What crosses the boundary today.
Non-empty text and image blocks become agent_message_chunk updates.
The prompt response settles after the Agent becomes idle.
An addressed prompt can stop without cancelling another Session.
A machine client can allow or reject a bridge-owned escalation.
What automation cannot reconstruct.
No correlated call, progress, result, failure, or cancellation event.
No runtime-owned input, output, cache, or reasoning token receipt.
No list, load, resume, fork, or per-Session close contract.
A model gateway can provide an explicit accounting workaround. Durable logs require shared filesystem access and are not an ACP compatibility surface.
The minimum observable bridge.
Project tool/call to tool_call, preserve its call id through one terminal tool_call_update, and normalize message usage into the prompt response or usage_update. Apply an explicit redaction and retention policy to raw inputs and outputs.
Acceptance gates.
Every tool starts and terminates exactly once.
Arguments and results follow declared redaction rules.
Usage reconciles with provider accounting.
Machine telemetry does not imply a native editor experience.
Primary evidence.
Test the boundary, not the badge.
The full guide includes the capability ledger, message sequence, a bounded source probe, safe workarounds, implementation requirements, and acceptance tests.
Read the complete guide