feat(chat-swarm): add worker Auto Compact planner (#126)

[James3014]

Refs #126 / #51 / #104.

Disposition

WORKER_AUTO_COMPACT_PLANNER_SOURCE_CANDIDATE_READY

Exact subject:

• base: main@5256c40f56bbfd5a7eff7737ecf54da4b0359c4d
• head: 82e35e79df70d18028572f7362b33bd1b1bfc99e
• changed files: exactly 3 (chat-swarm-auto-compact.ts, its hostile test, and existing continuation aggregate-test wiring)

Scope

Transport-neutral Worker Auto Compact source only. Extends the merged #120 continuation seam without adding browser/carrier creation, MCP runtime tools, or a second durable ledger.

Flow implemented:

pressure signal + provenance
-> compactRequired decision
-> safe-boundary/reconciliation/checkpoint gate
-> bounded versioned/hash-bound capsule
-> NON_AUTHORIZING replacement-carrier intent

Implemented safety / correctness

• pressure precision is explicit ESTIMATED | EXACT;
• EXACT is accepted only from HOST_NATIVE; unknown precision/source fails closed;
• configured prepareAtRatio is explicit and hash-bound into the capsule;
• below threshold -> NOT_REQUIRED;
• busy/current task -> WAIT_SAFE_BOUNDARY;
• unknown effect / pending continuation / RECONCILE_REQUIRED -> BLOCKED_RECONCILIATION;
• missing checkpoint -> BLOCKED_CHECKPOINT;
• disabled worker -> BLOCKED_DISABLED;
• only a safe idle worker with checkpoint produces PREPARE_REQUIRED;
• capsule stores checkpoint hash, not raw checkpoint state;
• capsule is bounded, versioned and deterministically hash-bound;
• capsule createdAt cannot precede pressure observation;
• structural schema excludes transcript/reasoning/raw-tool/credential/session fields;
• consumer verifier rejects unsupported schema, extra fields, malformed pressure, bounds violations, bad hashes, post-hash material tampering and timestamp inconsistency;
• context summary is explicitly CONTEXT_ONLY, never canonical task authority;
• replacement intent is NON_AUTHORIZING, carries no target carrier identity, and cannot transfer worker/task authority;
• no SQLite migration/table/second ledger was introduced.

#117/#105 remains owner of real carrier creation/recovery. Actual epoch transfer remains the merged #120 continuation seam.

Exact-head verification

GitHub CI run Waishnav#212 / 34751212454 on head 82e35e79...:

• Diff check (PR): PASS;
• Chat Swarm continuation aggregate-domain (macOS), which executes the new Auto Compact hostile suite: PASS;
• continuation coordinator / durable-store / corruption-fence / restart-fence / retired-carrier / terminal-replay macOS jobs: PASS;
• Local agent sessions (macOS): PASS;
• Smoke (macos-latest): Typecheck PASS, Test PASS, Build PASS, Doctor PASS;
• Smoke (ubuntu-latest): Typecheck PASS, Test PASS, Build PASS, Doctor PASS;
• Smoke (windows-latest): Typecheck PASS, Test FAIL on the repository's pre-existing Windows carrier-binding baseline; Windows is outside this macOS-only acceptance scope and no baseline is relabeled as PASS.

Owner review policy

Owner explicitly waived independent reviewer requirements for this workstream. Exact-head controller review + repository CI is the acceptance gate. This is not represented as independent review.

Claim ceiling after accepted merge

WORKER_AUTO_COMPACT_PLANNER_SOURCE_ACCEPTED

This does NOT prove live Worker Auto Compact, real A->B ChatGPT carrier rollover, zero-touch carrier creation, #51 closure, #117 closure, or #104 Ultra parity.