eval: refuse dead-session attach without restart

[schickling-assistant]

Why

A relay that intends to attach only to an existing PTY daemon can currently land on the dead-session Restart? [Y/n] prompt. Later input intended for the target is then consumed as restart consent and evaluates retained launch metadata. This guards the explicit attach-only contract implemented by compoundingtech/pty#123 for issue compoundingtech/pty#122.

Public reproduction: https://github.com/schickling-repros/2026-07-pty-attach-only-mode/tree/schickling-assistant/2026-07-30-pty-attach-only-mode

What

Add a model-free pty-attach-only cell using synthetic sessions in an eval-owned PTY root. It proves all three sides of the policy: attach-only works against a live daemon, legacy attach still demonstrates the dangerous dead-session restart, and attach-only refuses a dead daemon without interaction or a new incarnation.

How

The held-out judges require:

• the exact --no-restart help surface, so an unknown-option error cannot fake safety;
• a live reader round-trip over a real terminal (live-input -> LIVE-ACK:live-input) with one incarnation;
• a real-TTY legacy mutation control that changes the execution marker from one to two;
• a no-input TTY that emits exactly one expected noninteractive refusal diagnostic;
• a queued-input TTY that permits only terminal echo plus that same diagnostic;
• one marker execution and one session_start event after both candidate attaches;
• retained exited state without a matching live daemon;
• exact synthetic-root cleanup.

The generated catalog and model-free harness exclusion inventory are updated. No provider/model call is involved.

Verification

Against exact PTY PR #123 head 36547b02c32116cca81df4147a638da7df6981a5 (PTY 0.12.0, artifact SHA-256 406fbfcc6e292bcd178be15470e0fc8310ba1ddc35becbab25e0cffd0f096334):

• st2 eval ./cells/pty-attach-only/ --keep — PASS, 8 PASS / 0 FAIL / 8 gating judges
• bin/check-kdl-parse.sh — PASS (67 KDL files)
• bin/check-st2-semantic.sh — PASS (44 folder evals, 9 nested catalogs)
• bin/check-harness-contract.sh — PASS (13 model-free cells)
• bin/check-overnight-policy.sh — PASS (44-cell inventory)
• bin/check-no-pii.sh / bin/check-no-pii-history.sh — PASS
• bin/generate-catalog.sh --check — PASS

The complete free preflight separately reaches the unchanged inbox-hygiene fixture-reset check, which currently reports deleted PROCESSED.log; the new cell-specific and downstream inventory/isolation gates above pass.

Rationale

Keeping this model-free makes the lifecycle invariant deterministic, cheap, and suitable for every PTY/st2 integration change. The explicit live and legacy controls prevent vacuous refusal tests, while exact bounded terminal transcripts reject interactive confirmation variants.

Posted on behalf of @schickling

field	value
agent_name	co2-bear
agent_session_id	a078daee-6f98-4916-91a8-d21291407789
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	evals/schickling-assistant/2026-07-30-pty-attach-only-dead-refusal
machine	dev3
tooling_profile	dotfiles@0fb7e03

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 48498c9c47

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".