realtime-session-fixtures-state.ts — the hand-off between the two realtime-session bundles.
realtime-session-guard (server transport, runs first) seeds sessions whose Config carries
SERVER-DECIDED keys (maxSessionDeadlineIso, identityVerification). Those keys can only be written
by trusted in-process code — MJAIAgentSessionEntityServer refuses every other writer, including the
session's owner over the wire, which is precisely what the guard exists to do — so the wire bundle
realtime-session-verification (client transport) cannot create such a row itself. It reads the ids
from here instead.
This module is deliberately free of any server import so the client bundle stays "server-free by
construction" (see bootstrap-client.ts). Both bundles run serially in one process, so module state is
a safe carrier (the same device subscription-isolation and permission-engine use for fixtures).
realtime-session-fixtures-state.ts — the hand-off between the two realtime-session bundles.
realtime-session-guard(server transport, runs first) seeds sessions whoseConfigcarries SERVER-DECIDED keys (maxSessionDeadlineIso,identityVerification). Those keys can only be written by trusted in-process code —MJAIAgentSessionEntityServerrefuses every other writer, including the session's owner over the wire, which is precisely what the guard exists to do — so the wire bundlerealtime-session-verification(client transport) cannot create such a row itself. It reads the ids from here instead.This module is deliberately free of any server import so the client bundle stays "server-free by construction" (see bootstrap-client.ts). Both bundles run serially in one process, so module state is a safe carrier (the same device
subscription-isolationandpermission-engineuse for fixtures).