Port Agent Client Protocol (ACP) & Devin harness integration to Rust #72

Completed in commit e2da9bc051. Ported Agent Client Protocol (ACP) JSON-RPC client and Devin harness integration with permission modes.

Reopening: acp.rs is unreferenced scaffolding with no transport. Nothing in the crate calls it.

Audited against 468f1fa325. crates/openagents-cli/src/acp.rs is 65 lines. It has zero callers:

$ grep -rn "acp::" crates/openagents-cli/src/ | grep -v "src/acp.rs"
(no output)

Unmet scope items, verbatim from this issue:

• "Full Agent Client Protocol (ACP) JSON-RPC client implementation in Rust" — there is no client. The file contains two serde structs (JsonRpcRequest 6, JsonRpcResponse 13), one method that builds an initialize request body (build_initialize_request, acp.rs:38-56), and one that unwraps a response (handle_response, acp.rs:58-64). There is no transport of any kind: no stdio pipes, no process spawn, no framing, no read loop, no request/response correlation beyond an incrementing seq. build_initialize_request returns a struct that nothing ever sends.
• "Devin CLI process management, permission mode controls (dangerous, prompt, read-only), and streaming session parser" — PermissionMode is declared at acp.rs:21-26 and stored on DevinAcpClient.mode at :29. It is never read anywhere in the crate; no code branches on it, so it gates nothing. There is no session parser and nothing streams. The only Devin code that exists is delegate.rs:134-144, which runs devin --prompt <p> through cmd.output() — a buffered one-shot, not process management, and not the invocation the installed devin CLI accepts.
• "Claude Code and OpenAI Codex headless CLI harness adapters" — delegate.rs:98 and :110 shell out to claude -p <p> and codex exec <p> via cmd.output(). Neither reads stderr into the result (:105, :117 read res.stdout only), neither streams, neither passes a working directory, and neither is an ACP harness. Reachable only through oa coder --delegate, whose default lane never reaches a model (see #85).

There is no test covering ACP at all. crates/openagents-cli/tests/cli_test.rs does not import acp.

Acceptance for the reopen:

1. oa speaks ACP to a real agent process over stdio: show an initialize request written, the response read, and a session prompt answered.
2. --permission-mode read-only demonstrably refuses a write that dangerous allows. Show both runs.
3. Streaming session updates appear while the child runs, not after it exits.
4. A test that drives ACP against a stub agent process and asserts on the parsed session updates.

Substantial progress in f00c28ebbe (main, WAL receipt seq=183). Staying open on one unverified adapter.

Landed: acp.rs was 65 lines that built one initialize struct and never sent it. It is now a real JSON-RPC client over the agent's stdio -- initialize -> session/new -> session/set_mode -> session/prompt -- that auto-answers session/request_permission (preferring an allow* option), parses tool_call, usage_update, and agent_message_chunk, drains stderr, and kills the process group on every exit path. Permission modes are wired through session/set_mode.

The real Devin CLI answered over it: session expensive-iris, streamed DEVIN_ACP_OK, 12848 in / 33 out tokens, 1.2s. The claude headless adapter also ran live. Tests include a 20-line Python ACP server the client must genuinely talk to, so the protocol path is exercised rather than asserted.

Still open: the Codex headless adapter is implemented but has never been run against a successful response. Codex on this machine is unauthenticated -- api.openai.com returns 401 -- so the child was correctly reported as failed, which proves the failure path and nothing about the success path. Its answer-extraction parser is written from the TypeScript contract plus the documented codex --json shapes, not confirmed against real output. The same is true of opencode.

That gap is exactly the shape of defect this repo keeps shipping: a parser that looks right, is never run against the real thing, and fabricates or drops the answer in production. It needs one authenticated run per lane before this closes. The workspace has a route -- remote Codex over Tailnet on archlinux -- so this is verifiable without new credentials.