tenant.openagents/omega

Serve Omega Agent over ACP, on a socket that is off, loopback, and read-only

Serve Omega Agent over ACP, on a socket that is off, loopback, and read-only omega#82 asks for recursive composability: Omega is already an ACP client, and an external ACP host should be able to attach to Omega and get Omega Agent — the router, with its disclosed routing — rather than a raw provider. Two lanes released this issue rather than half-land it, both because `OmegaAgentConnection` was constructed only under `#[cfg(test)]`. `a96f6c0512` wired it, so this is the other direction. OMEGA-DELTA-0041. `crates/omega_acp_server` serves Omega Agent to an external host over a loopback socket, and four properties hold it down structurally rather than by a runtime check something could forget to call. **Off by default, exactly.** `OMEGA_ACP_SERVER` must be `1`. `true`, `yes`, `on`, `01`, ` 1` and an unset variable are each off, with a typed `OffReason` rather than a bool, and a source check fails on a truthy-tolerant read such as `to_lowercase()` or `parse::<bool>()` — the values a later edit would widen to are not the values a unit test happened to list. **Loopback by construction.** `LoopbackHost::new` refuses anything but `127.0.0.1` and `::1`, and refuses a *name* rather than resolving it, because resolution is the step at which `localhost` can be made to mean something routable. `LoopbackAcpServer::bind` takes that type, so a routable interface needs a new type, not a new setting. **Read-only, inside the authority partition rather than beside it.** This is an unauthenticated model-driven surface — `authMethods` is empty, so it carries no bearer at all and is structurally weaker than the Desktop MCP surface. Owner gate 8 reaches it directly, on the day three model-callable Full Auto starts were removed from OpenAgents Desktop. So `SERVED_SURFACE` is the four methods a host can reach, each observation, and `UNEXPOSED_AUTHORITY` classifies every authority-bearing control with the typed refusal an attempt receives — checked in both directions against `FULL_AUTO_AFFORDANCES` and `PinGesture::all()`, so adding a Full Auto control fails until somebody says what a served host is told. Anything unlisted is refused by the absence of a dispatch entry. **A served session can never reach an engine lane.** A pin is the only door to one, setting a pin requires a `PinGesture`, and no variant of that enum is reachable over a socket. The consequence is asserted against every engine state the router can be shown — including idle lanes with an executor registered — so "the engine was down" is not what is doing the work. Ingress is a record beside the disclosure, not a fourth executor class. `ExecutorClass` answers who ran the work; serving over ACP changes who asked. Reusing `ExternalAcp` would make a served session claim an external agent did work Omega did, and make one token mean opposite things depending on which side of the socket the reader stands on. `OMEGA-AGENT-AC-04` therefore stands unrevised at three classes and `SessionOrigin` carries the ingress. Both records cross the wire with exactly their declared fields: `the_disclosure_record_holds_no_rendered_label` now asserts `EXECUTOR_DISCLOSURE_FIELDS` **exactly** against the struct's own source instead of failing on the word `label`, because a denylist that catches `label` passes for `line`, `text`, `summary`, and `caption`. GPUI never opens the socket. `omega_acp_server` declares no dependency on GPUI, `workspace`, `project`, `agent_ui`, or `ui`, and the only production caller of `start_if_enabled` is `crates/omega_effectd` — the supervisor layer. Both are checked by scanning the tree. Driven by a real external host. Stock Zed 1.12.0 attached through a `sh -c "exec nc 127.0.0.1 8282"` bridge, opened a thread on the served agent, and prompted it. The first shape answered ACP's `refusal` stop reason, and Zed implements its meaning literally: it dropped the turn and showed a refusal banner with no disclosure at all. That was watched happening, and is why a served turn now ends with `end_turn` and states what it did not do in the message and in the record. The headless half of the exit is `the_upstream_acp_client_reads_the_disclosure_off_a_real_socket`, which drives the same loopback socket with the pinned ACP SDK's own client — third-party framing, dispatch, and session handling — and reads the disclosure back off it. Fifteen falsifications were run, each probed byte-for-byte against a pristine copy before its test ran so a failed string match could not report green: default-on, a routable bind, an unlisted method answered instead of refused (both in-process and over a real socket), a served pin, a rendered line on the wire, an unclassified Full Auto control, a second served identity, the socket moved into reach of the UI layer, a UI crate starting it, the supervisor dropping the lifecycle, and a rendered field added to each record. Every one failed its named check. What this does not cover, stated rather than discovered: the listener runs in the Omega process under the supervisor's control, not inside the packaged `@openagentsinc/omega-effectd` daemon, which lives in the openagents repository and is out of this packet's scope. The surface also does not execute — a served turn is answered by disclosing where it would route. The v1 fleet-backed server stays deferred. Release Notes: - Omega Agent can now be attached to from an external ACP host over a loopback socket, off unless `OMEGA_ACP_SERVER=1`, where it discloses which executor a turn would run on and executes nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>