Expose attach-negotiated daemon session capability proof

[rynfar]

Purpose

Expose a public, generation-scoped proof of attach-negotiated daemon client capabilities. This is required before Comet can use correlated_prompt_lifecycle_v1, and it should repair Pylon's current server-offer shortcut at the same shared SDK seam.

Coordination:

• Prime fork umbrella: Track Pylon fork parity and upstream overlap #1
• Pylon consumer umbrella: Prime provider parity: tasks, automation, and upstream watch pylon#114
• Comet consumer umbrella: Prime Agent integration: coordinate Comet, Pylon, and fork contracts rynfar/comet#1
• Comet session owner merged from feat(harness): own bounded native Prime sessions rynfar/comet#6

Current gap at 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47

• DaemonClient.supportsServerCapability("correlated_prompt_lifecycle_v1") proves only the daemon_hello offer.
• DaemonAgentConnection.attach() conditionally advertises the matching client capability.
• DaemonAttachResult.client.capabilities contains the daemon-established attach-side set, but the public connection does not expose it.
• DaemonAgentConnection.supportsCorrelatedPromptLifecycle() currently delegates to the server offer.
• Pylon computes correlatedPromptLifecycleAvailable from the same offer before attach.

A server offer is not a negotiated intersection. Method presence, package version, ignored options, or a successful attach without validating its returned client capability are not substitutes.

Proposed contract

• Add frozen public-root PRIME_AGENT_SDK_FEATURES token negotiated_daemon_session_capabilities_v1.
• Add public DaemonAgentConnection.supportsNegotiatedCapability(capability: DaemonClientCapability): boolean.
• Return true only after the current attached generation has:
  1. the matching validated server offer;
  2. the capability in the exact attach/reattach request; and
  3. the same capability in the validated DaemonAttachResult.client.capabilities for this connection/client/generation.
• Return false before attach, during invalidation/replacement, after dispose, and after any failed or ambiguous reattach until the new generation is proved.
• Reject malformed, duplicate-conflicting, unsupported, wrong-client, or wrong-generation attach capability data rather than treating it as proof.
• Keep supportsCorrelatedPromptLifecycle() as server-offer evidence because the SDK currently uses it before attach to construct the advertised capability list. Document that it is not a negotiated proof; consumers must use the new accessor after attach. Do not make the pre-attach method false or negotiation would never start.
• Commit the negotiated set only after attach identity and snapshot validation succeeds, not merely when the raw attach response arrives.
• Return a boolean only. Do not expose client IDs, session IDs, paths, raw attach results, or mutable capability collections.

The exact public name is proposed for review. If a different generic accessor is chosen, it must preserve these semantics and the frozen feature token.

Compatibility

• Protocol v7 foundation behavior stays compatible.
• Stock Prime and older fork artifacts omit the new SDK token/accessor and remain detectable before prompt construction.
• Existing attach capability lists and server offers do not become mandatory globally.
• Pylon must enable correlated lifecycle only from the post-attach proof. Its ordinary-prompt fallback may remain Pylon-local.
• Comet will fail its prompt feature gate and cleanly close the fresh owned session when proof is unavailable. It will not fall back to an uncorrelated prompt.

Deterministic tests

• token exported and public root frozen;
• offer without attach request/response proof => false;
• method/options presence without token => incompatible consumer gate;
• attach request plus missing/invalid/wrong-client response capability => fail/false;
• exact offer + advertised + echoed capability after successful attach => true;
• attach failure/cancellation, dispose, replacement, reattach failure, and stale old-generation result => false;
• reattach can re-establish proof only for the new exact generation;
• concurrent event-before-attach-response cannot use correlated behavior early;
• stock/current compatibility matrix;
• no native client/session identity appears in public errors or logs.

Upstream overlap decision

Current upstream/main@a903d4b6768f484bd6d459b7b0aa7dee38e461e2 has no correlated prompt lifecycle or negotiated-capability accessor. Decision: retain this small fork-boundary proof and record the evidence in .pylon/features.yaml and .pylon/upstream-review.md.

Merge bar

Update the fork ownership ledgers, run exact stock/current compatibility tests, build a reproducibly hashed artifact, and review the Prime/Pylon/Comet consumer assumptions together. No consumer may infer this proof from versions, method presence, server offers, or attach success alone.

[rynfar]

Consumer issues are now explicit:

• Pylon post-attach gate: Prime correlated prompts must require post-attach capability proof pylon#190
• Comet bounded host-private turn: feat(harness): run one bounded correlated Prime text turn rynfar/comet#7

Merge order is Prime #17 API/artifact, Pylon PrimeIntellect-ai#190 compatibility update, then Comet #7. The existing supportsCorrelatedPromptLifecycle() must remain offer evidence for pre-attach request construction; only the new accessor is the post-attach proof.

[rynfar]

Claimed for implementation.

• branch feat/negotiated-session-capabilities
• isolated worktree /Users/rynfar/.prime/worktrees/prime-negotiated-session-capabilities
• base origin/pylon@7238ac8cff25962ada9ffe4530b7d4d1cddc1b47
• decision: retain the fork-boundary proof; upstream has no equivalent

Declared owned files before edits:

• packages/coding-agent/src/modes/agent-connection/daemon-agent-connection.ts
• packages/coding-agent/src/modes/agent-connection/types.ts only if the public interface needs the accessor
• focused agent-connection tests
• packages/coding-agent/src/sdk-features.ts and public export tests
• .pylon/features.yaml
• .pylon/upstream-review.md
• focused docs only if required by review

No Pylon or Comet consumer code is owned by this branch. I will not push or open a PR until exact-head tests and independent P0/P1 reviews approve.

[rynfar]

Pre-commit security review found that the proof also needs a transport-generation and shared-client invalidation seam. I am expanding the declared owned area before edits to include:

• packages/coding-agent/src/modes/daemon/daemon-client.ts
• its focused tests

Reason: resetTransportForReconnect() can replace the physical socket without notifying connection close listeners, and multiple logical DaemonAgentConnections may share one DaemonClient. The proof must bind to the physical transport generation and fail closed when another same-session logical attachment mutates or detaches the shared server state. This remains within Prime #17; no wire capability or consumer code is added.

[rynfar]

Ownership update after exact-head review findings.

The repair remains isolated on feat/negotiated-session-capabilities / /Users/rynfar/.prime/worktrees/prime-negotiated-session-capabilities. The exact owned candidate scope is now:

• .pylon/features.yaml
• .pylon/upstream-review.md
• packages/coding-agent/.changes/negotiated-daemon-capability-proof.md
• packages/coding-agent/docs/agent-connection.md
• packages/coding-agent/docs/sdk.md
• packages/coding-agent/src/modes/agent-connection/daemon-agent-connection.ts
• packages/coding-agent/src/modes/daemon/daemon-client.ts
• packages/coding-agent/src/sdk-features.ts
• packages/coding-agent/test/agent-connection-daemon.test.ts
• packages/coding-agent/test/daemon-client.test.ts

The first committed candidate 7c68a7ab4 is retired after exact review withheld approval. The active repair adds synchronous pending invalidation, permanent fail-closed admission, attach-proof fencing for correlated runtime frames, negotiated rather than offered resync shaping, docs, and the required changelog fragment. No Pylon or Comet consumer code is owned here. I will freeze a new commit only after renewed local validation, then require new exact-head P0/P1 approvals before push/PR.

[rynfar]

New frozen local candidate after the first exact-head review repairs:

• HEAD a0233b09cb18d6b0ec53e0f1514144f0564e2223
• tree 779b5fabe8e0e637c485ee2e6db86d881df2df2b
• base 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47
• exact receipt SHA-256 b3e6d4716efcfea6897edfdb24179675955e0e578dfd248e94fdf72454233943
• cumulative patch SHA-256 c84858519b6c8cf9715feb180babadde7f9fc709a3929a6a2e3a9905a812f3c3

Renewed validation at this exact head:

• focused daemon connection/client tests: 183/183 passed
• root build: passed (live generated model catalog restored afterward)
• npm run check: passed
• clean real supervisor process suite: 13 passed, 8 fixture-gated skips
• git diff --check: passed

This candidate adds the review-requested same-stack invalidation, permanent fail-closed admission/proof fence, bounded correlated runtime-frame hold/release/discard behavior, committed-echo resync shaping, shared-client retained-shaping invalidation, SDK docs, and changelog fragment. Three independent exact-head reviews are in progress. The branch remains unpushed and no PR will open until every P0/P1 gate approves.

[rynfar]

Third frozen exact candidate (local; not pushed)

The two blockers on retired a0233b09 are repaired in a new clean candidate:

• commit: 6a4e19f974390e2051010461bd28a609420ffdf3
• tree: 9a4138f13a4164f0c164bfa31bfd683567749704
• base: 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47
• cumulative patch SHA-256: e914158d80a2fca5d2d8ad99d900bd6c26740a3272f9476a6b2089daff4beb4f
• repair-commit patch SHA-256: a3c33f9f631b14f6d747b891499f15e2207a6cda6867227a09262357d6c56021
• validation receipt SHA-256: 2c1cf52037ac2995e7faf108397548b2f32f98a61800af6485c3d70ef9ec65b2

7c68a7ab4 and a0233b09 remain retired and withheld.

Repairs

• Every same-connection attach/reattach admission now captures a synchronous monotonic token. Queued or active older operations must retain the exact token through retry and final commit, so B cannot publish while later C is pending.
• Pre-proof correlated runtime retention is bounded by both 128 frames and 256 KiB cumulative conservative structural weight. Accounting is iterative, does not stringify/copy payloads, and rejects unsafe, cyclic, individually oversized, or cumulatively oversized values before retention.
• Queue and weight reset together on publish, discard, invalidation, failure, transport loss, and disposal. Overflow clears all retained frames and emits only the fixed payload-free fail-close error.
• Replacement lifecycle shaping is rechecked after its async query against the exact invalidation revision and shared owner; a concurrent shared-client capability mutation strips stale shaping.
• Explicit DaemonClient.close() is terminal owner disposal: later connect() rejects and a live connection emits one fixed close instead of invoking recovery.

Exact-tree validation

• focused connection/client suites: 190/190 passed;
• root build: passed; generated catalog restored; clean tree;
• root check, installer render, browser smoke, typecheck, and git diff --check: passed;
• stock 0.8.1 ↔ rebuilt-current real runtime adoption: 2/2 passed (installed 0.8.1 launcher SHA-256 c5dffcd16a401551986023134fbc05457775e1eeed618a5a6ae0d0cee1772d5f);
• six isolated real-process files: 79/79 passed;
• real supervisor suite: 13 passed, 8 fixture-gated skips;
• rebuilt namespace: frozen [bounded_daemon_ingress_v1, negotiated_daemon_session_capabilities_v1] plus accessor;
• stock 0.8.1 namespace: no registry token and no accessor.

Fresh exact-head API, security/resource, and test/repro reviews are running. I will not push or open a PR unless all P0/P1 gates approve this exact head without modification.

[rynfar]

Candidate 6a4e19f97 retired

Exact-head test review found a same-connection replacement race before approval:

1. an active-A session_replaced handler waits in getPromptLifecyclesFor();
2. the same connection reattaches and commits target B with valid proof;
3. the old A query resumes;
4. the candidate strips stale lifecycle shaping but still commits A state/messages and route identity;
5. proof can remain true for B while later commands route through stale A identity.

The second-connection stale-shaping test did not cover this same-connection proof/route divergence. 6a4e19f97 is withheld and will not be pushed. The next candidate will discard the entire old handler when its exact same-connection attachment admission, epoch, transport, or route identity changes, while still allowing a peer-only shared-client capability overwrite to commit unshaped A state. A deterministic gated A-query → committed B-reattach test will prove the route and proof stay aligned.

[rynfar]

Fourth frozen exact candidate (local; not pushed)

The accepted blockers on retired 6a4e19f97 are repaired in a new clean candidate:

• commit: 192d9be71eb04375f181bad53ab8f746ca9053a7
• tree: 916c18de386830f11b635cb1d08644b853f2a5b1
• base: 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47
• cumulative patch SHA-256: 0a3ca5e16bb4d52e29a5a8dd0e7c7b99632f0207bc93efab34a400e8b15bdbe3
• repair-commit patch SHA-256: 46ddfe0a0bf0efc7dac558e5cfd281f8374ede84af23529d22ecacd073fe0682
• validation receipt SHA-256: 436f520eb728a2c612c5c18138b886d97a94ac61631645f7510c84b1f7dddc0f

All three earlier candidates remain retired and withheld.

Additional repairs

• A nonchunked replacement query captures the exact same-connection admission, attachment epoch, active route, transport generation, terminal/update, and disposal state. If any changes while lifecycle recovery is awaited, the entire old handler is discarded. It cannot commit stale A state after B reattach. A peer-only shared-client overwrite may still commit A's unshaped replacement because A's route did not change.
• The first explicit DaemonClient.close() transition now notifies listeners even when a prior natural transport loss already removed the socket. Repeated close stays idempotent and later connect stays rejected.
• Normal and update recovery loops wake on owner close and check terminal state before and after every restart/connect/reconnect/list/attach/snapshot await. An already-running callback is not cancellable, but its result is discarded. No later recovery work or connected event can publish.
• Owner close produces one fixed public connection error with no raw socket/log path. Natural-loss plus socketless owner-close tests cover both ordinary and update recovery.
• The public close lifecycle is now included in the release fragment as well as SDK docs and governance ledger.

Exact-tree validation

• focused connection/client suites: 195/195 passed;
• root build, root check, installer render, browser smoke, typecheck, and cumulative git diff --check: passed;
• stock 0.8.1 ↔ rebuilt-current runtime adoption: 2/2 passed;
• six isolated real-process files: 79/79 passed;
• real supervisor suite: 13 passed, 8 fixture-gated skips;
• current namespace exposes the frozen token/accessor; installed stock 0.8.1 exposes neither;
• exact worktree is clean.

Fresh API, security/resource, and test/repro review is running against this exact head. It remains local and unpushed pending unanimous P0/P1 approval.

[rynfar]

Candidate 192d9be71 retired

API and test review independently confirmed a chunked-replacement fence P1:

1. A receives session_replaced { snapshotFollows: true } but no snapshot begin/chunks.
2. The same connection reattaches or reconnects and commits B with valid proof.
3. pendingChunkedReplacement still owns the dispatch fence.
4. Every non-snapshot B frame is queued before active-route filtering, including session_closed.
5. B proof can remain true after B closes, and the stale queued-message list is unbounded.

192d9be71 is WITHHELD and will not be pushed. The repair will synchronously retire/discard the old header and queued frames on attachment admission and physical transport loss, before any new proof can publish. Deterministic header-only A → B reattach and A → socket recovery tests will require B runtime events and close invalidation to flow immediately.

[rynfar]

Fifth frozen exact candidate (local; not pushed)

The stale chunked-replacement blocker on retired 192d9be71 is repaired:

• commit: 63c946d3064b2b262bb0ed727da9d5b363cf3daf
• tree: f4ff15eb6067dd62a6b3670ceb28705c0bb1ae81
• base: 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47
• cumulative patch SHA-256: 2992dc6707698732f6d176819193234b02176f5efbbdf8e39dd74d5da0836482
• repair-commit patch SHA-256: e6d0d95ecda43945591907940bf5df7af3da98b48b0aed34436382f30a1d02e4
• validation receipt SHA-256: 06e713064fd17211583cb690f3971a2563fedbb73d89824947a43fe20925ff35

All four earlier candidates remain retired and withheld.

Additional repair

• Same-connection attach/reattach admission synchronously retires an old chunked-replacement header and its queued frames before promise-tail scheduling.
• Attachment-epoch changes, physical transport loss, disposal/fail-close, and a matching session_closed also retire the old fence.
• A begun old assembly is rejected and removed. A delayed old snapshot begin/chunk/end is ignored until a fresh attachment commits, so it cannot race a gated B reattach.
• Chunked-replacement queued frames now have independent 128-frame and 256 KiB cumulative structural-weight limits. Overflow drops the fence and emits the fixed payload-free fail-close error.
• Peer-only shared-client attachment does not retire another logical connection's route-local fence; its frames remain bounded and lifecycle shaping remains proof-gated.

New deterministic coverage

• header-only A fence → gated B reattach;
• delayed old A begin/end while B response is pending;
• old A queued event discard and fresh B event delivery;
• B session_closed immediately invalidates B proof;
• header-only A fence → physical reconnect and fresh event route;
• matching A close bypasses/retires its own fence;
• cumulative chunk-fence memory overflow below the count cap, with no payload canary leak.

Exact-tree validation

• focused connection/client suites: 199/199 passed;
• build/check/typecheck/installer/browser/diff: passed;
• stock 0.8.1 ↔ rebuilt current: 2/2 passed;
• six process files: 79/79 passed;
• real supervisor suite: 13 passed, 8 fixture-gated skips;
• namespace stock/current gates passed; worktree clean.

Fresh exact-head API, security/resource, and test/repro review is running. The candidate remains local and unpushed pending unanimous P0/P1 approval.

[rynfar]

Candidate 63c946d30 retired

API review found one remaining delayed-transfer P1. The retirement mode ignored a delayed old session_snapshot_begin, but a pre-begin session_snapshot_failed { purpose: "replacement" } with a fresh ID could still create an assembly and start internal A snapshot recovery. That internal A attach becomes a newer admission and can supersede the already-admitted gated B reattach.

63c946d30 is WITHHELD and will not be pushed. The next candidate will:

• ignore an unsolicited failed snapshot ID while retired-transfer discard mode is active;
• still admit a before-begin failure that belongs to the exact current requesting/receiving attach attempt;
• bind that admitted failure to the request attempt so it fails that attempt instead of starting unrelated runtime recovery;
• extend the deterministic header-only A → gated B test with delayed pre-begin A failure and prove no internal A attach occurs.