Add live session binding and project-scoped identities

[5000Stadia]

What changed

• Adds no-restart Codex session attachment with explicit precedence, expiry, hook-ABI validation, and honest boundary-only versus live-bridge reporting.
• Adds project-qualified PROJECT.SEAT addressing, project-filtered directories, and fail-closed same-project bare-name resolution.
• Adds guarded wipe agent, wipe project, and wipe all clean-start workflows with exact affected-mailbox confirmation and coherent metadata cleanup.
• Adds adapter-wide agentpost upgrade and synchronized AgentPost v1.3.0 release metadata.
• Bumps the Codex integration to 0.0.6+codex.20260728214546 and makes diagnostics compare the installed generation with the package-expected generation.
• Hardens attachment lookup and wipe operations against symlink escapes, permissive runtime state, malformed attachment metadata, active-consumer races, and same-name mailbox recreation.
• Includes all three public protocol specifications in source distributions.

Why

An unmanaged Codex thread could not safely adopt an alternate mailbox without restart because its parent environment and loaded plugin could not be rewritten. Separately, profile project metadata was recorded but ignored by human addressing, allowing a globally unique bare handle to resolve silently into another project. AgentPost also lacked a coherent supported reset operation for mailbox, binding, group, and workspace state.

The release hardening makes attachment state fail closed and performs wipe attachment work descriptor-relatively inside private directories. Wipe acquires authoritative consumer leases for every target, holds them through the transaction, and serializes mailbox registration through a root-level namespace fence. Rollback collisions preserve the staged original and report its recovery path.

Impact

agentpost attach never installs or replaces a plugin and cannot claim already-idle wake when only lifecycle boundaries are available. Human channel commands now require explicit qualification across projects; low-level canonical-key APIs remain available for already-resolved scripts. Broader wipe scopes preview and require the exact current mailbox list before irreversible deletion, never touch source repositories, and refuse while any target consumer is live.

The v1.3.0 adapter refresh requires a one-time reload for Claude and Codex plugin generations. Mail and profiles remain durable throughout.

Validation

• PYTHONPATH=src python3 -m unittest discover -s tests -v — 235 tests passed
• python3 scripts/verify_clean_install.py — Python 3.12 clean bootstrap passed
• python3 -m compileall -q src tests scripts
• node --check src/agentpost/data/codex_bridge.mjs
• sh -n scripts/install.sh
• ./scripts/smoke_two_agents.sh
• Rebuilt and inspected the v1.3.0 sdist and wheel; all three public specs are present
• Installed the wheel into an isolated home and reran the two-agent smoke
• Verified stale Codex bindings report WOULD-UPGRADE from 0.0.5 to expected 0.0.6
• GitHub Actions green on Python 3.11, 3.12, and 3.13 for the exact release candidate
• git diff --check

Release candidate: 9e3f3f74c385f91def16a9ae9417f83b1791554d.