[benbrandt]

Scope: standalone live core

Fifth incremental extraction from #655, on current main (091f9b2), after #676, #677, #680, and #681 landed. This is the larger atomic feature slice discussed in the split plan: 43 files, +2,898/-181, including 1,573 added test/snapshot lines and 1,301 added runtime lines. No dependency or generated app-server files change.

Included

• Standard associations for opted-in non-AIR v1 clients and non-AIR v2 clients. AIR retains its existing opt-ins, private updates, generation identities, and fallback.
• One opaque conversation ID across assignments, idle work, and handler replacement. Announce immediate parents before children; buffer unresolved ancestry rather than flattening it.
• Child-owned streamed-item/tool state, plans, titles, permissions, and elicitation. Accepted URL completion state survives parent attachment changes; late approval replies are rejected locally when actual work ends.
• Empty child capabilities and an allowlist boundary for all client mutations, including private extensions and raw provider IDs. Known raw IDs are restricted even while announcement publication is backpressured. Parent cancellation cascades to observed live children; an actual ending produces idle, observability loss produces unknown.
• Association-only replay and safe reattachment: current provider parentage must match through known ancestors, inactive owned children receive future events without loading them, and copied forks cannot steal the original runtime. Parent history still replays normally; an explicit advisory says recorded child transcripts are not included.
• Current child snapshots follow the real successful wire write, including complete JSON-RPC batches. Same-parent setup execution is serialized without waiting on each other's shared batch delivery. Closing a parent fences queued reopen attempts.
• Preserve the model reporting already landed in feat: report the model of each native subagent session #678: reuse its source priority and read-only model option helper. Model observations are not guessed from spawn arguments or parent values; buffered older settings cannot replace newer observations.

Explicitly deferred

No recursive child transcript replay, history/live item reconciliation, recorded historical work outcomes, new configuration readback/effort reporting, directed-session messages, or child mutation controls. Those remain separate changes after this live core is reviewed and landed.

The current RFD explicitly allows live support without complete child history. Recoverable associations are replayed truthfully; omitted transcripts are not silently presented as complete.

Review order

1. Contract selection, connection-owned identities/restrictions, and ACP mutation dispatch.
2. Live router admission, child-owned rendering/work/request state, and existing model reporting.
3. Provider subscriptions and ownership verification; no parent cwd/MCP/instruction overrides when rejoining a child.
4. Conversation-owned interaction handlers and request cancellation scopes.
5. Session setup lane, batch-write freshness boundary, and association-only replay.
6. Behavior-focused tests and wire snapshots for both versions.

The async queue-completion gap found while planning the split is fixed here: a session transition waits for async callbacks and propagates rejection without breaking the notification lane. A regression reproduces both ordering and rejection behavior. The old #655 reference helper must not be copied back over this implementation.

Validation

Final validation used main's latest lockfile (including #679):

• npm run typecheck
• npm run build
• npm test: 1,959 passed, 38 skipped
• Focused live/wire/queue suites: 44 passed, 2 v2-only cases skipped on v1
• npm run test:integration: 15 passed — eight new real-Codex 0.164.0 cases cover active-child reattachment, fork identity/ownership isolation, parent cancel/close, and child terminal output/exit across later parent prompts, on v1 and v2, using a local scripted model
• npm run bundle:all: all six targets compile
• Real live-model no-tool smoke completed with end_turn
• git diff --check

Existing AIR and parent-session golden files are unchanged. The fixed-command terminal fixture alone uses full-access mode to avoid CI hosts without sandbox namespace support; production sandbox settings are unchanged. The full live-model E2E suite and execution of every OS bundle were not run.

References

• ACP specification at 8aa92106feba5cdd0da210a87a39dfee4dc24f13: identity, announcement, and automatic routing, best-effort replay and response freshness.
• Official TypeScript SDK checkout c7e07388feed7a530f8211d0dae4951cb6d26d09 and published 2.0.2 for transport/runtime evidence; normative behavior comes from the spec, not the SDK implementation.