feat: collaboration config on session.create (collab sessions P1a)

[saucam]

P1 of docs/collaborative-session-design.md §11, following P0 (#247).

P1 is split in two along the repo's own contracts before consumers rule:

• P1a — this PR. The contract: a collaboration's goal + role→backend bindings can be requested, validated, persisted, and read back. The daemon stays fully working; the config round-trips but drives nothing yet.
• P1b — next. The consumer: compile to an ephemeral one-goal pack, spawn role-children on their bound backends with leaf scopes, tear down at goal end.

Splitting also isolates the cross-repo protocol change into one small, auditable diff.

Lockstep: paired with highflame-ai/codeoid-ui#35, per codeoid-ui CONTRIBUTING ("if you change codeoid-protocol … update the daemon's src/protocol/ in lockstep").

What changed

Area	Change
packages/protocol	CollaborationConfig / CollaborationRole / ORCHESTRATOR_ROLE; on SessionCreateMsg, echoed on SessionInfo; 3 published LIMITS
schemas.ts	Zod — shape only, deliberately
daemon/collaboration.ts	new — the semantic rules + the CLI role grammar
store.ts / transcript.ts	collaboration JSON column + TranscriptMeta field
pipeline/pack.ts	roleSchema gains optional (provider, model) — §8.1
cli.ts / terminal/client.ts	--collaborate <goal> + repeatable --role

codeoid new api-limits ~/repo \
  --collaborate "Add rate limiting to the public API" \
  --role orchestrator:claude \
  --role reasoning:openai:gpt-5-codex \
  --role review:gemini*3

Design notes worth reviewing

Shape in the schema, semantics in the daemon. Zod checks only structure. The rules — provider registered, exactly one orchestrator, orchestrator on claude in v1, model valid for its role's backend — live in collaboration.ts. Same reasoning the codebase already applies to providerId being a bounded string rather than an enum: the frame must parse so the daemon can answer with a specific, actionable error instead of the schema opaquely rejecting the whole create.

Fail-closed matters more here than on a plain session. The entire point of a collaboration is that roles sit on different vendors. A silent fallback to the default backend would produce a "multi-model" session that is secretly single-model — so an unregistered provider rejects the create outright.

Audit pass (commit 8806fb7)

A pre-merge audit found six issues in this PR; all are fixed here.

• High — collaboration was erased from transcript meta on the first status write. #writeMetaAtomic serializes the whole object and renames over the file, so a field written only at create time is gone after the next status transition — and that file is what the resume path reads. Reproduced: create + one turn left collaboration: undefined on disk. The durability guarantee this PR advertises held only for sessions that had never taken a turn.
• Medium — a session's providerId could contradict its own orchestrator role. The claude-only rule guarded the role entry, but the thing that must mount the fleet MCP is the session. providerId is now derived from the orchestrator role, and an explicit conflicting value is rejected.
• Medium — resolveBackend's model check could never reject anything (carried in from feat: per-child provider/model on dispatched workers (collab sessions P0) #247). resolveAgainstList(...) ?? resolveModelIdForProvider(...) read as strict validation, but the fallback returns its input unchanged. Kept the permissive house policy, deleted the dead branch, corrected the comment. This also corrects an overstatement in feat: per-child provider/model on dispatched workers (collab sessions P0) #247's description.
• Low ×3 — validateCollaboration re-checks the published LIMITS (embedded frontends bypass Zod); role names stored lowercased; parseRoleSpec bounds count.

The meta regression test drives a real turn before asserting — the original tests only checked the create-time write, which is exactly why the High slipped through. Suite now 1878 pass / 0 fail.

Validation returns a normalized config (goal/name trimmed, count defaulted, model resolved against its own role's backend) so nothing downstream re-resolves — and nothing re-resolves against the wrong provider. This reuses P0's resolveModelIdForProvider, which is what catches "review on gemini with model opus" at create time rather than on the first turn.

Role names are free-form strings, not an enum (§3, "a role is data"). Adding security-reviewer must stay a config change.

Persisted in both places. TranscriptMeta is what the resume path actually reads; the sessions.collaboration column keeps a collaboration visible to anything querying the table directly. The column is additive; NULL = a normal session.

Verification

• Suite 1871 pass / 0 fail (+29), typecheck + biome + bun build clean.
• New src/tests/collaboration.test.ts covers the validator, the CLI grammar, and the real SessionManager.handle() create path — driven by a genuine two-backend ProviderRegistry, not _testProviderFactory (which injects one mock into every session and would hide whether the config survives create → SessionInfo → persistence).
• Mutation-checked: dropping the collaboration passthrough fails 2 tests; disabling the fail-closed provider check fails 2 others.
• Two pre-existing bun test "errors" come from packages/core/src/messages.test.ts deliberately throwing from a listener to prove later listeners still run. Unrelated; that test passes.

Scope notes

• Orchestrator is claude-only in v1 — the only backend that mounts the fleet MCP server. Error text points at Support non-Claude orchestrators for collaborative sessions (mountable fleet MCP) #245.
• roleSchema.provider absent = the session's own backend, so every existing pack is unaffected; it is consumed only on the fleet/child path, never to mutate a bound session mid-run.
• MODEL_CATALOG staleness (opus → claude-opus-4-8) still outstanding from feat: per-child provider/model on dispatched workers (collab sessions P0) #247 — unchanged here.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.