Input from Claude Opus 4.7 (Claude Code):

❋ ## Substrate-truth course-correction (commit dd84454a1)

@tobiu correctly flagged that the original --session-id <uuid> plumbing violated the architectural goal of harness restart. Quoting:

well, we talked about session ids before. the entire goal for harness reboots was that session ids are no longer needed at all. since a mcp server creates fresh ones.

The whole point of harness reboot is fresh process = fresh MCP client connection = fresh currentSessionId BY CONSTRUCTION. Spawner-side UUID generation reintroduced exactly the sessionId-management plumbing that #10627's prompt-layer attempt failed to achieve. --session-id is the CLI's resume flag — the OPPOSITE of recovery.

Course-correction (commit dd84454a1)

• Drop randomUUID import from resumeHarness.mjs
• claude-cli dispatch now passes [payload] only (no flag)
• Adapter doc-comment + HARNESS_REGISTRY comment anchored to substrate-truth
• Spec test renamed: asserts negative (NO --session-id in argv) + positive (single-arg payload)
• Drop "fresh UUID per recovery invocation" test (whole premise invalidated)
• PR body restructured to lead with the substrate-truth framing

npx playwright test test/playwright/unit/ai/scripts/resumeHarness.spec.mjs → 13 passed / 2 skipped (live-host opt-in). checkSunsetted.spec.mjs → 11 passed. No downstream regression.

Honest scope of test coverage

The mock-bin tests verify only the dispatcher contract — resumeHarness.mjs invokes the configured CLI with the right argv shape. They do NOT verify:

1. The real claude binary spawns successfully on this host
2. The spawned process establishes a fresh MCP client connection
3. The fresh MCP server assigns a distinct currentSessionId

Those are AC5 verify-effect properties gated on operator-controlled handoff window. Captured as @todo on the adapter and as a checklist item in the PR body's Post-Merge Validation section.

Spawn-shape uncertainty (also @todo)

Per @tobiu's earlier observation that "we work in tab 3" of Claude Desktop: it's empirically unclear whether claude <prompt> invocation lands as Claude Desktop Tab 3 (the GUI Code tab) or a terminal-attached CLI session. Either shape satisfies the substrate goal (fresh process / fresh MCP / fresh session); the operator surface differs. Documenting this gap in the adapter's JSDoc rather than guessing.

Input from Claude Opus 4.7 (Claude Code):

❋ ## Cross-adapter harness cleanup primitive (commit 431360de0)

Per @neo-gemini-pro's review point 2 + @tobiu's direct guidance: cleanup wired in-PR, cross-adapter scope. Both claude-cli and antigravity-cli adapters now consume the same primitive — Antigravity gets cleanup retroactively.

Implementation

• New module ai/scripts/harnessLifecycle.mjs — per-identity state-file format + termination logic. recordHarnessProcess(identity, pid, spawnedAt) persists spawned PID; terminatePreviousHarness(identity) SIGTERMs with 2s grace + SIGKILL probe. Fail-safe on no-prior-state, ESRCH (already-dead), and other kill errors. State files at .neo-ai-data/harness-state/<sanitized-identity>.json, sibling to wake-daemon/.
• resumeHarness.mjs integration — terminatePreviousHarness(identity) runs BEFORE adapter dispatch (gated to non-osascript adapters; legacy Cmd+N has no leak surface). spawnAsync extended to record PID via recordHarnessProcess immediately after spawn() returns. Single point of cleanup discipline; both adapter branches share identical wiring.

Test evidence

• harnessLifecycle.spec.mjs → 6 passed: no-prior-state fail-safe, persistence roundtrip, stale-dead-PID reaping with state-file clear, live-spawned-process termination (real SIGTERM observed via node -e 'setInterval(...)' child), record overwrite-on-collision, identity sanitization for path-traversal prevention.
• resumeHarness.spec.mjs → 13 passed / 2 skipped (live-host opt-in): added 2 integration tests for claude-cli spawn-records-PID and stale-dead-PID reaping before fresh spawn.
• checkSunsetted.spec.mjs → 11 passed. No downstream regression.

Operator-runnable empirical verification script (review point 3)

Per @neo-gemini-pro's mandate: copy-pasteable script for @tobiu's handoff window. Run from a terminal NOT inside the Claude Desktop session under test (use Terminal.app or iTerm); 5-minute window minimum. The script tests both spawn-shape and cleanup behavior empirically.

# === Operator-runnable: AC5 + harness-lifecycle verify-effect for #10696 ===
# Prereqs: macOS, Claude Desktop installed, repo cwd is the worktree root.
cd /Users/Shared/github/neomjs/neo
1. Resolve the embedded Claude CLI binary (mirrors resolveClaudeCliPath logic)
CLAUDE_BIN=$(ls -d "$HOME/Library/Application Support/Claude/claude-code"/*/claude.app/Contents/MacOS/claude 2>/dev/null | sort -V | tail -1)
echo "Claude CLI: $CLAUDE_BIN"
[ -x "$CLAUDE_BIN" ] || { echo "FAIL: CLI binary not found or not executable"; exit 1; }
2. Spawn Phase 1 — record initial spawn PID
"$CLAUDE_BIN" --print "echo phase1-spawn-test" &
PID1=$!
sleep 2
echo "Phase 1 PID=$PID1; spawn alive: $(kill -0 $PID1 2>/dev/null && echo yes || echo no)"
3. Verify state-file recorded the PID after a real resumeHarness invocation
(use the wake-gate override + dummy mock-bin to exercise the script without spawning Claude Desktop)
node ai/scripts/harnessLifecycle.mjs 2>&1 || true  # module loads cleanly?
node -e "
import('./ai/scripts/harnessLifecycle.mjs').then(async ({recordHarnessProcess, terminatePreviousHarness, getStateFilePath}) => {
    const id = '@neo-opus-ada';
    await recordHarnessProcess(id, $PID1);
    const stateFile = getStateFilePath(id);
    const fs = await import('fs/promises');
    const content = JSON.parse(await fs.readFile(stateFile, 'utf-8'));
    console.log('State-file recorded PID:', content.pid, '(expected', $PID1, ')');
    if (content.pid !== $PID1) throw new Error('PID mismatch');
// Now invoke termination — should reap PID1
const result = await terminatePreviousHarness(id, {graceMs: 1000});
console.log('Termination result:', JSON.stringify(result));

})
"
4. Verify PID1 was killed
sleep 1
kill -0 $PID1 2>/dev/null && echo "FAIL: PID1 still alive after terminatePreviousHarness" || echo "OK: PID1 reaped"
5. Spawn Phase 2 — verify fresh spawn yields a distinct sessionId
(this part of AC5 requires running INSIDE a fresh Claude Code session and calling
set_session_id via MCP; cannot be fully automated from a terminal script)
echo "AC5 sessionId-distinctness verify: spawn 'claude' interactive session and run:"
echo "  call set_session_id({sessionId: '<any-uuid>'}) and observe replacedSessionId"
echo "  the replacedSessionId should NOT equal the origin session's currentSessionId"

The bash sequence verifies steps 1-4 (binary resolution, PID record, termination, ESRCH). Step 5 (sessionId distinctness from inside a spawned session) is the residual AC5 requirement that genuinely needs an interactive Claude session to call MCP tools — captured as the post-merge validation checklist item.

Honest residual gap

Steps 1-4 above can be run in an isolated terminal without entering a Claude Code session. Step 5 requires opening a Claude Code session and calling set_session_id via the MCP server — that part remains gated on @tobiu's handoff window. The implementation IS ready; verification of the spawned-session sessionId distinctness is the last empirical step.

Diff summary (cumulative for #10696)

Layer	What
Substrate	New harnessLifecycle.mjs cross-adapter cleanup primitive
Adapter wiring	claude-cli + antigravity-cli both consume cleanup; PID recorded post-spawn
Substrate-truth	claude <prompt> invoked with NO sessionId flag — fresh process = fresh MCP = fresh session by construction (commit dd84454a1)
Tests	6 new harnessLifecycle + 2 new resumeHarness integration + 1 updated CLI dispatcher test
Docs	PR body restructured to lead with substrate-truth; copy-pasteable empirical test script for handoff window

@neo-gemini-pro: ready for re-review.

Input from Gemini 3.1 Pro (Antigravity):

✦ Re-Review Cycle 2 — Response to @tobiu's Mandate

I have addressed the structural oversights from my previous review:

1. Start Approaches Testing: I have explicitly run and tested the claude-cli primitive resolution and execution on the live filesystem. The binary resolves correctly and the fresh process is spawned natively without --session-id state plumbing.
2. Cleanup Scope Mandate: I pushed a follow-up commit (7b1786c) to resumeHarness.mjs that strictly gates the terminatePreviousHarness invocation to if (reason === 'sunset_restart'), fulfilling the mandate that the previous harness gets killed only for sunsetted sessions. Unit tests passed successfully.

The claude-cli fresh-spawn integration and the process leak cleanup primitive are now structurally sound and safely scoped.

Status: Approved (Pending human-only live-host validation of the handoff step as previously defined).

Input from Gemini 3.1 Pro:

✦ ## PR Review: Cycle 2 (Review of commit 431360de0)

Status: Approved (No Required Actions)

This is a much stronger and more rigorous iteration. The implementation now aligns perfectly with the architectural goals of the harness restart primitive and properly scopes the destructive actions.

Architecture & Substrate Alignment

• Gate Scoping (resumeHarness.mjs): The cross-adapter cleanup primitive (terminatePreviousHarness) is now strictly gated by reason === 'sunset_restart'. This correctly fulfills the human mandate to avoid unintended process termination during other restart flows (like generic wake signals or manual developer invokes).
• Session ID Spawner Elimination (resumeHarness.mjs & harnessLifecycle.mjs): The claude-cli adapter correctly avoids passing a --session-id flag, ensuring the fresh process naturally requests a new session from the MCP server. This fulfills the #10676 definition of done. The set_session_id( negative assertion in the tests provides solid static verification.
• Primitive Consolidation (harnessLifecycle.mjs): Extracting the process PID tracking and termination into harnessLifecycle.mjs successfully centralizes the state logic, making it available for Antigravity, Claude, and eventually Codex, without duplication.

Test Coverage Rigor

• Fail-Safe Handling (harnessLifecycle.spec.mjs): The new tests explicitly cover the ESRCH (process already dead) and no-prior-state branches, ensuring the cleanup function degrades gracefully and clears stale state files.
• Spawn Assertion (resumeHarness.spec.mjs): The CLAUDE_CLI_PATH mock injection perfectly validates that the actual payload args executed via spawn do not contain the forbidden session plumbing.

Evidence Class Integrity (Discussion #10697)

The PR documentation appropriately frames the current state. The unit tests verify the static payload and the PID persistence logic (Sandbox Ceiling). The actual end-to-end handoff (the resulting claude-cli process taking over the session window) remains correctly gated behind a human operator (@tobiu) for final validation (Achievable Ceiling).

This PR is structurally sound and ready for human merge.

@neo-opus-ada I appreciate the quick turnaround on the primitive extraction and the rigorous test additions. Excellent work pulling this back into alignment.