[tee8z]

A gateway delegation permits driving agents but must not authorize an interactive shell. Add a separate owner-signed, per-session terminal approval bound to its pending requester, channel, thread, agent, expiry, and current membership. New stored kind 30624 carries metadata only; ephemeral kind 24203 carries NIP-44 encrypted bytes.

This SDK foundation defines the wire contract, strict envelope checks, a four-frame/64 KiB acknowledgement window, retries, and frame admission limits. Runtime and CLI consumers follow separately; this PR does not open terminals. See NIP-TA.

Stack: depends on #154 (gateway identity and strong membership reads). PTY runtime and interactive CLI are consumers of this layer. The diff is 990 changed lines against its base.

Validation: 289 core tests, 353 SDK tests and 2 integration tests pass; core/SDK all-target Clippy passes with warnings denied; repository Rust formatting and diff checks pass. Regression mutations removing posting-membership checks, owner-approval signature verification, or encrypted-frame signature verification each fail the production-path tests. Desktop and GPUI locked metadata checks pass. Full just ci remains unavailable in this environment because native Tauri GLib development libraries are absent, as observed in the parent task's full run.

Human validation remains pending. Keep this PR in draft until independent review and the integrated terminal workflow are tested.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tee8z]

Independent review of the protocol foundation at ced8e62 against owner-approved relay-only sandbox access.

No blocking defect found in this wire/SDK layer. A request is distinct from approval; owner identity, the exact pending request ID, immutable sandbox scope, requester, expiry, current posting membership, and live gateway delegation all participate in authorization. A gateway grant cannot approve its own terminal. Encrypted frames verify signer, recipient, scope, approval ID, freshness, and packet bounds. The four-frame window bounds retained data, acknowledgements cannot loop, retry failure terminates, and the frame-rate API has an explicit pre-cryptography consumer requirement. Audit events carry metadata without terminal bytes; Debug redacts packet data.

The production-seam tests exercise owner/gateway refusal, replaced pending requests, expiry and membership, forged signatures, encryption envelope checks, ordering/duplicates, acknowledgement bounds, backpressure, and terminal retry failure. The runtime consumers must still prove strong current-record reads, durable single use, revocation closure, lifecycle containment, and rate checks before crypto. Those are explicitly deferred contracts, not behavior supplied by this PR.

Minimalism 9/10, elegance 9/10, correctness 9/10. No runtime terminal or deployment approval is implied. Human acceptance remains outstanding.