feat: support RLM training over ACP

[hallerite]

Summary

• express the RLM runtime as typed harness configuration and send its strict ai.prime.rlm/runtime-v1 payload through ACP session/new
• carry opaque ACP session/close metadata through the generic runner and let the RLM harness validate its own final ai.prime.rlm/session-v1 snapshot into training metrics
• honor the standard HTTP Idempotency-Key in the interception server by coalescing in-flight retries and replaying completed non-streaming responses within one rollout
• namespace the key before forwarding it upstream so separate rollouts cannot collide in a provider-global idempotency cache
• pin the live RLM E2E to Nano commit 7a26d3c2cd2f38e11807ef7b88ce4ea197552ea8 until the companion Nano PR merges

Verifiers does not model RLM lineage, compaction, subagents, or ACP lifecycle artifacts. Those semantics stay inside Nano; Verifiers only transports standard ACP close metadata and standard HTTP idempotency.

Contract

This intentionally requires the new Nano contract and contains no backwards-compatibility path. Land PrimeIntellect-ai/nano-rlm#134 before this PR, then remove the temporary CI commit pin once Nano main contains the contract.

Validation

• Ruff check and format passed on all touched Python files
• pytest tests/v1/test_idempotency.py -q — passed against a real loopback interception server
• complete deterministic v1 suite — passed
• Prime VM contract E2E — passed, covering two ACP prompts, MCP resume, concurrent recursive children, kernel/subprocess environment isolation, and final close metrics
• pre-push hooks — markdownlint, Ruff, format, and Ty all passed

[macroscopeapp]

🟡 Medium acp/__init__.py:263

Graceful close swallows exceptions from acp_close_metrics and trace.record_metrics, so invalid close metadata or metrics make the session appear to close successfully while final RLM metrics are silently absent. Limit the best-effort except to shutdown transport, allowing metric validation and recording failures to propagate.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @verifiers/v1/acp/__init__.py around line 263:

Graceful close swallows exceptions from `acp_close_metrics` and `trace.record_metrics`, so invalid close metadata or metrics make the session appear to close successfully while final RLM metrics are silently absent. Limit the best-effort `except` to shutdown transport, allowing metric validation and recording failures to propagate.

[macroscopeapp]

🟠 High interception/server.py:438

Each distinct client-supplied Idempotency-Key adds an entry to session.idempotent_requests that retains the full response.raw for the rollout, so a long-running harness with fresh keys grows memory without bound and can OOM the shared interception server. Add a bounded or expiring replay cache, or evict entries once their replay guarantee is no longer needed.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @verifiers/v1/interception/server.py around line 438:

Each distinct client-supplied `Idempotency-Key` adds an entry to `session.idempotent_requests` that retains the full `response.raw` for the rollout, so a long-running harness with fresh keys grows memory without bound and can OOM the shared interception server. Add a bounded or expiring replay cache, or evict entries once their replay guarantee is no longer needed.