feat: require exact Claude residency resume

agent-identity: mbp2025.direct.omp.bn5hrz39
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.1.7
agent-runtime: OMP 18.1.7
tooling-profile: dotfiles@4816a7a

Author: schickling-assistant

docs/vrs/spec.md

@@ -681,6 +681,29 @@ native session, and becomes active. A mismatch, unsupported driver capability,
 indeterminate presence, malformed ledger, or foreign ownership becomes a
 fail-closed refusal. No path substitutes a fresh session.
 
+For Claude, the provider binding owns the exact native UUID, wrapper incarnation,
+canonical workspace, transcript path, and optional resume generation. Checkpointing
+first resolves the UUID to exactly one file in the active managed Claude
+transcript store, rejects a matching Codex transcript, opens the file with
+`O_NOFOLLOW`, requires a regular `<uuid>.jsonl` file, validates every recorded
+`sessionId`, derives one rooted workspace lineage, and stores the SHA-256 of
+the exact bytes. Resume revalidates that lineage and digest before any provider
+child starts, rejects authored
+session selectors, and lowers to `claude <options> --resume <uuid> -- <prompt>`.
+Ordinary launches also use the option terminator and explicitly remove inherited
+residency fence variables.
+
+The synchronous `SessionStart` observer is Claude's native identity proof.
+Ordinary observation remains fail-open. During mandatory resume, observer setup,
+payload validation, transcript validation, and durable candidate publication
+propagate failure. The hook stores the candidate under the new wrapper
+incarnation and resume generation without replacing the checkpoint binding.
+After complete-group presence establishes the current wrapper incarnation,
+exact native-session verification promotes only that incarnation's candidate.
+A failed start therefore leaves the checkpoint
+retryable. A later explicit in-process session switch becomes the next
+authoritative binding and does not inherit the consumed resume fence.
+
 `st2 tasks --json` uses schema `st2.task-inventory.v3`. Each task row appends
 `residencyPolicy` and nullable `runtimeResidency` beside the existing process
 `runtime` observation. A missing ledger is `null`, never inferred as active or

hooks/claude-observe.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # st2 Claude observe hook: forward one hook event (name in $1, payload on stdin) to the agent's
-# observed-harness-state record. Fail-open; observation must never wedge or slow the harness.
+# observed-harness-state record. Ordinary observation fails open. A residency SessionStart
+# propagates failure because its native-session binding is launch authority, not telemetry.
 
 set -u
 
@@ -11,11 +12,21 @@ identity="${ST_AGENT:-}"
 # with a custom bus root (ST_ROOT != CATALOG) declaration resolution under ST_ROOT finds nothing
 # and every transition would silently drop.
 root="${CATALOG:-${ST_ROOT:-}}"
+mandatory_binding=""
+if [[ "$event" == "SessionStart" ]]; then
+  mandatory_binding="${ST2_CLAUDE_RESUME_GENERATION:-}${ST2_CLAUDE_EXPECTED_NATIVE_SESSION:-}"
+fi
 runtime_id="${ST2_CLAUDE_RUNTIME_ID:-$identity}"
 if [[ -z "$event" || -z "$identity" || -z "$root" ]] || ! command -v st2 >/dev/null 2>&1; then
+  [[ -n "$mandatory_binding" ]] && exit 1
   exit 0
 fi
 
+if [[ -n "$mandatory_binding" ]]; then
+  exec st2 --catalog "$root" driver claude-observe --identity "$identity" --runtime-id "$runtime_id" \
+    --event "$event" >/dev/null 2>&1
+fi
+
 st2 --catalog "$root" driver claude-observe --identity "$identity" --runtime-id "$runtime_id" \
   --event "$event" >/dev/null 2>&1 || true
 exit 0