feat: implement the coding-agent execution gateway

[christso]

Objective

Implement the accepted AllAgents coding-execution gateway so external callers can run Codex or Pi against an immutable repository revision through one authenticated, cancellable, evidence-preserving A2A contract.

Authoritative inputs

• ADR 0002: Serve coding-agent execution through an A2A gateway
• Implementation-ready plan
• AHP decision inputs
• Architecture PR: docs(architecture): simplify coding execution gateway #485

The plan is the implementation authority. Start with its Goal Capsule, then work U1-U8 in dependency order using each unit's cited R/F/AE/KTD entries, test scenarios, Verification Contract, and Definition of Done.

Settled scope

• Public protocol: A2A 1.0 HTTP+JSON with streaming and one required versioned AllAgents coding-execution extension.
• Initial peer backends: Codex and Pi only. OpenCode is deferred.
• Separate gateway and worker processes. The gateway never runs agent processes or mounts writable repositories.
• Private Node 22 execution-service workspace so the existing Node 18 CLI package remains compatible.
• Built-in storage supports one durable gateway replica. Multi-replica database storage is deferred.
• Initial worker policy is one execution at a time for reviewed repositories in one mutual-trust domain. Hostile-source and cross-tenant sandboxing are deferred and must not be claimed.
• Evaluation datasets, assertions, scoring, repetitions, retries, and durable evaluation Runs remain outside AllAgents.

Load-bearing implementation constraints

• Admission, canonical Task reservation, idempotent replay, and cancellation routing sit above the official A2A SDK default request handler.
• The extension uses only standard A2A carriers: Agent Card/header/Message negotiation, request data at Message.metadata[uri], and one fixed integrity Artifact; do not add Task.extensions.
• After authentication and bounded parsing, retained-claim replay resolves before mutable profile, deadline, readiness, and quota checks; those checks apply only to a new atomic claim.
• Invocation claim and submitted Task commit as one aggregate. Terminal Artifact blobs publish before one atomic manifest switch.
• Every worker attempt carries an ID, lease epoch/fence, and monotonic event sequence. Stale or late events cannot overwrite terminal state.
• Public bearer traffic reaches a named trusted TLS boundary. Remote worker routes use mTLS or an equivalent authenticated encrypted overlay; a same-host Unix socket is the local alternative.
• Gateway and worker transition selection is pure; mutating or terminating effects carry the exact attempt/revision fence that authorized them, and I/O executors re-enter from persisted or freshly observed state.
• A minimal monotonic worker command record tombstones cancel-before-dispatch attempts and rejects stale dispatch before workspace creation.
• The effective-profile digest is computed from a versioned pre-resolution intent that can contain policy and environment-variable names, but not resolved secret values, per-attempt identity, or per-run paths.
• Cancellation is linearized, reaches the provider-native abort once, and publishes canceled only after termination and cleanup are verified.
• Git acquisition uses canonical HTTPS URLs, exact commit object IDs, hermetic configuration, no redirects or repository-controlled secondary fetch/exec behavior, and verified provenance.
• Backend configuration/session roots are invocation-local and ambient selectors are removed.
• Descendants must be quiescent before final file/Artifact capture.
• Production worker readiness requires a dedicated supervised container/process boundary, or an equivalent systemd/cgroup mechanism, that proves descendant termination and orphan-root ownership.
• If bounded escalation cannot prove quiescence, the worker stops admission and exits so its external supervisor destroys the boundary; replacement readiness performs orphan recovery.
• Credentialed profiles require an OS-enforced provider/tool credential boundary or equivalent broker. Environment filtering alone is defense in depth, not proof.
• Terminal results require the integrity kernel defined by R17; optional evidence truncation is explicit rather than fabricated.
• Operational telemetry is metadata-only behind one pre-export allowlist and bounded redaction; prompts, outputs, tool/source/file content, raw identities, and secrets never enter processors or exporters.
• The small test-side race checker validates attempt/fence correlation, required ordering, maximum effect counts, and forbidden post-terminal effects; it is not a formal model or second lifecycle implementation.

Current state

• PR docs(architecture): simplify coding execution gateway #485 contains architecture documentation only; no runtime implementation has started.
• The plan received focused architecture, security, flow, and implementation-readiness review. Findings were integrated into requirements, KTDs, diagrams, units, tests, and Definition of Done.
• Plan structural validation covers 22 requirements, 5 flows, 14 acceptance examples, 15 KTDs, 8 implementation units, complete traceability, valid local links, and no stale initial OpenCode scope.
• No implementation tests were run because no runtime code changed.

Delivery expectation

Use proof-first implementation for contract, state, race, and lifecycle units. Keep provider fixture tests deterministic and isolated from real user homes and credentials. Run credentialed backend smoke tests only in disposable repositories and report unavailable prerequisites as skipped rather than passing.