refactor: reuse shared definitions with frozen client behavior

[samheutmaker]

Repeated lifecycle comparisons, MCP projections, effort lists, and trace types could drift independently. This reuses existing definitions where their semantics match and adds regression checks where separate representations must remain.

Follows #320. The dependency/security repair in #329 was incorporated for fresh validation; the incremental 16-file DRY patch is unchanged from the original reviewed head.

Changes

• Reuse separate command and turn terminal-status predicates, and the existing agent predicate. Preserve each domain's values, unknown-status handling, root-turn defaults, admission rules, and cancellation targets.
• Import/re-export the SDK's trace types in the app, reuse the existing MCP status projection, and derive TUI fallback effort values from its completion metadata.
• Guard intentionally separate MCP runtime/wire/persisted shapes and model metadata conversions, including sorting, empty arrays, omitted fields, trust removal, capability ordering, and exact pricing strings.

Behavior constraints

SDK and protocol sources, generated contracts, migrations, and the original compatibility baseline are unchanged. No response, event, ordering, acceptance, cancellation, reconnect, schema, or provider behavior is intentionally changed. No translation layer is added.

Turn, command, and agent state machines remain separate. Existing TUI versus desktop/web effort fallback differences remain. Model conversion implementations remain unchanged; their distinct projections are protected by tests instead of being forced into one struct.

Validation

• Final full-stack head e1e5e36cee54575d52730902176117bf0e2bba91 passed all 22 checks in fresh CI, including security, compatibility, SDK/browser, mobile, desktop lifecycle/SSH, and distribution gates. Go coverage is 90.1% against the unchanged 90% floor. The final development merge commit 58860dc7715a4122c713a205cca0a2194b648a1e has exactly the tested full-stack tree; frozen SDK/protocol/database paths remain unchanged.
• New lifecycle/cancellation/MCP/model characterization tests passed against unchanged refactor(backend): separate responsibilities with a frozen client contract #320 before refactoring, then passed after the changes.
• Full Go suite and affected session/client/daemon race suites passed; focused MCP/provider/config race checks passed.
• Build, vet, whipvet, integration-tag compilation, and pinned golangci-lint passed (zero lint issues).
• App typecheck/production build and 44 focused trace/model-selection tests passed. Both changed app files emit byte-identical JavaScript.
• Fresh compatibility checks passed at clean head 1bb0b4661fa4f7a0236dfdb9f377656c10f4e05d against original baseline 271c0f8d2a35648d1b45056d57432590b783483c and refactor(backend): separate responsibilities with a frozen client contract #320: byte-identical generated/SDK artifacts, calibrated Unix/WebSocket responses and ordered events, mutation negative controls, lifecycle checks, and both-engine retained-data/schema/trace rollback.
• Complete task acceptance passed on the final head, including all 49 SDK acceptance cases with zero failures or skips, native/recursive-agent behavior, reconnect/cancellation, persistence, and model accounting.

---

Note

Medium Risk
Dependency pins from unmerged upstream archives and Go 1.27.2 shift coverage weighting; lifecycle and client cancellation paths are refactored but heavily regression-tested.

Overview
Bumps Go to 1.27.2 and refreshes golang.org/x/*, golangci-lint v2.14.0, and docs TanStack pins. CI’s SDK job now runs npm run audit:production instead of raw npm audit.

Adds npm overrides for braces and node-forge from reviewed upstream tarballs, plus scripts/audit-production.mjs (pin/hash verification and a single allowed GHSA disposition for fixed-but-still-3.0.3 braces). docs/dependency-security.md documents the process.

Centralizes lifecycle semantics with IsTerminalCommandStatus and IsTerminalTurnStatus, wired through session store, daemon admission, and root client (command tracking, turn cleanup, cancel targeting). MCP mcp.status uses mcp.ServerStatuses instead of hand-built JSON.

Reuses SDK trace types in the app (trace-math.ts) and derives TUI defaultEfforts from completion metadata; a few CutLast call sites satisfy new linter modernization hints.

Adds regression tests only for status boundaries, root-client cancellation/provider validation, MCP/config/model contract parity, and LLM encode/decode/presentation bounds—documented as behavior-preserving with no SDK/protocol/migration changes.

^{Reviewed by Cursor Bugbot for commit e1e5e36. Bugbot is set up for automated code reviews on this repo. Configure here.}