Master landed the tool-subagent depth budget while this branch was in
flight: the numeric default maxDepth now fails the mount against the
ACP provider's depthLimit: false, so the composition fixture must state
maxDepth: 'provider-managed' — the documented opt-out for a provider
whose recursion budget lives in the child harness. The fixture also
moves off the retired stdio-demo REPL onto the current app-boot driver
pattern (runLoaderSmoke + one-shot cli), and the split isDirectory
statements gain the file-not-a-directory case the single-expression
form used to cover implicitly.
The inheritance branch ran only under hand-mounted plugin tests, and
the with-key e2e always configures an explicit cwd. Add a test-only
cordis.yml (scripted delegating model + the scripted mock ACP child)
booting the stdio app through the real Loader with cwd omitted: the
child proves it ran in — and was announced — the parent session's
workspace, keylessly.
SubagentStartRequest.parent, its core-data type-equiv mirror, and the
ACP backend Agent Note still said the out-of-process backend ignores
request.parent — no longer true: with cwd unconfigured it reads exactly
the session header's cwd, and a parent session without one now rejects
at start. State the one-field read at each owning contract, record the
workspace-resolution decision in the Agent Note, and align the README's
accessibility wording with the search-permission guard.
statSync().isDirectory() is true for a mode-600 directory, but a
subprocess cwd needs X_OK — spawn would fail EACCES, deferring a
self-contained configuration error past the load/start boundary the
resolution owns. Probe accessSync(X_OK) alongside the type check so
"not an accessible directory" is literally what the guard verifies.
An omitted maxDepth meant unbounded recursion, and the shipped examples
shipped that default. maxDepth now defaults to 1; a numeric cap requires
the provider's depthLimit capability (the mount fails loud and points to
the explicit 'provider-managed' opt-out for out-of-process providers),
and a child AT the cap loses the delegating tool from its own schema via
the child toolFilter — prompt-face hiding on top of the execution-face
depth check. Examples pin maxDepth explicitly. The ACP snapshot harness
gains Scenario.childToolOmissions so a child session may legitimately
omit declared delegation tools from its pinned header and prompt;
affected subagent/workflow goldens are re-recorded.
A subagent child's recursion depth lived only in runtime AgentOptions,
so a persisted child came back from resume counted as top-level and
maxDepth stopped binding after every restart. Add
SessionHeader.delegationDepth, round-trip it through the JSONL and
SQLite backends (SQLite schema v5), restore it on agent-loop resume,
and write it when the in-process backends create a child. The seam now
owns the shared depth vocabulary (delegationDepthOf): the persisted
header is authoritative and monotone — runtime options may deepen it
but never lower it.
path.resolve('') is the process cwd, so an empty configured cwd would
silently reintroduce the launch-directory fallback the parent-session
cwd resolution removed. Fail at plugin load with an actionable message
instead.
The ACP backend resolved an unset cwd to the harness process's launch
directory, so a delegated child ran — and announced its ACP session —
in the server's cwd instead of the delegating session's workspace.
Resolve the working directory explicitly: the config cwd override
(made absolute and validated at load), else the parent session
header's cwd (validated at start), failing loud before spawning when
neither exists.
Exercise both exitCode and signalCode arriving after the SIGTERM grace begins but before the bounded SIGKILL confirmation helper starts. This pins the fast path that avoids signaling an already-terminated child and restores the package's per-file 100% branch and statement coverage.
Keep the marker transition deterministic by withholding the synthetic exit event, matching the OS state race the defensive pre-check exists to absorb.
Pass an explicit Linux platform to the two remaining SIGTERM-specific ladder tests instead of inheriting the host platform.
This keeps their synchronous-exit assertions focused on the POSIX middle and final rungs while the dedicated Windows case continues to verify the direct SIGKILL path.
Without the pin, native Windows coverage deterministically expected SIGTERM but observed the intended SIGKILL-only behavior.
Observe signal errors and bound the final forced-exit edge with disposeGraceMs so a refused or ineffective SIGKILL cannot leave disposal pending forever.
Apply the confirmation bound on POSIX and Windows, remove listeners and timers on every outcome, and update the ACP consumer contract plus the generated config catalog.
Cover emitted signal errors, synchronous kill exceptions, refused termination, and accepted termination that never reports exit.
