feat(daemon): reconstruct managed session catalog

[sethkarten]

Summary

• reconstruct immutable managed-session family catalog authorization across resident, saved, passive, and remote sessions
• thread one duplicate-fail-closed topology snapshot through message, observe, hydration, and supervisor delivery
• preserve passive lifecycle surfaces and closing-session fences while rejecting incompatible persisted/live or malformed remote topology

Stack

• Draft child of feat(kernel): dispatch host requests as capabilities #1243 (core02-host-request-dispatcher)

Validation

• Focused configured catalog suite: 228/228
• Post-commit exact configured suite: 228/228
• Nonwriting Biome on six paths: pass
• Root tsgo --noEmit: pass
• git diff-check / clean hygiene: pass

Exclusions

• no MCP/project settings, kernel host-request, launchEnv/lifecycle recovery, probe, or saved-sibling follow-up

---

Note

High Risk
Changes authorization for agent-to-agent messaging, observation, and session topology across daemon and supervisor; incorrect catalog merge or trusted-read bugs could deny service or mis-scope reach.

Overview
Replaces ad-hoc sibling/registry lookups with listCatalogFamilySessions, which walks RLM registries under descriptor-anchored (O_NOFOLLOW) managed roots, reads session bytes via a trusted openat helper (no pathname reopen), and fails closed on cycles, symlink/path tricks, registry limits, and header/registry mismatches. Catalog RPC gains family; siblings and name checks take sessionDir.

Daemon and supervisor build one frozen agentFamilyCatalogEntries / familyCatalogEntries snapshot from persisted, artifact, passive, resident, and remote rows (merge only when topology claims agree; duplicates/conflicts deny ACLs). Agent-origin send, observe, roster, and cross-worker wake/delivery use that snapshot end-to-end—including post-wake session-id checks so hydration cannot substitute a different target.

agent-messages tightens nuclear-family logic: siblings need a single catalog-resolved parent, parent edges reject contradictory id+path claims, and passive rows can reserve names via direct parent claims without widening reach. readSessionInfoFromBuffer parses metadata from already-trusted bytes.

Protocol schema revision 17 adds optional sessionDir on detached rename_saved_session so inactive renames use the correct catalog authority.

^{Reviewed by Cursor Bugbot for commit 3bc6523. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Reconstruct managed session catalog with TOCTOU-safe family traversal and snapshot-based ACL enforcement

• Introduces listCatalogFamilySessions in daemon-catalog-process.ts, which traverses the full session artifact tree using descriptor-bound (O_NOFOLLOW) opens and a Python openat sidecar to prevent symlink/rename races during reads.
• Authorization decisions in daemon-mode.ts and daemon-supervisor.ts now operate on a single immutable catalog snapshot captured before any hydration or delivery, preventing TOCTOU drift between topology checks and action.
• Catalog entries are merged from persisted headers, artifact-resident registries, and live runtime state; conflicting claims across sources cause authorization to fail closed rather than being silently coerced.
• sessionDir is threaded through rename, sibling lookup, name-availability, and worker-creation flows so that catalog authority is always scoped to the correct root.
• Daemon schema advances to revision 17; rename_saved_session now requires protocol ≥7 and schema ≥17 and accepts an optional sessionDir field.
• Risk: any saved session with mismatched, ambiguous, or externally-pathed topology headers will be rejected by the new traversal, which fails closed rather than degrading gracefully.

^{Macroscope summarized 3bc6523.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d685ec4. Configure here.}