[benbrandt]

Incremental extraction — completed; reference only

This PR was split into independently reviewable and shippable changes; all eight planned extractions are now merged. Keep it as the reference implementation; do not merge the full diff wholesale. The extraction PRs target main directly, not this branch or each other.

1. Merged: ACP SDK patch update, chore(deps): update ACP SDK to 2.0.2 #676 — two dependency files, no adapter code.
2. Merged: owned Vitest discovery, test: restrict Vitest discovery to owned suites #677 — one 11-line configuration, independently validated with main's SDK 2.0.0.
3. Merged: mock Responses server improvements, test: support concurrent mock Responses requests #680 — test-only request routing, async responses, safe failures, and direct standalone coverage.
4. Merged: behavior-preserving item-rendering state extraction, refactor: extract streamed item rendering state #681 — two source files; the same handler owns the same state, with unchanged outputs and no new subagent behavior.
5. Merged: live standard-subagent core, feat: add live standard ACP subagent sessions #682 — identity, ancestry, mutation restrictions, interactions, child-owned rendering, and lifecycle/reconnect safety together. Association-only replay is explicit; recursive transcripts and historical outcomes remain deferred. Native model reporting from feat: report the model of each native subagent session #678 is preserved.
6. Merged: recorded child transcript replay and reconciliation, feat: replay recorded subagent conversations #684 — both spawn formats, legacy/paginated stores, recursive ancestry, best-effort gaps, and state reconciliation without duplicate presentation.
7. Merged: read-only child configuration snapshots, refactor: report read-only child configuration snapshots #685 — complete observed model/effort singleton snapshots, historical/current separation, verified post-response refresh, and nonblocking reads with stale-result fencing. Existing model reporting and AIR behavior are preserved; no controls are enabled.
8. Merged: historical child outcomes, refactor: replay historical child outcomes #686 — latest recorded turn completion/cancellation/failure before the response, independent of current foreground state, interactions, ownership, and controls; legacy and paginated stores covered. This is the final planned extraction, not permission to merge the old combined diff.

Completion audit — main at 9091b73

All eight planned slices above are on trunk, including #685 and #686. Compared the old reference tree directly against current main rather than treating the stale three-dot PR diff as unlanded work. Most remaining differences are superseded implementation, differently organized/expanded tests, and intervening trunk changes. Do not copy back the old non-awaiting transition helper, weaker replay reconciliation, pre-#678 model reporting, older dependency/release files, or old tests wholesale.

Merged audit follow-up: #687. A coordinator already known through a pathless spawn did not learn its available recorded path before nested child replay. Four new v1/v2 warm/cold regressions fail without the fix; two more preserve an already observed path against older history. The fix is two files, +39/-1 lines, with no identity, parent, title, ownership, capability, or AIR changes. Current validation: typecheck/build, 2,070 unit tests, 15 real-app-server integration tests, and all six bundles. The follow-up merged to main as 6cce035. All planned extractions and this audit fix are merged; the old combined diff is superseded and must not be merged wholesale. The original branch remains available for reference.

Separate follow-up candidates, not bundled into #687: the reference uses iterative drains where two standard-router pending-buffer drains still use argument spreading (a byte cap is not an argument-count cap), and contains some additional focused assertion coverage for existing foreground/writer behavior. These are hardening/test follow-ups, not missing planned feature scopes. Child controls and directed-message extensions remain deliberately outside this extraction.

Main also includes native child model reporting from #678. Subsequent runtime extractions must preserve/reuse that implementation rather than overwrite it with the older reference code.

Tests and snapshots travel with the behavior they verify. New feature pieces must be validated separately; this combined PR's green CI does not establish that an arbitrary subset is standalone.

Known gap to close before the configuration piece lands

A focused runtime probe confirmed that enqueueSessionTransition completes before an async callback settles. Configuration publication passes such a callback. Fixed in the #682 live-core extraction: async completion and rejection propagation now participate in the notification lane, with a permanent ordering/rejection regression. The old reference branch itself still contains the earlier helper; do not copy it back over the extracted implementation. Neither #676 nor #677 includes this helper or depends on the subagent implementation.

---

Summary

Implement the first coherent slice of the unstable standard ACP subagent contract, independently of AIR's existing private contract.

• Use standard associations for opted-in non-AIR v1 clients and non-AIR v2 clients. Preserve AIR's updates, generation-based identities, and opt-out fallback without emitting both contracts.
• Keep one opaque child session identity across delegations, idle work, and parent replay. Announce immediate parents before children, buffer unresolved ancestry instead of flattening it, and namespace copied fork histories separately.
• Report child work independently of conversation lifetime and the parent's foreground prompt. Observed endings become idle; lost observability becomes unknown, not a fabricated terminal failure. V2 also gets child-scoped native state updates.
• Route permissions and elicitation under the child ID. Keep request scopes alive through parent replay, withdraw them at actual work boundaries (even under output backpressure), and reject late replies locally even if a client ignores cancellation.
• Advertise empty child capabilities and reject unadvertised session mutations, including private extensions and raw-provider-ID bypasses. Direct child cancellation is ignored; parent cancellation cascades to observed live descendants.
• Replay each child conversation once, deduplicate overlapping completed items, and publish fresh work snapshots after the replay response. Serialize standard same-parent attachment operations, then release fresh child traffic after the latest setup response is written, including batched responses. Keep close/cancel independent and fence queued setups after close.
• Keep child titles, plans, and unfinished tools separate from the parent. Child Markdown plans use authoritative completed snapshots. Agent-owned child input is not misreported as ordinary user input.

Review corrections

• Child approval, elicitation, and accepted-URL completion state now belong to the child conversation, not the parent's current prompt or resume handler.
• Replay release observes successful SDK wire writes rather than the next event-loop turn. Delayed/failed batch members cannot cause pre-response fresh snapshots, and two same-parent resumes in one batch do not deadlock.
• Existing nested-child metadata uses the same ancestor-announcement gate as child events. The regression fails on both protocol versions without the gate.
• The root Vitest configuration is JavaScript ESM, fixing the application TypeScript root-directory failure while retaining owned-test discovery.

Second review: lifecycle corrections

• Restored child delivery validates current provider parentage through the ancestor chain. Loaded owned runtimes are rejoined without execution-context overrides. Owned inactive children get routes without being loaded; copied foreign fork history cannot steal the original runtime's events or authorize interrupts.
• Child item-rendering state now survives parent handler changes, including terminals, streamed-output bookkeeping, message phases, and item presentation tracking.
• Standard child admission precedes tool/terminal cleanup as well as normal rendering. Setup transitions share the session notification lane; replay snapshots share live state-publication ordering.
• Replayed tool snapshots reconcile persistent tracking before duplicate live completions are suppressed. Outstanding-tool cleanup is turn-scoped so an old completion cannot fail newer work.
• Both recorded spawn formats use the same child-history traversal.
• Live child requests retain foreground/action tracking during replay, including a new native turn arriving while presentation remains buffered.

26 permanent lifecycle regressions cover these paths on both protocol versions, plus real-Codex terminal-lifetime tests. Existing AIR golden transcripts are unchanged. The terminal fixture uses full-access mode only for its fixed local script in an isolated workspace, avoiding CI hosts that cannot create sandbox network namespaces; production sandbox policy is unchanged.

CodeQL correction

Unexpected mock response-handler exceptions are logged server-side and return only a fixed HTTP 500 message. Regression tests cover synchronous exceptions, rejected stack-trace strings, and recovery on the next request. No production adapter behavior is changed.

Latest specification / SDK alignment

• Upgrade the published ACP SDK dependency to ~2.0.2 (lockfile resolves 2.0.2).
• Report observed child models and reasoning effort as complete, read-only singleton configuration snapshots, never by copying parent values or offering parent choices. Child configuration changes do not mutate the parent or grant session/set_config_option.
• Optional configuration reads run outside the notification lane; publication rejoins the existing ordered setup/notification lane. Pending or late reads cannot stall child output, replace newer observations, or bypass replay boundaries. Refreshed current configuration follows the replay response, and unchanged settings are re-established on reattachment.
• Replay a known final child turn outcome as historical idle before the response, with its actual success/cancellation/failure reason. Do not promote it into the foreground-state cache, runtime ownership, or mutation authorization. Missing or still-running history invents no outcome. Both legacy and paginated histories are covered; unavailable turn summaries do not discard available transcripts.
• Preserve the actual batch-write freshness boundary and empty child capability allowlist. Claude is an implementation reference, not a replacement for Codex provider ownership checks or the spec.

Adds 22 reporting regressions across v1/v2, plus real-app-server assertions for initial/read-only child configuration and refresh on parent replay. The replayed-idle wording is currently on the upstream rfd-replayed-subagent-outcomes branch, not spec main; this historical-only reporting is compatible with both.

Deliberate limits / next package

• No child mutation controls are advertised yet.
• Dedicated session_message / directed-message reporting remains follow-up work; ordinary runtime operation reports remain available.
• Child history and missing ancestry remain best-effort. Copied history alone never authorizes interrupting the original runtime.
• The full live-model E2E suite was not run, and cross-platform bundles were compiled, not executed on every target OS.
• npm audit reports 5 findings (3 high, 2 moderate) in unchanged dependencies. Unrelated dependency remediation is not included here.

Validation

Local validation below is for merge commit 05d625c, which brings Codex main at a77829f into the feature branch without rewriting history. Dependency conflicts retain ACP SDK 2.0.2 alongside Codex 0.164.0 and the main lockfile's Vitest 5.0.5. Compatibility fixes only add the new nullable activity fields to typed feature-test fixtures; no additional production subagent behavior was changed. The PR itself has not been merged into main. CI passed for this merge commit, including typecheck, unit and integration tests, and binary bundling; both CodeQL workflows also passed.

• npm run typecheck
• npm test: 1,980 passed, 39 skipped
• npm run build
• npm run test:integration: 15 passed, including actual Codex 0.164.0 active-child replay, fork identity isolation, cancellation, close, and child terminal completion across independent parent prompts through both ACP versions with a local mock model; also verifies child configuration snapshots and replay refresh
• npm run bundle:all: all six targets compile
• npm run codex-test: live-model no-tool smoke test completed with end_turn
• git diff --check

Includes 97 focused selection/wire/lifecycle tests (94 run; 3 v2-batch cases skipped on v1), four response-delivery tests, and a foreground-state regression, with golden transcripts for both protocol versions. Existing AIR snapshots are unchanged.

The parallel validation run also reproduced a test-discovery bug: Codex downloaded plugins containing tests into an integration fixture under tmp/. Vitest now discovers only the repository-owned src/__tests__/ and scripts/ suites, using its default filename patterns, instead of collecting generated third-party fixtures.

References checked

• ACP specification main at 41c6a98caa3dea7d8e05a8013348e266dd4286e1: read-only child configuration and replay / current-state separation.
• Pending replayed-outcome clarification at e839564daab1da2c68cb8a006c786dfcbf0e68f1: historical idle outcomes may remain visible without proving current activity.
• TypeScript SDK main at c7e07388feed7a530f8211d0dae4951cb6d26d09, alongside published 2.0.2 and real SDK wire decoding in tests. The specification is the protocol source of truth; the SDK is runtime evidence.
• Claude implementation at 739dde3ae5bb848bdb90e2c9150e2cc4687d480c: observed model / configuration reporting and historical outcomes / current-state handling. Used as implementation reference, not a normative contract or proof of Codex runtime ownership.

[benbrandt]

Superseded by the independently validated and merged incremental PRs: #676, #677, #680, #681, #682, #684, #685, and #686, plus the completion-audit fix #687 (main at 6cce035). Closing without merging the old combined diff. The reference branch is intentionally retained. The tracker records the remaining optional hardening/test follow-ups separately; child controls and directed-message extensions remain outside this work.