feat: run the main thread as a native Claude session under Herdr

[oldsj]

Summary

• Native agent sessions under Herdr (delivery ledger, journal mirror, resume) and, on top, the r7 context model: a main-thread window owned by Mainloop through rotation, topics, a token-scoped mainloop CLI with server-side policy, and topic-tagged delegation to a child agent whose report returns to the main thread.
• Status is answered from Postgres and adds no native turn.
• Behind MAIN_THREAD_MODE=native; the SDK chat path is unchanged and remains the default.

Scope and caveats

• Local-kind only. k8s/apps/mainloop/overlays/spike-herdr and spikes/ are local exceptions to GitOps; trunk checkov/trivy ignores extended to spikes/** for that reason.
• Proved live with real Claude and Codex on the local cluster (main thread, delegation and report, status without a native turn, pod replacement and resume, rotation, policy refusals). Depth refusal is covered by fakes only. Default tests use fakes (105 pass).
• Known gap: the per-binding token scopes the CLI but is not a security boundary while the rest of the backend API is unauthenticated and reachable from the pods. API authentication is a required follow-up before any non-local use.
• Not built: topic supervisors, per-child turn budgets, recovery of queued deliveries after a backend restart.

Specs: docs/specs/chat.md, docs/specs/sessions.md; measurements and open items: docs/spikes/native-main-thread-context.md.

🤖 Generated with Claude Code