Enforce constrained and idempotent delegated-agent writes

[ajac-zero]

Problem

The generic append endpoint accepts user, agent, or system sources, only checks that a supplied turn belongs to the conversation, and treats any retry using an existing idempotency key as equivalent without comparing source, turn, item count, or payload. Those semantics are too permissive for an external delegated agent runtime.

Proposed change

Add delegated-agent write validation, either inside the new atomic finalization endpoint or through a dedicated restricted append path. It must:

• require source: agent
• require the token-bound turn and conversation
• verify the turn agent matches the token agent
• accept new writes only while the turn is active
• validate an allowlisted set of Open Responses output item types and assistant roles
• reject user/system role injection and unsupported output shapes
• compute and persist a canonical digest covering source, turn, ordered payloads, and authorization bounds
• return the original result only for an exact retry
• return a typed conflict for a changed retry

Generic owner append may remain opaque and permissive; delegated writes need the stricter contract.

Acceptance criteria

• Delegated writes cannot target another turn, conversation, owner, or agent.
• Delegated writes cannot append after terminal turn closure.
• Exact retries return the original item IDs and sequence range.
• Changed source, turn, count, order, or payload under the same key is rejected.
• Sequence allocation remains transactional and gap-free.
• Allowed and rejected protocol shapes are documented and tested.
• Existing generic append behavior is either preserved for owner sessions or explicitly migrated with compatibility notes.

[dispatch-developer]

This spans authorization-bound write semantics, canonical idempotency, transactional sequencing, protocol validation, and compatibility coverage, so it is hard.