Attach ACP to a client-native session with executable alignment #561

Story

As an XMD user who created a coding-agent session through a native CLI, I want
later ACP work to attach to that exact provider-owned history, so a document can
continue the conversation without substituting an identity or accepting a
different executable build as the same session.

Context

PR #559 implements the client-native construction route. XMD allocates the
provider-native identity, the native process creates the session under that
identity, and later native launches resume it. ACP intentionally refuses a
client-native route because current XMD does not prove that the ACP child and
the native process operate on the same provider history.

The earlier #519 investigation proved native-to-ACP continuity is possible when
both sides use one explicitly aligned Claude executable. That probe is
feasibility evidence, not a production contract: the minimal implementation
retains no executable path, version, or digest and ships no patched ACPX
runtime.

This follow-up does not block #520's native-only Claude proof and advertisement.

Required architecture

Settle a provider-neutral attachment contract before implementation. It must
define:

• the filtered durable representation of the executable/build identity needed
  to accept one native and ACP history as the same history;
• how the native launcher and ACP child are bound to the same validated build
  without retaining an executable path or mutating global environment;
• how ACP receives the exact retained client-allocated identity, such as
  resumeSessionId, without inferring it from ACP or ACPX identifiers;
• how a client-native construction route authorizes attachment only after all
  identity and build checks pass;
• session-coordinator ownership across native exit, ACP attachment, Prompt,
  cancellation, teardown, replay, and stale handles;
• upgrade and replay behavior for records that predate the binding; and
• fail-closed behavior for missing history, unsupported providers, executable
  drift, identity disagreement, and unavailable adapter support.

The route remains create-once and never converts to acp-first. XMD never
reconstructs or inspects provider-private transcripts, and no path discards
persistent provider state to make attachment succeed.

Acceptance

• A native-created session and later ACP Prompt use the exact same retained
  provider-native identity.
• A marker introduced only in the native conversation is recovered by a
  marker-free ACP turn, proving history rather than UUID equality alone.
• Native and ACP execution use one validated executable/build identity.
• Missing or divergent identity, history, executable, or adapter capability
  refuses before an ACP turn and never creates substitute history.
• ACP and native owners never overlap; the existing coordinator remains the
  single live authority.
• Completed replay performs no live attachment. Incomplete replay resumes only
  the history authorized by its retained route and binding.
• Durable and public records contain filtered identity/build facts and no
  executable path, argv, environment, credential, or transcript content.
• Deterministic tests use controlled ACP and native seams; an opt-in real-Claude
  proof validates history continuity without reading provider-private files.

Dependencies

• Launch a deterministically prepared Agent session in its native UI #517: umbrella session-launch capability
• PR 🚀 Hand a prepared agent session to its native UI #518: provider-neutral launch and ownership foundation
• PR 🔗 Let XMD name a coding-agent session, and hand it to the native process #559: client-native identity, construction route, native creation/resume,
  and fail-closed ACP refusal
• Prove and advertise Claude native session launch in XMD #520: native Claude proof and advertisement; independent and not blocked by
  this issue
• Resuming a native claude --session-id conversation silently completes without its history instead of loading it or failing agentclientprotocol/claude-agent-acp#1019 or another released scoped binding
  interface may simplify implementation, but no specific upstream patch is
  assumed until architecture selects a mechanism

Out of scope

• Native Claude advertisement, owned by Prove and advertise Claude native session launch in XMD #520
• Agent.AddDir / additional directories
• Transcript reconstruction or provider-private file inspection
• A bootstrap model turn
• Converting or deleting construction routes
• Shipping a vendored ACPX patch before the architecture requires one