Add a Prime Agent capability package for cost-routed delegation

[leonardsellem]

What this adds

A second, independent install target alongside the existing Codex plugin:

package.json                    Prime Agent capability-package manifest
skills/sol-orchestration/       workflow contract + Python-backed kernel callables
scripts/                        package verifier + operator-approved live-smoke setup
README.md                       install, compatibility, removal, and safety documentation

This candidate is a dedicated branch from DannyMac180/sol-advisor:main (154fd7ac282088f58246e192347960ba0bfc945f). Its exact head is cf1767c3c973bf2900fcf8e6898ded4828a0eb2f. package.json points to DannyMac180/sol-advisor, and the diff for inherited plugins/ and .agents/ is empty. The Prime Agent and Codex contracts do not import, install, or modify one another.

Why put it here

Sol Advisor is a harness discipline: the primary session decomposes, specifies, verifies, and owns acceptance while bounded workers implement. Prime Agent's RLM and persistent IPython kernel make it possible to test the same discipline with different economics:

• the orchestrator does not read project files;
• implementation routes to exact models from an operator-owned allowlist;
• deterministic diff, ownership, tamper, and verification checks run as Python in the kernel;
• a separate review child reads changed files;
• every package-managed delegation writes a versioned episode so model choice can later be evaluated from evidence instead of intuition.

The package ships no default model or provider. It imports Prime Agent's bundled rlm runtime lazily and declares no runtime dependency, so every module still imports and tests outside a Prime Agent kernel.

The episode corpus

Each delegation opens a record before spawn and closes it with exactly one boundary outcome: ship, fix-first, rethink, or abandon. Records preserve the exact selector, effort at spawn, child-clamped effort, surviving allowlist size, per-round verification outcomes, correction count, child usage when readable, and named degradations.

That ordering is deliberate: opening only after spawn would lose the crashes and refusals that are most useful for routing policy. Corrections remain linked. When a child cannot be corrected in place, the lifecycle starts a new delegation on the same selector and records restart-only-corrections rather than silently changing model or losing lineage.

Policy fitting is not part of this PR; this PR builds the instrument that accrues the data.

Safety boundary

Prime Agent is not a sandbox, and this package does not claim otherwise. Children run with the operator's permissions; ownership is an attribution and detection device, not enforcement.

The package therefore:

• snapshots before spawn and detects both working-tree and committed changes;
• checks Prime Agent config, episode-store size, git hooks, and HEAD movement outside ordinary git status;
• runs the tamper gate before verification, so child-controlled conftest.py, package scripts, hooks, or command-loaded files are not executed beside credentials;
• derives verdict fields only from kernel-computed evidence and fences model-authored text as untrusted;
• redacts environment values and secret-shaped output before persistence;
• bounds collection and packet size while preserving the tail of failing verification output.

Detected violations are reported, never automatically reverted.

Trace-driven corrections included in this head

The latest real skill run exposed a gap fixtures had not caught:

1. run() treated an importable rlm module as proof that delegation worked.
2. Fresh imports did not expose the documented preflight and routing modules.
3. Preflight blocked on optional agent_message and entirely unused agent_observe requests even though the lifecycle already supported linked same-model restarts.
4. The written fallback encouraged raw children, producing no episode, attributable cost, or correction lineage.

This head reports capability as unverified until preflight, exposes the documented package-root modules, degrades missing direct correction to the recorded restart path, removes the unused observe probe, and labels raw recovery unrecorded-manual-delegation. A nested prime-agent process is explicitly not presented as inheriting the parent session's host bridge.

On the exact failing session surface, candidate preflight passed despite unavailable agent_message.list_agents, retained the exact parent selector, returned restart-only-corrections, and reported roster_reachable=false.

Verification

Run from a clean proof checkout whose origin was DannyMac180/sol-advisor:

• sh scripts/verify-prime-agent-package.sh — 20/20 passed
• Python 3.11, warnings as errors — 270 passed
• Python 3.14, warnings as errors — 270 passed
• isolated install/remove cycle — passed; the real Prime Agent home was unchanged
• git diff --check upstream/main...HEAD — passed
• git diff upstream/main...HEAD -- plugins .agents — empty
• package.json repository/homepage metadata — matches DannyMac180/sol-advisor

The full package has also completed a separate live Sol→Luna field acceptance over an existing ChatGPT Pro subscription: a routed worker changed only its owned files, deterministic pytest independently returned 2 passed, a separate reviewer returned zero findings, and episode d-85fa3b079ceb closed ship. The temporary host-local provider alias used for that Prime Agent 0.7.0 compatibility test is operator configuration; it is not included here and the package remains provider-neutral.

Known inherited verifier condition

The unchanged Codex verifier currently exits 1 on both upstream/main and this candidate with:

FAIL: manifest does not describe app-task routing

Because plugins/ and .agents/ are byte-identical to the base, this PR does not fold an unrelated plugin fix into a package contribution. The new Prime Agent verifier is deliberately independent of that inherited lane; the README still lists the Codex verifier as its own command, and that baseline failure should be resolved separately.

Prime Agent 0.7.0 compatibility note

Prime Agent 0.7.0 can authenticate successfully yet return an empty alternate Codex catalog because it sends its own package version as the Codex catalog client_version. Static model listing therefore does not prove RLM executability. Relevant upstream runtime reports/fixes include #639, #696, #740, and PR #831.

The package queries exact selectors through authenticated RLM preflight, owns no OAuth credential, bundles no provider shim, and tells operators to revalidate native discovery after upgrading Prime Agent.

Honest caveats

• Children share the operator's working directory; delegations are serialized for attribution.
• Restart-only correction costs a fresh child context when direct messaging or retention is unavailable.
• Append-only episode storage is a convention with integrity signals, not an OS-enforced property.
• Runtime contracts were verified against Prime Agent 0.7.0; an unknown runtime fingerprint is recorded as a degradation and should trigger re-verification.
• The live evidence is one operator's field report, not a benchmark.

If the surface is too large, reasonable landing options are the manifest/scaffold/verifier first, documentation-only discoverability, or keeping the implementation in the fork until more episodes accrue.