#2140 fix(core-bridge): expose schema-v2 service caller lifecycle

Outcome

• Parse the exact schema-v2 caller.json object written by Agent Relay Desktop, including its nested auth and inbox routes.
• Export the validated caller descriptor, identity checks, result-inbox lifecycle, durable settlement helpers, and disconnect helper required by Relayflows node spawning.
• Fail closed before authentication when the core does not advertise the complete service-caller lifecycle.
• Keep the caller secret out of the returned descriptor, JSON, inspection output, and error text.

Why

Published @agent-relay/core-bridge@18.0.0 accepts an obsolete string-valued auth shape and lacks the schema-v2 descriptor/inbox exports used by Flows PR #707. A clean install therefore succeeds but the first real Desktop caller load either rejects caller.json or reaches an untyped missing export.

This is the package-only repair. It does not merge or release Flows #707, publish npm, or claim the end-to-end lifecycle is complete.

Local verification

$ npm run build --workspace @agent-relay/core-bridge

> @agent-relay/core-bridge@18.0.0 build
> tsc

$ npm test --workspace @agent-relay/core-bridge -- --run

 Test Files  5 passed (5)
      Tests  105 passed | 1 skipped (106)
   Duration  680ms

$ npx prettier --check CHANGELOG.md packages/core-bridge/README.md packages/core-bridge/src/auth.ts packages/core-bridge/src/auth.test.ts packages/core-bridge/src/index.ts packages/core-bridge/src/service-callers.ts packages/core-bridge/src/service-callers.test.ts
Checking formatting...
All matched files use Prettier code style!

$ git diff --check
# exit 0, no output

Packed-surface verification after npm pack --workspace @agent-relay/core-bridge:

{
  "required": [
    "readCallerDescriptor",
    "requireServiceCallerMethods",
    "assertServiceCallerIdentity",
    "serviceCallerIdentity",
    "serviceCallerInboxOpen",
    "serviceCallerInboxNext",
    "serviceCallerInboxAck",
    "serviceCallerInboxFail",
    "serviceCallerInboxClose",
    "serviceCallerDisconnect"
  ],
  "missing": []
}

The first attempted fresh root install on this host failed with ENOSPC because /tmp exhausted inodes. The commands above used the already-complete dependency tree from the prior isolated review checkout. Fresh-install proof is therefore delegated to normal PR CI and remains a merge gate.

Current package state\n\nExact head b078d69f4bc59b7c0990f5db3a9a20eec0bc9b33 has independent review, green CI, and zero unresolved review threads. It is ready for the required human review and merge. No release has been dispatched.\n\n## Remaining Flows #707 gates

• an official GitHub-workflow package release (only after human authorization);
• pin/validate the published successor from a genuinely fresh Flows install;
• land and consume the paired strict replay fixes in Relaycast #644 and Relay #2119;
• run the canonical plain-terminal Desktop lifecycle, including lost-response/restart same-key recovery, one worker, journal-before-ack, exact release, and cleanup.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}