Stabilize live plugin validation

[dimavrem22]

Executive Summary

This PR makes Claude Code live validation strict and repeatable across voice and host-bootstrap paths.

• Correlates one current call per owner and validates each transcript through its authoritative identity.
• Uses a three-word full-run marker while retaining exact action, recipient, delivery, and uniqueness gates.
• Bounds setup-only retries and keeps public CI diagnostics content-safe.

Description

Voice scenarios now sweep interrupted matching calls, snapshot both owners, apply a request-time lower bound, and require one stable driver/AUT pair before validation. Driver records prove scripted caller speech, while the exact AUT record must prove two-way conversation and agent-local output; teardown ends every post-snapshot matching record on both owners.

The hosted scenario hashes the full workflow run identity into three distinct speech-safe words and keeps its current-request, open-action, exact-recipient/body, receipt, and exactly-once checks. Dependency installation uses a bounded setup-only retry, while live messages, calls, model turns, and side effects remain single-attempt. Failure diagnostics expose only bounded state, counts, and error classes.

Reason

Recent live runs repeatedly evaluated two-way speech on the non-authoritative call record and sometimes lost a long spoken marker during hosted action extraction. Setup network reads and raw failure artifacts also made CI less stable and less safe to inspect publicly.

Decisions

• Call correlation: Kept correlation plugin-owned using owner, direction, number, snapshot, server timestamp, and stability checks so no product API change is required.
• Retry boundary: Retries apply only to dependency installation; live calls, messages, model turns, and side effects remain single-attempt.
• Behavioral proof: The driver record proves caller speech, the AUT record proves both parties and agent output, and hosted completion still requires one exact post-call SMS.

Testing

• Full plugin and latest-host contract suite: .venv/bin/python -m pytest -q — 453 passed, 23 expected live-environment skips.
• Python compilation: .venv/bin/python -m compileall -q inkbox_claude tests — passed.
• Static Python checks: uvx ruff check --select F ... — passed.
• Workflow and shell validation: every workflow YAML parsed successfully, bash -n tests/ci/retry_install.sh passed, and git diff --check passed.
• Live voice behavior: expected to select one current driver/AUT pair, validate each owner’s transcript, and deliver exactly one current-marker post-call SMS; validation cycles are tracked in CI.