feat: af install --path selector + Go SDK harness fixes

[AbirAbbas]

This PR consolidates two related changes into a single reviewable unit. It
supersedes and replaces #746 — the three Go SDK commits from that PR
(7c6f11e1, 18c3f3ea, 5b763d87) are cherry-picked here (-x), and #746
has been closed in favor of this one. The two changes are independent (one
touches control-plane/, the other only sdk/go/) but ship together so a
single node repo can both be installed via af install --path and drive a Go
SDK harness that talks to the control plane correctly.

---

Part 1 — af install --path selector for one-repo multi-package installs

Problem

The SWE-AF repository ships two installable nodes from one repo: a Python node
(manifest at the repo root) and a Go port under go/ (which will get its own
go/agentfield-package.yaml). Today af install has no way to select a
subdirectory — GitInstaller.findPackageRoot walks the clone and takes the
first agentfield-package.yaml (root wins). Registry entries are keyed by
manifest name, so two packages from one repo already coexist cleanly — only
the selector was missing.

The root manifest must stay exactly what a bare af install <repo> gets. This PR
adds an opt-in --path <subdir> selector without changing any default behavior.

Design

af install <source> --path <subdir>:

• <subdir> is relative to the source root (e.g. go). The manifest MUST exist
  at <root>/<subdir>/agentfield-package.yaml, and that subdirectory becomes the
  package root — its subtree is what gets copied to
  ~/.agentfield/packages/<name>. A missing manifest fails with an error naming
  the full expected path.
• Validation: absolute paths and paths that escape the source root via ..
  (after filepath.Clean, plus a post-join containment check) are rejected. For
  the git path this syntactic check runs before any clone work.
• No flag → byte-identical to today (root-first walk).
• Composes with the existing @ref pin on git URLs (ref is parsed from the URL,
  subdir is resolved after clone — orthogonal).
• Applies to both the git install path and the local-directory install path
  with identical semantics (<local-dir>/<subdir>), resolved before any copy or
  registry mutation.
• The selector targets the top-level source only; it is never propagated to
  recursively-installed node dependencies.

Key pieces: domain.InstallOptions.Path; shared
packages.ResolvePackageSubdir / ValidateSubdirSelector;
GitInstaller.Subdir + resolvePackageRoot; --path flag + help text in the
CLI; local path threaded through installLocalPackage.

Validation contract

• --path go on a repo with manifests at both root and go/ installs the
  go/ package (registry entry named per the go/ manifest; package dir holds
  the go/ subtree at its root).
• Bare af install <repo> on the same repo installs the ROOT package —
  unchanged behavior.
• --path <dir> with no manifest there errors with the expected manifest
  path; nothing installed, no registry mutation.
• --path /abs and --path ../escape are rejected before any install work.
• --path go combined with an @ref on the URL — both honored.
• A Go-language subdir package (go.mod + entrypoint.build at the subdir
  root) resolves its build relative to the subdir-as-package-root.

Test plan / gates run

New behavior-driven tests (derived from the contract, not the implementation):

• control-plane/internal/packages/install_path_test.go — resolver + git
  post-clone resolution (faked clone, no network) + @ref composition + Go
  subdir build via the existing stubbed toolchain.
• control-plane/internal/core/services/install_path_test.go — local-directory
  --path selection, root default, and rejection paths leaving the registry
  unmutated.

---

Part 2 — Go SDK harness fixes (consolidates #746)

Problem

The Go SDK's claudecode harness and Agent.Call had three defects that broke
long-running child reasoners and the claude runtime path:

1. Prompt swallowed by variadic flags. The claude prompt was passed as a
   positional argument, but the variadic --allowedTools flag consumed it —
   claude never received the prompt.
2. Wrong note endpoint. The note endpoint path was missing its /api/v1
   prefix.
3. 15s hard cap on Agent.Call. Agent.Call was a synchronous
   POST /execute/{target} bounded by the 15s default http.Client timeout, so
   any child reasoner that ran longer than 15s was killed.
4. Idle watchdog starved. The claude provider's output format didn't stream
   incremental events, so the idle watchdog could fire mid-run.

Fixes

• Prompt via stdin. The claude prompt is now delivered on stdin rather
  than as a positional arg, so the variadic --allowedTools flag can no longer
  swallow it.
• Note endpoint path corrected to /api/v1.
• Agent.Call rewritten to async submit + poll. It now mirrors the Python
  SDK: submit via /execute/async/{target}, then poll the execution record with
  Python-parity pacing (0.25s doubling to 4s, jittered), the call timeout
  bounding each individual request rather than the overall wait, fully
  ctx-cancellable, with lineage headers on submit and polls so DAG parentage is
  preserved. This removes the sync endpoint's 15s cap.
• claude output switched to --output-format stream-json --verbose, so
  incremental events keep the idle watchdog fed for the full duration of a run.

Tests

• sdk/go/agent/agent_call_coverage_test.go — covers the async Call
  submit/poll paths: poll-interval clamping, submit-side request/transport/
  read/decode/4xx errors, and await-side ctx-cancel, transport, read, HTTP-error,
  and decode branches.
• sdk/go/harness/claudecode_defaultrunner_test.go — covers the
  claudecode default-runner fallback (the runCLI == nil path in
  ClaudeCodeProvider.Execute).
• Plus stdin/stream-json coverage in claudecode_test.go,
  claudecode_integration_test.go, and agent_test.go / note_test.go.

These lift sdk-go patch coverage above the 80% min_patch gate (98% on the
touched lines).

---

Gates run (both parts)

Run locally against the CI-literal steps (Go 1.25.4, GOWORK=off):

• control-plane: go build ./..., go vet ./..., go test ./... — pass
  (one pre-existing, environment-dependent failure, TestDevServiceRunDev,
  which spawns a real agent subprocess and polls its port; unrelated to and
  untouched by this PR — it passes in CI).
• sdk/go: go build ./..., go vet ./..., go test ./... — pass.
• gofmt -l clean on all changed files.
• golangci-lint run --new-from-rev=origin/main on control-plane → 0 new issues.
• sdk-go patch-coverage gate (diff-cover vs origin/main) → 98%, above the
  80% min_patch floor.

---

Part 3 — provider + failure-path parity fixes

Four verified Go SDK fixes bringing the harness providers and the async
failure path to parity with the Python reference implementations. All changes
are under sdk/go/ (plus one new sdk/go/go.mod dependency).

Fix 1 — codex native structured output (harness/codex.go)

The codex provider ignored options.Model and built a deprecated
codex exec --json [--full-auto] invocation. Ported from the codex harness
patch:

• Pass -m <model> (SWE-AF resolves gpt-5.5 vs gpt-5.3-codex by auth mode and
  the value must reach the CLI).
• Add --skip-git-repo-check.
• Replace deprecated --full-auto with the permission->sandbox mapping: auto
  -> --dangerously-bypass-approvals-and-sandbox; read-only /
  workspace-write / danger-full-access -> --sandbox <mode>; else
  --sandbox workspace-write.
• Deliver the prompt via stdin (mirroring the claude provider), not argv.
• Native structured output: when a schema is set, pass --output-schema
  (pointing at the STRICT rewrite of the schema — defaults stripped, all
  properties required, additionalProperties:false, recursively) and
  --output-last-message, reading the last-message file when stdout yields no
  parseable final text. The runner owns the strict-schema computation + file
  write and hands codex the paths via a schemaAware interface, then swaps in a
  codex-native prompt suffix while claude/opencode keep the Write-tool suffix.
  Options gains no schema field.

Fix 2 — opencode JSON stream + exit-0 error surfacing (harness/opencode.go)

• Add --format json and parse the JSONL event stream: recover the final
  message, sum per-step cost from step_finish events (nil when none report a
  cost), and count turns per step_start (falling back to tool_use).
• Surface hard failures on which opencode exits 0 (Model not found,
  AuthenticationError, Unauthorized, APIError) plus in-band JSON error
  events, instead of returning empty output that reads downstream as "no
  result". Non-JSON stdout still falls back to trimmed raw text.

Fix 3 — native ReasonerFailed carrier (agent/)

New exported ReasonerFailed{Message, Result, ErrorDetails} error type. In
executeReasonerAsync's error branch it is detected via errors.As and its
result / error_details are attached to the single 5x-retried status post
(only when non-nil), so a reasoner that ran but failed records status=failed
without discarding its structured outcome. The two sync HTTP paths
(handleExecute / handleReasoner) mirror this on their error response; a
plain error synthesizes neither key.

Fix 4 — real schema validation in the harness retry loop (harness/)

ParseAndValidate was unmarshal-only, so output missing required fields,
carrying invalid enum values, or (with additionalProperties:false) extra
fields passed silently and the schema-retry loop never fired. Add
validateAgainstSchema (github.com/santhosh-tekuri/jsonschema/v5) and run it
at every parse-success point in handleSchemaWithRetry, so a validation failure
drives the existing retry branch (schemaMaxRetries default 2 preserved).
Validation applies only when both a destination and a schema are provided;
uncompilable schemas skip validation (no regression).

Note: this makes map-schema harness calls stricter than before (previously
unmarshal-only) — callers control strictness through the schema they pass.

Gates run (Part 3)

• sdk/go: go build ./..., go vet ./..., go test ./... — pass; gofmt -l
  clean on all changed files.
• golangci-lint run --new-from-rev=origin/main on sdk/go -> 0 new issues
  (the 7 pre-existing findings on earlier commits are untouched).
• sdk-go patch-coverage gate (diff-cover vs origin/main) -> 94% on 621
  touched lines, above the 80% min_patch floor.

Part 4 — Agent.Call resilience to transient control-plane outages (agent/)

Real-LLM testing exposed a robustness bug in the async submit+poll Agent.Call
path this branch introduced: a single failed HTTP request to the control plane
killed the whole call. Two ~hour-long SWE-AF builds died at ~55 minutes when the
CP briefly went slow under system load (load avg ~37 on a 16-core box; the CP
itself was healthy and recovered) — one status poll that timed out "awaiting
headers" aborted a call that had been running 30+ minutes, and a slow submit
POST likewise killed a call before it could be confirmed accepted.

Poll resilience. A transient poll failure (transport error/timeout, 408/429,
or 5xx) no longer fails the call. Consecutive failures retry with exponential
backoff (capped 15s) for a configurable window of unbroken failure — default
5 min — after which the call fails with a clear control plane unreachable for Xs
error rather than the raw first error. A single successful poll resets the
window. A 404 on a just-submitted execution (the CP can lag before the row is
queryable) retries within a shorter bounded window, then fails with a distinct
not-found message. Permanent 4xx (auth, bad request) still abort immediately.

Submit safety. Re-POSTing execute/async is not idempotent (a duplicate
would double-run a coder), so the submit retries only on errors that prove the
request never reached the server — dial / DNS / connection-refused, detected by
inspecting the error chain (syscall.ECONNREFUSED, net.DNSError, dial-phase
net.OpError). Ambiguous failures (a timeout awaiting headers — the request may
already have been accepted) are never blind-retried; instead the submit client
timeout is raised substantially (default 120s) so a slow-but-healthy CP doesn't
abort an accepted request, failing with a clear message only if it still times
out.

Config. Three env knobs (AGENTFIELD_* integer-seconds convention, read
once and cached): AGENTFIELD_CALL_POLL_TIMEOUT_SECONDS (60),
AGENTFIELD_CALL_RETRY_WINDOW_SECONDS (300),
AGENTFIELD_CALL_SUBMIT_TIMEOUT_SECONDS (120), with dedicated submit/poll HTTP
clients so these timeouts don't affect other client traffic. Each retried
failure logs at warn via the existing structured-log seam
(call.outbound.submit_retry / call.outbound.poll_retry) with attempt count
and elapsed window, so operators see degradation without the call dying.

Python parity. The Python SDK's async Call path (_submit_execution_sync /
_await_execution_sync in client.py) uses bare requests with
raise_for_status() and no transient retry — its shared-session urllib3
Retry(total=3) adapter is not applied to those calls — so it shares this
fragility (its only comparable retry is wait_for_approval's catch-all
back-off loop). This Go change improves on Python: a bounded failure window,
404-specific handling, and idempotency-safe submit retries.

Gates run (Part 4)

• sdk/go: go build ./..., go vet ./..., go test ./... — pass; gofmt -l
  clean on all changed files.
• golangci-lint run --new-from-rev=origin/main on sdk/go -> 0 issues
  (also cleaned the pre-existing branch-delta findings this gate surfaced).
• sdk-go patch-coverage gate (diff-cover vs origin/main) -> 89% on 779
  touched lines, above the 80% min_patch floor; agent package 92.3%.

🤖 Generated with Claude Code

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	86.90%	87.40%	↓ -0.50 pp	🟡
sdk-go	92.50%	92.00%	↑ +0.50 pp	🟢
sdk-python	93.76%	93.73%	↑ +0.03 pp	🟢
sdk-typescript	90.42%	90.42%	→ +0.00 pp	🟢
web-ui	84.76%	84.79%	↓ -0.03 pp	🟡
aggregate	85.55%	85.75%	↓ -0.20 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	82	92.00%	✅
sdk-go	849	95.00%	✅
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.

[github-actions]

Performance

SDK	Memory	Δ	Latency	Δ	Tests	Status
Go	226 B	-19%	0.63 µs	-37%	✓	✓

✓ No regressions detected