feat(autonomy): duration-ceiling watch leg, digest job, settled HostServicesOnly (P4)

[IanFrelinger]

Summary

Phase 4, the final phase of the post-merge plan: three closures that finish what the honest assessment opened. Stacked on #304.

1. Absolute duration ceiling on the watch window

WatchThresholds.MaxInvocationDuration — an absolute per-invocation wall-clock ceiling, judged like the contract-conformance leg: no baseline, no minimum invocation count. The relative legs (error-rate delta, latency factor) judge against the previous generation's baseline, which means a first-generation deploy escapes them entirely, and a pathological single invocation can hide inside a healthy mean until enough samples accumulate. The absolute leg closes both holes.

Scope honesty, stated in the docs: wall clock is the one per-invocation resource genuinely measurable in a shared host process. Per-brick memory/CPU attribution is not, and a fake ceiling would be worse than none. Configured via Nexo:Autonomy:WatchMaxInvocationSeconds (0 = off, the default — additive, no behavior change unconfigured).

2. The digest becomes a host job

AddNexoAutonomyDigestJob — swap provenance retained in a bounded ring (RecordingBrickSwapProvenanceSink, which still logs every event, so R2.1's no-unlogged-path holds) and rendered as the §7 human digest on cadence (DigestIntervalSeconds, default hourly, 0 disables).

• Order-independent sink takeover: whichever order the host calls AddNexoAutonomy and this, the retaining sink serves — a theory pins both orders, because the failure mode (digest renders an empty history while the loop swaps away) would be silent.
• Saturation honesty: a full ring names how many events fell off rather than presenting a truncated history as complete.
• Single-op controls (pause, rollback, demote) stay on the authority services. A rendering job is not a control surface.

3. HostServicesOnly is settled, not pending

The fail-closed refusal in the Docker backends is now documented as the permanent posture. The one workload that ever seemed to need the mode — package restore during the in-session build — was solved without network in P3 (offline restore from SDK packs, cleared sources). A model server, the other imagined consumer, belongs on the proposer side of the boundary, not inside a certification session. The enum member stays declared for a backend that can genuinely realize per-session egress rules; none is planned. Recorded under "Settled decisions" in the evidence doc.

Testing

• In-container, 32/32 across the four touched suites: GenerationWatchWindowTests (+SlowInvocation_BreachesTheAbsoluteDurationCeiling_WithoutNeedingABaseline), AutonomyDigestJobTests (new: bounded ring, saturation note, both composition orders, interval-0 quiet decline), AutonomyCompositionTests (+2 validator rows), AutonomousIterationHarnessTests (unchanged, regression guard)
• make kernel-coverage-gate — runs in CI (Infrastructure paths touched)

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.