feat(conversations): unify native session continuation

[Neonforge98]

Problem

Team Chat and Work Item comments did not share one audience policy, so a human-directed Work Item comment could accidentally fall through to the assigned Agent. Shared and imported conversations also used source-specific continuation paths, including prompt-rendered history, which could collapse roles, tool pairing, and the target provider's native resume semantics.

The required invariant is strict: any registered imported or Team/My Session transcript may be a source, but a target is selectable only when ORG2 can write the full canonical user/assistant/tool transcript into that provider's native store, read it back through the app's authoritative reader, and resume the exact native session id. Cloud is the collaboration plane, never an Agent host.

Solution

• Share one audience-routing contract between Team Chat and Work Item. Team Chat remains human conversation; its ordinary messages also enter the canonical transcript as attributed user messages. @human/@all routes human notifications, @Agent routes an explicit Agent, and ordinary Work Item comments retain assigned-Agent semantics.
• Replace prompt/cursor/bootstrap continuation logic with one provider-neutral core. It accepts only a canonical SessionEvent timeline, a stable conversation locator, and a local execution target; Work Item and Cloud concepts do not enter the core.
• Project ordered user messages, assistant messages, tool calls, tool-call ids, JSON arguments, tool results, images, and timestamps into one bounded structured representation. History is never concatenated into a user prompt or provider preamble.
• Materialize that structure into the target's real native transcript:
  • Native Agent: existing agent_messages persistence.
  • Claude Code: account-scoped Claude project JSONL.
  • Codex CLI: account-scoped rollout JSONL with session_meta, turn_context, model-facing response_item, and UI-facing event_msg records.
• Read every newly written target through the existing authoritative Agent/CLI reader and compare it semantically before dispatch. A mismatch fails closed and removes only the just-created, account-bound, ORG2-marked transcript.
• Reuse a healthy execution episode when its native transcript is an exact semantic prefix of the newer canonical transcript. Synchronize the missing role/tool suffix natively, read it back, verify exact equality, then resume the same provider-native id. Divergence creates a new verified episode; no delta is ever injected through the user prompt.
• Resume only the exact provider-native id. Codex app-server never falls back from a failed thread/resume to thread/start.
• Reuse ordinary persisted child Sessions and parentSessionId as the durable execution-episode ledger. There is no continuation database, checkpoint, encrypted duplicate transcript, Cloud runner, or remote key handoff.
• The writable root owner keeps the ordinary native root send path. A member viewing an imported/Team surface gets a hidden local provider episode. Both render as the same canonical conversation in the app.
• Imported roots now refresh when the Cloud epoch/count/tail advances, including the root-only case with no fork descendants. A writable local root is never overwritten by its Cloud mirror.
• The setup dialog offers only installed targets with a verified native writer/reader/resume contract and shows the compatible local account and model. In this change those External CLI targets are Claude Code and Codex.

Product and security semantics

• Every run uses the sender's selected local Agent/provider account, model, and workspace. Provider credentials remain on that device.
• A member's ORG2 app must be online to execute that member's turn. Cloud cannot impersonate an offline member because ORG2 has no Cloud Agent host.
• The visible Team/My Session is canonical. Provider-specific execution episodes are local implementation details and publish only their resulting native event tail back to the shared conversation.
• Portable fidelity covers the complete canonical user/assistant/tool transcript and attachments, not provider-private reasoning, hidden policy prompts, credentials, or opaque process memory.
• Claude Code and Codex are the verified External CLI targets in this PR. Other registered providers remain valid sources and are not offered as targets until they have a native writer, existing-reader round trip, and strict-resume proof. There is no lossy fallback.
• Native Agent appends new structured rows transactionally. Claude/Codex atomically update only the episode's bound ORG2-marked native transcript before resuming the same native id.
• No database schema or Cloud infrastructure migration is added by the native materializer. This PR is stacked on feat(pm): expand MCP, routines, work items, inbox, and skills #844's existing collaboration and PM surface.

Verification

• pnpm test -- --no-cache — 1,254 files / 9,917 tests passed.
• Focused continuation/materializer/import/RPC suite — 4 files / 24 tests passed.
• pnpm typecheck and pnpm lint — passed.
• cargo check and cargo fmt --all -- --check — passed.
• cargo clippy --workspace --all-targets -- -D warnings — passed.
• cargo test — 1,149 library tests passed, 1 authenticated real-Codex smoke test ignored; all integration and doc-test groups passed/ignored as declared.
• cargo test --workspace --no-fail-fast — every non-network target passed. The managed sandbox denied ephemeral loopback binds in four targets; rerunning those targets with local loopback enabled passed. A final isolated agent_core rerun passed 3,212 tests with 2 declared ignores and 0 failures.
• Native writer proofs include Claude and Codex writer-to-existing-reader round trips plus Claude same-native-id prefix synchronization with two separate user records.
• Commit hook passed lint-staged, TypeScript, and scoped Rust clippy (agent_core, org2). git diff --check and staged secret/personal-path scan passed; dependency folders were not staged.
• Neonforge/VantaNode dual-instance test passed on the final behavior:
  • canonical root: sdeagent-9f8cf8b6-5e25-4ce2-a122-56750c76555d
  • VantaNode execution episode: sdeagent-7b38c9a2-b975-4b3f-9f39-d0e387ce8e38
  • two online continuations and one post-cold-restart continuation reused that same native child
  • while VantaNode was offline, Neonforge appended a canonical root turn; restart synchronized it as a separate native user row before VantaNode's next user row
  • revoking Cloud access removed the remote surface while retaining the local native episode
  • direct SQLite evidence showed user rows at sequences 11, 13, 15, 17, and 19; the remote canonical deltas and current sender messages were never joined into one prompt
• Cloud fleet ledger across the test: 8 new test roots, no missing rows, and no epoch/count/frozen regression. The pre-existing high-epoch fleet set was unchanged.

Omnigent comparison

Audited against xhluca/session-migrate / Omnigent commit 658fb8bd4d383ff705a4eb9229c0ba3525a1b8f4.

• ORG2 adopts the correct part: a provider target needs a real native transcript writer and native resume id.
• ORG2 is stronger for Team/My Sessions: one author-attributed, ordered collaboration transcript can be continued by different members, devices, local accounts, and providers without changing the visible conversation or moving credentials to a Cloud runner.
• ORG2 verifies each native write through the reader the normal app uses and fails closed on mismatch.
• Omnigent currently has more concrete native rebuild adapters (including Pi, Qwen, and Hermes). ORG2 currently verifies Native Agent, Claude Code, and Codex.
• Omnigent explicitly classifies Cursor and OpenCode cross-provider history as text PREAMBLE; ORG2 intentionally does not claim those targets because that violates the native role/tool invariant.

Architecture audit

docs/architecture-audit-2026-08-26/ProviderNativeConversationContinuation.md records the capability matrix, reuse/synchronization semantics, removed duplication, failure behavior, and Omnigent comparison.