@the-open-engine/zeroshot 6.23.0 → 6.25.0

package/src/agent/agent-task-executor.js

@@ -17,6 +17,7 @@ const { getNestedExecutionRegistry, TaskExecutionHandle } = require('./task-exec
 const os = require('os');
 const { parseProviderChunk, getProvider } = require('../providers');
 const { getTask, getTaskBySpawnOwnershipToken } = require('../../task-lib/store.js');
+const { OMP_SESSIONLESS_ENV } = require('../../task-lib/omp-storage-root.js');
 const { loadSettings } = require('../../lib/settings.js');
 const { getDefaultProviderId } = require('../../lib/provider-names');
 const { resolveClaudeAuth } = require('../../lib/settings/claude-auth.js');
@@ -46,6 +47,7 @@ const {
 } = require('../task-spawn-cleanup-ownership');
 const {
   providerSessionFromCompletedTask,
+  resolveAgentProviderSession,
   resolveAgentResumeSessionId,
   validateCompletedResumeIdentity,
 } = require('./provider-session');
@@ -722,14 +724,48 @@ function buildTaskRunArgs({
     args.push(mcpArg);
   }
 
-  const resumeSessionId = resolveAgentResumeSessionId(agent, providerName);
-  if (resumeSessionId) {
-    args.push('--resume', resumeSessionId);
+  if (providerName === 'omp') {
+    const ompResumeArg = buildOmpResumeArg(agent, providerName);
+    if (ompResumeArg) args.push('--omp-resume', ompResumeArg);
+  } else {
+    const resumeSessionId = resolveAgentResumeSessionId(agent, providerName);
+    if (resumeSessionId) {
+      args.push('--resume', resumeSessionId);
+    }
   }
 
   return args;
 }
 
+/**
+ * OMP never accepts a bare `--resume <sessionId>` (see failClosedUnsupportedSessionControl in
+ * adapters/omp.ts): the child `zeroshot task run` process needs the *complete* committed tuple so
+ * it can re-check it against the prior owner's persisted row and re-verify identity/manifest/
+ * fingerprint drift before ever spawning OMP.
+ *
+ * `priorOwnerTaskId` is what turns this from an assertion into a cross-check: the child resolves
+ * that row and requires every field below to match it exactly, so a stale or tampered argv
+ * descriptor is a conflict that fails closed instead of a claim that is taken at face value.
+ * Nothing here is secret — it is the same non-secret shape as task.ompSessionOwnership.session,
+ * and it deliberately carries no storage-root or partition path.
+ */
+function buildOmpResumeArg(agent, providerName) {
+  const session = resolveAgentProviderSession(agent, providerName);
+  const ompSession = session?.ompSession;
+  if (!session || !ompSession) return null;
+  return JSON.stringify({
+    priorOwnerTaskId: session.taskId,
+    partitionId: ompSession.partitionId,
+    sessionFileName: ompSession.sessionFileName,
+    expectedSessionId: session.sessionId,
+    expectedSessionFileIdentity: ompSession.sessionFileIdentity,
+    expectedArtifactManifestDigest: ompSession.artifactManifestDigest,
+    expectedExecutionFingerprint: ompSession.executionFingerprint,
+    expectedSelectedProvider: ompSession.selectedProvider,
+    expectedSelectedModel: ompSession.selectedModel,
+  });
+}
+
 /**
  * Build the `--mcp-config` args for a task-run invocation, or [] when they don't apply.
  *
@@ -805,6 +841,7 @@ function buildSpawnEnv(agent, providerName, modelSpec, options = {}) {
 
   if (clusterId) {
     spawnEnv.ZEROSHOT_CLUSTER_ID = clusterId;
+    spawnEnv.ZEROSHOT_AGENT_ID = agent.id;
     const cmdproofRoot = path.join(os.homedir(), '.zeroshot', 'cmdproof', clusterId);
     if (!spawnEnv.CMDPROOF_CACHE_DIR) {
       spawnEnv.CMDPROOF_CACHE_DIR = path.join(cmdproofRoot, 'cache');
@@ -812,6 +849,13 @@ function buildSpawnEnv(agent, providerName, modelSpec, options = {}) {
     if (!spawnEnv.CMDPROOF_KEY_DIR) {
       spawnEnv.CMDPROOF_KEY_DIR = path.join(cmdproofRoot, 'keys');
     }
+    // OMP session partitions live under the owning cluster's storageDir (never TASKS_DIR — see
+    // task-lib/omp-storage-root.js), forwarded to the spawned `zeroshot task run` child since it
+    // has no other way to learn which orchestrator instance owns this cluster.
+    if (providerName === 'omp') {
+      spawnEnv.ZEROSHOT_OMP_STORAGE_ROOT =
+        agent.cluster?.storageDir || path.join(os.homedir(), '.zeroshot');
+    }
   }
 
   const commandProofs = Array.isArray(agent.config?.commandProofs)
@@ -1456,6 +1500,25 @@ async function buildCompletionResult({
   };
 }
 
+/**
+ * Rebuild the provider-session snapshot from a *freshly re-read* task row.
+ *
+ * The snapshot inside a completion result is necessarily built while the OMP ownership row is
+ * still `provisional` — the detached watcher records verified materialization evidence but defers
+ * the commit decision to the agent's post-hook success boundary — so for provider `omp` it is
+ * stale by construction and always null. agent-lifecycle.js calls this *after* a checked commit
+ * and before publishing TASK_COMPLETED, which is the only point at which a durable, resumable
+ * `ompSession` exists to snapshot.
+ */
+function rebuildProviderSessionAfterCommit({ agent, providerName, taskId, logicalSuccess = true }) {
+  return providerSessionFromCompletedTask({
+    agent,
+    providerName,
+    taskInfo: getTask(taskId),
+    logicalSuccess,
+  });
+}
+
 function finalizeLogFollow(agent, state) {
   if (state.pollInterval) {
     clearInterval(state.pollInterval);
@@ -1886,6 +1949,11 @@ async function spawnClaudeTaskIsolatedExecution(agent, context, options = {}) {
   // only authoritative bridge back to the detached task row in the container.
   const isolatedEnv = {
     ...(providerName === 'claude' ? buildClaudeEnv(modelSpec, { includeAuth: false }) : {}),
+    // Docker is fresh-only for OMP (issue #866): the container filesystem is ephemeral, so a
+    // session partition allocated inside it could never be resumed and its ownership row would be
+    // unreclaimable once the container is removed. This marker makes the in-container
+    // `zeroshot task run` skip partition allocation entirely and launch `--no-session`.
+    ...(providerName === 'omp' ? { [OMP_SESSIONLESS_ENV]: '1' } : {}),
     [TASK_SPAWN_OWNERSHIP_TOKEN_ENV]: ownershipToken,
   };
 
@@ -3003,5 +3071,6 @@ module.exports = {
   parseResultOutput,
   buildCompletionResult,
   buildTaskRunArgs,
+  rebuildProviderSessionAfterCommit,
   killTask,
 };

package/src/agent/provider-session.js

@@ -3,6 +3,7 @@ const path = require('path');
 
 const { normalizeProviderName, providerSupportsCapability } = require('../../lib/provider-names');
 const { tryCanonicalMessageSequence } = require('../ledger-sequence');
+const { validateOwnedByTask } = require('../../task-lib/omp-session-ownership-schema.js');
 
 const DURABLE_SESSION_BOUNDARY_EVENTS = new Set([
   'TASK_STARTED',
@@ -44,6 +45,77 @@ function promptIdentity(value) {
   return `sha256:${crypto.createHash('sha256').update(String(value)).digest('hex')}`;
 }
 
+const DECIMAL_STRING = /^(0|[1-9][0-9]*)$/;
+const SHA256_DIGEST = /^sha256:[a-f0-9]{64}$/;
+const SESSION_FILE_NAME = /^[^/\\]+\.jsonl$/;
+const { PARTITION_ID_PATTERN } = require('../omp-session-partition');
+
+// Exactly the field set issue #866 fixes for this snapshot — no more, no less. The record is
+// closed in both directions so a stale snapshot written by a different Zeroshot version, or one
+// carrying smuggled extra state, is rejected rather than partially trusted.
+const OMP_SESSION_KEYS = new Set([
+  'schemaVersion',
+  'partitionId',
+  'sessionFileName',
+  'sessionFileIdentity',
+  'artifactManifestDigest',
+  'executionFingerprint',
+  'selectedProvider',
+  'selectedModel',
+]);
+const IDENTITY_KEYS = new Set(['device', 'inode']);
+
+function normalizeIdentity(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  if (!Object.keys(value).every((key) => IDENTITY_KEYS.has(key))) return null;
+  if (!DECIMAL_STRING.test(String(value.device)) || !DECIMAL_STRING.test(String(value.inode))) {
+    return null;
+  }
+  return { device: String(value.device), inode: String(value.inode) };
+}
+
+/**
+ * The optional providerSession.ompSession field (issue #866): required in addition to the
+ * generic tuple above for provider 'omp', absent for every other provider. Every digest here is
+ * sha256:<64-lower-hex>; every device/inode is a canonical unsigned decimal string. Never carries
+ * storage-root or partition paths — those stay in task.ompSessionOwnership, not the agent
+ * snapshot; the partition is re-derived from the owner row at resume time.
+ */
+function normalizeOmpSession(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return null;
+  }
+  if (!Object.keys(value).every((key) => OMP_SESSION_KEYS.has(key))) return null;
+  const sessionFileIdentity = normalizeIdentity(value.sessionFileIdentity);
+  if (
+    value.schemaVersion !== 1 ||
+    !normalizeNonEmptyString(value.partitionId) ||
+    !PARTITION_ID_PATTERN.test(value.partitionId) ||
+    !normalizeNonEmptyString(value.sessionFileName) ||
+    !SESSION_FILE_NAME.test(value.sessionFileName) ||
+    value.sessionFileName === '.jsonl' ||
+    !sessionFileIdentity ||
+    typeof value.artifactManifestDigest !== 'string' ||
+    !SHA256_DIGEST.test(value.artifactManifestDigest) ||
+    typeof value.executionFingerprint !== 'string' ||
+    !SHA256_DIGEST.test(value.executionFingerprint) ||
+    !normalizeNonEmptyString(value.selectedProvider) ||
+    !normalizeNonEmptyString(value.selectedModel)
+  ) {
+    return null;
+  }
+  return {
+    schemaVersion: 1,
+    partitionId: value.partitionId,
+    sessionFileName: value.sessionFileName,
+    sessionFileIdentity,
+    artifactManifestDigest: value.artifactManifestDigest,
+    executionFingerprint: value.executionFingerprint,
+    selectedProvider: value.selectedProvider,
+    selectedModel: value.selectedModel,
+  };
+}
+
 function supportsSessionResume(providerName) {
   try {
     return providerSupportsCapability(providerName, 'sessionResume');
@@ -68,6 +140,8 @@ function normalizeProviderSession(value) {
   const contextSequence = normalizeCursor(value.contextSequence);
   const guidanceSequence = normalizeNullableCursor(value.guidanceSequence);
   const normalizedPromptIdentity = normalizePromptIdentity(value.promptIdentity);
+  const hasOmpSession = Object.hasOwn(value, 'ompSession');
+  const normalizedOmpSession = hasOmpSession ? normalizeOmpSession(value.ompSession) : null;
 
   if (
     !provider ||
@@ -84,7 +158,8 @@ function normalizeProviderSession(value) {
     (value.guidanceSequence !== null && guidanceSequence === null) ||
     !Object.hasOwn(value, 'promptIdentity') ||
     normalizedPromptIdentity === undefined ||
-    !supportsSessionResume(provider)
+    !supportsSessionResume(provider) ||
+    (provider === 'omp' ? normalizedOmpSession === null : hasOmpSession)
   ) {
     return null;
   }
@@ -100,6 +175,7 @@ function normalizeProviderSession(value) {
     contextSequence,
     guidanceSequence,
     promptIdentity: normalizedPromptIdentity,
+    ...(provider === 'omp' ? { ompSession: normalizedOmpSession } : {}),
   };
 }
 
@@ -169,6 +245,29 @@ function validateCompletedResumeIdentity(taskInfo) {
     : 'Provider continuation did not confirm the requested session identity';
 }
 
+/** taskInfo.ompSessionOwnership is the authoritative, watcher-committed continuation evidence for
+ * provider 'omp'; a provisional/cleanup-required/missing record means this task never durably
+ * proved a resumable session, regardless of what the generic sessionId/resumeIdentityVerified
+ * columns say (rpc-watcher.js never populates those — they're the stdout-parsing watchers' path).
+ * The record is re-fenced to this exact task row: an ownership object naming a different owner is
+ * not this task's continuation evidence, however well-formed it is. */
+function ompSessionFromCompletedTask(taskInfo) {
+  const ownership = validateOwnedByTask(taskInfo?.ompSessionOwnership ?? null, taskInfo?.id);
+  if (!ownership || ownership.state !== 'committed' || !ownership.session) {
+    return null;
+  }
+  return {
+    schemaVersion: 1,
+    partitionId: ownership.partitionId,
+    sessionFileName: ownership.session.fileName,
+    sessionFileIdentity: ownership.session.fileIdentity,
+    artifactManifestDigest: ownership.session.artifactManifestDigest,
+    executionFingerprint: ownership.session.executionFingerprint,
+    selectedProvider: ownership.session.selectedProvider,
+    selectedModel: ownership.session.selectedModel,
+  };
+}
+
 function providerSessionFromCompletedTask({
   agent,
   providerName,
@@ -192,7 +291,16 @@ function providerSessionFromCompletedTask({
     return null;
   }
 
-  const sessionId = normalizeNonEmptyString(taskInfo.sessionId);
+  const isOmp = provider === 'omp';
+  const ompOwnership = isOmp
+    ? validateOwnedByTask(taskInfo.ompSessionOwnership ?? null, taskInfo.id)
+    : null;
+  const ompSession = isOmp ? ompSessionFromCompletedTask(taskInfo) : null;
+  // rpc-watcher.js never populates the generic sessionId column; the OMP-observed session ID
+  // committed alongside ompSession is the one authoritative identity for this provider.
+  const sessionId = isOmp
+    ? normalizeNonEmptyString(ompOwnership?.state === 'committed' ? ompOwnership.session?.sessionId : null)
+    : normalizeNonEmptyString(taskInfo.sessionId);
   const taskId = normalizeNonEmptyString(taskInfo.id);
   const generation = agent?.iteration;
   const agentId = normalizeNonEmptyString(agent?.id);
@@ -207,6 +315,7 @@ function providerSessionFromCompletedTask({
     contextSequence: agent?.currentContextSequence,
     guidanceSequence: agent?.currentGuidanceSequence ?? null,
     promptIdentity: agent?.currentPromptIdentity ?? null,
+    ...(isOmp ? { ompSession } : {}),
   });
 }
 
@@ -264,6 +373,7 @@ function restoreAgentProviderSession({ agent, savedState, messageBus, clusterId
 }
 
 module.exports = {
+  agentCanReuseSession,
   agentWorkspaceProvenance,
   normalizeProviderSession,
   promptIdentity,

package/src/agent-cli-provider/adapters/omp.ts

@@ -4,6 +4,7 @@ import { appendJsonSchemaPrompt } from '../schema';
 import { isRecord, unknownToMessage } from '../json';
 import { OMP_REMEDIATION, OMP_SUPPORTED_VERSION } from '../omp-release';
 import { parseNormalizedOmpRpcEventLine } from '../omp-rpc-events';
+import type { OmpSessionLaunch } from '../omp-rpc-session';
 import {
   InvalidProviderModelError,
   type BuildProviderCommandOptions,
@@ -180,8 +181,13 @@ function detectCliFeatures(helpText?: string | null, versionText?: string | null
   };
 }
 
+function resolveOmpSessionLaunch(options: BuildProviderCommandOptions): OmpSessionLaunch {
+  return options.ompSession ?? { kind: 'none' };
+}
+
 function assertRequiredOmpFeatures(options: BuildProviderCommandOptions): void {
   const features = optionFeatures(options);
+  const session = resolveOmpSessionLaunch(options);
   const required: ReadonlyArray<readonly [boolean | undefined, string]> = [
     [features.versionMatches, `exact OMP version ${OMP_SUPPORTED_VERSION}`],
     [features.supportsRpcMode, '"rpc" mode'],
@@ -190,6 +196,10 @@ function assertRequiredOmpFeatures(options: BuildProviderCommandOptions): void {
     [features.supportsApprovalMode, '--approval-mode'],
     [features.supportsNoTitle, '--no-title'],
     [features.supportsNoSession, '--no-session'],
+    ...(session.kind === 'none'
+      ? []
+      : ([[features.supportsSessionDir, '--session-dir']] as const)),
+    ...(session.kind === 'resume' ? ([[features.supportsResume, '--resume']] as const) : []),
   ];
   const missing = required.filter(([supported]) => supported === false).map(([, label]) => label);
   if (missing.length === 0) return;
@@ -203,16 +213,35 @@ function assertRequiredOmpFeatures(options: BuildProviderCommandOptions): void {
 }
 
 function failClosedUnsupportedSessionControl(options: BuildProviderCommandOptions): void {
-  const hasResumeSessionId = options.resumeSessionId !== undefined;
-  if (!hasResumeSessionId && !options.continueSession) return;
-  const field = hasResumeSessionId ? 'options.resumeSessionId' : 'options.continueSession';
-  throw contractError({
-    code: 'invalid-field',
-    field,
-    exitCode: 2,
-    message:
-      'OMP RPC lane runs sessionless (--no-session) in this slice; resume/continue session control is capability-gated off (sessionResume: false).',
-  });
+  if (options.continueSession) {
+    throw contractError({
+      code: 'invalid-field',
+      field: 'options.continueSession',
+      exitCode: 2,
+      message: 'OMP RPC lane never supports --continue; continuation is always an explicit verified --resume partition.',
+    });
+  }
+  const hasVerifiedResume = resolveOmpSessionLaunch(options).kind === 'resume';
+  if (options.resumeSessionId !== undefined && !hasVerifiedResume) {
+    throw contractError({
+      code: 'invalid-field',
+      field: 'options.resumeSessionId',
+      exitCode: 2,
+      message:
+        'OMP RPC lane requires a verified session partition (options.ompSession.kind === "resume") to resume; a bare session ID cannot be trusted.',
+    });
+  }
+}
+
+function sessionArgs(session: OmpSessionLaunch): readonly string[] {
+  switch (session.kind) {
+    case 'none':
+      return ['--no-session'];
+    case 'fresh':
+      return ['--session-dir', session.partition.path];
+    case 'resume':
+      return ['--session-dir', session.partition.path, '--resume', session.file.path];
+  }
 }
 
 function rejectMcpConfig(options: BuildProviderCommandOptions): void {
@@ -257,8 +286,9 @@ function buildCommand(_context: string, options: BuildProviderCommandOptions = {
   const modelSelector = resolveModelSelector(options);
   const warnings = collectWarnings(options);
   const overlay = createOmpConfigOverlay();
+  const session = resolveOmpSessionLaunch(options);
 
-  const args: string[] = ['--mode', 'rpc', '--no-session', '--model', modelSelector];
+  const args: string[] = ['--mode', 'rpc', ...sessionArgs(session), '--model', modelSelector];
   if (options.modelSpec?.reasoningEffort) {
     args.push('--thinking', options.modelSpec.reasoningEffort);
   }

package/src/agent-cli-provider/omp-release.ts

@@ -84,3 +84,29 @@ export function findOmpReleaseAsset(platform: string): OmpReleaseAsset | undefin
 export function ompReleaseAssetDownloadUrl(asset: OmpReleaseAsset): string {
   return `${OMP_RELEASE_DOWNLOAD_BASE_URL}/${asset.name}`;
 }
+
+// Docker isolation runs the cluster image as linux/amd64 only (see AGENTS.md OMP Docker
+// section); the base image's AWS/Terraform/kubectl/Helm/Infracost/TFLint/tfsec layers are
+// hard-coded x86-64 assets, so this cannot yet claim native arm64.
+export const OMP_DOCKER_PLATFORM = 'linux/amd64' as const;
+export const OMP_DOCKER_RELEASE_PLATFORM = 'linux-x64' as const satisfies OmpReleasePlatform;
+
+const OMP_DOCKER_RELEASE_ASSET = findOmpReleaseAsset(OMP_DOCKER_RELEASE_PLATFORM);
+if (!OMP_DOCKER_RELEASE_ASSET) {
+  throw new Error(
+    `No OMP release asset found for Docker platform "${OMP_DOCKER_RELEASE_PLATFORM}"`
+  );
+}
+
+const OMP_DOCKER_RELEASE_URL = ompReleaseAssetDownloadUrl(OMP_DOCKER_RELEASE_ASSET);
+const OMP_DOCKER_RELEASE_SHA256 = OMP_DOCKER_RELEASE_ASSET.sha256;
+
+// Digest-verified install for the Docker image variant only. Downloads the pinned release asset,
+// verifies its SHA-256 before install, and asserts `omp --version` matches exactly — never
+// `latest`, never trusting the tag URL alone.
+export const OMP_DOCKER_INSTALL_COMMAND: string =
+  `set -eu; curl -fsSL --retry 3 -o /tmp/omp "${OMP_DOCKER_RELEASE_URL}"; ` +
+  `printf '%s  /tmp/omp\\n' '${OMP_DOCKER_RELEASE_SHA256}' | sha256sum -c -; ` +
+  `install -m 0755 /tmp/omp /usr/local/bin/omp; rm -f /tmp/omp; ` +
+  `v="$(omp --version 2>&1 | head -n1 | tr -dc '0-9.')"; ` +
+  `[ "$v" = "${OMP_SUPPORTED_VERSION}" ] || { echo "omp --version mismatch: $v" >&2; exit 1; }`;

package/src/agent-cli-provider/omp-rpc-driver.ts

@@ -464,6 +464,20 @@ export function runOmpRpcTask(
       // (agent_end / a delayed prompt_result), not by this function returning.
     }
 
+    // Present on both the get_state response's `data` and a `session_info_update` event frame per
+    // docs/rpc.md; either may carry only a subset, so callers merge this onto prior evidence
+    // rather than replacing it wholesale.
+    function sessionFieldsFromRecord(
+      record: Record<string, unknown>
+    ): Partial<Pick<OmpRpcSessionEvidence, 'sessionId' | 'sessionFile'>> {
+      const sessionId = getString(record, 'sessionId');
+      const sessionFile = getString(record, 'sessionFile');
+      return {
+        ...(sessionId !== null ? { sessionId } : {}),
+        ...(sessionFile !== null ? { sessionFile } : {}),
+      };
+    }
+
     function sessionEvidenceFromState(
       stateResponse: Record<string, unknown> | null
     ): Omit<OmpRpcSessionEvidence, 'phase'> {
@@ -471,15 +485,27 @@ export function runOmpRpcTask(
       const data = getRecord(stateResponse, 'data');
       const model = data ? getRecord(data, 'model') : null;
       return {
-        sessionId: null,
-        sessionFile: null,
+        ...UNKNOWN_SESSION_EVIDENCE,
+        ...(data ? sessionFieldsFromRecord(data) : {}),
         selectedProvider: (model ? getString(model, 'provider') : null) ?? '',
         selectedModel: (model ? getString(model, 'id') : null) ?? '',
         thinkingLevel: (data ? getString(data, 'thinkingLevel') : null) ?? '',
       };
     }
 
-    function dispatchFrame(frame: OmpRpcInboundFrame): void {
+    // session_info_update is a builtin slash-command side channel (docs/rpc.md) that can carry a
+    // later-observed sessionId/sessionFile than the initial get_state snapshot. Returning the
+    // hooks.onSession() promise (rather than fire-and-forget) lets a persistence failure surface
+    // through the same enqueue()/state.chain .catch() -> failPermanently() path as every other
+    // dispatch failure, instead of being silently swallowed.
+    function handleSessionInfoUpdate(frame: OmpRpcInboundFrame): Promise<void> | void {
+      const updates = sessionFieldsFromRecord(frame);
+      if (Object.keys(updates).length === 0) return;
+      state.sessionEvidence = { ...state.sessionEvidence, ...updates };
+      return hooks.onSession({ ...state.sessionEvidence, phase: 'ready' });
+    }
+
+    function dispatchFrame(frame: OmpRpcInboundFrame): void | Promise<void> {
       if (state.terminal) return; // Frames after the terminal frame are dropped.
       if (!state.readyReceived) {
         dispatchReadyFrame(frame);
@@ -513,6 +539,8 @@ export function runOmpRpcTask(
         case 'agent_end':
           handleAgentEnd();
           return;
+        case 'session_info_update':
+          return handleSessionInfoUpdate(frame);
         default:
           if (state.promptSent) emitNormalized(frame);
       }

package/src/agent-cli-provider/omp-rpc-session.ts

@@ -1,6 +1,6 @@
-// Session-launch types for the OMP RPC v2 driver. This slice launches sessionless
-// (`--no-session`) only; `fresh`/`resume` are typed for Subissue 4's session-flag activation but
-// are unreachable from any caller in this slice.
+// Session-launch types for the OMP RPC v2 driver. `none` keeps the Docker-only sessionless launch
+// (`--no-session`); `fresh`/`resume` carry a verified partition (and, for resume, a verified
+// session file) allocated and checked by the JS task-lib layer — never a raw, unverified path.
 
 export interface VerifiedOmpPartition {
   readonly path: string;