fix: enforce immutable session configuration laws

LAWS/CHAT.md

@@ -37,3 +37,9 @@
 
 - A session's subagent activity MUST appear in the chat transcript with the subagent identity when known.
 - A session's subagent activity MUST appear in the chat transcript with the delegated task when known.
+
+## Session configuration
+
+- A session’s provider MUST support its model, and its harness MUST support that provider.
+- A session MUST have exactly one effective configuration.
+- Berd MUST show the configuration that the session uses.

src/app/AppShell.berdctl.test.tsx

@@ -80,6 +80,7 @@ vi.mock("@/app/views/NavigationPanesView", () => ({
 }));
 
 vi.mock("@/shared/api/acp", () => ({
+  reserveAcpSessionConfiguration: () => ({ sequence: 0, clear: () => {} }),
   acpCreateSession: (...args: unknown[]) => mockAcpCreateSession(...args),
   acpListSessionsPage: (...args: unknown[]) => mockAcpListSessionsPage(...args),
   acpLoadSession: (...args: unknown[]) => mockAcpLoadSession(...args),

src/app/AppShell.navigation.test.tsx

@@ -317,6 +317,19 @@ function seedProviderModels(
       ],
     ]),
   );
+  // Simulate a successful live inventory response: seeding a provider's
+  // display candidates alone is advisory and never establishes proof.
+  useProviderModelCacheStore.setState((state) => {
+    const providers = new Map(state.providers);
+    const existing = providers.get(providerId);
+    if (existing) {
+      providers.set(providerId, {
+        ...existing,
+        provenModelIds: models.map((model) => model.id),
+      });
+    }
+    return { providers };
+  });
 }
 
 vi.mock("@/shared/profile/buildProfile", () => ({
@@ -440,6 +453,7 @@ vi.mock("@/shared/api/acp", () => ({
   acpListSessionsPage: (...args: unknown[]) => mockAcpListSessionsPage(...args),
   acpLoadSession: (...args: unknown[]) => mockAcpLoadSession(...args),
   discoverAcpProviders: vi.fn().mockResolvedValue([]),
+  reserveAcpSessionConfiguration: () => ({ sequence: 0, clear: () => {} }),
 }));
 
 vi.mock("@/shared/api/acpApi", () => ({
@@ -1403,6 +1417,7 @@ describe("AppShell global navigation", () => {
         "openai",
         "~/goose artifacts",
         expect.any(Object),
+        expect.objectContaining({ clear: expect.any(Function) }),
       );
     });
     expect(
@@ -3426,6 +3441,7 @@ describe("AppShell global navigation", () => {
         "codex-acp",
         "~/goose artifacts",
         expect.objectContaining({ modelId: "gpt-5.4-mini" }),
+        expect.objectContaining({ clear: expect.any(Function) }),
       );
     });
     act(() => pendingPrepare.resolve({}));
@@ -3488,6 +3504,7 @@ describe("AppShell global navigation", () => {
         "databricks_v2",
         "~/goose artifacts",
         expect.objectContaining({ modelId: "goose-gpt-5-5" }),
+        expect.objectContaining({ clear: expect.any(Function) }),
       );
     });
     await waitFor(() => {

src/app/AppShell.tsx

@@ -2700,17 +2700,28 @@ export function AppShell({
         const persona = agentState.personas.find(
           (candidate) => candidate.id === agentId,
         );
-        const cachedModels = [
-          ...useProviderModelCacheStore.getState().providers,
-        ].flatMap(([providerId, entry]) =>
-          entry.models.map((model) => ({
+        const modelCache = useProviderModelCacheStore.getState();
+        const cachedModels = [...modelCache.providers].flatMap(
+          ([providerId, entry]) =>
+            entry.models.map((model) => ({
+              ...model,
+              providerId: model.providerId ?? providerId,
+            })),
+        );
+        const provenModels = [...modelCache.providers].flatMap(([providerId]) =>
+          modelCache.getProvenModelsForProvider(providerId).map((model) => ({
             ...model,
             providerId: model.providerId ?? providerId,
           })),
         );
         const executionTarget = personaExecutionTarget(persona, {
           providers: agentState.providers,
           models: cachedModels,
+          getProvenModelsForHarness: () => provenModels,
+          isModelInventoryAuthoritative: (providerId) =>
+            useProviderModelCacheStore
+              .getState()
+              .isModelInventoryAuthoritative(providerId),
           catalogEntries: getProviderCatalog(),
         });
 

src/app/lib/chatRuntimeStartup.test.ts

@@ -5,6 +5,18 @@ const mockLoadPersistedMessageQueues = vi.hoisted(() =>
 );
 const mockGetClient = vi.hoisted(() => vi.fn<() => Promise<unknown>>());
 const mockRefreshAllModelProviders = vi.hoisted(() => vi.fn());
+const mockMigratePersonaTargetIfUnchanged = vi.hoisted(() => vi.fn());
+const mockAgentState = vi.hoisted(() => ({
+  personas: [] as Array<Record<string, unknown>>,
+  providers: [] as Array<{ id: string; label?: string }>,
+}));
+const mockModelCacheState = vi.hoisted(() => ({
+  providers: new Map<
+    string,
+    { models: Array<Record<string, unknown>>; provenModelIds?: string[] }
+  >(),
+  runtimeManagedProviderIds: new Set<string>(),
+}));
 
 // The latch under test wraps startChatRuntime, whose body touches most of the
 // startup module graph. Everything it reaches is stubbed inert (resolved,
@@ -18,6 +30,7 @@ vi.mock("@/features/agents/stores/agentStore", () => ({
       setProviders: () => {},
       setPersonas: () => {},
       setPersonasLoading: () => {},
+      ...mockAgentState,
     }),
   },
 }));
@@ -48,12 +61,15 @@ vi.mock("@/features/providers/runtimeProviderConstraints", () => ({
 }));
 
 vi.mock("@/features/providers/modelCacheRefresh", () => ({
-  getModelCacheRefreshProviderIds: () => [],
+  getModelCacheRefreshProviderIds: () => ["claude-acp"],
 }));
 
 vi.mock("@/features/providers/providerCatalog", () => ({
+  canonicalProviderCatalogIdFromEntries: (_entries: unknown, id: string) => id,
   getModelProviders: () => [],
   getProviderCatalog: () => [],
+  resolveAgentProviderCatalogIdStrictFromEntries: () => null,
+  resolveModelProviderCatalogIdStrictFromEntries: () => null,
 }));
 
 vi.mock("@/features/providers/runtimeProviderConfig", () => ({
@@ -110,8 +126,7 @@ vi.mock("@/features/providers/stores/defaultProviderReadinessStore", () => ({
 vi.mock("@/features/providers/stores/providerModelCacheStore", () => ({
   useProviderModelCacheStore: {
     getState: () => ({
-      providers: new Map(),
-      runtimeManagedProviderIds: new Set(),
+      ...mockModelCacheState,
       loadPersisted: () => {},
       refreshAllModelProviders: (...args: unknown[]) =>
         mockRefreshAllModelProviders(...args),
@@ -166,8 +181,9 @@ vi.mock("@/shared/api/distro", () => ({
 }));
 
 vi.mock("@/shared/api/agents", () => ({
-  listPersonas: async () => [],
-  migratePersonaTargetIfUnchanged: async () => null,
+  listPersonas: async () => mockAgentState.personas,
+  migratePersonaTargetIfUnchanged: (...args: unknown[]) =>
+    mockMigratePersonaTargetIfUnchanged(...args),
 }));
 
 function deferred<T>() {
@@ -190,6 +206,12 @@ describe("runChatRuntimeStartup", () => {
     mockGetClient.mockResolvedValue({});
     mockRefreshAllModelProviders.mockReset();
     mockRefreshAllModelProviders.mockResolvedValue(undefined);
+    mockMigratePersonaTargetIfUnchanged.mockReset();
+    mockMigratePersonaTargetIfUnchanged.mockResolvedValue(null);
+    mockAgentState.personas = [];
+    mockAgentState.providers = [];
+    mockModelCacheState.providers = new Map();
+    mockModelCacheState.runtimeManagedProviderIds = new Set();
   });
 
   it("collapses concurrent callers onto one startup run", async () => {
@@ -221,6 +243,73 @@ describe("runChatRuntimeStartup", () => {
     inventoryRefresh.resolve();
   });
 
+  it("does not migrate a runtime-managed configuration seed before live discovery", async () => {
+    mockAgentState.providers = [{ id: "claude-acp", label: "Claude Code" }];
+    mockAgentState.personas = [
+      {
+        id: "persona-1",
+        displayName: "Configured Claude",
+        systemPrompt: "Help.",
+        provider: "claude-acp",
+        modelProviderId: "claude-acp",
+        model: "configured-model",
+        isBuiltin: false,
+        writable: true,
+      },
+    ];
+    mockModelCacheState.runtimeManagedProviderIds = new Set(["claude-acp"]);
+    mockModelCacheState.providers = new Map([
+      [
+        "claude-acp",
+        {
+          models: [{ id: "configured-model", providerId: "claude-acp" }],
+        },
+      ],
+    ]);
+
+    const { runChatRuntimeStartup } = await import("./chatRuntimeStartup");
+    await runChatRuntimeStartup();
+
+    expect(mockMigratePersonaTargetIfUnchanged).not.toHaveBeenCalled();
+  });
+
+  it("migrates an authoritative unsupported persona model without losing its harness", async () => {
+    mockAgentState.providers = [{ id: "claude-acp", label: "Claude Code" }];
+    mockAgentState.personas = [
+      {
+        id: "persona-1",
+        displayName: "Legacy Claude",
+        systemPrompt: "Help.",
+        provider: "claude-acp",
+        modelProviderId: "openai",
+        model: "gpt-5",
+        isBuiltin: false,
+        writable: true,
+      },
+    ];
+    mockModelCacheState.providers = new Map([
+      ["claude-acp", { models: [], provenModelIds: [] }],
+    ]);
+    mockRefreshAllModelProviders.mockImplementation(async () => {
+      mockModelCacheState.providers = new Map([
+        ["claude-acp", { models: [], provenModelIds: [] }],
+      ]);
+    });
+
+    const { runChatRuntimeStartup } = await import("./chatRuntimeStartup");
+    await runChatRuntimeStartup();
+    await vi.waitFor(() => {
+      expect(mockMigratePersonaTargetIfUnchanged).toHaveBeenCalledWith(
+        expect.objectContaining({ id: "persona-1" }),
+        {
+          provider: "claude-acp",
+          modelProviderId: "claude-acp",
+          model: null,
+        },
+      );
+    });
+  });
+
   it("stays latched after a successful run", async () => {
     const { runChatRuntimeStartup } = await import("./chatRuntimeStartup");
     const first = runChatRuntimeStartup();

src/app/lib/chatRuntimeStartup.ts

@@ -259,15 +259,19 @@ async function startChatRuntime(
     const cachedModels = [...modelState.providers].flatMap(
       ([providerId, entry]) =>
         authoritativeProviderIds.has(providerId)
-          ? entry.models.map((model) => ({
-              ...model,
-              providerId: model.providerId ?? providerId,
-            }))
+          ? entry.models
+              .filter((model) => entry.provenModelIds?.includes(model.id))
+              .map((model) => ({
+                ...model,
+                providerId: model.providerId ?? providerId,
+              }))
           : [],
     );
     const targetContext = {
       providers: useAgentStore.getState().providers,
       models: cachedModels,
+      isModelInventoryAuthoritative: (providerId: string) =>
+        authoritativeProviderIds.has(providerId),
       catalogEntries: getProviderCatalog(),
     };
     const personas = useAgentStore.getState().personas;
@@ -311,13 +315,14 @@ async function startChatRuntime(
     );
     await modelCacheStore.refreshAllModelProviders(refreshProviderIds);
     const modelState = useProviderModelCacheStore.getState();
-    return new Set([
-      ...modelState.runtimeManagedProviderIds,
-      ...refreshProviderIds.filter((providerId) => {
+    return new Set(
+      refreshProviderIds.filter((providerId) => {
         const entry = modelState.providers.get(providerId);
-        return entry != null && !entry.error;
+        return (
+          entry != null && !entry.error && entry.provenModelIds !== undefined
+        );
       }),
-    ]);
+    );
   };
 
   const loadSessionState = async () => {

src/app/views/__tests__/NavigationPanesView.test.tsx

@@ -315,6 +315,7 @@ vi.mock("@/features/chat/stores/chatStore", () => ({
 }));
 
 vi.mock("@/shared/api/acp", () => ({
+  reserveAcpSessionConfiguration: () => ({ sequence: 0, clear: () => {} }),
   acpSearchSessions: (...args: unknown[]) => mockAcpSearchSessions(...args),
 }));