fix(integrations): preserve native OMP lifecycle and prompt authority

[bandzalkin]

Rebased onto main c73cd9cd39b4 (2026-10-16)

Rebased onto current main c73cd9cd39b4679e67ba321b08443581a5b3c9f0 (after #808) as one commit: head 36f9abbc8500d713f384156e4795aa625895adfe. The previous head was 242a3c96268ee7f322213656a658ac5bb1c75133 over d7ab3429.

The only conflict was with #808 in tests/framework_conformance/test_toolkit_helpers.py: #808 renamed agent_name(run_id=…) to token= inside the omp_acp label test that this PR deletes along with the retired command. The deletion is kept. Every other change matches the previous head line for line, and #808's helpers, callers and new suites are unchanged.

Verified locally at the new head (macOS, Python 3.13.14, uv 0.12.19, E2E opt-ins unset). This was a focused check, not the full suite:

• uv sync --all-packages --locked --extra dev and all pre-commit hooks passed.
• pytest -q, run on 18 affected files: 620 passed, 10 skipped. The files are fix: give each baseline provision its own agent name #808's test_provision_names, test_reap_on_exit, test_sweep_owned and test_toolkit_helpers; the OMP, RPC and permission suites; ACP behaviour and retention; adapter conformance; and the other suites this PR touches.
• A direct check of the provisioning-name helpers passed.

The full suite ran on the stacked #798 head, which includes this commit. Current CI is the checks on this head. The notes below about the previous head, including its verification and checks, are historical.

---

Previous rebase onto main d7ab3429cbdb (2026-10-15) — historical

Rebased onto current main (after #709, #804, #789/#775, #796 and #802) as one commit; head 242a3c96268ee7f322213656a658ac5bb1c75133. Resolved against #709's OMP ACP changes by keeping the native RPC adapter (workspace flag, room-rejoin coverage and form-policy test class carried over) and #804's owner-module imports. Over #802, the OMP image and turn-outcome probes live in its imageprobes.py/outcomeprobes.py registries.

CHANGELOG.md edits are dropped: Release Please generates it.

Verified at the new head (macOS, Python 3.13): uv sync --all-packages --locked --extra dev, all pre-commit hooks, and the full pytest -q: 8652 passed, 739 skipped. Verification notes further down refer to the previous head.

---

Summary

Replace the OMP ACP workaround with the room-owned native RPC adapter on upstream d7ab3429cbdb5381b9ca572cf7eac210a8196052. Preserve prompt settlement, delivery ownership, startup readiness, system-prompt authority and recovery.

Changes

• Migrate exports, examples, builders and conformance consumers to native RPC without a compatibility shim; retain model/effort selection, approvals, custom tools, MCP, workspaces and session restore/replay.
• Narrate SDK-cancelled selects with an independent permission pair, safe arguments and fresh UUID4 IDs. Native offered choices (including Deny), identity and capability-derived effects remain unchanged. No fabricated chat/completion effects or correlation.
• Full-registry recognition is privacy-only. Successful projection preserves withheld native names and device wrapper fields apart from redacted values.
• Protect privacy projection and final envelope encoding against Exception, not BaseException. Failures do not retry normalization/redaction; encoding fallback preserves name/id and enabled-native effects with only safe scalar path/file_path/target fields and opaque arguments.
• Shared helper fixes: surrogatepass UTF-8 file-content counting; decoder ValueError handling through the existing failed-tool path. No validation or execution-policy change.

Narration is best-effort send_event, not durable delivery.

CI portability correction

Production code and custody timeouts are unchanged by this correction.

• Natural-depth regressions now calibrate the actual decoder call stacks on the running interpreter, exponentially bracket/binary-search the successful decode boundary, and explicitly skip only after proving the maximum decoded payload encodes intact. Four stack-independent encoding fault cases remain the boundary proof.
• Zero child exit status was not portable custody proof. Close gives the root stdin EOF and bounded grace while independently terminating captured descendants; Windows termination is forced, and the venv launcher can propagate its interpreter child's exit status. Tests now capture the actual peer and creation-time identities, prove root ancestry, completed/non-cancelled close and root wait, absence of every owned identity, and empty adapter room ownership. This is not an arbitrary nonzero-exit allowance.

Windows close limit: when OMP runs behind a Windows launcher, the real interpreter/OMP process is a descendant and is forcibly terminated during the launcher's/root's stdin-EOF grace. Close is therefore forced, not graceful, for that real process. docs/acp.md documents this existing behavior; process settlement does not imply graceful completion or exit status zero.

Verification

Prepared head 4184abba6c80dbcf807c637f5956129be5e36abd removes only the test-only changelog entry from behaviorally tested head 8ebb4f8ecb400b46b8356f224d2ca6824412a2ad; code and tests are identical:

• Managed macOS 3.11.16: permission records + RPC, 91 passed / 1 explicit no-natural-window skip.
• Managed macOS 3.12.14 and 3.13.14: same scope, 92 passed each.
• Fresh Linux/arm64, UID 1000, read-only root, all capabilities dropped, no-new-privileges, pinned UV image: Python 3.11.14, 91 passed / 1 positively established no-window skip.
• All five static hooks passed. Windows correctness awaits the complete CI matrix on this exact head; CI outcomes are recorded separately, not inferred from macOS.

Historical source 3352c62c: affected scope 2793 passed / 3 skipped; all static hooks passed. Historical guard-removal mutation: six behavioral failures. Historical replay: 8948 passed / 722 skipped. These are historical evidence, not fresh final-head full-suite claims. A supplemental local custody probe was denied before execution and is not claimed; the owned RPC regression scope above did execute.

Commit range and merge order

Complete prerequisite range: d7ab3429cbdb5381b9ca572cf7eac210a8196052..242a3c96268ee7f322213656a658ac5bb1c75133.
Merge #763 before #798. Related: #709. No merge, fork publication, deployment, native-provider acceptance or dependency pin is included.

[bandzalkin]

Rebased onto current main (d7ab3429) at 242a3c96268e; the description's new first section lists the conflict resolutions and the verification at this head.