feat(execution): durable session-independent execution correlation (#565)

[Yatsuiii]

What

First implementation slice for session-independent execution correlation (#565),
following the design merged in #574. Adds cmcp_runtime.execution: a durable
ExecutionRegistry that atomically reserves (agent_identity, execution_id, action_binding) before upstream invocation, classifies replays and collisions
without re-invoking, and fails closed on restart. Plus the minimal wiring to
consult it on the tool call path and a typed AuditEntry.execution_id field.

Why

Closes part of #565 (correlation and durable state). Per #574, session_id is
the only validated correlation key today and it carries two jobs that stop
fitting together across independent requests. execution_id is the caller-
asserted key that survives independent requests; this slice makes it durable and
gives it fail-closed collision/replay semantics so a fault after upstream
invocation cannot become permission to repeat an irreversible effect.

Design notes for reviewers

• State machine. admit() (under BEGIN IMMEDIATE) reserves a fresh
  in_flight row or classifies an existing key: replay_in_flight,
  replay_terminal, replay_outcome_unknown, collision_changed_binding. It
  never rewrites a row. finalize() moves in_flight to completed (transport
  delivered) or outcome_unknown (earlier); both terminal and non-replayable.
  recover() seals every still-in_flight row as outcome_unknown at startup.
• Action binding is deferred to Define canonical bytes for execution action/intent bindings #588. admit() takes the binding as an
  opaque digest string and never computes it; the proxy gets it from an injected
  action_binding_fn. provisional_action_binding ships as an explicit stub
  with an undecided preimage (docstring cites the open question and altrudev's
  proposed envelope) that reuses the existing cmcp_runtime.catalog.approval
  canonicalizer. No second serializer.
• Requirement 7 is partially met. The Define session-independent execution correlation for post-session MCP #565 thread targeted one transaction
  boundary for the terminal state and its audit evidence, noting AuditStore
  would need a method that writes both under one BEGIN. This slice does not
  do that: the execution row and the audit chain entry are in separate SQLite
  databases. Instead the proxy writes the audit entry first, then finalize().
  The narrower docs: propose session-independent execution correlation (#565) #574 invariant still holds - a terminal transition is durable
  before a later request is classified as replay, because finalize() commits
  its own transaction before any later admit() runs. A crash in the gap, or a
  failure inside finalize(), leaves the row in_flight for recover() to
  seal. The only residual ambiguity is an audit entry showing a definite outcome
  while the registry says outcome_unknown, which is the more conservative
  reading. A real single transaction needs a shared single-writer datastore and
  is out of this slice (disclosed in the spec under "Known limitations").
• execution_id is bound-checked at ingress (1 to 200 printable non-space ASCII)
  before it can reach the durable key; a violation is denied
  (execution_invalid_execution_id) with no reservation and is not written to
  the audit entry.
• Known review question: _classify_existing compares bindings with != rather
  than hmac.compare_digest.

Scope held out

HTTP-native transport, Tasks, delegated identity, discovery, broad SDK support.
No claim of exactly-once external execution. #588's binding construction.

Security impact

Touches audit chain integrity and adds replay/collision enforcement.

• New typed AuditEntry.execution_id field: always serialized, null when
  absent, never synthesized. It is included in the hashed entry body, so entry
  hashes for chains written after this change differ from before; existing
  persisted chains still verify against their own stored payloads.
• Replay and collision policy lives entirely in ExecutionRegistry; the proxy
  has one call site each for admission and finalization and does not branch on
  policy. A replay or collision is refused before upstream invocation and the
  refusal is audited under the asserted execution_id.
• Fail-closed on ambiguity: any execution left in_flight by a crash or a
  persistence failure becomes outcome_unknown at the next startup and can never
  admit another invocation. There is no replay window and no expiry.
• Not addressed here: a single durable transaction spanning the terminal
  execution row and the terminal audit entry (see "Requirement 7" above);
  cross-process reservation fencing beyond SQLite BEGIN IMMEDIATE +
  busy_timeout.

Test plan

• pytest passes - tests/unit + tests/conformance: 1557 passed, 6
  skipped. The 6 tests/unit/test_startup.py failures are pre-existing TPM
  /dev/tpmrm0 device-permission failures that reproduce on clean main;
  untouched here.
• ruff check passes (ruff check src tests)
• mypy passes (mypy src, 69 files)
• New coverage: tests/unit/test_execution_correlation.py (20, registry
  level incl. an 8-thread reservation race, restart recovery, injected
  persistence failure) and tests/unit/test_execution_correlation_call_path.py
  (12, proxy level: reserve before upstream, no re-invoke on replay/collision,
  audit carries execution_id, finalize on terminal and on upstream fault).

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I
  agree to the Developer Certificate of Origin (https://developercertificate.org).
  All four commits carry Signed-off-by.

---

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!