docs(collaboration): define local observer contract

[627150795]

Problem

Live Session sharing spans Pi session state, controller ownership, identity, event replication, transport, UI, and threat modeling. It is not safe to begin with a remote relay or a second execution authority.

Value

Define the smallest local read-only Observer boundary that can precede Web or relay work: validated Session identity, bounded snapshots, monotonic event cursors, redaction, backpressure, lifecycle isolation, and zero-network guarantees.

Approach

• Add docs/design/LOCAL_READ_ONLY_OBSERVER_CONTRACT.md.
• Keep Pi as the sole Session execution authority and use existing SessionManager resolution.
• Separate read-only observation from any future prompt, interrupt, steer, kill, or file mutation capability.
• Define stale cursor, resync, lifecycle, queue budget, redaction, trust, and acceptance rules.
• Do not add a Web server, relay, browser transport, remote controller, or runtime code.

Validation

• git diff --check
• bun run lint
• bun run typecheck

Impact

Documentation only. This is a focused local Observer research slice for #166 and does not expand the first phase of #76 or claim remote collaboration is implemented.

Addresses #166

[tt-a1i]

Thank you for writing down this candidate. We are closing it under the future-capability disposition in #277. The PR remains the preserved research source, but OpenPI will not promote a protocol-only or candidate design into a repository contract before there is an active implementation or experiment with a fixed owner, revision, verifier, and acceptance evidence. This is not a content rejection, and no rebase is requested. Restart the work from the linked source Issue when that evidence frontier is ready.