feat(provider): persist and verify exact OMP continuation sessions

[tomdps]

Closes #866

[greptile-apps]

Greptile Summary

The PR adds exact OMP session continuation and verification.

• Detects valued --resume support from the locally installed OMP CLI and prevents caller overrides from bypassing that probe.
• Captures, persists, and validates exact OMP session identities for fresh and resumed tasks.
• Fails closed on missing, malformed, conflicting, or forked session identities.
• Adds contract, adapter, persistence, restoration, reuse, and end-to-end lifecycle coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/agent-cli-provider/adapters/omp.ts	Adds fail-closed valued-resume detection, command construction, and strict OMP session-frame inspection.
src/agent-cli-provider/single-agent-runtime.ts	Intersects resume feature overrides with local OMP capability detection, resolving the previously reported probing bypass.
task-lib/provider-session-capture.js	Applies provider-owned capture policy and persists exact identity verification or conflicts.
src/agent/provider-session.js	Enforces provider-specific identity normalization and completion validation before retaining resumable sessions.
task-lib/runner.js	Initializes tasks requiring OMP identity capture in an unverified state until watcher completion.
tests/unit/omp-session-lifecycle.test.js	Covers fresh capture, exact continuation, malformed or forked identities, persistence failures, retries, and durable task state.

Sequence Diagram

sequenceDiagram
  participant Agent
  participant Runtime
  participant OMP
  participant Watcher
  participant Store

  Agent->>Runtime: Invoke with optional resumeSessionId
  Runtime->>OMP: Probe --help
  OMP-->>Runtime: Advertised CLI capabilities
  alt Exact resume is locally supported
    Runtime->>OMP: "--resume <sessionId>"
  else Resume support is not proven
    Runtime-->>Agent: Reject continuation
  end
  OMP-->>Watcher: JSONL session frame
  Watcher->>Store: Persist captured session identity
  Watcher->>Watcher: Verify required/exact identity
  alt Identity is valid
    Watcher-->>Agent: Completed with verified session
  else Identity is missing, malformed, conflicting, or different
    Watcher-->>Agent: Fail closed
  end

Loading

_{Reviews (3): Last reviewed commit: "fix(provider): simplify OMP resume help ..." | Re-trigger Greptile}

[tomdps]

Updated c07ffda closes the continuation review loop end to end:

• local help must prove a valued --resume form; caller overrides cannot self-attest it
• OMP session headers are adapter-owned, exact, nonempty, and sticky on malformed/conflicting output
• fresh and resumed OMP tasks start fail-closed and become verified only in the watcher terminal transaction
• empty public task-run resume values are rejected instead of silently starting fresh
• fake OMP coverage crosses the real non-PTY watcher and SQLite row, including exact resume, fork/prefix mismatch, missing/malformed/conflicting IDs, persistence failure, restore, cwd/worktree drift, and continuation deltas
• fresh Claude/Codex behavior remains unchanged

Verification: provider build passed; 82 adapter/executable-contract tests and 43 lifecycle/capture/context/restore/reuse/task-run tests passed. Independent reviewer completed multiple reject/fix iterations and returned final APPROVE with no remaining blockers.