase>test</phase>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-jar-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>jar-native</id>
+                                <phase>package</phase>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-antrun-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>verify-native-jars</id>
+                                <phase>package</phase>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+        <!--
+            The SDK's inprocess test profile requires this module's classifier
+            artifact. Bind the same guarded native lifecycle so `-Pinprocess`
+            works without a separate libc property. Host validation fails
+            before download or packaging on non-glibc and unsupported hosts.
+        -->
+        <profile>
+            <id>inprocess</id>
+            <properties>
+                <copilot.native.classifier>linux-x64</copilot.native.classifier>
+                <copilot.native.cli.filename>copilot</copilot.native.cli.filename>
+            </properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>exec-maven-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>validate-native-host</id>
+                                <phase>validate</phase>
+                            </execution>
+                            <execution>
+                                <id>fetch-native</id>
+                                <phase>generate-resources</phase>
+                            </execution>
+                            <execution>
+                                <id>test-fetch-native</id>
+                                <phase>test</phase>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-jar-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>jar-native</id>
+                                <phase>package</phase>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-antrun-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>verify-native-jars</id>
+                                <phase>package</phase>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
         <!--
             Skip the npm download when building offline or when only the
             placeholder JAR is needed: mvn -Dcopilot.native.skip.download=true
@@ -241,13 +370,27 @@
                         <configuration>
                             <skip>true</skip>
                         </configuration>
+                        <executions>
+                            <execution>
+                                <id>validate-native-host</id>
+                                <phase>none</phase>
+                            </execution>
+                            <execution>
+                                <id>fetch-native</id>
+                                <phase>none</phase>
+                            </execution>
+                            <execution>
+                                <id>test-fetch-native</id>
+                                <phase>none</phase>
+                            </execution>
+                        </executions>
                     </plugin>
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-jar-plugin</artifactId>
                         <executions>
                             <execution>
-                                <id>jar-linux-x64</id>
+                                <id>jar-native</id>
                                 <phase>none</phase>
                             </execution>
                         </executions>
diff --git a/java/copilot-native/scripts/validate-native-host.mjs b/java/copilot-native/scripts/validate-native-host.mjs
new file mode 100644
index 0000000000..10b19530ef
--- /dev/null
+++ b/java/copilot-native/scripts/validate-native-host.mjs
@@ -0,0 +1,55 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+import { pathToFileURL } from "node:url";
+
+export function validateNativeHost(classifier, host) {
+  if (classifier !== "linux-x64") {
+    throw new Error(`Unsupported native build classifier: ${classifier}`);
+  }
+  if (host.platform !== "linux" || host.arch !== "x64") {
+    throw new Error(
+      `Native ${classifier} packaging requires Linux x64; detected ${host.platform}-${host.arch}`,
+    );
+  }
+  if (!host.glibcVersionRuntime) {
+    throw new Error(
+      `Native ${classifier} packaging requires glibc; musl and unknown libc hosts are unsupported`,
+    );
+  }
+
+  return `Validated native build host: ${classifier} (glibc ${host.glibcVersionRuntime})`;
+}
+
+export function detectNativeHost() {
+  const report = process.report?.getReport();
+  return {
+    platform: process.platform,
+    arch: process.arch,
+    glibcVersionRuntime: report?.header?.glibcVersionRuntime,
+  };
+}
+
+function main() {
+  const [classifier] = process.argv.slice(2);
+  if (!classifier) {
+    console.error("Usage: node validate-native-host.mjs <classifier>");
+    process.exitCode = 1;
+    return;
+  }
+
+  try {
+    console.log(validateNativeHost(classifier, detectNativeHost()));
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  main();
+}
diff --git a/java/copilot-native/scripts/validate-native-host.test.mjs b/java/copilot-native/scripts/validate-native-host.test.mjs
new file mode 100644
index 0000000000..cbad530c07
--- /dev/null
+++ b/java/copilot-native/scripts/validate-native-host.test.mjs
@@ -0,0 +1,67 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { validateNativeHost } from "./validate-native-host.mjs";
+
+test("accepts Linux x64 with glibc", () => {
+  assert.equal(
+    validateNativeHost("linux-x64", {
+      platform: "linux",
+      arch: "x64",
+      glibcVersionRuntime: "2.39",
+    }),
+    "Validated native build host: linux-x64 (glibc 2.39)",
+  );
+});
+
+test("rejects Linux x64 with musl or unknown libc", () => {
+  assert.throws(
+    () =>
+      validateNativeHost("linux-x64", {
+        platform: "linux",
+        arch: "x64",
+        glibcVersionRuntime: undefined,
+      }),
+    /requires glibc/,
+  );
+});
+
+test("rejects a non-Linux host", () => {
+  assert.throws(
+    () =>
+      validateNativeHost("linux-x64", {
+        platform: "darwin",
+        arch: "x64",
+        glibcVersionRuntime: undefined,
+      }),
+    /requires Linux x64/,
+  );
+});
+
+test("rejects a non-x64 host", () => {
+  assert.throws(
+    () =>
+      validateNativeHost("linux-x64", {
+        platform: "linux",
+        arch: "arm64",
+        glibcVersionRuntime: "2.39",
+      }),
+    /requires Linux x64/,
+  );
+});
+
+test("rejects an unimplemented classifier", () => {
+  assert.throws(
+    () =>
+      validateNativeHost("linuxmusl-x64", {
+        platform: "linux",
+        arch: "x64",
+        glibcVersionRuntime: undefined,
+      }),
+    /Unsupported native build classifier/,
+  );
+});
diff --git a/java/docs/adr/adr-007-native-bundling-strategy.md b/java/docs/adr/adr-007-native-bundling-strategy.md
index f561842fe9..bed843a06c 100644
--- a/java/docs/adr/adr-007-native-bundling-strategy.md
+++ b/java/docs/adr/adr-007-native-bundling-strategy.md
@@ -208,7 +208,7 @@ If none succeeds, startup fails. The PATH fallback does not claim to support eve
 
 ### Current platform scope
 
-The platform detector recognizes the 8 classifiers listed in this ADR. The current Maven packaging and documented experimental support publish only `linux-x64`. Additional classifier artifacts remain follow-up work.
+The platform detector recognizes the 8 classifiers listed in this ADR. The Maven build binds native packaging only for an explicitly selected implemented classifier. Currently, Linux x64 glibc hosts can opt in with `copilot.native.libc=glibc`, while the `inprocess` test profile selects the required `linux-x64` classifier automatically. Both paths validate the host before downloading or packaging native files. Linux x64 musl and other unsupported hosts build only the OS-neutral placeholder, sources, and Javadoc artifacts unless they explicitly request in-process tests, which fail during host validation. Additional classifier artifacts remain follow-up work.
 
 ## Binding technology: JNA over Panama FFM
 
@@ -359,8 +359,9 @@ The pattern follows DJL's `LibUtils.loadLibrary()` approach: detect the platform
   2. Locates the matching `runtime.node` binary on the classpath (via `getResourceAsStream` from the classifier JAR).
   3. Extracts `runtime.node` and the transitional CLI entrypoint into `~/.copilot/runtime-cache/` if valid cached files are not already present.
   4. Loads it via [JNA](#references) using the C ABI entry points, per the [binding technology decision](#binding-technology-jna-over-panama-ffm) above. The JNA-specific code is confined behind an internal binding interface to preserve a future FFM migration path.
-* The Java build fetches the pinned `@github/copilot-<classifier>` npm package, verifies its SHA-512 integrity from `nodejs/package-lock.json`, and packages the version-matched runtime and CLI files.
+* A validated supported-host profile fetches the pinned matching `@github/copilot-<classifier>` npm package, verifies its SHA-512 integrity from `nodejs/package-lock.json`, and packages the version-matched runtime and CLI files.
 * The current release work publishes the `linux-x64` classifier. The planned classifier set expands to the other detected platforms.
+* Adding an implemented platform requires validated host activation, a profile that supplies the classifier and platform CLI filename, and lifecycle bindings for the shared host validation, fetch, script test, package, and verification executions.
 * `cli-native.node` is not bundled. It provides terminal UI features that are irrelevant to the Java SDK's programmatic API surface.
 
 ## Related work items