Client broker leg 1: profile identity contract + session-only custody with verified, CAS-safe ingress retire

Context

The first executable leg of #16742 (client connection broker, D#16720 Option-D), split out at PR #17176's review: the profile CONTRACT and the session-only custodian land now with a real verified lifecycle; the Electron-main and env-indirection custodian producers remain #16742's open legs. The split is review-driven truth-narrowing (the reviewer's exact-tree search showed one production createFleetProfile producer), not scope erosion — the umbrella keeps the three-shape close.

Acceptance Criteria

• Pure profile contract module in apps/agentos/fleet/: versioned endpoint normalization (client twin of the Node endpoint-boundary policy, parity-spec-bound), stable endpoint-derived profileId (display labels / logins / checkout paths forbidden as identity keys), CLOSED credential-free record schema (forbidden field names + bearer-shaped value scan + flat primitives), custodian vocabulary for all three shapes with per-shape storable-field sets, explicit custody-migration machine (read-old → establish → verify → retire; rollback terminal; generation advances exactly at retire).
• Session-only boot custody EXECUTABLE with a real lifecycle: establish = bridge install moves the bearer into transport closures; verify = an authenticated resolveViewerIdentity round-trip through the newly established bridge; retire = the launcher pre-boot ingress slot cleared only after verify succeeds and only when the slot still holds the exact established credential (CAS) — a rejected or wrong bearer, an unreachable endpoint, and a value rotated in during verification all preserve the ingress (rollback truth).
• A second SharedWorker onStart() never downgrades: a bearer-less pass retains an existing bridge (live or fail-closed) instead of overwriting it; pinned including the handshake-unavailable case.
• The bridge carries a renderable non-enumerable profileId fact (bearer-shaped values refused); the worker realm holds ONE bearer-format authority (sibling copies import it).
• Evidence: unit pins for every lifecycle truth above (real installFleetBridge + stubbed wire envelopes, never a construction-certifying stub) PLUS an L3 live non-destructive probe against the real Fleet fixture server (verified retire with the true bearer; preserved ingress with a wrong one).

Out of Scope

Electron-main profile/custody binding (worker deliberately carries profileId: null in shell mode — identity lives with main) and the env-indirection production producer — both remain #16742 ACs. The C2 wake consumer (#17130).

Lineage

Successor slice of #14574 / PR #15287's shipped remote-tenant custody (documented, never erased); the tenant seam is untouched.

Signal Ledger

Inherits D#16720 v11/v12 family-keyed graduation (fable AUTHOR+APPROVED, opus APPROVED); leg split ratified in PR #17176's review round (gpt).

Origin: #16742 / PR #17176 review PRR_kwDODSospM8AAAABJq_n0A · Retrieval Hint: "client profile contract session-only custody verified CAS retire second window preservation"

Live latest-open sweep: latest 8 checked 2026-08-15T14:4xZ (nearest: #17180/#17178/#17177 — different surfaces); no equivalent. A2A claim sweep: current-hour window clean.