[G01g] Wire paired terminal execution through a bounded broker handoff

[jjangg96]

Goal

Connect the reviewed paired terminal path to one same-process experimental executable and a narrowly bound broker handoff, with offline evidence that authority, credential separation and fail-stop recovery boundaries are preserved.

Scope and dependencies

Bounded G01 continuation of #1, after #54 (merged PR #55, main d62242b). This is an offline-tested experimental integration, not a production daemon, live-run authorization, or closure of G01/G02. Reuse the existing active parent Goal; no new parallel native Goal. User-authorized Luna/max implementation and independent review. Ready for offline implementation; live credentials/environment permissions block execution, not fixture-based development.

Contract

• Extend existing tagged cmd/g01-live with a mutually exclusive paired-terminal mode and explicit worker approval/state inputs. Reject incompatible/unused phase or worker flags before credentials/effects.
• Reuse the reviewed private terminal sequence and canonical controller-derived PairInput/PairBinding. Do not accept a caller-provided pairing manifest, fork worker subprocess, or add production APIs. A narrow adapter may expose fixed completion/error only as part of this complete executable slice.
• Strictly validate both approvals, current immutable build, shared identity, workflow and controller binding, expiries, exact required original controller/worker phase authority and distinct private state roots. Hold controller lease before worker lease; release worker before controller. Preserve the original session until terminal finalization.
• Broker adds a dedicated paired-terminal mode with fixed verified g01-live arguments, not arbitrary commands. Preserve module boundaries; bind bounded private worker approval bytes/hash and state identity before authenticated work and child launch. Do not introduce a second competing pairing authority or silently broaden existing approval. Bind admission/attempt state so replaced worker approval/state or a consumed attempt cannot mint/launch again.
• Keep PEM in broker, controller credentials only in bounded child stdin, JIT only in transient in-process controller-to-worker transfer. No worker JIT stdin/subprocess, inherited management environment, dynamic secret-bearing errors, raw SDK output or published private paths.
• Reuse immutable binary verification, controller approval snapshot, journal preparation/claim bridge, minimal installation/verification authority, exact workflow identity/head/path/event/attempt verification and one-shot token mint. A paired mode must not borrow cleanup authority for broader effects without an explicit reviewed approval contract.
• Normal terminal success requires exact original session acknowledgement, non-force owned worker deletion plus separate absence, and exact owned set deletion/postchecks. Cancellation, crash, storage uncertainty or lost response stops with retained journals/claims/resources and fixed nonzero output. No retry, resume, claim reset, replacement session or automated reconciliation.

TDD and acceptance

• Preserve meaningful behavioral red: current CLI refuses the valid future paired invocation; corrected mode consumes controller input once only after gates. Missing-symbol compilation is not sufficient red.
• Actual private TLS/Unix fixtures through the exported adapter prove one acquire/JIT/create/start, original session close, non-force worker delete + absence, owned set delete + absence, complete rosters and no secrets in journals/output.
• Invalid shared identity/build/expiry/phases/state/symlinks, wrong/changed approval hash or state inode, cancellation and claims reject before subsequent credential/API/Docker effects.
• Broker fixtures verify exact fixed argv/minimal environment, one controller-only credential payload, workflow verification before launch, one mint/handoff, bounded child output/timeout and no second attempt.
• Original session/lease lifetime, unknown outcome and reopened-history no-effect behavior remain intact; no fake supported crash recovery or migration.
• Existing controller-only and separate worker modes retain refusal/plan behavior. Existing exact Go/SDK pins, exhaustive fixture partitions, tagged CLI checks, race/vet and full offline checks remain enforced.
• Record exact red/green commands/results, security limits, remaining live gaps and ownership-preserving rollback in one focused PR; independent Luna/max contract and security reviews plus clean Codex verdict and CI on current head precede conditional SHA-matched merge.

Ownership / exclusions

One dedicated branch/worktree and integrator owns cross-module interfaces. G01 files: livecanary paired adapter and cmd/g01-live plus fixtures. G02 files: broker mode/files/entry/process/admission and cmd/g01-broker plus fixtures. No cmd/gh-runnerd production daemon, no separate worker-process pairing, no changes to PR #59 readiness document unless separately coordinated.

No live GitHub/App/key/runner/group/workflow, Docker/Lima configuration, Keychain/launchd or reboot operations are authorized. The selected Mac, prepared private repository and manual App installation are preparation only. Future live execution requires exact immutable artifact/resource authority and scoped controller/job isolation; recovery after uncertain acquisition/JIT/session remains a separate evidence gate.