The first executable leg of #17130 (C2 cutover — browser-direct cockpit wake consumer), per the leg map at claim time (issue comment IC_kwDODSospM8AAAABPBZxYg). Builds ONLY on frozen wire (PRs #17103/#17116) + landed C1 (PR #17176): zero dependency on the D#16764 fold or any S-chain state. The relay sibling ai/services/fleet/fleetWakeSseConsumer.mjs is the shape authority; the realm boundary carries no imports, so the parser twin is bound by a parity spec (the endpoint-normalizer precedent).
Acceptance Criteria
Worker-realm SSE consumer twin in apps/agentos/fleet/: pure frame parser (parity-spec-bound to the relay's parseSseFrames) + the consumer state machine — vouched subscriptionId adoption from the state handshake, poll-digest catch-up once per connection with the client-held watermark, server retry: hint as the backoff floor (exponential under cap), staleness horizon, TextDecoder chunk decoding.
Two credentials, two headers, never aliased: class-1 fleet admission on Authorization, the viewer's class-3 MC mint on x-neo-mc-authorization; a byte-identical pair is refused CLIENT-SIDE at install — loud, before any wire — and non-pair server refusals of the stream are carried as honest observations (rendered, never retry-stormed). (Amended in PR #17194's review round: the original clause stipulated observing the SERVER's pair refusal, which the strictly stronger client preflight makes unreachable — the pair never crosses the wire; the server-side pair refusal remains pinned in the server's own arming spec, fleetWakeArming.spec.mjs.)
Custody: both mints reach the consumer through C1 closure custody — the pane receives a wake-stream CAPABILITY on the registry bridge, never a credential, and the capability PINS destination, credentials, and transport (an override attempt fails loud). Both mints ride the launch contract's transient ingress (the two pre-boot slots: read-old at establish → closure → CAS-retired under the one session proof), never durable Body-readable state (Option-D extended to the second mint; the profile record schema stays credential-free).
Absence-of-signal vocabulary preserved verbatim from the relay (alive: 'unknown' + reason; poll remains the truth lane) so leg 2 renders reasons, never verdicts.
Evidence: unit pins (two-header arming · byte-identical refusal · cold-start catch-up from the vouched id alone · reconnect + watermark continuity · retry-floor respected · caps-respecting backoff) + parser parity spec + an L3 live probe against the real /fleet/events fixture (fleetServer.mjs:452).
Out of Scope
Store-bound rendering, honest-degraded rows, and the whitebox-e2e journey (leg 2 of #17130); relay-side consumption (#17101, shipped); C3 render states (#16744).
Lineage
The browser twin of the relay consumer shipped in PR #17116 (slice 3), consuming the C1 custody contract shipped in PR #17176 — both named, neither replaced.
Origin: #17130 leg map · Retrieval Hint: "browser wake stream consumer twin two mints closure custody parity parser"
Live latest-open sweep: latest 6 checked 2026-08-15T16:08Z (nearest: #17188/#17186/#17184 — test-isolation surfaces, different domain); no equivalent. A2A claim sweep: current-hour window clean (my own #17130 claim broadcast is the parent's).
tobiu referenced in commit c145ace - "feat(agentos): browser wake-stream consumer twin + the bridge's two-mint wake capability (#17190) (#17194) on Aug 15, 2026, 11:42 PM
Context
The first executable leg of #17130 (C2 cutover — browser-direct cockpit wake consumer), per the leg map at claim time (issue comment IC_kwDODSospM8AAAABPBZxYg). Builds ONLY on frozen wire (PRs #17103/#17116) + landed C1 (PR #17176): zero dependency on the D#16764 fold or any S-chain state. The relay sibling
ai/services/fleet/fleetWakeSseConsumer.mjsis the shape authority; the realm boundary carries no imports, so the parser twin is bound by a parity spec (the endpoint-normalizer precedent).Acceptance Criteria
apps/agentos/fleet/: pure frame parser (parity-spec-bound to the relay'sparseSseFrames) + the consumer state machine — vouchedsubscriptionIdadoption from thestatehandshake,poll-digestcatch-up once per connection with the client-held watermark, serverretry:hint as the backoff floor (exponential under cap), staleness horizon,TextDecoderchunk decoding.Authorization, the viewer's class-3 MC mint onx-neo-mc-authorization; a byte-identical pair is refused CLIENT-SIDE at install — loud, before any wire — and non-pair server refusals of the stream are carried as honest observations (rendered, never retry-stormed). (Amended in PR #17194's review round: the original clause stipulated observing the SERVER's pair refusal, which the strictly stronger client preflight makes unreachable — the pair never crosses the wire; the server-side pair refusal remains pinned in the server's own arming spec,fleetWakeArming.spec.mjs.)alive: 'unknown'+ reason; poll remains the truth lane) so leg 2 renders reasons, never verdicts./fleet/eventsfixture (fleetServer.mjs:452).Out of Scope
Store-bound rendering, honest-degraded rows, and the whitebox-e2e journey (leg 2 of #17130); relay-side consumption (#17101, shipped); C3 render states (#16744).
Lineage
The browser twin of the relay consumer shipped in PR #17116 (slice 3), consuming the C1 custody contract shipped in PR #17176 — both named, neither replaced.
Origin: #17130 leg map · Retrieval Hint: "browser wake stream consumer twin two mints closure custody parity parser"
Live latest-open sweep: latest 6 checked 2026-08-15T16:08Z (nearest: #17188/#17186/#17184 — test-isolation surfaces, different domain); no equivalent. A2A claim sweep: current-hour window clean (my own #17130 claim broadcast is the parent's).