feat(managed-agent): broker authentication and broker-provisioned writer credentials - #13210

Absorbs main's broker authentication (#13210) and the cold-load refusal
hardening (#13361). Two conflict hunks in hosted-harness-session.ts keep
both semantics: main's restore-refusal diagnostics reuse the single
pre-close verdict read, and the typed checkpoint_blocked decline now
fires only for a drive takeover — a bare load or a cancellation-only
load keeps the baseline retriable 409 (main's new witness pins the bare
shape; a new drive-shape witness pins the decline).

R10 (qwen-code-ci-bot review 5410379695, four Criticals) shared one root
cause: a plain attach was minted while the journal held an unsettled
Turn with no live owner of the wait.

- R10-1: the attached cancellation redrive of a parked no-tool Turn no
  longer mints a plain attach; no kernel is consulted on that arm, so
  there was no inapplicable to mirror — the load keeps the cold arm's
  retriable refusal, drive keeps its typed decline.
- R10-2: the prompt route guards the journal itself — a fresh promptId
  is refused 409 hosted_prompt_recovery_required whenever any input is
  unsettled, whatever the takeover answered; no admission can stack on a
  parked Turn's mid-flight checkpoint.
- R10-3: all three plain-attach epoch migrations (plus the recovered
  path's) move ONLY the epoch and keep the consumed watermark, so a
  committed-but-undelivered tail — including turn.settled — replays
  instead of being skipped behind the exclusive cursor; the plain cancel
  route answers an honest 409 when nothing live can be aborted while the
  journal is unsettled, and the CANCELLING arm adopts + streams on that
  coded refusal instead of re-issuing a no-op cancel.
- R10-4: a null epoch proves only that the admission REPLY was lost; the
  withdraw arm resubmits once, and on the coded duplicate-admission 409
  adopts the attach epoch via a split-expectation recordRecoveryAdmission
  (turn epoch vs session epoch — a session can still carry an earlier
  Turn's), keeping the watermark; without a prior mark the refusal names
  a different Turn's work, so it burns the retry budget and records the
  daemon's own code on exhaustion.

Also: recordRecoveryAdmission's epoch CAS predicates are null-safe with
split turn/session expectations (a real-store adoption witness proves
`IS NULL` matches and a wrong expected session epoch still refuses);
the R9 journal-replay's detached async writer now answers a failed
identity read with the retriable refusal instead of hanging the request;
the re-prove identity guard gains its workspaceId-mismatch witness; the
sibling wholesale store mock exports ManagedSessionStoreHttpError.

Witnesses: CLI suites 243/243 across the three hosted files (new R10
tests plus the merge-restored main witness), HarnessCoordinatorTest
51/51, ManagedAgentServerIntegrationTest 29/29 (real H2), full module
suites managed-agent-server 744/744 and qwencode 181/181, npm run
build, typecheck, eslint.

…#13434)

The baseUrl guard added in QwenLM#13210 rejects non-loopback plaintext hosts
unless allowInsecureHttp is set. Nine construction sites in
http-managed-session-store.test.ts still used the fake host
http://session-store.test without the opt-in, so 12 tests have failed on
main since that merge and now block CI on every PR that includes latest
main. Pass allowInsecureHttp: true to those fixtures; the dedicated
guard-negative test is untouched.

- pin both halves of the parseLine pair: the record half now asserts the
  normalized message (so a raw-as-record substitution goes red), and a new
  case keeps one slot per physical record that fails validation
- witness the non-object owner-payload disjunct that stands between a
  primitive systemPayload on disk and a TypeError from the 'in' operator
- widen the restore-head grant table to all five disjuncts and the
  journal-vs-head agreement test to all three, via disjoint headOverrides
- make the fake store honour the requested page limit so the two-page
  count derives from production's limit=100 request
- merge resolution: opt the fake-host store constructions into
  allowInsecureHttp after main's plaintext-HTTP guard (#13210)

Each new row was mutation-probed: it goes red when its own disjunct (or
the limit) is removed and stays green on pristine source.

Co-authored-by: Qwen-Coder <[email protected]>

Resolve the overlap with the broker-auth work (#13210):

- bridgeTypes.test.ts (add/add): union of both suites, plus the
  127-prefixed DNS-name reject rows the loopback predicate's per-octet
  numeric test is pinned by, and a row covering the opt-in below.
- bridgeTypes.ts: the HTTPS-off-loopback rule predates the
  broker-provisioned allowInsecureHttp opt-in that arrived with this
  merge; honor it (mirroring http-managed-session-store.ts) so the field
  stays reachable through the bridge parser, and correct the loopback
  predicate's JSDoc premise — a four-label name whose labels are not all
  numeric survives the URL parser verbatim.
- hosted-harness-session.test.ts: keep main's loopback baseUrl in the
  bounded-store actual call; the factory-refusal test's descriptor now
  carries allowInsecureHttp so the store factory is what rejects it.

Co-authored-by: Qwen-Coder <[email protected]>

Resolve the http-managed-session-store.test.ts conflict by keeping both
sides' new suites (this PR's six witness tests and main's #13341 fake-server
override suite) and adopting main's bootStoresAndSession helper.

Review round: opt the five new createHttpManagedSessionStores call sites
into allowInsecureHttp so the six tests they set up actually run (R4-1) —
plaintext guard from #13210 reached this branch through the merge. Drop
this branch's per-call-site CommonJS module-scope pins in
terminal-image-renderer.test.ts and test-efficacy.integration.test.ts now
that main pins the same shims at suite/builder level (R4-2); verified green
under an ambient {"type":"module"} TMPDIR, and mermaidImageRenderer
returns to 13 failed if main's builder pin is removed.

Co-authored-by: Qwen-Coder <[email protected]>

QwenLM#13341)

* test(core): close QwenLM#12693 post-merge review test and hygiene gaps

Second batch of QwenLM#12693 post-merge review follow-ups — the test-coverage and
hygiene findings that remained after the correctness PR:

- The HTTP store suite never drove a failing or inconsistent server: the fake
  now takes page/receipt overrides and stored-integrity edits, pinning the
  multi-page read, contiguous-revision, bytes-vs-metadata, empty-page,
  nextRevision, echo-receipt mismatch and 409 resource-missing paths.
- A sealed Managed session can now be seen to survive daemon archive through
  the sealed-writer fallback (red if that arm is removed; mutation-checked).
- The managed-resume rejection test stubs QWEN_RUNTIME_DIR — ambient exports
  outrank setRuntimeBaseDir and redirected the hook to the ambient runtime.
- sink success-path coverage: session_source and file_history_snapshot domain
  round-trips, carried system subtypes through the message channel, and the
  remaining three turn_result guard disjuncts; the unmapped-refusal fixture
  now uses a genuinely unmapped subtype (rewind instead of the mapped
  file_history_snapshot).
- The live-vs-cold projection difference is documented at both sites and
  pinned by a test asserting the deliberate narrower live door.
- parseLine returns the validation it already ran, so transcript indexing no
  longer validates every record twice; the accumulator's four unavailability
  reasons and the empty-transcript default gain a collocated suite.
- isLockRecord's managed-sealed branch reuses isValidCommitProof instead of
  re-implementing it; the misplaced recoverUncommittedTail safety contract
  now sits on the method that truncates; the unused de-facto-private export
  of buildManagedSessionRestoreProjection is dropped.

* test(core): cover the restore head mismatch and align the 409 comment

- The journal-vs-durable-head check now has a witness: a server head that
  overstates committedSequence is refused after the page loop.
- The staged-survival assertion's comment no longer overclaims a literal
  retry of the same missing resource (review R1-3).

* test(core): address the round-1 review on the test batch

Addressing the seven Suggestion findings from the auto-review, each with the
mutation witness the review asked for:

- The restore-journal head guards now have witnesses too, via headOverrides:
  a storageVersion/recoveryStatus mismatch is refused by the grant check, an
  overstated committedSequence fails journal-vs-head, a stale eventsDigest
  fails metadata-vs-records, and a page that promises the end while the head
  is ahead is refused (the 'did not advance' branch was already pinned).
- The 409 test drives a real retry of the same transaction with a staged ref
  it carries, asserting the retried commit body still posts bytesBase64 —
  exactly the regression that would appear if a failure path ever released
  staged entries.
- SessionExecutionEngineAccumulator.parseLine's returned
  `{ value, record }` pair is pinned independently on both halves, proving
  the raw line value survives where the normalized record drops fields.
- The hot/wide projection distinction is documented as width, not lifecycle —
  `projectManagedSessionRecords` is named as the reader-facing list used on
  live paths too (`readActiveTranscriptChain`) — and the pin test's title
  and inline comment say the same.
- `turn_result` case rejection now asserts both halves of the
  canCarry/write agreement on the same record object.
- Carried system subtypes assert their message channel (one
  message.committed, zero domain.committed) before the cold round-trip.
- QWEN_RUNTIME_DIR is deleted once in each package's setup file (preload of
  every suite) instead of two per-test stubs, closing the class: 15 ambient
  failures in session-transcript-reader and 4 ACP lock failures on
  writer-lease reproduce on ambient machines and now pass.

* test(core): address the round-2 review on the test batch

- pin both halves of the parseLine pair: the record half now asserts the
  normalized message (so a raw-as-record substitution goes red), and a new
  case keeps one slot per physical record that fails validation
- witness the non-object owner-payload disjunct that stands between a
  primitive systemPayload on disk and a TypeError from the 'in' operator
- widen the restore-head grant table to all five disjuncts and the
  journal-vs-head agreement test to all three, via disjoint headOverrides
- make the fake store honour the requested page limit so the two-page
  count derives from production's limit=100 request
- merge resolution: opt the fake-host store constructions into
  allowInsecureHttp after main's plaintext-HTTP guard (QwenLM#13210)

Each new row was mutation-probed: it goes red when its own disjunct (or
the limit) is removed and stays green on pristine source.

Co-authored-by: Qwen-Coder <[email protected]>

* test(cli): scope fake renderer scripts as CommonJS under a poisoned tmpdir

Deterministic verification rejected the round-2 commit: 15 packages/cli
tests in mermaidImageRenderer, terminal-image-renderer and test-efficacy
failed with renderer results of kind 'unavailable'. The fake mmdc/chafa/git
executables those suites write under os.tmpdir() are extensionless CommonJS
scripts, and the runner's /tmp/package.json carries "type": "module", so
node executed them as ES modules and they crashed on require/__dirname
('require is not defined in ES module scope'), which the renderers then
report as chafa being unavailable.

Write a {"type":"commonjs"} package.json next to each fake so the
nearest-scope lookup pins the module system regardless of what sits above
the host's temp directory. Verified both ways: the three files are green
with the poisoning in place and stay green with TMPDIR pointed at a clean
directory.

Co-authored-by: Qwen-Coder <[email protected]>

---------

Co-authored-by: qwen-code-ci-bot <[email protected]>
Co-authored-by: Qwen-Coder <[email protected]>

Conflicts resolved:
- managed-agent-public-api.openapi.json: #13210 took v1.30.0 with its
  gateway-free qwenSignature scheme this morning; the W2 cwd contract now
  ships v1.31.0, with both changelog sentences kept and the contract's
  two (v1.30) feature references re-anchored to (v1.31).
- README.md: keep both feature sections - main's broker authentication
  and writer credentials first, the W2 controlled cwd change after, with
  the settle retry budget recorded in its refusal paragraph.
- web-shell generated client: regenerated from the resolved contract,
  so it carries the v1.31 text and main's 413 payload_too_large arm.
The cwd migration is V45 after upstream took V40-V44 this morning.

…#13565)

Move the merged-PR history of the Managed Agent dual-path proposal
(QwenLM#12380) out of the issue body into a bilingual ledger under
docs/design/. The issue body had come within 10 KB of GitHub's 256 KiB
limit, so the body will keep only the delivery snapshot and the open
PRs, and merged rows move here rewritten to their merged final state.

The ledger carries every merged row the issue tracked up to its
2026-10-03 reconcile (adding the missing merge commit to the five
earliest rows and normalising the Chinese state cells), rewrites the
eight rows the issue still listed as open although their PRs had merged
(QwenLM#13141, QwenLM#13166, QwenLM#13174, QwenLM#13210, QwenLM#13214, QwenLM#13217, QwenLM#13218, QwenLM#13247), and
adds rows for the 48 managed-agent PRs merged between that reconcile and
main 0c13502 that had no row yet. PRs closed without merging (QwenLM#13087,
QwenLM#13336) sit in their own table. Later merges land at the next reconcile.

Co-authored-by: wenshao <[email protected]>