[RefImpl] Keep AGT Guardian replay and session-chain state across restarts and eviction #233

Target runtime or language

Hardening the existing AGT reference implementation (reference-implementations/agt/, TypeScript on Bun).

What this proves

That the Guardian's replay protection (§10.3) and session chain (§8.6) hold for the lifetime of a session, not just the lifetime of the process. Both are deferred from #229 and listed there as follow-up work.

1. Replay protection survives a restart. createReplayProtectionStore() keeps seen request_id values in memory. After a restart, the Guardian accepts a request it already answered, as long as its timestamp is still inside the skew window. @astrogilda's acceptance test in probityai/agent-evidence-vectors#74 reproduces this. Only the skew window needs to be retained, because anything older is rejected with -32006.

2. A session's chain survives eviction and restart. The session-context store evicts the least recently written session when it passes maxSessions (default 1024). The eviction is reported on stderr. If an evicted session takes another step, its chain restarts at GENESIS_HASH and seq 1, and the Inspector shows a CHAIN BREAK. A restart does the same thing to every session. That avoids a chain that falsely looks complete, but the chain still breaks. A store that keeps or reloads each session's chain head would let the chain continue.

Done when a request replayed inside the skew window is refused with -32005 after a restart, and when a session that keeps taking steps across eviction or a restart continues its chain without a break.

Do you intend to implement this yourself

Yes, I want this assigned to me

Current Priority Scope

Feeds the runnable Guardian reference implementation

_{Issue drafted with Claude Code.}