feat(chat-swarm): add transport-neutral Worker Auto Compact planner (#51-B/C source)

[James3014]

Parent / purpose

Child of #51 / #104. This issue owns the transport-neutral Worker Auto Compact source slice only after #120 / PR #122 established deterministic continuation.

Exact source base at creation: main@5256c40f56bbfd5a7eff7737ecf54da4b0359c4d.

Scope

Implement only:

context-pressure observation
-> compactRequired decision
-> safe-boundary / reconciliation gate
-> bounded continuity capsule
-> non-authorizing replacement-carrier intent

This child MUST consume the merged #120 continuation seam and MUST NOT:

• create/open ChatGPT conversations;
• implement browser/CDP/OpenCLI carrier control;
• create a second worker/task/continuation ledger;
• move task authority into browser/session state;
• claim live A->B rollover or P0: implement macOS zero-touch ChatGPT worker runtime pool #117 completion.

#117/#105 remains owner of real replacement-carrier creation/wake/recover. The output of this slice is source material that #117 can consume before requesting a replacement carrier.

Pressure contract

• exact ChatGPT token telemetry is unavailable unless a supported host-native signal explicitly supplies it;
• estimated pressure must remain labeled ESTIMATED with provenance;
• only host-native evidence may be labeled EXACT;
• configured threshold is bounded and explicit; no hidden hard-coded token truth;
• pressure alone never authorizes carrier transfer.

Safe-boundary contract

At/above the configured threshold:

• AVAILABLE + no current task + valid checkpoint + no pending continuation/unknown effect => prepare allowed;
• busy/current task => wait for safe boundary;
• RECONCILE_REQUIRED, unknown effect, or unresolved continuation => reconciliation block;
• missing checkpoint => checkpoint block;
• no state may auto-requeue/retry an uncertain task.

Capsule contract

Capsule must be bounded/versioned/hash-bound and structurally limited to:

• swarm/worker identity;
• source continuation epoch;
• checkpoint hash only (not arbitrary raw checkpoint truth);
• pressure provenance;
• stable role instructions;
• bounded context-only summary;
• task/result/evidence refs;
• blockers;
• explicit claim ceiling.

Do not include full transcript, hidden reasoning, raw tool history/output dumps, credentials/tokens/cookies/session secrets, or stale transport state.

Verification

• focused positive/negative/hostile tests;
• estimated vs exact provenance enforcement;
• busy/reconcile/unknown/pending/missing-checkpoint blocks;
• deterministic capsule hash;
• size/ref bounds;
• existing feat(chat-swarm): deterministic worker continuation epoch transfer (#51-A) #120 continuation regressions remain green;
• macOS typecheck/test/build/Doctor;
• git diff --check through existing CI policy.

Owner review policy

Per Owner instruction in this workstream, no independent reviewer is required for this child. Exact-head controller verification + repository CI is sufficient. Do not mislabel Owner/controller review as independent review.

Claim ceiling

After accepted source merge only:

WORKER_AUTO_COMPACT_PLANNER_SOURCE_ACCEPTED

This does not prove real worker carrier replacement, zero-touch runtime, live Auto Compact, #51 closure, #117 closure, or #104 Ultra parity.

[James3014]

2026-09-13 source acceptance — Worker Auto Compact planner

PR #127 merged normally as main@07f5c30a6ec8fcb9bfb511cb2b76ae089d6f6244 from exact accepted head 82e35e79df70d18028572f7362b33bd1b1bfc99e.

Accepted source contract:

• explicit ESTIMATED vs EXACT pressure provenance; only HOST_NATIVE may claim exact pressure;
• configurable threshold is observable and capsule-hash-bound;
• busy/current-task workers wait for safe boundary;
• unresolved effect, pending continuation and RECONCILE_REQUIRED fail closed;
• missing checkpoint / disabled worker fail closed;
• bounded chat_swarm.worker_auto_compact_capsule.v1 with checkpoint hash rather than raw checkpoint authority;
• deterministic capsule hash and exact consumer verifier;
• version mismatch, extra fields, malformed pressure, timestamp inconsistency and post-hash tampering fail closed;
• context summary is CONTEXT_ONLY;
• replacement-carrier intent is explicitly NON_AUTHORIZING and does not choose or authorize a target carrier;
• no second durable ledger/table/migration or carrier/browser authority was introduced.

Exact-head CI run Waishnav#212 / 34751212454:

• diff-check PASS;
• continuation aggregate-domain macOS PASS (includes the new Auto Compact hostile suite);
• all existing continuation focused macOS jobs PASS;
• Local Agent Sessions macOS PASS;
• macOS Smoke Typecheck/Test/Build/Doctor PASS;
• Ubuntu Smoke PASS;
• Windows retained the known pre-existing Test baseline and is outside the macOS-only delivery gate.

Owner previously waived independent-reviewer requirements for this workstream; no independent-review claim is made.

Accepted claim: WORKER_AUTO_COMPACT_PLANNER_SOURCE_ACCEPTED.

This is source-only. It does not prove live Auto Compact, real ChatGPT A->B carrier replacement, zero-touch carrier creation, #51 completion, #117 completion, or #104 parity.