Add bounded ACP form elicitation to conversation chat

[simple-agent-manager]

Problem and behavior

Pinned Claude and Codex ACP adapters emit elicitation/create form questions, but SAM's permission bridge did not handle them. With ACP_INTERACTION_FORMS_ENABLED=true on a conversation session, the client now advertises elicitation.form, validates a bounded flat schema, persists the request encrypted in Cloudflare, and displays an owner-only chat card. A valid creator answer is validated at the Worker and VM boundaries, saved with idempotency, and returned once to the live callback; decline, cancel, expiry, task-mode requests, URL mode, and unsupported schemas cancel explicitly.

The form flag remains off by default and independent from permission rollout. URL elicitation remains disabled. The coordinating parent agent (SAM task 01M3SG06CFJYF7F6HVJXHTFTN1) reviewed the exact candidate and staging evidence under Raphaël’s authorization to ship. GitHub records this PR merged at 2026-09-30T21:43:58Z on the frozen head; C1 remains dormant/default-false. Activation and the legacy-runtime hold belong to the separate #2204 decision.

Evidence

• The 14-case shared JSON corpus runs in TypeScript and Go. A version-checked verifier executes pinned Claude ACP 0.81.2 form builders and compares their output with corpus fixtures. Codex ACP 1.13.1 has no importable builder export, so the verifier pins its exact bundled builder/helper source and constants together with the complete reviewed schema fixture digest; it does not execute extracted bundle text. The manual verifier requires explicit absolute CLAUDE_ACP_PACKAGE_DIR and CODEX_ACP_PACKAGE_DIR paths, avoiding command lookup through mutable PATH. Go tests exercise the pinned acp-go-sdk v0.13.5 JSON-RPC path, raw-frame rejection before lossy decode, prompt ownership, deadline, cancellation, and duplicate receipt.
• Worker tests cover encryption, creator-only answer and detail, schema/answer rejection, deadline and idempotency, plus callback create → creator answer → VM delivery confirmation. Live Instant and VM Claude plan-mode conversations reached the real browser form and agent callback in staging.
• Real chat Playwright mocks cover mobile and desktop owner, noncreator, answer (including required empty text and empty enum), decline, lost receipt/retry, reconnect, and responsive layout. Unit regressions fence late detail success, terminal/access revocation, and delayed-hash submission after access loss. Reviewed screenshots are committed under docs/notes/acp-c1-screenshots/ and linked below. Raphaël's permission clearance assertions from fca210a90 are preserved with a positioning fix.
• Security, Go/Cloudflare, UI, constitution, docs/env, and task-completion specialist reviews passed after the parent-review fixes, with no release blockers. Public chat and configuration docs describe current form support.

Validation

• Shared corpus 14/14; pinned wrapper verifier passed; shared/API/web typecheck and API lint passed.
• Focused Go form tests and -race passed; previous full ACP/server Go package run passed.
• Worker form store/vertical suite 5/5 passed. Final form Playwright audit passed on iPhone SE and desktop: 10/10 active scenarios (10 viewport skips). Required empty text and empty enum are submitted end-to-end. The retained permission clearance scenario passed 6/6 CI-mode iPhone 14 repeats after a layout-settling assertion. Form card unit regressions passed 4/4; deploy workflow 47/47; web typecheck and lint passed (three existing warnings). File-size and diff checks passed. At prior head 418d5f2ea, CI found two stale API capability expectations (the new formBridge field) and SonarCloud flagged dynamic fixture-verifier execution. A second scan at 8098badd8 found the verifier’s npm root -g subprocess command lookup through mutable PATH. All three issues are fixed; focused API tests 54/54 and the pinned verifier against installed packages pass, and security re-review passed. At 53b170f7, SonarCloud, aggregate Test, Playwright and all other checks passed, but the full Worker suite exposed four stale permission decision fixtures in acp-interaction-store.test.ts (legacy accepted where the current contract requires selected_option). The current test-only delta corrects those inputs and preserves legacy encrypted-answer purge coverage; the focused Worker file passes 8/8. Exact-head CI run 36768485895 passed all jobs including full Durable Object Workers; SonarCloud PR quality gate is OK. CodeRabbit evidence is recorded separately below.

Staging proof and rollback

The coordinating parent agent approved exact head 7a6f56f25847932fea8e8a592522aac2212a765e after CI. A fresh contention check found no active staging deployment or node. Neither staging GitHub Environment ACP override existed; the staging Worker had ACP_INTERACTIONS_ENABLED=false and no forms binding. Temporary staging-only overrides set both true. Exact-head enable deployment 36771134033 and built-in smoke passed; effective Worker bindings read true/true.

Live path	Full session ID	Full form interaction ID	Safe receipt and callback evidence
Instant Claude, plan-mode accept	cfe72088-946b-444e-956b-b652bfd2f502	8a46e581-d0df-4bfc-a7ed-0248887a0935	Real chat card submitted; assistant message contained FORM_CALLBACK_RECEIVED. The first harness waited for the wrong terminal predicate and did not capture a structural delivery_confirmed receipt. The post-submit card capture and callback marker are separate observations.
Instant Claude, plan-mode decline	255b8c1a-8ca3-48f9-b189-ad76517f03ba	86e84a3c-2bcf-45b7-b21e-e46ee993fc1f	Interaction list returned state=delivery_confirmed, deliveryState=confirmed; assistant message contained FORM_CALLBACK_DECLINED. The decline path did not accept an empty object.
VM Claude, plan-mode accept	bdbfe51f-64e6-4278-8cec-2e93b84eb867	e0c20294-3838-4f45-9f78-9867695fa00c	Interaction list returned state=delivery_confirmed, deliveryState=confirmed; assistant message contained FORM_CALLBACK_RECEIVED.

VM timing is separated from the form wait: task 01M3T21XEE9HV73MYXGP6KXM9J was queued at 21:03:15.918Z and delegated after provisioning at 21:08:59.148Z (5m43s); workspace_ready was observed at 21:10:20Z, in_progress/running at 21:13:49Z, and the form was observed pending at 21:15:45Z. The harness did not capture a distinct agent.ready frame or exact prompt-start timestamp, so those stages are not inferred from the longer timeout. The earlier VM probe, session 3539074c-2aee-48fa-a45d-112cbbf9e0a6, had no assistant/tool output before its 10-minute window ended; it supplies no form result.

The Instant default-mode probe, session 36cab77f-f7a0-47c3-982c-85bb68fdbe42, emitted no form, and the model response reported AskUserQuestion unavailable in that run. This is no observed emission, not proof that SAM failed to advertise the capability or that the tool was unavailable to every default-mode session. The successful external-account proofs above used plan mode; deterministic pinned-wrapper fixtures are separate evidence.

Cleanup read-back: all five listed test sessions returned stopped; all five temporary profile DELETEs returned HTTP 200 (01M3T0AM19P5H6H2M7CFWRWYA2, 01M3T0W8RX5ZT04HC6MANW3BGG, 01M3T16WCVB6AYPWQ45ASRGPA6, 01M3T19XFHY3ZBHKTKH11GTF7F, 01M3T21RHF31VYKPC89GV7TGAW). Test-owned node deletion calls succeeded; the retained first Instant node 01M3T0AR6TV1HTCCQF01NWFWMH reads deleted, and a fresh staging D1 query returned zero active nodes. The retained default Instant and first VM workspaces read deleted; other test workspace rows were removed. The two temporary staging GitHub ACP overrides were removed back to their prior absent state.

The Instant accept harness's stop request returned HTTP 500. Its explicit fallback deleted test node 01M3T0WCN6Y1Y29VRMND4V7V5Q with HTTP 200. A fresh read-back found session cfe72088-946b-444e-956b-b652bfd2f502 stopped, no row for workspace 01M3T0WCTP3PMEX50FJMV2M2WN, and backing task 01M3T0WC760R3AMR9N9WGPN9SZ cancelled with workspace_id=null; there is no live orphan from that fallback. All five temporary profile GETs now return 404. The live decline path above proves a declined callback; wrapper/prompt cancellation and stale-answer fencing were verified by focused Go/Worker tests, without claiming a separate live external-account cancel run.

Same-head rollback deployment 36778422816 completed successfully: configuration, Cloudflare deploy, and built-in smoke jobs all passed on SHA 7a6f56f25847932fea8e8a592522aac2212a765e. Fresh Cloudflare Worker settings read ACP_INTERACTIONS_ENABLED=false and ACP_INTERACTION_FORMS_ENABLED=false; staging GitHub Environment has neither override. No production variable was changed by this staging exercise. The reusable deploy workflow forwards the independent forms flag in both sync passes; checked-in Wrangler defaults false. Merge and any later production deployment are separate from this staging read-back.

C2 and D handoff

C2 URL elicitation needs its own capability flag and completion lifecycle; C1 advertises form only and cancels URL requests. Reuse interaction identity, creator authorization, runtime generation, deadline, no-wake delivery and encrypted Cloudflare authority, but define a URL-specific decision schema. D diagnostics may use safe IDs, state, generation and receipt reason codes; never log or event raw schemas, answers, wrapper metadata, or tokens. The task file records the contract in detail.

UI Screenshot Evidence

Surface: Conversation form card

• Desktop evidence:
• Mobile evidence:
• Mock/stress data used: Playwright mock with long text, many items, an expired request, noncreator, invalid fields, a lost answer receipt, special characters, and 320px overflow check.
• Screenshot quality review: Reviewed owner, action, receipt, and noncreator screenshots on desktop and mobile for layout quality, overflow, clipping, readability, and responsive behavior; issues found in sticky clearance, labels, descriptions, focus, and receipt visibility were fixed and re-reviewed with no remaining visual issues.

Additional desktop empty answer, mobile empty answer, desktop receipt, mobile receipt, desktop noncreator, and mobile noncreator views are included in the PR.

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

Official documentation and pinned adapter sources were inspected before implementation: ACP protocol, Claude ACP package, and Codex ACP package. The installed package manifests were checked for versions 0.81.2 and 1.13.1, and the pinned Go SDK v0.13.5 wire decode was exercised.

Codebase Impact Analysis

packages/shared defines the bounded schema and cross-language corpus; packages/vm-agent/internal/acp advertises and handles the callback; apps/api validates, encrypts, stores, and delivers; apps/web presents owner-only chat forms; apps/www documents behavior. The existing permission bridge and task-mode cancellation were checked as regression boundaries.

Documentation & Specs

Updated apps/www/src/content/docs/docs/guides/chat-features.md, apps/www/src/content/docs/docs/reference/configuration.md, .claude/skills/env-reference/SKILL.md, and the C1 task file. The docs describe conversation-only, flag-gated forms and URL unsupported behavior.

Constitution & Risk Check

Checked Principle XI configurable limits with the constitution specialist. Bounds and form deadlines come from existing or new environment-backed configuration. Security review covered creator authorization, encrypted form payloads, HMAC-protected answer receipts, no-wake delivery, generation fencing, cancellation, and sensitive-data exclusion from logs/events/transcripts/cache. URL and task forms remain disabled by explicit decisions.

Specialist Review Evidence

All six local specialists returned final re-reviews. Their earlier blocking findings were fixed; the Go/Cloudflare reviewer’s remaining low-priority old-waiter observation cannot attach an answer to the next prompt and was not a release blocker. The coordinating parent agent separately reviewed the exact head and later deltas.

Reviewer	Status	Evidence / disposition
Security auditor (/root/security_review)	ADDRESSED	Re-reviewed HMAC answer hashes, deadline and payload guards, form capability gating, late detail/hash revocation races, and verifier security fixes (no dynamic execution or mutable-PATH lookup); no remaining security blocker.
Go / Cloudflare (/root/go_cloudflare_review)	ADDRESSED	Fixed lossy SDK scope handling, late-deadline answers, decline payload, Go/TypeScript metadata parity, and prompt registration; race tests passed. Reviewed both deployment sync passes and test-only Worker delta. Low-priority old-waiter window cannot answer the next prompt.
UI / UX (/root/ui_review)	ADDRESSED	Fixed sticky-header overlap, choice descriptions, invalid-field focus/labels, answered-receipt visibility, and explicit valid empty answers; re-reviewed desktop/mobile screenshots and Playwright payloads with no UI blocker.
Constitution (/root/constitution_review)	ADDRESSED	Replaced fixed form-message/schema text limits and one-second expiry polling with configurable bounds and deadline timing; Principle XI re-audit passed.
Documentation / environment (/root/docs_env_review)	ADDRESSED	Clarified creator-only contents and answer versus generic project-member metadata; documented five form limits. Rechecked flag defaults, both deployment sync passes, and rollback; no remaining mismatch.
Task completion (/root/task_validation)	ADDRESSED	Closed the original vertical-test and pinned-wrapper evidence gaps; final audit passed after Claude builder verification, Codex source/fixture pinning, focused tests, and parent-review fixes.
Coordinating parent agent (SAM task 01M3SG06CFJYF7F6HVJXHTFTN1)	PASS	Separately reviewed exact head 7a6f56f2, parent-requested UI/deployment fixes and later test-only deltas; authorized gated staging and independently confirmed rollback. This is agent review under Raphaël’s authorization, not a human code review.

CodeRabbit Review Evidence

The trusted workflow_dispatch 36757343075 requested a review at 2026-09-30T18:16:02Z and completed successfully. CodeRabbit replied to that dispatched command at 18:16:19Z with Action not completed: Review rate limited. Its earlier 18:15:29Z Review skipped: Auto reviews are disabled status was the automatic-review path, not the dispatched request's outcome. No CodeRabbit review arrived after more than three hours; GitHub's PR reviews remain empty. The best-effort request/wait requirement is satisfied. Neither comment is a review, and no retrigger or waiver is needed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: raphaeltm/simple-agent-manager/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: a8e4b210-53b1-4bf8-bdb9-3ac8d2a37068

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[raphaeltm]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[codspeed]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/recover-c1-forms-after-465p25 (7a6f56f) with main (86e6c5b)}

[simple-agent-manager]

Parent review of exact7702452d29d6538d94bff311cc955285a848b454: staging HOLD pending the following corrections.

1. AcpFormCard drops valid empty-string answers in onAccept (value !== '') and maps an empty-string enum option to undefined. Shared and Go validators permit these values. Preserve valid empty text/enum values, distinguish select placeholder from an empty option, and cover required empty-string submission in the real UI tests.
2. The detail-fetch success callback does not check its AbortController before writing detail/values. Ignore stale success callbacks after cleanup/interaction changes. Clear retained answer receipt/content on terminal state or access revocation; add delayed-response ownership coverage.
3. Provide a concrete supported deployment path and effective binding read-back for ACP_INTERACTION_FORMS_ENABLED. The current diff adds Env typing but no deployment forwarding. Keep staging untouched until the revised candidate is reviewed.
4. Complete durable PR review/preflight evidence and post the reviewed desktop/mobile screenshots; local workspace paths are not accessible review artifacts. Resolve the current Preflight Evidence and Code Quality Checks failures.

Reviewed the Worker validation/encryption/deadline/receipt delta, Go schema validation/raw-frame guard, prompt/generation ownership, capability gating, and UI. Their core direction is sound; the findings above remain open. The #2200 permission assertions are preserved. No ready transition or merge is approved. Staging is reserved for C1 after these corrections and parent review of the resulting exact head.

[simple-agent-manager]

Reviewed7702452d..39d0f48: form validation/HMAC extraction and committed-answer/count helpers preserve the relevant behavior; no new blocker found in that refactor. Inspected committed mobile owner/actions and desktop actions screenshots: readable layout and unobstructed action buttons at the captured positions.

Staging remains HOLD: AcpFormCard is unchanged, so the prior empty-string answer, stale detail callback, retained receipt cleanup, and forms deployment-path findings remain open. Durable screenshot availability is now addressed. Await revised UI/tests and CI; do not treat this refactor review as staging authorization.

[simple-agent-manager]

Parent review PASS at exact418d5f2ea708d525ca3c645119911141402c9436. Reviewed the delta from39d0f48a: valid empty strings/enum selections now preserved; aborted detail responses ignored; terminal/revoked state discards private values/receipt; delayed hash completion fenced by active interaction/access identity. Regression tests exercise the races. Reviewed deployment flag propagation through both sync passes, checked-in false default, and new mobile/desktop empty-answer screenshots. Prior parent blockers addressed.

Staging is authorized for THIS exact head once current CI is green, subject to a fresh contention check. No additional parent confirmation required unless the code head changes. Root independently verified zero active staging nodes, no active staging deployment, ACP_INTERACTIONS_ENABLED=false, and forms binding absent. Owner must snapshot both override states, temporarily enable staging global+forms flags, deploy exact head, read back effective bindings/runtime version, validate the real account and fixture flows, then clean resources and restore both override presence and effective disabled values. Preserve precise session/interaction/receipt evidence. No production mutation, ready transition, or merge authorized by this approval.

[simple-agent-manager]

Parent delta review PASS exactb66937b1850df32e5850ddcdbb8a86cc7d8e1745. Compared against418d5f2e: capability-test expectation includes formBridge; Codex extracted-code evaluation removed and replaced with pinned source/helper/constants/fixture drift checks; Claude builder still executes. No production behavior change. Codex fingerprints remain static evidence, distinct from runtime execution.

Exact-head staging approval reinstated once latest-head CI (including Sonar) is green, subject to immediate contention check and the existing temporary staging flag, live roundtrip, cleanup and verified restoration conditions from comment5917571805. No additional confirmation needed unless head changes. No production mutation, ready transition or merge approved.

[simple-agent-manager]

Parent delta review PASS8098badd8927b4855f0580c6f9361c33d45e6aa2: compared tob66937b1, only verifier stdout wording changed to explicitly distinguish executable Claude evidence from static Codex fingerprints. Exact-head staging approval now applies to8098badd after full latest-head CI including Sonar passes, under all existing contention, temporary staging flags, live verification, rollback and cleanup conditions. No additional confirmation required then. Freeze the candidate; routine evidence can be recorded in this PR body/comments without restarting CI. No production/ready/merge approval.

[simple-agent-manager]

Parent delta review PASS exact53b170f706136b26814286c621506ec9d175519d. Compared with8098badd: removed child_process/npm PATH discovery; verifier requires explicit absolute existing adapter directories. Version/source/fixture checks retained. Only test tooling and its documentation changed.

Exact-head staging authorization applies to53b170f7 once all latest-head CI including Sonar passes and an immediate contention check is clear. All existing temporary staging flag, live proof, restoration and cleanup conditions remain; no additional parent confirmation needed then. No production/ready/merge authorization.

[simple-agent-manager]

Parent delta review PASS exact7a6f56f25847932fea8e8a592522aac2212a765e. Only inherited Worker tests changed: permission answers now select the offered allow option, preserving duplicate/race/outbox assertions. The purge test seeds legacy encrypted_answer/IV after a valid answer and confirms delivery before purge; it still asserts all detail/answer/decision ciphertext and IV columns are cleared while summaries survive. No production-validation change.

Staging approval applies to7a6f56f2 once ALL latest-head CI including full Worker suite and Sonar passes, plus immediate contention check. Previous temporary staging flags, live proof, rollback and cleanup conditions remain. No further parent confirmation needed then. No production/ready/merge approval.

[sonarqubecloud]

Quality Gate passed

Issues
34 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.9% Duplication on New Code

See analysis details on SonarQube Cloud

[simple-agent-manager]

Final C1 evidence is now in the PR body at frozen head 7a6f56f25847932fea8e8a592522aac2212a765e: full session/form IDs for Instant accept, Instant decline, and VM accept; safe receipt states and callback markers; the two diagnostic session IDs and their limits; VM provisioning versus form-wait timestamps; five stopped sessions/profile deletion receipts; zero active staging nodes; and rollback read-back.

Rollback workflow 36778422816 passed configuration, Cloudflare deploy, and smoke on that exact SHA. Fresh Worker settings read ACP_INTERACTIONS_ENABLED=false and ACP_INTERACTION_FORMS_ENABLED=false; both temporary staging GitHub overrides are absent. The default-mode probe observed no form emission; it does not prove the tool was unavailable.

GitHub records #2206 merged at 2026-09-30T21:43:58Z, before this evidence update. I made no code commit or merge. C1 activation remains separate from #2204.

[simple-agent-manager]

Cleanup addendum at frozen head 7a6f56f25847932fea8e8a592522aac2212a765e: after the Instant accept session stop returned HTTP 500, the test-owned node DELETE returned 200. Fresh reads show the session stopped, its workspace row absent, and its backing task cancelled with no workspace ID. All five temporary profiles return 404; staging D1 has zero active nodes. Both ACP staging GitHub overrides remain absent and effective Worker bindings remain false/false.

The PR body now distinguishes the live Instant decline callback from deterministic wrapper/prompt cancellation tests; no separate live cancel result is claimed. Live VM acceptance and the default-mode no-emission limit remain recorded with full IDs and safe receipts.

[simple-agent-manager]

Production verified: merge 989bf7b deployed successfully in run https://github.com/raphaeltm/simple-agent-manager/actions/runs/36783707657 after main CI36781294922 passed. Read-only Cloudflare settings confirm VM_AGENT_REQUIRED_VERSION matches that merge and both ACP_INTERACTIONS_ENABLED and ACP_INTERACTION_FORMS_ENABLED are false. Production API /health and app returned HTTP200. This ships dormant forms support; it does not activate interactions or resolve the separate legacy-runtime preservation, URL elicitation, auth diagnostics, or Sol6.1 provider-entitlement work.