Introduce a lossless event-boundary SSE assembler

Parent

Part of #147. Delivers the expand slice of #20.

What to build

Introduce one lossless SSE Event Assembler that recognizes complete event boundaries before any JSON parsing. It must handle valid multi-line and metadata-bearing SSE events while retaining the original bytes for Transparent Passthrough consumers.

Acceptance criteria

The assembler emits only complete SSE events and correctly handles CRLF/LF boundaries, multiple data: lines, comments, empty events, event, id, and retry fields.
Transparent consumers can forward the exact original event bytes without reserialization or normalization.
Converted consumers receive a bounded semantic view only after the complete event is assembled.
Partial input, EOF, malformed fields, cancellation, and size limits have deterministic bounded outcomes.
Adversarial chunk-boundary tests demonstrate that transport chunking cannot change event meaning or cause premature JSON parsing.

Blocked by

Bound upstream SSE reader queue and define reader lifecycle #19

{
  "contract": {
    "acceptance": [
      "The assembler emits only complete frames and produces identical semantic results for every tested partitioning of LF, CRLF, CR, split-CRLF, multi-data, metadata, comment, empty, BOM, and unknown-field fixtures.",
      "Repeated data fields join with a literal newline after removing at most one optional leading space; field order and exact raw frame bytes, including original line endings and invalid UTF-8, remain available unchanged.",
      "Transparent consumers can forward byte-identical input without decoding, normalization, or reserialization, and PassthroughSseSemanticStats retains its existing observable counters, terminal detection, response identity, and telemetry limits.",
      "EOF after a non-empty frame without the required blank line emits no frame and reports a bounded incomplete disposition; no caller can accidentally treat it as complete.",
      "A pending frame over 16 MiB fails with the typed size classification and no payload echo, while completed frames release their buffered storage.",
      "A static audit proves production and test code use the module interface rather than introducing another event assembler; protocol conversion behavior is unchanged in this Issue."
    ],
    "change_claims": {
      "paths": [
        "src-python/sse_events.py",
        "src-python/codex_proxy.py",
        "tests/test_sse_events.py",
        "tests/test_routing.py"
      ],
      "resources": [
        "gateway-sse-event-assembler",
        "gateway-transparent-sse-byte-identity",
        "gateway-sse-semantic-stats"
      ]
    },
    "dependencies": {
      "dispatch_after": [
        19
      ],
      "merge_after": [
        19
      ]
    },
    "design": [
      "Create one pure in-process deep module at src-python/sse_events.py. Its small interface accepts arbitrary byte chunks and emits complete blank-line-delimited SSE frames while retaining the exact original bytes; callers do not implement line or event assembly themselves.",
      "Represent each complete frame with exact raw bytes, ordered raw fields/comments, and a semantic view of data joined with a literal newline plus event, id, and retry values. Preserve unknown fields and invalid UTF-8 bytes in the raw view; semantic JSON decoding is not this module's responsibility.",
      "Handle LF, CRLF, and CR line endings, including CRLF split across chunks, an optional initial UTF-8 BOM for semantic parsing, a single optional space after the first colon, field-without-colon syntax, comments, empty frames, and arbitrary transport fragmentation.",
      "Follow WHATWG EOF behavior: an event is complete only after a blank line. EOF discards a pending incomplete frame and reports only bounded structural status; it never promotes partial bytes into a semantic event.",
      "Bound one pending frame to 16 MiB and raise a typed size error containing counts only, never payload content. Reset and terminal behavior are deterministic and do not retain data after completion.",
      "Replace the existing private event-assembly logic in PassthroughSseSemanticStats with this module while preserving all telemetry fields and transparent forwarding bytes. Converted production routes remain unchanged until #225."
    ],
    "difficulty": "heavy",
    "done_when": [
      "Focused assembler and PassthroughSseSemanticStats regressions are observed failing before implementation and passing afterward.",
      "Development and candidate matrix: python -m pytest -q tests/test_sse_events.py tests/test_routing.py; run affected node IDs during RED/GREEN and this exact module matrix once after local freeze.",
      "Compatibility evidence: python -m pytest -q tests/test_protocol_translation.py; reuse it after review-only or test-only deltas that do not cross the protocol seam.",
      "Explicitly forbidden for the Worker and Reviewer: bare repository-wide pytest, tests/test_real_client_e2e.py, Rust/frontend suites, CI polling, and real-client GUI qualification; exact-SHA CI and Issue #227 own broader/release gates.",
      "git diff --check",
      "python scripts/report_quality_gates.py (report-only)",
      "Exact-local-SHA Standards and Spec reviews report no blocker before the branch is pushed once.",
      "After local freeze, exactly one push/PR update and exact-SHA GitHub Actions run pass; no intermediate real-client qualification is run."
    ],
    "priority": "P1",
    "risk": "strict",
    "sha256": "100801246f6796ceddd42c76beeb4d9bf614a267becd44d36c178239e7342622",
    "unresolved_decisions": []
  },
  "dispatch": {
    "accepted_at": "2026-07-26T08:03:40Z",
    "attempt": 1,
    "base_sha": "7ba14f6fee6c21831f6ba7edf63b01b6ec0ba955",
    "branch": "work/issue-224",
    "candidate_sha": "11c56e2ad9bdb37a1906a50d5be1791d21139a01",
    "claimed_at": "2026-07-26T01:29:29.667350Z",
    "contract_sha256": "100801246f6796ceddd42c76beeb4d9bf614a267becd44d36c178239e7342622",
    "creator_agent_id": "d81c5928-aff7-4d9d-b6a0-2b9f70ffad21",
    "generation": 1,
    "id": "dispatch-issue-224-a1",
    "integrating_at": "2026-07-26T08:31:57.535998Z",
    "merged_at": "2026-07-26T08:32:01Z",
    "pr_number": 233,
    "status": "merged",
    "worker_agent_id": "b4db62e0-c13a-4093-93d3-99ffc7d75acf",
    "workspace_id": "wks_74d52ca70789611b"
  }
}