feat(coding-agent): finalize v0.8 Core lifecycle and project MCP hardening

[sethkarten]

v0.8 Core lifecycle and project MCP hardening

Links #1182.

Provenance

• Base official chain: fix(coding-agent): report accurate worker lifecycle and hide stopping workers #850 (2857), fix(coding-agent): finalize timed-out worker stops instead of stranding registrations #851 (e9ef), and fix(coding-agent): self-heal stale worker registrations on resume #852 (14d6).
• Successor chain: b54d root ownership, 1b375 catalog, e599 C05, and da683 project MCP/openat.

Delivered outcomes

• Root lifecycle ownership.
• Immutable catalog and C05–C06.
• Global-first admission.
• Frozen internal snapshot.
• Explicit manager bypass.
• Retained FD/openat behavior.

Validation gates

• Unit1: 378 passed, 7 skipped.
• C05: 350 passed.
• Biome.
• Root tsgo.
• Required MCP: 10/124.
• Lifecycle5: 131 passed, 8 skipped.

Evidence

• Local evidence manifest (exact literal): /Users/milkkarten/.prime/agent/session-artifacts/019fdead-3a11-779b-b344-92432391502c/sub-469ba6c1/019ff0ce-028b-754a-9bdf-906aee5b2910/FINAL-MANIFEST.md
• Key hashes are recorded on the latest Prime Agent v0.8: five-stack integration tracker #1182 issue comment/reviewer evidence where applicable.

Fresh security review: APPROVE.

This supersedes the old candidate topology, but does not close or otherwise mutate #1186.

Status

This is deliberately a draft and is not merge-ready or human-ready. MCP, Prompts, ACP, Eval, and Release work remains ongoing. No paid eval or release has been performed. No tag or version change is included.

Note

Finalize Core v0.8 kernel host-request lifecycle hardening and project MCP declaration pipeline

• Introduces a branded HostRequestHandler type requiring binary (payload, context) signatures; handlers must be created via createHostRequestHandler — raw or forged functions are rejected at runtime via assertHostRequestHandler.
• Adds HostRequestContext with per-call requestId, generation, AbortSignal, and isCurrent() so handlers can detect staleness or revocation during teardown/replacement.
• KernelManager now tracks all in-flight host requests, revokes them on teardown/replace, and awaits settlement (5 s timeout) before closing sockets, preventing stale handlers from surviving session replacement.
• Adds a full M01 MCP declaration pipeline: typed McpDeclarationDocument storage in Settings, SettingsManager read/write methods, a credential-free URL parser, redaction helpers, a safe runMcpDeclarationProbe handshake, and an immutable createMcpRuntimeDeclarationSnapshot combining user and conditionally project declarations.
• Project MCP declarations are gated by an opaque ProjectMcpDeclarationAdmission token backed by a McpProjectTrustAuthority that uses device/inode identity and retained directory fds to mitigate path-race attacks; project I/O goes through a Python stdlib helper (project-settings-openat) with advisory locking and atomic replace.
• Adds a public mcp CLI subcommand (parseMcpDeclarationCommand / executeMcpDeclarationCommand) for list/inspect/preview/test/add/enable/disable/remove, with project-scope operations requiring a valid admission derived from global trust policy.
• AgentDaemon and DaemonSupervisor now capture an immutable agentFamilyCatalogEntries() snapshot before any wake/route decision, preventing TOCTOU mismatches; sibling authorization requires exactly one unambiguous catalog-resolved parent.
• Resident daemon workers now persist and restore only an allowlisted subset of non-secret launch environment keys via filterPersistedDaemonLaunchEnv.
• Risk: all existing host handler implementations must be updated to accept (payload, context) and be wrapped with createHostRequestHandler; unary handlers throw at dispatch time.

📊 Macroscope summarized da683ec. 28 files reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.