fix(scope): close remaining ownership boundaries

packages/core/agent-loop/README.md

@@ -8,13 +8,13 @@ This is the only package in the harness that contains concrete loop logic. Every
 
 ### Public API
 
-Lifecycle (scoped): programmatic creation and resume snapshot caller-owned identity/configuration data, reserve both IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. Resume installs an owner-liveness sentinel before persistence load, then hands ownership directly to the full lifecycle. After setup resolves, the factory checks its lifecycle flag, owner-fiber state, and owning agent status around one microtask checkpoint so a same-turn Cordis unload wins before publication. Successful setup inserts both session and agent before announcing either, enables driving immediately before `agent/session-start`, then starts the loop. Setup calls to `send`/`steer`/`inject`/`cancel` reject structurally; load/setup rejection or owner unload publishes nothing. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope. All `agent/*` dispatches go through `agentEvents(ctx, agent)`; per-step assembly through `assembleContextFor(agent)`; the turn-end durability checkpoint through `ctx.sessions.flush(session)`.
+Lifecycle (scoped): programmatic creation and resume snapshot caller-owned identity/configuration data, reserve both IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. A create hands one-read raw seed and metadata references synchronously to the session boundary, which rejects exotic shells and materializes accepted values in a single recursive pass; pre-cloning either value could incorrectly sanitize prototypes. Resume installs an owner-liveness sentinel before persistence load, captures each loaded metadata field once, then hands ownership directly to the full lifecycle. After setup resolves, the factory checks its lifecycle flag, owner-fiber state, and owning agent status around one microtask checkpoint so a same-turn Cordis unload wins before publication. Successful setup inserts both session and agent before announcing either, enables driving immediately before `agent/session-start`, then starts the loop. Setup calls to `send`/`steer`/`inject`/`cancel` reject structurally; load/setup rejection or owner unload publishes nothing. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope. All `agent/*` dispatches go through `agentEvents(ctx, agent)`; per-step assembly through `assembleContextFor(agent)`; the turn-end durability checkpoint through `ctx.sessions.flush(session)`.
 
 - `ctx.agentLoop.create(id: string, options?: AgentOptions, meta?: { cwd?: string }): ReactLoopAgent` — config-driven create: an agent on a fresh per-run session id `${id}-session-<uuid>` with optional session metadata. Used for `cordis.yml`-configured agents. The per-run uuid avoids colliding with the on-disk log a prior run materialized once a durable persistence backend is loaded; each run is a new session (a deliberate demo simplification — a real resume-or-create policy is a TODO). Disposed with the calling fiber.
 
 `AgentLoop` also implements the `AgentFactory` seam and registers itself via `ctx.agents.setFactory(this)`, so plugins create/resume agents through `ctx.agents` (the interface):
 
-- `ctx.agents.create({ agentId, sessionId, meta?, seed?, agentOptions?, setup? }): Promise<AgentHandle>` — programmatic create on a caller-supplied `sessionId`, NOT `${id}-session`. It awaits the unpublished setup transaction before returning; `meta` carries cwd/lineage/seed-boundary metadata and `seed` reconstructs a forked child prefix. The resolved [`AgentHandle`](../agent/README.md) owns exact teardown.
+- `ctx.agents.create({ agentId, sessionId, meta?, seed?, agentOptions?, setup? }): Promise<AgentHandle>` — programmatic create on a caller-supplied `sessionId`, NOT `${id}-session`. It awaits the unpublished setup transaction before returning; `meta` carries cwd/lineage/seed-boundary metadata and `seed` reconstructs a forked child prefix after the session boundary validates and detaches each raw value in one pass. The resolved [`AgentHandle`](../agent/README.md) owns exact teardown.
 - `ctx.agents.resume({ agentId, resumeSessionId, agentOptions?, setup? }): Promise<AgentHandle>` — load a persisted session via `ctx.sessionPersistence` ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), reconstruct its history, then await setup against a fresh unpublished agent scope before rollback-covered publication. The live session id is the resumed id; turn numbering and derived history continue from the loaded log. Requires a session-persistence backend (NOT hard-injected — non-persistent demos still work; `resume` rejects with a clear error when persistence is absent). Returns an `AgentHandle`.
 
 The config-driven `ctx.agentLoop.create()` path keeps its agent owned by the loop fiber (it discards the handle) — only the programmatic factory callers (the ACP bridge and in-process subagent backends) hold a handle and own per-agent teardown.

packages/core/agent-loop/src/index.ts

@@ -178,20 +178,21 @@ export class AgentLoop extends Service implements AgentFactory {
    */
   async createAgent(options: CreateAgentOptions): Promise<AgentHandle> {
     // Snapshot every caller-owned field before the first async setup boundary.
-    // The callback itself is an identity capability; all data fields are
-    // detached so caller mutation cannot drift a reserved/published identity or
-    // the options the accepted agent observes.
+    // The callback itself is an identity capability. Agent options detach here;
+    // seed and metadata stay raw only until sessions.prepare() synchronously
+    // reads, validates, and detaches them, so structuredClone cannot erase an
+    // exotic prototype before the session boundary sees it.
     const agentId = options.agentId
     const sessionId = options.sessionId
     const setup = options.setup
     const agentOptions = structuredClone(options.agentOptions ?? {})
-    const seed = options.seed === undefined ? undefined : structuredClone(options.seed)
-    const meta = structuredClone(options.meta ?? {})
+    const seed = options.seed
+    const meta = options.meta
     const release = this.reserve(agentId, sessionId)
     try {
       const session = this.ctx.sessions.prepare(sessionId, {
         ...seed !== undefined ? { seed } : {},
-        meta,
+        ...meta !== undefined ? { meta } : {},
       })
       // A seeded (forked) create is still a fresh start, NOT a resume.
       return await this.startOwned(agentId, agentOptions, session, 'startup', setup)
@@ -281,16 +282,23 @@ export class AgentLoop extends Service implements AgentFactory {
             throw new Error(`agent "${agentId}" resume aborted: owner disposed during persistence load`)
           }),
         ])
+        // The backend is an async boundary too. Read each loaded header field
+        // once so a stateful implementation cannot pass a valid presence check
+        // and then substitute a different value during reconstruction.
+        const createdAt = meta.createdAt
+        const cwd = meta.cwd
+        const parentSession = meta.parentSession
+        const seedLength = meta.seedLength
         // An out-of-band direct registry/session insertion can still race this
         // service's reservation, so the public enter primitives re-check exact
         // liveness at publication.
         const session = this.ctx.sessions.prepare(sessionId, {
           seed: events,
           meta: {
-            createdAt: meta.createdAt,
-            ...meta.cwd !== undefined ? { cwd: meta.cwd } : {},
-            ...meta.parentSession !== undefined ? { parentSession: meta.parentSession } : {},
-            ...meta.seedLength !== undefined ? { seedLength: meta.seedLength } : {},
+            createdAt,
+            ...cwd !== undefined ? { cwd } : {},
+            ...parentSession !== undefined ? { parentSession } : {},
+            ...seedLength !== undefined ? { seedLength } : {},
           },
         })
         // Calling startOwned synchronously installs the complete lifecycle

packages/core/agent-loop/tests/resume.spec.ts

@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import LlmService from '@deepseek-ai/dsh-llm'
 import SessionStore, { Session, SessionId } from '@deepseek-ai/dsh-session'
-import type { SessionEvent } from '@deepseek-ai/dsh-session'
+import type { SessionEvent, SessionHeader } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { AgentId } from '@deepseek-ai/dsh-agent'
@@ -99,6 +99,22 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => {
     await ctx.fiber.dispose()
   })
 
+  it('createAgent sends raw metadata to the session validator before cloning can sanitize it', async () => {
+    class ExoticMeta {
+      readonly cwd = '/accepted'
+    }
+    const { ctx } = await persistentHarness(new MockAdapter([textResponse('hi')]))
+
+    await expect(ctx.agents.create({
+      agentId: AgentId('exotic-meta-agent'),
+      sessionId: SessionId('exotic-meta-session'),
+      meta: new ExoticMeta(),
+    })).rejects.toThrow(/session metadata is not a plain JSON record/)
+    expect(ctx.agents.get(AgentId('exotic-meta-agent'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('exotic-meta-session'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
   it('resume of a session with no cwd carries an undefined cwd header', async () => {
     // Lifecycle 1: create a no-cwd session and run a turn.
     const adapter1 = new MockAdapter([textResponse('a')])
@@ -411,6 +427,54 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => {
     await ctx2.fiber.dispose()
   })
 
+  it('reads each loaded metadata field once before reconstructing a resumed session', async () => {
+    const sessionId = SessionId('resume-loaded-meta-once')
+    const root = await persistSession(sessionId)
+    const ctx = await mountPersistentHarness(root, new MockAdapter([textResponse('next')]))
+    const loaded = await ctx.sessionPersistence.load(sessionId)
+    const reads = { createdAt: 0, cwd: 0, parentSession: 0, seedLength: 0 }
+    const meta = Object.defineProperties({
+      version: loaded.meta.version,
+      id: loaded.meta.id,
+    }, {
+      createdAt: {
+        enumerable: true,
+        get: () => { reads.createdAt += 1; return reads.createdAt === 1 ? loaded.meta.createdAt : 1n },
+      },
+      cwd: {
+        enumerable: true,
+        get: () => { reads.cwd += 1; return reads.cwd === 1 ? '/loaded' : 'relative' },
+      },
+      parentSession: {
+        enumerable: true,
+        get: () => { reads.parentSession += 1; return reads.parentSession === 1 ? SessionId('parent') : 1n },
+      },
+      seedLength: {
+        enumerable: true,
+        get: () => { reads.seedLength += 1; return reads.seedLength === 1 ? 0 : 1n },
+      },
+    }) as unknown as SessionHeader
+    ctx.sessionPersistence.load = () => Promise.resolve({ meta, events: loaded.events })
+
+    const resumed = await ctx.agents.resume({
+      agentId: AgentId('resume-loaded-meta-once'),
+      resumeSessionId: sessionId,
+      agentOptions: { model: 'mock' },
+    })
+
+    expect(reads).toEqual({ createdAt: 1, cwd: 1, parentSession: 1, seedLength: 1 })
+    expect(resumed.agent.session.header).toEqual({
+      version: loaded.meta.version,
+      id: sessionId,
+      createdAt: loaded.meta.createdAt,
+      cwd: '/loaded',
+      parentSession: 'parent',
+      seedLength: 0,
+    })
+    await resumed.dispose()
+    await ctx.fiber.dispose()
+  })
+
   it('an idle inject() is flushed durably on its own (survives without explicit flush/dispose)', async () => {
     // Lifecycle 1: run a turn, then inject context while idle. The idle inject
     // wraps its context/message in a one-shot turn AND checkpoints it (the turn-enclosure RFC)

packages/core/agent-loop/tests/review-fixes.spec.ts

@@ -605,7 +605,7 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
     return ctx
   }
@@ -1014,7 +1014,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     // Blocking listener on the parent context (survives fiber disposal).
@@ -1071,7 +1071,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     const unlisten = ctx.on('system-prompt/assemble', async function (_assembly, _context, next) {
@@ -1127,7 +1127,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     ctx.on('agent/pre-step', async () => {
@@ -1179,7 +1179,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     ctx.on('agent/pre-step', async () => {
@@ -1228,7 +1228,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     ctx.on('system-prompt/assemble', async function (_assembly, _context, next) {

packages/core/agent-loop/tests/scope-lifecycle.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
 import LlmService from '@deepseek-ai/dsh-llm'
-import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
+import SessionStore, { SessionId, type SessionEvent } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { AgentId, agentEvents, assembleContextFor } from '@deepseek-ai/dsh-agent'
@@ -307,6 +307,36 @@ describe('agent scope lifecycle', () => {
     await retry.dispose()
   })
 
+  it('rejects an exotic seed before publishing either reserved identity', async () => {
+    const ctx = await harness()
+    const published: string[] = []
+    ctx.on('session/created', () => { published.push('session') })
+    ctx.on('agent/created', () => { published.push('agent') })
+    class ExoticData { readonly value = 'not durable JSON' }
+    const seed = [{
+      seq: 0,
+      type: 'test/exotic-seed',
+      data: new ExoticData(),
+    }] as unknown as SessionEvent[]
+
+    await expect(ctx.agents.create({
+      agentId: AgentId('exotic-seed'),
+      sessionId: SessionId('exotic-seed-session'),
+      agentOptions: { model: 'mock' },
+      seed,
+    })).rejects.toThrow(/seed event at index 0 is not losslessly JSON-serializable/)
+
+    expect(published).toEqual([])
+    expect(ctx.agents.get(AgentId('exotic-seed'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('exotic-seed-session'))).toBeUndefined()
+    const retry = await ctx.agents.create({
+      agentId: AgentId('exotic-seed'),
+      sessionId: SessionId('exotic-seed-session'),
+      agentOptions: { model: 'mock' },
+    })
+    await retry.dispose()
+  })
+
   it('a throwing session/created listener disposes the scope (pre-nesting rollback window)', async () => {
     const ctx = await harness()
     let boom = true