feat(v1): integrate nano-RLM training over ACP

[hallerite]

Summary

• run nano-RLM through the generic typed ACP prompt lifecycle
• pass its runtime-v1 execution policy and credentials at session creation
• consume cumulative session metrics from successful PromptResponse._meta, not session/close
• validate only the session id and metrics Verifiers consumes while allowing additive snapshot fields
• pin nano-RLM to the exact producer commit from nano-RLM PR #144
• retain MCP, resume, recursive branches, credential isolation, skills, and cumulative metrics

Stack

PR 2 of the three-PR Verifiers stack. This targets typed ACP base PR #2438. Its exact nano-RLM dependency is 11dcb9c353f1f7c89c8c6f1bc0ddea33b3cffa19 from nano-RLM #144.

Validation

• full Verifiers suite on the combined stack — 919 passed, 77 credential-gated skips
• nano-RLM full suite — 123 passed
• live Prime VM contract E2E against the exact pin — passed
  • two concurrent recursive children
  • three expected training branches
  • MCP after resume
  • kernel credential isolation
  • prompt-boundary recursive metrics
• changed-file pre-commit hooks and push-hook CI-parity type check

---

Note

Medium Risk
Moves API keys and execution policy from env vars into ACP session metadata and changes the metrics contract; mis-validation or metadata drift could break rollouts or drop training signals.

Overview
The RLM harness stops wiring nano-RLM through RLM_* environment variables and instead supplies a typed ai.prime.rlm/runtime-v1 payload on ACPConfig.session_meta at session creation (model, provider credentials, policy, skills, kernel env, etc.). prepare_acp now keeps only resolved_env plus RLM_HOME in subprocess env.

Compaction policy is expressed as int | None in that metadata (including per-task random thresholds) instead of string env values.

Rollout metrics no longer come from a @metric helper that shells out to read sessions/*/meta.json. acp_turn_result validates ai.prime.rlm/session-v1 with _SessionSnapshot, checks session_id against the trace, and calls trace.record_metrics.

The default nano-rlm install pin is updated to 5ee1c34024a183bbbd3a38a6129995f5b982631d.

^{Reviewed by Cursor Bugbot for commit a15fcc6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes the training-critical RLM execution path, including ACP session metadata, provider credential propagation, concurrency policy, dependency pinning, and metric collection. The combined runtime and sensitive-data impact warrants human review.

Not approved because:

• Monthly spending limit reached (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ea4935b. Configure here.}