fix(protocol): validate schema at daemon execution

[galligan]

Context

Client-side schema preflight can become stale when a daemon is replaced before an operation arrives. The receiving daemon must validate the caller's schema fingerprint at the execution boundary so newer input cannot be silently discarded.

What changed

• Adds the protocol v2 reserved execution envelope and per-operation schema-fingerprint validation.
• Makes CLI and MCP compatibility failures actionable through typed daemon_stale errors with exit code 8.
• Retains raw execution for proven legacy inspection and drain operations only after metadata validation on the established socket.
• Requires checked execution for schema-sensitive operations and refuses raw resend after socket loss.
• Keeps older raw clients usable against upgraded daemons while reserving the new guarantee for upgraded clients.

Verification

• Focused daemon, surface, and contract tests passed: 158 tests.
• just check passed Ruff, formatting, strict mypy, 1,345 tests with 17 live tests deselected, wheel and sdist builds, and package-content validation at the current stack tip.
• Real socket regressions cover legacy admission, replacement receivers, receiving-schema mismatch, and connection loss.
• Independent local review scored 5/5 with zero P0–P2 findings.
• Final exact-head composed-stack review at 7e5d6ba is clean at 5/5 with zero P0–P3 findings; adversarial supervisor coverage exercised all 27 immediate and 12 delayed recovery/closure outcome combinations.
• Hosted current-head check and Bootstrap smoke (macOS) are successful.

Risks and boundaries

This changes the local control protocol and its projections. It does not migrate the registry, launch Hermes, perform a live provider scenario, or publish a release. The stack remains ready for review and unmerged.

Closes: DIS-70

[linear-code]

DIS-70

[galligan]

• feat(hermes): add operator diagnostics and package proof #122
• fix(hermes): quarantine replaced session generations #121
• feat(hermes): add correlated local adapter #120
• feat(daemon): isolate provider startup recovery #119
• feat(providers): persist correlated receipt observations #118
• feat(delivery): freeze provider requests before submission #117
• docs(hermes): define native turn correlation contract #116
• feat(providers): guard binding-qualified routing #115
• docs(hermes): define native transport contract #114
• feat(registry): scope identity by provider binding #113
• fix(protocol): validate schema at daemon execution #112 👈 (View in Graphite)
• docs(providers): define shared provider identity contract #111
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Medium Risk
Changes the local control-socket contract and all CLI/MCP daemon paths; mis-handled compatibility could block ops or leave skewed execution, though behavior is fail-closed with broad test coverage.

Overview
Closes the daemon-replacement race where client-side metadata preflight on one connection could not guarantee the receiving daemon matched the caller’s op contract. Control protocol version 2 adds reserved __dispatch/execute, carrying op, params, and op_schema_hash; the daemon validates the fingerprint before invoking the handler and returns typed daemon_stale (exit 8, RPC 1012) on mismatch or unknown checked op.

CLI and MCP now run __dispatch/metadata and execution on the same Unix socket via shared control_op_compatibility policy: v2 daemons use checked execution for schema-sensitive ops; proven legacy read/drain ops may still use raw methods only after admission on that socket. Provider-bearing ops do not fall back to unchecked raw calls after rejection or connection loss.

Older daemons keep accepting raw ops; upgraded clients gain the execution-bound guarantee. ADR-0008, operator docs, and RETRO verification notes are updated; socket-level tests cover legacy admission, replacement receivers, hash mismatch, and dropped connections.

^{Reviewed by Cursor Bugbot for commit dcbbb67. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d66e150c-8d6a-4937-bd22-fb180612feab)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T20:54:06.139600Z	d5c7004	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ec71a2dc88

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_87a530d9-4e9e-43a5-b276-69f5be6ee027)

[galligan]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 56ca4900a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[galligan]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: d5c7004915

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[galligan]

Merge activity

• Sep 13, 11:23 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Sep 13, 11:25 PM UTC: Graphite rebased this pull request as part of a merge.
• Sep 13, 11:26 PM UTC: @galligan merged this pull request with Graphite.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_e3c45a48-8886-40d9-a2f4-a80c97a54a1d)