feat(broker): add durable existing-session delivery

.agentworkforce/trajectories/active/traj_a5b8spueklgc/trajectory.json

@@ -0,0 +1,125 @@
+{
+  "id": "traj_a5b8spueklgc",
+  "version": 1,
+  "task": {
+    "title": "Resolve all active review and CI findings for Relay PR #1851",
+    "source": {
+      "system": "plain",
+      "id": "AgentWorkforce/relay#1851"
+    }
+  },
+  "status": "active",
+  "startedAt": "2026-09-25T01:22:49.708Z",
+  "agents": [
+    {
+      "name": "default",
+      "role": "lead",
+      "joinedAt": "2026-09-25T02:50:08.242Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_b91llr1ynosb",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-09-25T02:50:08.242Z",
+      "events": [
+        {
+          "ts": 1790304608243,
+          "type": "decision",
+          "content": "Use one atomically published receipt file per delivery ID: Use one atomically published receipt file per delivery ID",
+          "raw": {
+            "question": "Use one atomically published receipt file per delivery ID",
+            "chosen": "Use one atomically published receipt file per delivery ID",
+            "alternatives": [],
+            "reasoning": "Removes the fixed-capacity outage and whole-ledger rewrites while preserving indefinite idempotency without unsafe pruning"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1790304615110,
+          "type": "decision",
+          "content": "Persist deferred native messages with explicit queued, in-doubt, and accepted states: Persist deferred native messages with explicit queued, in-doubt, and accepted states",
+          "raw": {
+            "question": "Persist deferred native messages with explicit queued, in-doubt, and accepted states",
+            "chosen": "Persist deferred native messages with explicit queued, in-doubt, and accepted states",
+            "alternatives": [],
+            "reasoning": "Restarts can recover queued messages, never replay an ambiguous injection, and safely discard a message already accepted before queue cleanup"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1790307646867,
+          "type": "decision",
+          "content": "Classify a dropped runtime reply by consulting the durable receipt outside the Tokio event loop: Classify a dropped runtime reply by consulting the durable receipt outside the Tokio event loop",
+          "raw": {
+            "question": "Classify a dropped runtime reply by consulting the durable receipt outside the Tokio event loop",
+            "chosen": "Classify a dropped runtime reply by consulting the durable receipt outside the Tokio event loop",
+            "alternatives": [
+              {
+                "option": "Always claim committed=true",
+                "reason": ""
+              },
+              {
+                "option": "Always claim committed=false",
+                "reason": ""
+              }
+            ],
+            "reasoning": "The oneshot can close both before and after reservation. An exact receipt distinguishes safely retryable uncommitted delivery from queued or in-doubt delivery without weakening fail-closed semantics."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1790307660847,
+          "type": "decision",
+          "content": "Require stable native sidecar session and runtime roots and place launch state under the Agent Relay user data directory: Require stable native sidecar session and runtime roots and place launch state under the Agent Relay user data directory",
+          "raw": {
+            "question": "Require stable native sidecar session and runtime roots and place launch state under the Agent Relay user data directory",
+            "chosen": "Require stable native sidecar session and runtime roots and place launch state under the Agent Relay user data directory",
+            "alternatives": [
+              {
+                "option": "Keep the OS temp default with a suppression",
+                "reason": ""
+              },
+              {
+                "option": "Use a random root that loses restart discovery",
+                "reason": ""
+              }
+            ],
+            "reasoning": "Deferred receipts must survive restart, and a predictable shared OS-temp root permits path attacks. The stable user data root preserves durability while removing the CodeQL temp-path flow."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1790308221641,
+          "type": "decision",
+          "content": "Report post-publish receipt directory sync failures as in-doubt: Report post-publish receipt directory sync failures as in-doubt",
+          "raw": {
+            "question": "Report post-publish receipt directory sync failures as in-doubt",
+            "chosen": "Report post-publish receipt directory sync failures as in-doubt",
+            "alternatives": [
+              {
+                "option": "Return ReceiptUnavailable after publish",
+                "reason": ""
+              },
+              {
+                "option": "Ignore directory fsync failures",
+                "reason": ""
+              }
+            ],
+            "reasoning": "persist_noclobber has already made the reservation visible, so committed=false would invite a retry that can conflict with at-most-once semantics. Strict fsync remains required, but failure is classified conservatively."
+          },
+          "significance": "high"
+        }
+      ]
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "AgentWorkforce/relay",
+  "tags": [],
+  "_trace": {
+    "startRef": "98cfa72090642b975ad2ac7cfe3c6d82b115f4b1",
+    "endRef": "98cfa72090642b975ad2ac7cfe3c6d82b115f4b1"
+  }
+}

CHANGELOG.md

@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - `teams.json` agents accept a per-agent `model` field when `up --spawn` starts them; an explicit `--model` or `-m` inside `cli` still wins.
+- Persistent brokers expose authenticated, versioned native existing-session delivery and reconciliation for Cloud Babysitter. They durably reserve each `deliveryId` before the sole worker write, return stable receipts for exact duplicates, and reject session substitution or unsupported native input without sending.
 
 ### Changed
 

crates/broker/src/lib.rs

@@ -27,6 +27,7 @@ pub(crate) mod events;
 pub(crate) mod listen_api;
 #[allow(dead_code)]
 pub(crate) mod metrics;
+pub(crate) mod native_delivery;
 pub(crate) mod node_control;
 pub(crate) mod node_delivery_probe;
 #[allow(dead_code)]