Audit coding-agent runtime capabilities and integration contracts

## Parent and milestone

- Parent issue: #23
- Milestone: not scheduled; design may proceed before implementation is gated
by #15.

## Problem

Codex, OpenCode, Pi, Claude Code, generic PTY execution, and their ACP adapters
expose different session, event, approval, cancellation, authentication, and
usage contracts. Designing an abstraction without a verified capability matrix
risks duplicating ACP, leaking vendors, or reducing every runtime to an
unreliable lowest-common-denominator interface.

## Outcome

Publish a source-linked capability and maturity audit that recommends ACP,
native extension, and degraded fallback behavior plus conformance scenarios for
each runtime.

## Scope

- Audit the pinned ACP schema, registry, authentication, session, prompt,
update, tool, permission, content, diff, terminal, capability, cancellation,
and remote-transport contracts.
- Audit Codex CLI/app-server/ACP adapter, OpenCode server/OpenAPI/SSE/ACP, Pi
SDK/RPC/ACP adapter, Claude Code supported interfaces, and generic PTY
fallback.
- Compare start, resume, follow-up input, events, approvals, cancellation,
health, usage, authentication, local/remote operation, and protocol stability.
- Separate agent-runtime capabilities from model-provider capabilities and
Durex queue, workspace, secret, plugin, budget, and node ownership.
- Classify each integration as `acp_standard`, `acp_plus_native`, or
`pty_degraded` with evidence for every exception.

## Non-goals

- Implementing an adapter.
- Forking ACP or adding private Durex lifecycle methods to it.
- Automating any consumer web chat.
- Selecting providers based only on popularity or claimed token savings.

## Acceptance criteria

- [ ] The audit links primary documentation, pins versions, and records the
review date.
- [ ] ACP coverage and gaps are mapped before any native adapter design.
- [ ] Codex, OpenCode, and Pi have complete capability matrices and recommended
integration paths.
- [ ] Every native extension has a required capability and security rationale.
- [ ] Claude Code and PTY fallback have explicit deferred or degraded
semantics.
- [ ] Required conformance tests are derived from observed behavior.
- [ ] Architecture documentation and #23 traceability are updated.

## Validation

- Run documented smoke probes against pinned ACP adapters and runtime versions
where installation and credentials permit.
- Review the matrix against current Durex runner, supervisor, interaction,
workspace, and live-output contracts.

## Dependencies

- #42 supplies the competitive baseline; implementation remains gated by #15.

Start with the pinned ACP schema and registry, then audit the named Codex, OpenCode, Pi, Claude Code, and PTY interfaces against the listed session, event, approval, cancellation, authentication, and usage contracts. Record primary sources, versions, review dates, capability matrices, integration classifications, security rationale, and conformance scenarios; finish by updating architecture documentation and #23 traceability.

Written by the indexing model from the issue text.