feat(sdk): prove negotiated daemon session capabilities

[rynfar]

Summary

Adds a generation-scoped, post-attach negotiated capability proof for strict native-daemon consumers.

• freezes SDK feature token negotiated_daemon_session_capabilities_v1;
• adds public DaemonAgentConnection.supportsNegotiatedCapability(...);
• commits proof only after the exact attachment validates identity, snapshot, echoed client capabilities, transport generation, owner, epoch, and admission revision;
• keeps offer evidence (serverCapabilities / supportsCorrelatedPromptLifecycle()) separate from negotiated proof;
• invalidates proof synchronously on every later attach/reattach admission, transport loss, replacement ambiguity, disposal, and terminal close;
• serializes shared-client mutations and fences stale attachment/snapshot work;
• adds terminal DaemonClient.close() state and close notification needed by bounded recovery.

Snapshot and lifecycle safety

• exact current request/admission ownership is required for streamed snapshot acceptance or tombstone rebind;
• request-bound snapshot transfers resolve only to their waiter before descriptor validation and do not publish runtime resync independently;
• ignored snapshot IDs are non-evicting and capped at 128 per live transport; an unsafe 129th ID fails permanently with a fixed payload-free error;
• pre-proof and pending-replacement queues are bounded at 128 frames and 256 KiB using conservative structural accounting;
• attachment admission, update, terminal close, transport close, disposal, and permanent reconciliation failure retire snapshot state under explicit ownership;
• message-first and socket-first close paths classify ownership before retirement;
• duplicate and contradictory close frames cannot emit or reconnect twice;
• stale direct replacement/resync frames cannot publish after close, during update/disposal, or from old A during inline/streamed A→B admission;
• dead-transport retirement cannot start per-snapshot recovery.

Compatibility and governance

• stock Prime Agent 0.8.1 retains protocol-v7 foundation compatibility but exposes neither token nor accessor, so strict consumers fail the feature gate cleanly;
• SDK docs, connection docs, change fragment, feature ledger, and upstream review ledger are included;
• intended consumer order remains Prime Expose attach-negotiated daemon session capability proof #17 → Prime correlated prompts must require post-attach capability proof pylon#190 → feat(harness): run one bounded correlated Prime text turn rynfar/comet#7.

Exact candidate and review

• commit: c27e1b6ea329aabe19ec70f768bcbf37c79a6bef
• tree: 45af0b9ce0199c3be5bffdde9c787eec06f82dd8
• base: 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47
• cumulative patch SHA-256: f90ba348f023e64394526f4b72856201c842630c19a3073d12889a007628ed89
• repair patch SHA-256: 120f4d048a0cfbc56b5ac2ddfd676b5425723966fec8fb5b50cd624de16f946a
• exact validation receipt SHA-256: 9980023b70a6d70bf146bd077dcbe97209819a20443df05f0f032de1015b14ba

Three independent exact-head reviews approved the unchanged commit with no P0/P1 findings: API/contract, security/resource, and test/reproduction.

Validation

• focused daemon connection/client suites: 219/219 passed;
• root build, npm run check, commit hook, YAML parse, and cumulative diff check: passed;
• pinned stock/current adoption: 2/2 passed;
• six isolated real-process suites: 79/79 passed;
• daemon supervisor process suite: 13 passed, 8 fixture-gated skips;
• current/stock namespace probes: passed;
• adversarial d6 failure reproduction, full-budget close ordering, duplicate/contradictory close, A→B admission, direct post-close/update/disposal frames, and 129-ID overflow: passed.

Known inherited follow-up

Aggregate storage inside one exact active snapshot request (candidate IDs, assemblies, and chunk maps) remains governed by inherited behavior rather than a new global cap in this PR. Strict consumers continue to block arbitrary saved-session attach pending a separate cumulative snapshot budget. An unrelated shared-client traffic availability hardening item is also recorded as nonblocking; retained queues remain bounded.

Closes #17.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Corrected the PR base from mirror-only main to required product branch pylon; closing/reopening only to trigger the protected pull_request CI event for the unchanged reviewed head.

[rynfar]

Candidate c27e1b6ea3 retired after hosted CI

PR #18's trusted exact-SHA run 33310987448 passed build/check, agent-core, AI, TUI, kernel, runtime Python, coding-agent shards 2/3 and 3/3, and process smoke. Shard 1/3 failed two ENG-4656 tests because its cast ResumeDaemonClient fixture did not implement the newly required concrete getTransportGeneration() method. After that first error, local reproduction also showed that the same fake returned a stale fixed client ID/capability list rather than the exact attach request echo now required by the negotiated-proof contract.

This is a deterministic test-fixture gap, not a production failure, but the exact reviewed head is retired and will not merge.

The dirty test-only repair:

• supplies one stable fake transport generation;
• echoes each attach/reattach request's exact clientId and capabilities;
• updates the governance ledger with the hosted result.

Local validation now passes ENG-4656 3/3, focused proof suites 219/219, and complete shard 1/3 1,466/1,466, plus npm run check and diff check. The dirty combined patch SHA-256 is 019a3fe952660303e1e69449d0a5c9479b521f5ecb993093576ce65c69bafb69. Independent pre-freeze review is running before a replacement commit is created.

[rynfar]

Ninth frozen exact candidate (local replacement after hosted fixture failure)

Candidate c27e1b6ea3 is retired. The replacement changes only the incomplete ENG-4656 cast fake and governance evidence; production source bytes are identical to the previously approved candidate.

• commit: d3323e38d7f3d93416819c7f509c67540c14dbcc
• tree: a07b06e3882d51ede94c4335ac5c6ae81a08b645
• base: 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47
• cumulative patch SHA-256: 124ee0fefcdd85c42cf557ab12f5c3cf25573a079d5af411b5f753a5095a4e90
• fixture/ledger repair patch SHA-256: 019a3fe952660303e1e69449d0a5c9479b521f5ecb993093576ce65c69bafb69
• validation receipt SHA-256: 9b574b0e4dd9f4bffd84194257d6a8eca6615380670f82b3407e26eb938257fb
• production diff SHA-256: d59b9f4e265398cccfb25835e29628b40208dfd273b159b8146f654e2174aa10 (byte-identical to retired candidate c27e1b6ea3)

The fixture now supplies one stable generation for its single non-reconnecting fake transport and returns the exact attach/reattach request's client ID and capabilities. It does not add a production fallback or claim an optional server capability.

Renewed validation:

• ENG-4656: 3/3 passed;
• focused connection/client: 219/219 passed;
• clean CI-like coding-agent shard 1/3: 1,466 passed, 24 skipped;
• npm run check, commit hook, cumulative diff check, YAML parse: passed;
• every other hosted job on the identical production bytes had passed in run 33310987448.

Two independent pre-freeze reviews approved the exact repair bytes with no P0/P1/P2. Fresh exact-head API, security/resource, and test/reproduction reviews are running. The replacement remains local and unpushed until all three approve.

[rynfar]

Replacement exact-head review gate passed

The clean hosted-CI repair candidate has unanimous exact-head approval:

• commit: d3323e38d7f3d93416819c7f509c67540c14dbcc
• tree: a07b06e3882d51ede94c4335ac5c6ae81a08b645
• cumulative patch SHA-256: 124ee0fefcdd85c42cf557ab12f5c3cf25573a079d5af411b5f753a5095a4e90
• fixture/ledger repair SHA-256: 019a3fe952660303e1e69449d0a5c9479b521f5ecb993093576ce65c69bafb69
• receipt SHA-256: 9b574b0e4dd9f4bffd84194257d6a8eca6615380670f82b3407e26eb938257fb

API/contract, security/resource, and exact test/reproduction reviews all APPROVE with no P0/P1; the exact test review also found no P2. Production source bytes remain identical to the previously approved candidate. The branch may be updated for a new trusted hosted run; merge remains gated on every required check passing the new exact SHA.

[rynfar]

Exact-SHA hosted gate passed

Trusted hosted CI run 33311730468 completed success on d3323e38d7f3d93416819c7f509c67540c14dbcc. Build/check, agent-core, AI, TUI, coding-agent shards 1/3–3/3, process smoke, kernel, runtime Python, contributor trust, changelog, and the aggregate gate all passed.

Final pre-merge verification:

• PR head: d3323e38d7f3d93416819c7f509c67540c14dbcc;
• PR base: pylon at 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47;
• merge state: clean and mergeable;
• local exact worktree: clean;
• formal exact-head reviews: 3/3 approve, no P0/P1.

All candidate, review, and hosted gates are satisfied. Squash merge is appropriate so retired intermediate candidates do not enter product history; the merged tree must equal a07b06e3882d51ede94c4335ac5c6ae81a08b645.

[rynfar]

Merged artifact approved for downstream consumers

Prime #17 merged as 91e13b6798343995291ccca6f523fba81ff96cd6 with tree a07b06e3882d51ede94c4335ac5c6ae81a08b645, exactly matching the reviewed candidate tree.

Reproducible public artifact:

• prime-agent-0.8.1.tgz
• SHA-256: c46497e2870618bb2caa9d59d161fc5abfad27472eec7deff39cfb1380ebe70c
• size: 9846977 bytes
• receipt SHA-256: d19206b34b87e001ba5964fecd48e154d78c5d5032901faad0f92dd3fff432b8

Both independent artifact reviewers approved with no P0/P1/P2. Two additional repacks reproduced all four package hashes exactly. The isolated install matches the public archive 1,436/1,436 files and exports the frozen negotiated_daemon_session_capabilities_v1 token, supportsNegotiatedCapability, and getTransportGeneration.

This artifact is the pinned input for pylon-code/pylon#190. It supersedes the earlier d6065af7... artifact, which remains suitable only for the pre-proof Comet session-owner milestone.