feat(autonomy): host composition + honest session-scope docs (P0+P1)

[IanFrelinger]

Summary

Phases 0 and 1 of the post-merge plan: make the certificate's session semantics honest, then give hosts a way to compose the autonomy loop. No Docker is touched by this PR — the first flight is deliberately the next, separate step.

Phase 0 — what a session actually proves

AutonomousIterationHarness and SessionEnvironmentInputs now state it plainly: when a SandboxSpec is supplied the session is started, attested (image digest, engine version, effective caps — refused if weaker than requested), recorded onto the certificate, and torn down with the iteration — but the harness never calls ISandboxedSession.ExecAsync, so the candidate's compile, witness, and mutation runs happen in the harness process.

Those inputs are therefore provisioning evidence, not a containment guarantee. The write surface is confined separately and genuinely by ProposerConfinement. docs/certification-evidence.md records this under known v0 limitations, alongside a second honest entry: the loop has never run against a live container engine or a real proposer.

Phase 1 — AddNexoAutonomy

Registers the swap host with its quarantine/watch/cadence surfaces, the iteration harness, ClusterBudget, the Docker session runner and reaper, and provenance sinks for both swap and session events (R2.1 — no unlogged path from objective to runtime). TryAdd throughout, so a host substitutes any piece by registering it first.

Options bind from Nexo:Autonomy, default Enabled=false, and ValidateOnStart refuses an enabled-but-incoherent configuration: sessions without an image cannot be attested, and a retention window below 1 leaves no rollback target — which would violate I-3 outright.

Deliberately no air-gapped refusal, unlike the MCP/A2A protocol surfaces. R6.3 requires autonomy controls to work fully offline, so an air-gapped host running a local model is legitimate and refusing it would enforce the reverse of the invariant. A test pins that reasoning.

The reaper is a separate opt-in (AddNexoAutonomySessionReaper) so a one-shot CLI process isn't forced to run a background sweeper.

A latent defect this surfaced

The DI test walks every edge rather than resolving the harness alone — this codebase has already produced a factory-laundered cycle that passed ValidateOnBuild and then recursed at resolution time. Doing that immediately exposed a pre-existing problem: AddCertificationInfrastructure alone registers ICompositionCertificationGate without the IBrickRegistry it requires, so it cannot satisfy ValidateOnBuild. These tests compose via AddCertificationGate (what real hosts call); the underlying fix is tracked separately rather than changed inside an autonomy PR.

Testing

10 composition facts: full-graph resolution with ValidateOnBuild/ValidateScopes, shared-singleton authority surfaces, quarantine visibility across paths, fail-closed defaults, the misconfiguration matrix, the air-gapped pin, host substitution, and configuration binding. All green.

Verified in a container, and worth recording why. On the Windows host, the CLI end-to-end suites (FullPipelineE2ETests) failed on this branch and passed on master — which looks exactly like a regression. It isn't one. Windows Smart App Control blocks freshly built unsigned assemblies (0x800711C7 loading Nexo.Core.Domain.dll), and those tests spawn the CLI, so the child process dies on load and the test reports only "exit 1, expected 0". master passed solely because its binaries were already built and allow-listed; any clean rebuild reproduces the failure on either branch.

Re-run through scripts/test-in-container.ps1, where Smart App Control does not apply: 12/12 pass — the 10 composition facts plus both E2E tests. No regression. The kernel-coverage floor is still CI's call, since Phase 1 added code to the assembly floored at 80%.

• make kernel-coverage-gate — runs in CI (Infrastructure paths touched)
• make test-prod-style — n/a (no hosting/API/routing changes)

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.