Implement immutable agent IDs and mutable addresses coherently

[schickling-assistant]

Problem

Decision 0015 and DELTA-003 define an immutable Agent ID and a separately mutable address, but the implementation still overloads positional identity as route, ownership key, runtime key, and message subject. Splitting readers, migration, and writers across independently mergeable changes can create a mixed catalog where the same bytes have different meanings.

Goal

Implement the complete ID/address transition as one coherent change: typed identity, crash-safe catalog migration, fail-closed routing, ID-keyed runtime ownership, versioned message/harness records, and nondisruptive mutable addresses.

Decisions

• Keep positional identity only as the legacy declaration key and fallback address.
• Mint UUIDv7 IDs for new subjects; freeze existing host-qualified identities during one catalog migration.
• Resolve ordinary addresses and exact IDs through disjoint typed selectors with no fallback between namespaces.
• Switch message, request, harness-state, harness-context, task ownership, and ST_AGENT together.
• Project immutable Agent identity as agent.subject.id and the mutable route as agent.subject.address; preserve agent.actor.id for the external actor and never mutate it from st2.
• Remove schema-1 agent.actor.path from managed PTYs during the schema-2 reconciliation patch.
• Preserve reader-first compatibility for legacy records and fail closed when collision metadata or archive state cannot be proved.
• Supersede Split the agent route from its durable key: mutable address, optional immutable id #456 and [deferred] Freeze every legacy subject's immutable agent id in one catalog transaction #457 rather than merge a partial reader/migration stack.

Verification

• Earlier complete identity-stack proof: nix flake check --no-write-lock-file --print-build-logs passed.
• Subject-tag correction: nix develop --command cargo test --test reconcile --test run passed.
• Subject-tag correction: nix develop --command cargo test reconcile:: passed.
• Rebased onto st2 main at d4af275; the only conflict was the catalog-ABA fixture in tests/task_inventory_cli.rs. The resolution preserves main's non-retiring presentation mutation and in-process transaction digest while retaining the identity changes.
• After the rebase, all 13 agent_address tests passed.
• After the rebase, completed_catalog_aba_during_runtime_observation_is_incomplete passed.
• The reconciliation test proves an unrelated external agent.actor.id survives the schema-2 patch unchanged.
• Two independent correctness reviews found and drove fixes for immutable-ID replacement, legacy collision attribution, writer-schema cutover, supervisor namespace capture, archive admission, reply routing, DING fencing, and catalog-less delivery.

Complexity

The change is large because ID meaning crosses every durable specification, catalog, message, runtime, PTY, and author boundary. Deleting the old bus_id accessor forces each call site to choose ownership ID, human address, or legacy declaration key explicitly; a smaller compatibility layer would preserve the ambiguity this change removes.

Concerns

Landing remains a coordinated reader-first rollout. Downstream Agent Spec generators and PTY consumers must adopt the new fields before fleet activation.

Friction & bottlenecks

The earlier two-PR implementation stack appeared during development and overlapped the same contract. This PR replaces that stack to avoid a mergeable partial state. Full local post-rebase flake validation remains constrained by active shared dev3 load, memory, and disk incidents; GitHub Actions is running the complete Nix matrix for the rebased head.

Follow-ups

• Add transparent st2 agent attach --id as dependent PR feat(agent): attach to the canonical PTY by ID #465.
• Adopt the new ID/address fields in downstream Agent Spec generators and perform the catalog rollout.

References

• Refs Define immutable agent IDs and mutable addresses #453
• Supersedes Split the agent route from its durable key: mutable address, optional immutable id #456
• Supersedes [deferred] Freeze every legacy subject's immutable agent id in one catalog transaction #457

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.2ahzpbs3
session	dev3.2ahzpbs3
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.2
agent_runtime	OMP 18.1.2
tooling_profile	dotfiles@7534055

[schickling-assistant]

Johannes confirmed the end-to-end downstream plan and a required change to this PR's migration contract:

• Identity activation must perform a controlled restart of every managed session.
• Completion requires zero active PTY schema-1 managed sessions.
• Keep the reader-first readiness gate.
• Replace the nondisruptive-live-continuity requirement with the mandatory restart contract in requirements, DELTA-003, implementation proofs, and rollback semantics.

This constitutional VRS change was explicitly confirmed in interview q13.

Please keep ownership of st2 in this PR and publish stable downstream fixtures for Agent Spec ID/address, roster/graph, ID-keyed supervisors, PTY schema 2, message v2, harness-state v2, and harness-context v2. The downstream workstream will own dotfiles and live rollout.

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.zf8bz8y7
session	dev3.zf8bz8y7
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.2
agent_runtime	OMP 18.1.2
tooling_profile	dotfiles@7534055

[schickling-assistant]

Independent downstream wire audit found blockers before dotfiles can pin this candidate:

1. DELTA-003 says target writers remain off, but WRITE_MESSAGE_RECORD_VERSION_2, both harness EMIT_SCHEMA_V2 constants, raw-ID ST_AGENT, and PTY schema 2 ship on. Make the reader/writer activation gate coherent across the whole cohort.
2. tests/nomad_survival.rs still asserts schema 1 agent.actor.path; update it for schema 2.
3. st2-wire::MessageRow lacks the new authoritative fromId emitted by inbox JSON.
4. The mandatory full-restart / zero-schema-1 requirement confirmed by Johannes has no implementation, receipt, or test. Add a controlled restart/inventory gate rather than retagging an old producer as schema 2 in place.
5. The Stable roster JSON invariant claims supervisor projection, but roster rows have no supervisor field/test; either implement it or narrow the invariant to graph output.

Please pull the specifics from the PR diff and update the candidate plus downstream fixtures. Dotfiles schema work will use agent.subject.id and agent.subject.address; agent.actor.id remains the external driving actor.

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.zf8bz8y7
session	dev3.zf8bz8y7
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.2
agent_runtime	OMP 18.1.2
tooling_profile	dotfiles@7534055

[schickling-assistant]

Downstream reader implementation exposed one missing runtime projection. When schema 2 makes ST_AGENT the raw immutable ID, scan-free in-session readers (statusline, footnote, Axe approval context) also need the current display route without inferring it from ID. Please export:

• ST_AGENT_ADDRESS: optional current host-qualified bus address, absent for a proved non-routable subject
• ST_AGENT_SCHEMA=2: declared identity environment contract

Legacy wrappers may keep ST_AGENT_SCHEMA=1 and no separate address. These values must come from the same resolved subject snapshot that writes PTY agent.subject.address; downstream must not call pty list or reconstruct a bus address from opaque ID bytes.

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.zf8bz8y7
session	dev3.zf8bz8y7
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.2
agent_runtime	OMP 18.1.2
tooling_profile	dotfiles@7534055

[schickling-assistant]

Closing in favour of the address-first landing: st2#468 → #467, per dotfiles decisions Q23–Q25 (seat dev3.direct.omp.v6c4mkm2) and the two audits (StackMinimal, StackAnatomy): the #453 problem statement is solved by a mutable address alone; the immutable-id half is staged behind named triggers in decision 0015 Amendment 1 (cross-host seat move, live/archive identity collision, a UUIDv7 creation call site). Branch kept; agent attach --id can be re-cut as attach --address on top of #467.

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.aetn947t
session	dev3.aetn947t
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.2
agent_runtime	OMP 18.1.2
tooling_profile	dotfiles@7534055