Revert unreviewed detached Agent Host program

[happylinks]

Reverts the unreviewed "detached Agent Host / Agent Operation / protocol v5" program that was pushed directly to main over ~38h by session os-01a03a08 and its workers (BASE a23d44a..main, identified by content, not author). 107 files changed, −31,987 lines. Typecheck (tsc --noEmit, whole repo incl. tests) is clean; all targeted test files for touched modules pass (session-kernel 198/198, protocol 91/91, transcript-store/actor/destination + session-safety suites green).

1. Removed

Whole directories / files (all new since BASE, verified with git log):

• packages/core/opensession-server/src/agent-host/ (27 files: host, driver, runtime, ledgers, canary qualification, socket framing, supervisor, probes)
• packages/core/opensession-server/src/server/agent-operation/ (39 files: composition, gateway, grants, kernel/transcript facades, pi-model + mcp adapters, readiness, stream journal, deletion coordinator, ledgers)
• server/agent-host-client.ts + test, server/agent-host-registry.ts
• server/security/transport/ (5 files: Linux peer credentials, Unix socket security, inherited-listener support — created by and only used by the program)
• server/session-kernel/: agent-host-supervision-protocol.ts, agent-host-supervision-signer.ts, both supervision test files, agent-operation-protocol.ts, agent-operation.test.ts
• packages/core/protocol/src/: agent-host.ts + test, agent-host-fence.ts, agent-host-supervision.ts, agent-operation.ts + test; their export lines removed from protocol/src/index.ts and the package.json exports map
• Deploy/ops artifacts: opensession-agent-host@.service, opensession-agent-host@.socket, deploy/install-agent-host-topology.sh, deploy/agent-host-service.test.ts, deploy/systemd/agent-host-unactivated/, and the topology-install call in deploy/deploy.sh
• Docs: docs/agent-host-deployment.md, docs/canary-qualification.md, the "Detached Agent Host boundary" section of docs/security-model.md, the "Agent Host execution binding" section of docs/executor-architecture.md, and the two Agent operation/supervision sections of docs/session-kernel-architecture.md

Surgical reverts in mixed live files (program hunks only):

• session-kernel/kernel.ts: registerAgentHostPlan / claimAgentHostSupervision facades and their imports
• session-kernel/actor-client.ts: decideAgentOperationAsync, agentOperationCancellationIntentAsync, decideAgentHostSupervisionAsync
• session-kernel/actor-worker.ts, actor-protocol.ts, actor-routing.ts, lifecycle-protocol.ts: the agent_operation / agent_host_supervision reducer command kinds and routing
• session-kernel/store-routing.ts, session-kernel/index.ts: routing entry and module export
• session-kernel/store.ts (the biggest job, ~2,000 program lines removed): claimAgentHostSupervision, decideAgentOperation, agentOperationCancellationIntent, supervision issuer wiring, supervision/operation row decoders and per-open row validators, the supervision-settle hook in applyRunEvent, the agent_operation quarantine-recovery special case, and all protocol imports
• scripts/check-module-side-effects.ts: dropped the agent-host glob

2. Deliberately KEPT, and why

• Transcript-destination surface (live-data caveat). transcript-store.ts, actor-transcript.ts, and session-kernel/transcript-protocol.ts keep the destination-append/receipt path (agent_append_destination, receipt query/validate) byte-for-byte: this code is in the currently deployed release and has written live per-session kernel data. The type definitions it needs (AgentTranscriptAnchorV1, AgentTranscriptReceiptRefV1, decodeAgentTranscriptReceiptRefV1 + its safe-JSON guard) were relocated from the deleted protocol/agent-operation module into session-kernel/transcript-protocol.ts unchanged.
• store.ts fence + plan surface. assertTranscriptDestinationFence, registerAgentHostPlan, and the session_kernel_agent_host_plan table stay (with a local copy of the plan-registration decoder) because the surviving transcript destination path and its tests (agent-transcript-destination.test.ts, store-host.test.ts) depend on them.
• Kernel SQLite schema and migrations. All agent tables' DDL, schema-version 32, and migrations 26/27/28/32 are kept — live DBs are at user_version 32 and the tables exist in every deployed per-session DB; removing DDL would make fresh and live DBs diverge and break removeSession/clearSession. Migrations 26 and 27 were reduced to DDL-only (their row-validation loops used deleted protocol decoders; pre-program DBs have empty agent tables, so behavior is identical). The pure-SQL schema asserts stay; the receipt-decoding row asserts were removed with the decoders.
• protocol/src/executor.ts (+1079), session.ts, notices.ts, events.ts. Kept in full: the Executor surface (decodeExecutorId, grants, operations, ExecutorProvider/ExecutionTarget, SessionSafetyState) is referenced by surviving live code (src/executor/, src/runner-executor/, server/executors/, server/managed-executors/, executor-client.ts, routes/frontend safety UI, and store.ts itself via decodeExecutorId); notices.ts/events.ts changes are the unrelated worker-report and steer_delivered work.
• Jaap Frolich's kernel lane work (lane-placement.*, actor-routing lane changes, kernel memory bounding, per-lane metrics), transcript-actor co-location (transcript-store.ts, actor-transcript.ts, transcript-offline-migration.*, transcript authority migration 31), onboarding/UI, session-safety (quarantine → paused_for_safety), capacity-control docs, and everything else unrelated: untouched.
• session-safety.ts keeps the agent_operation: "an agent action" display label — live DBs can contain sessions quarantined with that command kind.
• runAgentHosted in host-client.ts and callers: pre-existing at BASE, unrelated naming coincidence.

3. Not cleanly disentangled / leftovers

• Live DB residue: existing session_kernel_agent_host_supervision / agent_operations / cancellation / high-water rows are no longer read, validated, settled, or pruned; they sit inert until session deletion clears them. Supervision receipts stuck 'active' are harmless (nothing consumes them anymore).
• Quarantine recovery no longer re-validates agent-operation rows before declaring an agent_operation-quarantined session recoverable (the validators needed deleted decoders).
• docs/transcripts.md still mentions "future detached Agent Host recovery" when describing the kept typed destination surface — left as-is since the surface it documents remains.
• The kept destination-append path is now only reachable via direct store/test usage (its production caller, agent-operation/transcript-facade.ts, was deleted); a follow-up could retire it once live data ages out.
• Follow-up for ops (not this PR): the root deploy previously installed the disabled agent-host topology (service users/dirs); already-installed inert units/dirs on the host are not removed by a code revert.

Started by Michiel Westerbeek in this OS session

[open-session-os-tella-dev]

🤖 OS review · approve · confidence 5/5

Safe to merge once required CI completes. The PR removes the detached Agent Host and Agent Operation program while preserving the deployed transcript-destination contracts and schema compatibility needed by existing session databases. Repository-wide reference checks found no remaining production imports of the removed modules and no P0/P1 issues.

💡 Labels: os-adversarial — deeper two-pass review · os-simplify — quality cleanup pass · os-auto-fix — fix anything outstanding and push until CI passes.
_{Reviewed d28ec50 · GPT-5.6 Sol · earlier reviews collapse above · open session}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
opensession	Ready	Preview	Aug 27, 2026 9:20am