Verification pool sessions share one executor, violating the "separate sessions" invariant

[callumee]

Verification pool sessions share one executor, violating the "separate sessions" invariant

Severity: High
File: src/cain_agent/multi_agent/orchestration.py:91-93

build_orchestration creates multiple ExecutorVerificationSession instances but they all wrap the same validation_executor object:

sessions = tuple(
    ExecutorVerificationSession(f"verify-{index}", validation_executor)
    for index in range(session_count)
)

The architecture requires independent verification sessions for majority-vote integrity (FindingsPipeline.__init__ explicitly rejects pool sessions that share the discovery executor). Yet all three verification sessions share a single SDKExecutor, meaning they share the same hooks, allowed_tools, and — critically — the same underlying Claude Agent SDK session when resume_session_id is set. The pool then runs asyncio.run() per call inside ThreadPoolExecutor threads, but all threads drive the same executor state.

Why it matters

If one verification thread mutates executor state (e.g., appending a hook, advancing a session), the other threads observe the mutation. A failure in one session could corrupt the shared state for all three, turning an independent majority vote into a correlated single-point result — undermining the anti-self-certification design.

[cdxiaodong]

确认属实,这是当前优先级最高的一份 — 已修复(main c39f1dd,合并于 4096e00):build_orchestration 改为接受 executor 工厂(CLI 传入 _build_validation_executor 工厂),验证池每个 session 独立构造 executor,消除三会话共享单实例的状态相关性,多数表决的独立性恢复。向后兼容:直接传 executor 实例仍可用(共享语义已在 docstring 标注风险)。CLI 级测试已更新为断言 5 次独立构造(发现 1 + 校验 1 + 池 3)。Issue 暂保持开放。