Bind canary proof to one manager session

[vriesd]

Summary

• retain the OpenCode session ID on every observed tool call
• select the unique manager session linked by reviewer task parent, child, and model metadata
• derive all runtime, lifecycle, review, validation, and close checks from that one manager session only
• add a regression that splices authentic status evidence into another manager session and proves rejection

Verification

• bun run check: 587 passed, 1 intentional skip
• bun run replay: 13 of 13 cassettes reproduced
• pinned OpenCode 1.18.6 live smoke: passed
• three independent focused reviews: green
• contribution commit and push preflight: passed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bfe05bebb4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Select the unique parent rather than a unique review pair

When a canary legitimately completes two reviewer dispatches in the same manager session—for example, the first review reports a finding and a second review passes after repair—each task has a different child session, so linkedPairs.length is 2 even though both pairs have the same parent. This sets managerSessionId to null, empties managerCalls, and incorrectly fails every transcript-derived check. Determine uniqueness from the lineage parent IDs while allowing multiple reviewer children belonging to that one parent.

Useful? React with 👍 / 👎.