feat: supervise isolated recursive RLM sessions

[hallerite]

Summary

• supervise each recursive RLM session tree in one trusted process, with bounded recursion, concurrency, cancellation propagation, and joinable cleanup
• accept one strict, typed ai.prime.rlm/runtime-v1 payload at ACP session/new and return one authoritative ai.prime.rlm/session-v1 snapshot at session/close
• keep MCP transports and built-in search in the supervisor while exposing capability-bound proxy functions to the model-controlled kernel
• launch kernels with a minimal ambient environment plus the explicitly granted kernel_env, so provider, MCP, and search credentials are unavailable to kernel code and its subprocesses
• emit a standard HTTP Idempotency-Key for each actual model call, stable across SDK and outer retries, without exporting training-specific lineage semantics
• keep the public recursive surface small: rlm.run(prompt) returns a typed result while the supervisor owns identity, limits, metrics, and lifecycle

Contract

This intentionally breaks the earlier environment-variable and draft ACP contracts. There is no compatibility negotiation or fallback: clients must send the strict v1 runtime payload and consume the final v1 close snapshot. PrimeIntellect-ai/verifiers#2386 is the companion client change.

Security boundary

The kernel receives only the explicit task variables granted through kernel_env; provider, MCP, and search credentials stay in the supervisor. This prevents ambient credential leakage but is not hostile-code containment through a separate OS user or container boundary.

Validation

• uv run ruff check src tests
• uv run ruff format --check src tests
• uv run pytest tests/ -q — 122 passed
• Verifiers Prime VM contract E2E against 7a26d3c2cd2f38e11807ef7b88ce4ea197552ea8 — passed, covering two ACP prompts, MCP resume, concurrent recursive children, explicit/ambient environment isolation, and final close metrics

---

Note

High Risk
Reworks ACP session lifecycle, credential handling, and recursive execution. Breaking contract plus kernel isolation and broker RPC make this security- and training-critical.

Overview
Moves recursive rlm() calls, MCP, and credentialed search out of the IPython kernel into a session-tree supervisor. The kernel talks over a local framed broker using opaque capabilities; MCP URLs/headers/env and SERPER_API_KEY are no longer copied into kernel env or session artifacts.

ACP is now a strict versioned contract, not env-var fallback. initialize advertises ai.prime.rlm/contract-v1; session/new must send a complete runtime-v1 object (model, provider, policy, skills, kernel env, search key). session/close returns a credential-free session-v1 snapshot. Close/cancel/delivery are joinable and shielded.

Standalone CLI/Python still resolve RuntimeConfig from env (RLM_KERNEL_ENV, concurrency/call limits, tool-output window). Kernels start from a small platform env plus explicit task vars. Each model call gets a stable Idempotency-Key (retries use x-stainless-retry-count); those header names are reserved. rlm.run(prompt) is the public recursive surface.

^{Reviewed by Cursor Bugbot for commit 9f67cd7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 108604e. Configure here.}