Enhance WebSocket session configuration by introducing an optional config.resolved event, which provides a public snapshot of the session's configuration. Update the API reference documentation to clarify the conditions under which this event is emitted and the details it includes. Modify session management to respect the new setting for emitting configuration details, ensuring sensitive information remains secure. Update tests to validate the new behavior and ensure compliance with the updated configuration schema.

engine/docs/ws_v1_schema.md

@@ -156,8 +156,9 @@ Common events:
   - Fields: `sessionId`, `trackId`, `tracks`, `audio`
 - `config.resolved`
   - Fields: `sessionId`, `trackId`, `config`
-  - Sent immediately after `session.started`.
-  - Contains effective model/voice/output/tool allowlist/prompt hash, and never includes secrets.
+  - Optional debug event. Disabled by default (`ws_emit_config_resolved=false`).
+  - `config` is SaaS-safe and public-only: `channel` (if provided), `output.mode`, `tools.enabled`, `tools.count`, `tracks`.
+  - Must not expose internal IDs or runtime internals (`assistantId/appId/configVersionId/services/provider/model/baseUrl/systemPrompt`).
 - `session.stopped`
   - Fields: `sessionId`, `reason`
 - `heartbeat`
@@ -196,7 +197,7 @@ Common events:
 Track IDs (MVP fixed values):
 - `audio_in`: ASR/VAD input-side events (`input.*`, `transcript.*`)
 - `audio_out`: assistant output-side events (`assistant.*`, `output.audio.*`, `response.interrupted`, `metrics.ttfb`)
-- `control`: session/control events (`session.*`, `error`, `config.resolved`)
+- `control`: session/control events (`session.*`, `error`, optional `config.resolved`)
 
 Correlation IDs (`event.data`):
 - `turn_id`: one user-assistant interaction turn.