[danielkov]

Summary

Deliver the effective admitted prompt and attachments on AHP turn.start, with truthful user/external trigger provenance and enforceable denial, prompt replacement, and message effects.

Motivation

AHP defines expanded prompt content at the turn-start boundary. Kit previously reported an empty, externally triggered turn start and exposed the prompt only through user.message.inbound, masking interoperability gaps in backends that relied on that event alone.

Technical details

Keep user.message.inbound as a distinct input-arrival boundary and apply its effects before turn-start admission. Preserve logical message identity across both events so receivers can correlate transcript persistence without suppressing either policy decision. Mid-turn arrivals emit inbound without creating another turn start; internal notification turns do not invent an inbound message.

Apply full canonical prompt-list replacements within the admitted item scope, preserving authorized opaque attachment identities and persisting the effective input. Advertise only supported turn-start effects, and preserve cancellation and turn/session lifecycle ordering.

[kit-code-agent]

Turn-start handling can leave denied input pending, discard ACP replay identity, and emit unmatched completion events; the documented authority table also needs updating.

_{Took 24 min}

[kit-code-agent]

[P2] Include prepended notifications in the admitted turn scope — Notifications submitted with a user prompt are omitted from turn.start.items and survive full replacement or denial, allowing a model call after denial.

[P2] Preserve ACP replay identity when replacing admitted input — A legal replacement with a new canonical message ID drops the host-owned ACP message identity, invalidating the live replay cursor and changing the identity returned by full replay.

[P3] Pair turn completion when inbound interception is cancelled — Interrupting during user.message.inbound skips turn.start but still delivers the native cancelled turn.end, leaving receivers with an unmatched completion.

[P3] Update the documented turn-start authority — The hook-authority table still describes turn.start as observe-only although Kit now grants denial, prompt replacement, and user-facing messages.

_{Took 8 min 57 sec}

[kit-code-agent]

Admission can falsely acknowledge model-switch compaction, redispatch historical input after denial, and omit the start event for a background-approval turn.

_{Took 16 min}

[kit-code-agent]

A cancellation before turn-start delivery can leave an unmatched turn.end because the new start claim suppresses the completion fallback.

_{Took 12 min}

[kit-code-agent]

No issues found. The changes look good to merge.

_{Took 11 min}