chainlesschain 0.166.9 → 0.166.13

package/src/data/changelog.json

@@ -1,6 +1,45 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.13",
+      "cliVersions": ["0.3.8", "0.166.12", "0.166.13"],
+      "date": "2026-08-30",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.13 and Session Core 0.3.8: fail-closed P0 security closure",
+          "body": "> `chainlesschain` **0.166.12 -> 0.166.13** and Session Core\n> **0.3.7 -> 0.3.8** (release candidates, 2026-08-30).\n\n- **Fixed renderer IPC capabilities**: remove the environment-controlled\n  generic bridge bypass and generate an exact renderer/main capability\n  manifest that fails the Desktop build when it drifts.\n- **Default sandbox and approval boundary**: restore workspace-write with\n  network disabled as the CLI default, deny shell execution when the approval\n  gate is unavailable, and fail closed when approval policy loading or\n  persistence fails.\n- **Durable process audit**: require a persistent, redacted admission record\n  before high-risk process creation and retain bounded actor, session,\n  authorization, policy, sandbox, and result context.\n- **Release boundary**: these versions identify the source candidates for the\n  security fixes; publication still requires the exact candidate to pass the\n  repository's Linux, Windows, and macOS release matrices."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.12",
+      "cliVersions": ["0.166.10", "0.166.12"],
+      "date": "2026-08-30",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.12: durable rollout storage and converged Hooks v2",
+          "body": "> `chainlesschain` **0.166.10 -> 0.166.12** (release candidate,\n> 2026-08-30). The immutable `0.166.11` candidate was withheld after its npm\n> workflow could not bootstrap the new scoped runtime dependency; its tag is\n> not reused. Coordinated candidates are Context/Memory Kernel `0.1.0`,\n> Session Core `0.3.7`, Agent Protocol `0.1.7`, TypeScript Agent SDK `0.2.7`,\n> Python Agent SDK `0.2.7`, VS Code `0.37.75`, and JetBrains `0.4.105`.\n\n- **Canonical context planning**: ship deterministic budget allocation,\n  compaction, memory reducers, inventory validation, and cross-surface\n  conformance through `@chainlesschain/context-memory-kernel`.\n- **Durable memory cutover**: route CLI context, compaction, hierarchical\n  memory, App Server, WebSocket, REPL, and session flows through fail-closed\n  authority stages with crash-safe persistence and privacy purge receipts;\n  Session Core `0.3.7` exposes the write guard used to fence legacy writers.\n- **Protocol and SDK projections**: add bounded Context/Memory messages and App\n  Server pilot clients to the generated Agent Protocol, TypeScript SDK, Python\n  SDK, VS Code extension, and JetBrains plugin without granting IDE surfaces\n  independent write authority.\n- **Durable rollout stores**: converge App Server, WebSocket, and CLI entry\n  points on bounded memory, JSON, or SQLite rollout stores with explicit\n  selection, migration, recovery, and corruption handling.\n- **Hooks v2 convergence**: route CLI, REPL, headless, settings, plugins, and\n  App Server through one trust-aware event runtime with deterministic ordering,\n  audit replay, timeout supervision, and fail-closed decision semantics.\n- **Release integrity**: publish the new fixed CLI runtime dependency before\n  the immutable CLI tarball, then verify its registry bytes and npm provenance\n  against the exact release tag and commit."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.10",
+      "cliVersions": ["0.166.9", "0.166.10"],
+      "date": "2026-08-29",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.10: governed Graph Kernel production cutover evidence",
+          "body": "> `chainlesschain` **0.166.9 -> 0.166.10** (release candidate,\n> 2026-08-29).\n\n- **Production evidence aggregate**: `graph:production-evidence` verifies the\n  complete staged Graph Kernel cutover evidence set against the exact protected\n  source commit, producer run, inventory, rollout ledger, and qualification\n  artifacts before it can emit a passing receipt.\n- **Fail-closed coverage**: the verifier requires all 20 durable entries, nine\n  projection classes, three rollback modes, every retired writer and mutation,\n  and all three explicitly disabled Browser/Remote entries; missing, duplicate,\n  stale, cross-run, or digest-mismatched evidence is rejected.\n- **Protected consumption**: the production cutover workflow is bound to\n  reviewed GitHub Environments, downloads artifacts from the selected protected\n  producer run, and publishes a content-free receipt only after recomputing the\n  complete aggregate locally.\n- **Honest rollout boundary**: this release ships the verifier and protected\n  consumer, but does not claim that a production rollout occurred; P1-12 closes\n  only after the real environment supplies a valid staged-rollout artifact for\n  the same exact SHA."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.9",
@@ -10,7 +49,7 @@
       "sections": [
         {
           "heading": "Added - cc CLI 0.166.9: governed UI replay and Codex compatibility gates",
-          "body": "> `chainlesschain` **0.166.8 -> 0.166.9** (release candidate,\n> 2026-08-29). Agent Protocol and TypeScript Agent SDK candidate versions\n> remain `0.1.6` and `0.2.5`; Python Agent SDK moves to `0.2.6` after the\n> immutable `0.2.5` candidate was withheld from PyPI because its release\n> metadata named an unpublished CLI.\n\n- **Real UI driver**: reviewed Record & Replay drafts can execute the bounded\n  `observe/click/type/select/assert` vocabulary in an ephemeral Playwright\n  Chromium context instead of relying on a fake executor.\n- **Fail-closed isolation**: the driver denies filesystem, HTTP(S), and\n  WebSocket requests, requires exact reviewed capabilities and selectors, and\n  rejects ambiguous targets, environment drift, network attempts, or missing\n  terminal evidence.\n- **Content-free receipts**: selectors, typed values, page text, URLs, and\n  screenshots never enter reports; only domain-separated state, page,\n  screenshot, target, and receipt digests plus bounded structural metadata are\n  retained.\n- **Cross-platform authority**: a dedicated exact-SHA GitHub Actions matrix\n  runs the positive journey and an active network-escape probe in real Chromium\n  on Linux, Windows, and macOS, then refuses partial evidence in its aggregate.\n- **Exact Codex admission**: the optional experimental App Server adapter now\n  admits only explicitly listed upstream patch versions; prereleases and\n  unverified future patches fail closed to the stable `codex exec --json`\n  fallback before turn admission.\n- **Version-bound App Server evidence**: a second exact-SHA Actions matrix\n  generates each upstream version's own schema and exercises the documented\n  `initialize -> initialized -> thread/list` stdio lifecycle on Linux,\n  Windows, and macOS without making a model request.\n- **Removal readiness**: every compatibility job proves that production CLI\n  source has no dependency on the optional adapter and that the stable Codex\n  JSONL fallback still executes and projects terminal output independently.\n- **Windows strict-sandbox cleanup**: target-identity cleanup remains bound to\n  the stable file object while tolerating size and timestamp metadata settling\n  after the native helper closes its writer; same-path replacement is still\n  rejected.\n- **JetBrains real-host gate**: plan-review document access now runs inside\n  explicit IntelliJ read/write actions, and the UI journey targets the current\n  one-time permission label on every supported host/version pair.\n- **Python release metadata**: the `0.2.6` patch keeps the `0.2.5` runtime API\n  and generated protocol bindings while pointing install guidance at the latest\n  CLI that is actually available from the public npm registry."
+          "body": "> `chainlesschain` **0.166.8 -> 0.166.9**, published 2026-08-29 from exact\n> commit `222396f6a8429d4b862292a2572067a5cacb1003`. Agent Protocol `0.1.6`,\n> TypeScript Agent SDK `0.2.5`, and Python Agent SDK `0.2.6` are public. The\n> immutable Python `0.2.5` candidate was withheld from PyPI because its\n> release metadata named a CLI that was not yet public.\n\n- **Real UI driver**: reviewed Record & Replay drafts can execute the bounded\n  `observe/click/type/select/assert` vocabulary in an ephemeral Playwright\n  Chromium context instead of relying on a fake executor.\n- **Fail-closed isolation**: the driver denies filesystem, HTTP(S), and\n  WebSocket requests, requires exact reviewed capabilities and selectors, and\n  rejects ambiguous targets, environment drift, network attempts, or missing\n  terminal evidence.\n- **Content-free receipts**: selectors, typed values, page text, URLs, and\n  screenshots never enter reports; only domain-separated state, page,\n  screenshot, target, and receipt digests plus bounded structural metadata are\n  retained.\n- **Cross-platform authority**: a dedicated exact-SHA GitHub Actions matrix\n  runs the positive journey and an active network-escape probe in real Chromium\n  on Linux, Windows, and macOS, then refuses partial evidence in its aggregate.\n- **Exact Codex admission**: the optional experimental App Server adapter now\n  admits only explicitly listed upstream patch versions; prereleases and\n  unverified future patches fail closed to the stable `codex exec --json`\n  fallback before turn admission.\n- **Version-bound App Server evidence**: a second exact-SHA Actions matrix\n  generates each upstream version's own schema and exercises the documented\n  `initialize -> initialized -> thread/list` stdio lifecycle on Linux,\n  Windows, and macOS without making a model request.\n- **Removal readiness**: every compatibility job proves that production CLI\n  source has no dependency on the optional adapter and that the stable Codex\n  JSONL fallback still executes and projects terminal output independently.\n- **Windows strict-sandbox cleanup**: target-identity cleanup remains bound to\n  the stable file object while tolerating size and timestamp metadata settling\n  after the native helper closes its writer; same-path replacement is still\n  rejected.\n- **JetBrains real-host gate**: plan-review document access now runs inside\n  explicit IntelliJ read/write actions, and the UI journey targets the current\n  one-time permission label on every supported host/version pair.\n- **Python release metadata**: the `0.2.6` patch keeps the `0.2.5` runtime API\n  and generated protocol bindings while pointing install guidance at the latest\n  CLI that is actually available from the public npm registry.\n- **Release validation**: immutable tag `v-npm-0-166-9` resolves to the exact\n  commit above. Its Linux/Windows/macOS CLI CI and Strict Sandbox matrices,\n  npm Trusted Publishing/provenance/readback, Record & Replay real-browser\n  matrix, Codex App Server compatibility matrix, Desktop signed-Skill\n  qualification, and IDE release gate completed successfully. Open VSX\n  `0.37.73` is public; JetBrains source/tag `0.4.104` remains distinct from the\n  Marketplace-public `0.4.103` artifact."
         }
       ]
     },
@@ -30,7 +69,7 @@
       "sections": [
         {
           "heading": "Added - cc CLI 0.166.8 + Agent Platform and IDE patches: durable Graph review and recovery",
-          "body": "> `chainlesschain` **0.166.7 -> 0.166.8**,\n> `@chainlesschain/agent-protocol` **0.1.5 -> 0.1.6**,\n> `@chainlesschain/agent-sdk` **0.2.4 -> 0.2.5**, and\n> `chainlesschain-agent-sdk` **0.2.4 -> 0.2.5** (release candidate,\n> 2026-08-29).\n> VS Code **0.37.72 -> 0.37.73** and JetBrains\n> **0.4.103 -> 0.4.104** carry the paired governed review surfaces.\n\n- **Durable Graph history**: fixed App Server/SDK clients expose bounded,\n  metadata-only event and snapshot history for blocked-root, revision-diff,\n  and time-travel debugging across CLI, Desktop, and VS Code.\n- **Recoverable HumanTask quorum**: Graph human nodes persist exact\n  revision/attempt/operation bindings, release Agent capacity while waiting,\n  and enforce single-winner cancel/decision CAS, quorum, and separation of\n  duties through the Desktop product surface.\n- **IDE review parity**: VS Code adds bounded Graph history/diff projection;\n  both IDEs enforce revision-bound approval grants and single-winner\n  settlement without accepting UI-derived authority.\n- **Migration and retirement evidence**: N-1 definition backups, rollback\n  digests, replay validation, replacement reachability, historical reads, and\n  zero-success legacy-writer observations are bound to durable exact-SHA\n  evidence rather than prose-only rollout claims.\n- **Reliability gates**: temporal message custody, dependency/scope fairness,\n  cross-process DAG recovery, effect idempotency, and worktree cleanup have\n  explicit bounded artifacts and fail-closed aggregate checks.\n- **Release validation**: publication requires this exact candidate to pass\n  Agent Protocol and Python SDK conformance, Linux/Windows/macOS `CLI CI` and\n  `CLI Strict Sandbox`, the Graph real-journey matrix, immutable package\n  checks, and public-registry provenance readback."
+          "body": "> `chainlesschain` **0.166.7 -> 0.166.8** (source candidate fully carried into\n> public `0.166.9`; it was not published as a separate npm version),\n> `@chainlesschain/agent-protocol` **0.1.5 -> 0.1.6**,\n> `@chainlesschain/agent-sdk` **0.2.4 -> 0.2.5**, and\n> `chainlesschain-agent-sdk` **0.2.4 -> 0.2.5** (withheld Python candidate,\n> superseded by public `0.2.6`, 2026-08-29).\n> VS Code **0.37.72 -> 0.37.73** and JetBrains\n> **0.4.103 -> 0.4.104** carry the paired governed review surfaces.\n\n- **Durable Graph history**: fixed App Server/SDK clients expose bounded,\n  metadata-only event and snapshot history for blocked-root, revision-diff,\n  and time-travel debugging across CLI, Desktop, and VS Code.\n- **Recoverable HumanTask quorum**: Graph human nodes persist exact\n  revision/attempt/operation bindings, release Agent capacity while waiting,\n  and enforce single-winner cancel/decision CAS, quorum, and separation of\n  duties through the Desktop product surface.\n- **IDE review parity**: VS Code adds bounded Graph history/diff projection;\n  both IDEs enforce revision-bound approval grants and single-winner\n  settlement without accepting UI-derived authority.\n- **Migration and retirement evidence**: N-1 definition backups, rollback\n  digests, replay validation, replacement reachability, historical reads, and\n  zero-success legacy-writer observations are bound to durable exact-SHA\n  evidence rather than prose-only rollout claims.\n- **Reliability gates**: temporal message custody, dependency/scope fairness,\n  cross-process DAG recovery, effect idempotency, and worktree cleanup have\n  explicit bounded artifacts and fail-closed aggregate checks.\n- **Release validation**: publication requires this exact candidate to pass\n  Agent Protocol and Python SDK conformance, Linux/Windows/macOS `CLI CI` and\n  `CLI Strict Sandbox`, the Graph real-journey matrix, immutable package\n  checks, and public-registry provenance readback."
         }
       ]
     },

package/src/gateways/ws/session-core-protocol.js

@@ -18,6 +18,16 @@ function fail(code, message) {
   return { ok: false, error: { code, message } };
 }
 
+async function canonicalMemoryService(scopeKey) {
+  const { resolveCliContextMemoryCutover } =
+    await import("../../lib/context-memory-kernel/authority.js");
+  const decision = resolveCliContextMemoryCutover({ scopeKey });
+  if (!decision.canonical) return null;
+  const { createCliCanonicalMemoryService } =
+    await import("../../lib/context-memory-kernel/memory-service.js");
+  return createCliCanonicalMemoryService();
+}
+
 async function loadSingletons() {
   return import("../../lib/session-core-singletons.js");
 }
@@ -133,11 +143,11 @@ async function sessionsPolicySet(message) {
   const { getApprovalGate } = await loadSingletons();
   const gate = await getApprovalGate();
   try {
-    gate.setSessionPolicy(message.sessionId, message.policy);
+    await gate.setSessionPolicy(message.sessionId, message.policy);
+    await gate.awaitPersistence?.();
   } catch (e) {
-    return fail("INVALID_POLICY", e.message);
+    return fail(e.code || "INVALID_POLICY", e.message);
   }
-  await new Promise((r) => setImmediate(r));
   return ok({
     sessionId: message.sessionId,
     policy: gate.getSessionPolicy(message.sessionId),
@@ -146,6 +156,24 @@ async function sessionsPolicySet(message) {
 
 async function memoryStore(message) {
   if (!message.content) return fail("BAD_REQUEST", "content required");
+  const canonical = await canonicalMemoryService("cli:ws:memory.store");
+  if (canonical) {
+    try {
+      const scope = message.scope || "global";
+      const entry = await canonical.addScoped(message.content, {
+        scope,
+        scopeId: scope === "global" ? null : message.scopeId || message.agentId,
+        category: message.category,
+        tags: message.tags || [],
+        source: "cli-ws-session-core",
+        evidenceStore: "cli-ws-session-core",
+        evidenceId: String(message.id || `memory-store-${Date.now()}`),
+      });
+      return ok({ entry });
+    } catch (error) {
+      return fail(error.code || "MEMORY_STORE_FAILED", error.message);
+    }
+  }
   const { getMemoryStore } = await loadSingletons();
   const store = getMemoryStore();
   const entry = store.add({
@@ -162,6 +190,26 @@ async function memoryStore(message) {
 }
 
 async function memoryRecall(message) {
+  const canonical = await canonicalMemoryService("cli:ws:memory.recall");
+  if (canonical) {
+    try {
+      const scope = message.scope || "global";
+      const result = await canonical.recallScoped(message.query || "*", {
+        scope,
+        scopeId: scope === "global" ? null : message.scopeId || message.agentId,
+        tags: message.tags,
+        category: message.category,
+        limit: message.limit,
+        sink: "cli.ws",
+      });
+      return ok({
+        results: result.results,
+        memoryRevision: result.memoryRevision,
+      });
+    } catch (error) {
+      return fail(error.code || "MEMORY_RECALL_FAILED", error.message);
+    }
+  }
   const { getMemoryStore } = await loadSingletons();
   const store = getMemoryStore();
   const results = store.recall({
@@ -178,6 +226,17 @@ async function memoryRecall(message) {
 
 async function memoryDelete(message) {
   if (!message.id) return fail("BAD_REQUEST", "id required");
+  const canonical = await canonicalMemoryService("cli:ws:memory.delete");
+  if (canonical) {
+    try {
+      const receipt = await canonical.delete(message.id);
+      return receipt
+        ? ok({ id: message.id, deleted: true, receipt })
+        : fail("NOT_FOUND", `Memory ${message.id} not found`);
+    } catch (error) {
+      return fail(error.code || "MEMORY_DELETE_FAILED", error.message);
+    }
+  }
   const { getMemoryStore } = await loadSingletons();
   const store = getMemoryStore();
   const entry = store.get(message.id);

package/src/gateways/ws/session-protocol.js

@@ -30,6 +30,7 @@ import {
   sessionBudgetAdmissionError,
 } from "../../lib/session-budget-production-root.js";
 import { mergePricing } from "../../lib/llm-pricing.js";
+import { ensureCanonicalSessionTranscript } from "../../lib/session-transcript-migration.js";
 
 const PAYLOAD_DIGEST = /^sha256:[0-9a-f]{64}$/;
 const RAW_AUTHORITY_HASH = /^[0-9a-f]{64}$/;
@@ -752,7 +753,11 @@ export async function handleSessionCreate(server, id, ws, message) {
     createdSessionId = sessionId;
 
     const session = server.sessionManager.getSession(sessionId);
-    if (sessionBudgetRoot.enabled) {
+    if (
+      (sessionType || "agent") === "agent" &&
+      (sessionBudgetRoot.enabled ||
+        typeof server.sessionManager.markCanonicalSession === "function")
+    ) {
       bootstrapLease = wsBudgetDependency(
         server,
         "acquireSessionHostLease",
@@ -768,24 +773,33 @@ export async function handleSessionCreate(server, id, ws, message) {
           title: `WS agent ${new Date().toISOString().slice(0, 10)}`,
           provider: session.provider,
           model: session.model || "",
-          sessionBudgetRoot,
+          ...(sessionBudgetRoot.enabled ? { sessionBudgetRoot } : {}),
         });
         canonicalSessionCreated = true;
       } catch (cause) {
         const error = new Error(
-          "Budgeted WebSocket JSONL session could not be durably created",
+          "WebSocket canonical session could not be durably created",
           { cause },
         );
-        error.code = "CC_SESSION_BUDGET_SESSION_START_FAILED";
+        error.code = sessionBudgetRoot.enabled
+          ? "CC_SESSION_BUDGET_SESSION_START_FAILED"
+          : "CC_WS_CANONICAL_SESSION_START_FAILED";
         throw error;
       }
       if (startedSessionId !== sessionId) {
         const error = new Error(
-          "Budgeted WebSocket JSONL session returned a different session id",
+          "WebSocket canonical session returned a different session id",
         );
-        error.code = "CC_SESSION_BUDGET_SESSION_START_FAILED";
+        error.code = sessionBudgetRoot.enabled
+          ? "CC_SESSION_BUDGET_SESSION_START_FAILED"
+          : "CC_WS_CANONICAL_SESSION_START_FAILED";
         throw error;
       }
+      if (typeof server.sessionManager.markCanonicalSession === "function") {
+        server.sessionManager.markCanonicalSession(sessionId);
+      } else {
+        session.canonicalJsonlSession = true;
+      }
       const canonicalStart = wsBudgetDependency(
         server,
         "readSessionHostResumeState",
@@ -793,17 +807,20 @@ export async function handleSessionCreate(server, id, ws, message) {
       )(sessionId);
       if (!canonicalStart?.snapshot?.verified) {
         const error = new Error(
-          "Budgeted WebSocket JSONL session could not be verified",
+          "WebSocket canonical session could not be verified",
         );
-        error.code = "CC_SESSION_BUDGET_SESSION_START_FAILED";
+        error.code = sessionBudgetRoot.enabled
+          ? "CC_SESSION_BUDGET_SESSION_START_FAILED"
+          : "CC_WS_CANONICAL_SESSION_START_FAILED";
         throw error;
       }
       if (
-        !canonicalStart.sessionBudgetRoot ||
-        !sameSessionBudgetConfig(
-          canonicalStart.sessionBudgetRoot,
-          sessionBudgetRoot,
-        )
+        sessionBudgetRoot.enabled &&
+        (!canonicalStart.sessionBudgetRoot ||
+          !sameSessionBudgetConfig(
+            canonicalStart.sessionBudgetRoot,
+            sessionBudgetRoot,
+          ))
       ) {
         const error = new Error(
           "Budgeted WebSocket JSONL declaration does not match the requested root",
@@ -945,7 +962,14 @@ export async function handleSessionResume(server, id, ws, message) {
   }
 
   const { sessionId } = message;
-  const canonicalResume = wsBudgetDependency(
+  // Always consult the canonical transcript before the compatibility store.
+  // A manager without the newer markCanonicalSession() hook may still be
+  // resuming a session that another host already committed to JSONL. Skipping
+  // this read lets stale DB/WS state replace verified history and also bypasses
+  // missing/tampered/rollback refusal. readSessionHostResumeState() returns
+  // null for a genuinely absent transcript, so legacy-only sessions retain
+  // their compatibility fallback without weakening canonical authority.
+  let canonicalResume = wsBudgetDependency(
     server,
     "readSessionHostResumeState",
     readSessionHostResumeState,
@@ -963,7 +987,20 @@ export async function handleSessionResume(server, id, ws, message) {
     );
     return;
   }
-  const session = server.sessionManager.resumeSession(sessionId);
+  let session = server.sessionManager.resumeSession(sessionId);
+  if (
+    !session &&
+    canonicalResume?.snapshot?.verified === true &&
+    typeof server.sessionManager.resumeCanonicalSession === "function"
+  ) {
+    try {
+      session = server.sessionManager.resumeCanonicalSession(sessionId, {
+        type: "agent",
+      });
+    } catch {
+      session = null;
+    }
+  }
 
   if (!session) {
     server._send(
@@ -978,6 +1015,77 @@ export async function handleSessionResume(server, id, ws, message) {
     return;
   }
 
+  if (
+    canonicalResume?.snapshot?.verified === true &&
+    session.canonicalJsonlSession !== true &&
+    typeof server.sessionManager.markCanonicalSession === "function"
+  ) {
+    try {
+      server.sessionManager.markCanonicalSession(session.id);
+      canonicalResume = wsBudgetDependency(
+        server,
+        "readSessionHostResumeState",
+        readSessionHostResumeState,
+      )(session.id);
+    } catch (error) {
+      server._send(
+        ws,
+        envelopeError(
+          id,
+          error?.code || "CC_WS_CANONICAL_SESSION_BIND_FAILED",
+          error?.message || "WebSocket canonical session binding failed",
+          sessionId,
+        ),
+      );
+      return;
+    }
+  }
+
+  if (
+    !canonicalResume &&
+    session.type === "agent" &&
+    typeof server.sessionManager.markCanonicalSession === "function"
+  ) {
+    try {
+      ensureCanonicalSessionTranscript({
+        sessionId: session.id,
+        title: `WS agent ${new Date().toISOString().slice(0, 10)}`,
+        provider: session.provider,
+        model: session.model || "",
+        messages: session.messages,
+        source: "sqlite:llm_sessions",
+        stripLeadingSystem: true,
+      });
+      if (typeof server.sessionManager.markCanonicalSession === "function") {
+        server.sessionManager.markCanonicalSession(session.id);
+      } else {
+        session.canonicalJsonlSession = true;
+      }
+      canonicalResume = wsBudgetDependency(
+        server,
+        "readSessionHostResumeState",
+        readSessionHostResumeState,
+      )(session.id);
+      if (!canonicalResume?.snapshot?.verified) {
+        throw Object.assign(
+          new Error("Migrated WebSocket session could not be verified"),
+          { code: "CC_WS_CANONICAL_SESSION_MIGRATION_FAILED" },
+        );
+      }
+    } catch (error) {
+      server._send(
+        ws,
+        envelopeError(
+          id,
+          error?.code || "CC_WS_CANONICAL_SESSION_MIGRATION_FAILED",
+          error?.message || "WebSocket session migration failed",
+          sessionId,
+        ),
+      );
+      return;
+    }
+  }
+
   let sessionBudgetRoot;
   let canonicalSessionBudgetRoot = null;
   try {

package/src/gateways/ws/ws-agent-handler.js

@@ -42,6 +42,12 @@ import { createWsApprovalGate } from "./ws-approval-gate.js";
 import { createSessionMcpLedgerSink } from "../../lib/mcp-call-ledger-store.js";
 import { createMcpHostRecoveryRuntime } from "../../lib/mcp-host-recovery-runtime.js";
 import { compactConversationWithProvider } from "../../harness/provider-backed-compaction.js";
+import {
+  estimateMessagesTokens,
+  PromptCompressor,
+} from "../../harness/prompt-compressor.js";
+import { resolveCliContextMemoryCutover } from "../../lib/context-memory-kernel/authority.js";
+import { compactLiveMessagesCanonical } from "../../lib/context-memory-kernel/live-compaction.js";
 import { projectCanonicalResumeMessages } from "../../lib/session-message-provenance.js";
 import { feature } from "../../lib/feature-flags.js";
 import { classifyStreamRetryReason } from "../../lib/stream-retry.js";
@@ -586,6 +592,124 @@ export class WSAgentHandler {
     return block;
   }
 
+  _contextMemoryCutover() {
+    return resolveCliContextMemoryCutover({
+      env: this.session.contextMemoryEnv || process.env,
+      scopeKey: `cli:session:${this.session.id}`,
+    });
+  }
+
+  async _compactContextMemory(messages, providerOptions, trigger) {
+    const cutover = this._contextMemoryCutover();
+    if (!cutover.canonical) {
+      return compactConversationWithProvider(messages, providerOptions);
+    }
+    const probe = new PromptCompressor({
+      model: providerOptions.model,
+      provider: providerOptions.provider,
+      ...(providerOptions.maxMessages
+        ? { maxMessages: providerOptions.maxMessages }
+        : {}),
+      ...(providerOptions.maxTokens
+        ? { maxTokens: providerOptions.maxTokens }
+        : {}),
+    });
+    if (
+      providerOptions.onlyIfNeeded === true &&
+      !probe.shouldAutoCompact(messages)
+    ) {
+      const tokens = estimateMessagesTokens(messages);
+      return {
+        messages: [...messages],
+        stats: {
+          strategy: "none",
+          originalMessages: messages.length,
+          compressedMessages: messages.length,
+          originalTokens: tokens,
+          compressedTokens: tokens,
+          saved: 0,
+        },
+        degradedEvent: null,
+        usageEvent: null,
+        usageUnknownEvent: null,
+      };
+    }
+
+    let compatibilityResult = null;
+    const canonical = await compactLiveMessagesCanonical(messages, {
+      compressor: {
+        maxTokens: probe.maxTokens,
+        compress: async (dropped) => {
+          compatibilityResult = await compactConversationWithProvider(
+            dropped,
+            providerOptions,
+          );
+          await providerOptions.onContextMemorySummarySettled?.(
+            compatibilityResult,
+          );
+          return compatibilityResult;
+        },
+      },
+      sessionId: this.session.id,
+      operationId: `${trigger}-${randomUUID()}`,
+      provider: this.session.provider,
+      model: this.session.model,
+      env: this.session.contextMemoryEnv || process.env,
+      persist: this.session.canonicalJsonlSession === true,
+      trigger,
+      ...(this.session.canonicalJsonlSession === true
+        ? {
+            commit: (stats, output, settlement) => {
+              this._sessionHostLease?.assert?.();
+              const result =
+                this._canonicalSessionStore.appendCompactEventIfMessagesMatch(
+                  this.session.id,
+                  {
+                    ...stats,
+                    trigger,
+                    messages: projectCanonicalResumeMessages(output, {
+                      strict: true,
+                    }),
+                  },
+                  settlement.expectedMessages,
+                );
+              if (result && typeof result.then === "function") {
+                void Promise.resolve(result).catch(() => {});
+                const error = new TypeError(
+                  "Canonical compact settlement must be synchronous",
+                );
+                error.code = "CC_COMPACTION_SETTLEMENT_ASYNC";
+                throw error;
+              }
+              return result;
+            },
+          }
+        : {}),
+    });
+    if (canonical.receipt.status === "stale") {
+      const error = new Error(
+        "session messages changed during canonical compaction",
+      );
+      error.code = "SESSION_REVISION_STALE";
+      throw error;
+    }
+    if (
+      canonical.receipt.status === "reconciliation_required" &&
+      !compatibilityResult?.usageUnknownEvent
+    ) {
+      const error = new Error("canonical compaction requires reconciliation");
+      error.code = "CC_COMPACTION_RECONCILIATION_REQUIRED";
+      throw error;
+    }
+    return {
+      messages: canonical.messages,
+      stats: canonical.stats,
+      degradedEvent: compatibilityResult?.degradedEvent || null,
+      usageEvent: compatibilityResult?.usageEvent || null,
+      usageUnknownEvent: compatibilityResult?.usageUnknownEvent || null,
+    };
+  }
+
   _canonicalTurnFromAuthority(state, requestId, userMessage, inputDigest) {
     const status = state?.status || (state?.turn ? "completed" : "none");
     this._applyCanonicalMessages(state?.messages || []);
@@ -630,7 +754,8 @@ export class WSAgentHandler {
     const { session } = this;
     if (
       session.autoCompact === false ||
-      !feature("PROMPT_COMPRESSOR") ||
+      (!feature("PROMPT_COMPRESSOR") &&
+        !this._contextMemoryCutover().canonical) ||
       this._compactionSettlementBlock?.commitState === "provider-usage-unknown"
     ) {
       return true;
@@ -647,7 +772,7 @@ export class WSAgentHandler {
     let result;
     try {
       this._sessionHostLease?.assert?.();
-      result = await compactConversationWithProvider(session.messages, {
+      result = await this._compactContextMemory(session.messages, {
         provider: session.provider,
         model: session.model,
         baseUrl: session.baseUrl,
@@ -675,8 +800,17 @@ export class WSAgentHandler {
         maxTokens: session.compactionMaxTokens,
         maxOutputTokens: session.compactionMaxOutputTokens,
         summaryInputMaxChars: session.compactionInputMaxChars,
-      });
-      if (compactionUsageCall) {
+        onContextMemorySummarySettled: (summaryResult) => {
+          if (compactionUsageCall && !compactionUsageSettled) {
+            this._settleCanonicalCompactionUsage(
+              compactionUsageCall,
+              summaryResult,
+            );
+            compactionUsageSettled = true;
+          }
+        },
+      }, "auto");
+      if (compactionUsageCall && !compactionUsageSettled) {
         this._settleCanonicalCompactionUsage(compactionUsageCall, result);
         compactionUsageSettled = true;
       }
@@ -747,7 +881,11 @@ export class WSAgentHandler {
       );
     const shouldSettle = stats?.strategy !== "none" && stats?.saved > 0;
     let settlementError = null;
-    if (!messagesChanged && shouldSettle) {
+    if (
+      !messagesChanged &&
+      shouldSettle &&
+      stats?.canonicalAlreadySettled !== true
+    ) {
       try {
         const settlement =
           this._canonicalSessionStore.appendCompactEventIfMessagesMatch(
@@ -1977,7 +2115,7 @@ export class WSAgentHandler {
         try {
           this.assertSessionBudgetAdmission("WebSocket compaction");
           this._sessionHostLease?.assert?.();
-          result = await compactConversationWithProvider(session.messages, {
+          result = await this._compactContextMemory(session.messages, {
             provider: session.provider,
             model: session.model,
             baseUrl: session.baseUrl,
@@ -2002,8 +2140,17 @@ export class WSAgentHandler {
               : {}),
             maxOutputTokens: session.compactionMaxOutputTokens,
             summaryInputMaxChars: session.compactionInputMaxChars,
-          });
-          if (compactionUsageCall) {
+            onContextMemorySummarySettled: (summaryResult) => {
+              if (compactionUsageCall && !compactionUsageSettled) {
+                this._settleCanonicalCompactionUsage(
+                  compactionUsageCall,
+                  summaryResult,
+                );
+                compactionUsageSettled = true;
+              }
+            },
+          }, "manual");
+          if (compactionUsageCall && !compactionUsageSettled) {
             this._settleCanonicalCompactionUsage(compactionUsageCall, result);
             compactionUsageSettled = true;
           }
@@ -2068,7 +2215,8 @@ export class WSAgentHandler {
           if (
             !commandError &&
             !messagesChanged &&
-            session.canonicalJsonlSession === true
+            session.canonicalJsonlSession === true &&
+            stats?.canonicalAlreadySettled !== true
           ) {
             if (stats?.strategy !== "none") {
               try {