feat(prime): require negotiated correlated lifecycle proof

[rynfar]

Closes #190.

Summary

• require the frozen Prime SDK feature negotiated_daemon_session_capabilities_v1 before strict correlated mode can be selected
• complete attach first, then require the exact attachment's public supportsNegotiatedCapability("correlated_prompt_lifecycle_v1") proof
• permanently latch ordinary mode on an initial false proof, and permanently fail strict sessions closed if proof is later lost
• preserve the ordinary Prime compatibility path without inferring support from versions, schemas, methods, offers, constructor shape, or attach success
• fence reconnect, replacement, submit, reconcile, cancellation, worker recovery, quiescence, MCP recovery, and final publication to exact proof/generation ownership
• bound raw ingress, decoded queue weight, physical provider operations, worker-list classification, side-question cleanup, and disposal
• keep all native IDs, paths, correlations, diagnostics, capability payloads, and caught transport details private
• document the negotiated proof boundary and recovery/cleanup invariants

Coordination

• Pylon umbrella: Prime provider parity: tasks, automation, and upstream watch #114
• Prime proof issue: Expose attach-negotiated daemon session capability proof prime-agent#17
• Prime proof PR: feat(sdk): prove negotiated daemon session capabilities prime-agent#18
• Prime proof merge: 91e13b6798343995291ccca6f523fba81ff96cd6
• Exact Prime package SHA-256: c46497e2870618bb2caa9d59d161fc5abfad27472eec7deff39cfb1380ebe70c
• Comet consumer: feat(harness): run one bounded correlated Prime text turn rynfar/comet#7
• Comet umbrella: Prime Agent integration: coordinate Comet, Pylon, and fork contracts rynfar/comet#1

Validation

Exact rebased head: f34744ac774b0570c0608ccc8def509d3ae88ece / tree 55441e2a8997551d36cc2b846981fc03323b55fc

Combined origin/pylon...HEAD binary diff SHA-256:
ed9828372a0e6152acc8977bede14d43af1f2753da072f52d3b754eeb2c9dc34

Commit patch SHA-256 values:

• feature: 1dc7a49cb9a4c5f392821d05b53118df862e7b4130ba2be65636e1f412551755
• recovery hardening: d95fbe76904d4923527cd029a6005df3d08e83f46d8a32e44703df5189149853

Local results on the exact rebased head:

• runtime: 214/214
• Prime provider folder: 462 passed, 1 expected integration skip
• server typecheck: passed; no owned suggestions
• targeted lint: 0 warnings, 0 errors
• formatter and git diff --check: passed
• complete server run: 3,760 passed, 11 skipped, with one unrelated src/environmentTheme.test.ts watcher timeout

The theme watcher file and its implementation/config/dependency files are byte-identical to current origin/pylon. The isolated watcher failure reproduced on a clean origin/pylon worktree; one baseline run passed and later baseline/branch runs timed out. No branch-owned path intersects the 97 upstream paths added during rebase.

Review

Five independent P0/P1 reviews approved the exact rebased HEAD/tree/combined hash: API, security, design, adversarial, and test coverage. Any tree change invalidates those approvals and requires a fresh exact-head gate.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−3 B (−0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+40 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−10 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+50 B (+0.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.4 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: 05cf20c · PR result: f34744a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.