@bugmole/cli 0.4.0 → 0.6.0

package/src/registry-worker/index.ts

@@ -1,5 +1,5 @@
-import { MAX_TASK_ATTEMPTS, backoffUntil, isResumableTask, resumedTaskFields } from "../registry/task-scheduling.js";
-import { getProjectArtifact, isRunManifestKey, listProjectArtifacts } from "./artifacts.js";
+import { DEFAULT_APPROVAL_MODE, IN_REVIEW, LOCAL_WORKER_SEEN_THROTTLE_MS, MAX_TASK_ATTEMPTS, REVIEW_NOTE_MAX, approvalModeOf, autoApprover, backoffUntil, completionStatus, inReviewMessage, isResumableTask, needsApproval, resumedApproval, resumedTaskFields, resumePlacement, sentBackTaskFields, strandedTaskMessage } from "../registry/task-scheduling.js";
+import { getProjectArtifact, isRunManifestKey, listProjectArtifacts, runIdOfArtifactKey, type ArtifactVisibility } from "./artifacts.js";
 import {
   type Env,
   type Principal,
@@ -14,6 +14,7 @@ import {
   projectAllowed,
   memberOfProject,
   memberOfWorkspace,
+  projectLocked,
   randomToken,
   base64,
   fromBase64,
@@ -25,7 +26,7 @@ export type { Env } from "./core.js";
 import { detachedContext, handleExtendedRoutes, handlePublicRoutes } from "./routes/index.js";
 import { runScheduledJobs } from "./jobs/index.js";
 import { actorOf, auditProject, recordAudit } from "./org/audit.js";
-import { checkCloudRun, checkProjectLimit, executionModeOf, historyCutoffFor } from "./billing/enforcement.js";
+import { billingLinks, checkCloudRun, checkProjectLimit, executionModeOf, historyCutoffFor, runExpired } from "./billing/enforcement.js";
 import { workspaceOfProject } from "./billing/entitlements.js";
 import { heartbeatChecks, registryDispatch, runChangedHooks, runQueuedHooks, runService, taskChangedHooks, taskQueuedHooks, type InternalRunFields } from "./hooks.js";
 import { appendRunEvent, broadcastProjectEvent } from "./run-events.js";
@@ -37,6 +38,8 @@ import { cloudTargetId, parseCloudDevice } from "../runtime/device-clouds/target
 import type { CloudDevice } from "../runtime/device-clouds/types.js";
 import { cloudAccountError, freeWorkspaceLimit } from "./signup/policy.js";
 import { applyOrgMembership, isDeprovisioned } from "./sso/membership.js";
+import { claimDomainIdentity, identityInUse, identityValues, identityView, invalidIdentity, memberProjectWithIdentity, readIdentity, workspaceProjectWithIdentity, type StoredIdentity } from "./projects/identity.js";
+import { projectInactiveRefusal } from "./projects/inactivity.js";
 import "./features.js";
 
 function deviceCode(): string {
@@ -50,10 +53,14 @@ async function createDeviceAuthorization(request: Request, env: Env): Promise<Re
     projectName?: string;
     environment?: string;
     storageProvider?: string;
+    /** Which app this is (src/registry/project-identity.ts), computed by the CLI. */
+    identity?: unknown;
   } | null;
   if (!body?.projectId || !body.projectName || !body.environment || !body.storageProvider) {
     return response({ error: "projectId, projectName, environment, and storageProvider are required" }, 422);
   }
+  const identity = await readIdentity(body.identity);
+  if (identity === "invalid") return invalidIdentity();
   const sourceIp = request.headers.get("CF-Connecting-IP") ?? "unknown";
   const recent = await env.DB.prepare(`
     SELECT COUNT(*) AS count FROM device_authorizations
@@ -66,8 +73,8 @@ async function createDeviceAuthorization(request: Request, env: Env): Promise<Re
   const expiresAt = new Date(Date.now() + 5 * 60 * 1000).toISOString();
   await env.DB.prepare(`
     INSERT INTO device_authorizations
-      (attempt_id, code_hash, poll_secret_hash, project_id, project_name, environment, storage_provider, source_ip, expires_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      (attempt_id, code_hash, poll_secret_hash, project_id, project_name, environment, storage_provider, source_ip, expires_at, identity_json)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).bind(
     attemptId,
     await sha256(code),
@@ -78,6 +85,7 @@ async function createDeviceAuthorization(request: Request, env: Env): Promise<Re
     currentStorageProvider(body.storageProvider),
     sourceIp,
     expiresAt,
+    identity ? JSON.stringify(identity) : null,
   ).run();
   return response({ attemptId, code, pollSecret, expiresAt }, 201);
 }
@@ -95,6 +103,77 @@ function workspaceNameFromEmail(email: string | null | undefined): string {
   return domain.charAt(0).toUpperCase() + domain.slice(1);
 }
 
+type DeviceRefusal = { error: string; code: string; upgradeUrl?: string; billingUrl?: string; [key: string]: unknown };
+
+type DevicePlacement = {
+  workspaceId: string;
+  projectId: string;
+  /** The app is already a project in a workspace this person works in (a teammate's clone of the same repo). */
+  joined: boolean;
+};
+
+/**
+ * Where a CLI-registered project goes, under the same plan checks as creating
+ * a workspace or project in the dashboard: one Free workspace per person (a
+ * second one is refused, so the project joins the Free workspace they already
+ * own) and the plan's project limit for a project that doesn't exist yet.
+ * One app is one project: when the app's identity is already a project in a
+ * workspace the person belongs to, the machine pairs with that project.
+ */
+async function deviceProjectPlacement(env: Env, principal: Principal, projectId: string, identity: StoredIdentity | null): Promise<DevicePlacement | { refusal: DeviceRefusal; status: number }> {
+  if (identity) {
+    const joined = await memberProjectWithIdentity(env, principal, identity.hash);
+    if (joined) return { workspaceId: joined.workspaceId, projectId: joined.id, joined: true };
+  }
+  const existingProject = await env.DB.prepare("SELECT workspace_id AS workspaceId FROM projects WHERE id = ? AND deleted_at IS NULL")
+    .bind(projectId).first<{ workspaceId: string }>();
+  if (existingProject && !(await memberOfProject(env, principal, projectId, "project.manage"))) {
+    if (await projectLocked(env, projectId) && await memberOfProject(env, principal, projectId)) {
+      return {
+        refusal: {
+          error: "This project is read-only: the workspace has more projects than its plan includes. Upgrade, or choose which projects stay active in Billing.",
+          code: "plan_limit",
+          limit: "projects",
+          ...billingLinks(env, existingProject.workspaceId),
+        },
+        status: 402,
+      };
+    }
+    return { refusal: { error: "A project with this id already exists. Choose another project id.", code: "project_exists" }, status: 409 };
+  }
+  let workspaceId = `workspace_${principal.aegisId}`;
+  const workspace = await env.DB.prepare("SELECT id FROM workspaces WHERE id = ?").bind(workspaceId).first<{ id: string }>();
+  if (!workspace) {
+    const freeLimit = await freeWorkspaceLimit(env, principal);
+    if (freeLimit) {
+      const refusal = await freeLimit.clone().json() as DeviceRefusal & { workspaceId?: string };
+      if (!refusal.workspaceId || !(await memberOfWorkspace(env, principal, refusal.workspaceId, "workspace.write"))) {
+        return { refusal, status: freeLimit.status };
+      }
+      workspaceId = refusal.workspaceId;
+    }
+  }
+  if (!existingProject) {
+    if (identity) {
+      const inUse = await identityInUse(env, principal, workspaceId, identity);
+      if (inUse) return { refusal: await inUse.clone().json() as DeviceRefusal, status: inUse.status };
+    }
+    const projectLimit = await checkProjectLimit(env, workspaceId);
+    if (projectLimit) return { refusal: await projectLimit.clone().json() as DeviceRefusal, status: projectLimit.status };
+  }
+  return { workspaceId, projectId, joined: false };
+}
+
+function storedIdentityOf(json: string | null): StoredIdentity | null {
+  if (!json) return null;
+  try {
+    const value = JSON.parse(json) as StoredIdentity;
+    return value && typeof value.hash === "string" && typeof value.key === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+
 async function claimDeviceAuthorization(request: Request, env: Env, principal: Principal): Promise<Response> {
   const body = await request.json().catch(() => null) as {
     attemptId?: string;
@@ -108,9 +187,10 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
   const attempt = await env.DB.prepare(`
     SELECT attempt_id AS attemptId, code_hash AS codeHash, project_id AS projectId,
            project_name AS projectName, environment, storage_provider AS storageProvider,
-           status, failed_attempts AS failedAttempts, expires_at AS expiresAt
+           status, failed_attempts AS failedAttempts, expires_at AS expiresAt, identity_json AS identityJson
     FROM device_authorizations WHERE attempt_id = ?
   `).bind(body.attemptId).first<{
+    identityJson: string | null;
     attemptId: string;
     codeHash: string;
     projectId: string;
@@ -133,11 +213,23 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
   if (body.deviceId !== attempt.projectId) {
     return response({ error: "Device binding does not match the Bugmole project" }, 403);
   }
+  const identity = storedIdentityOf(attempt.identityJson);
+  const placement = await deviceProjectPlacement(env, principal, attempt.projectId, identity);
+  if ("refusal" in placement) {
+    // Recorded on the attempt, so the waiting CLI prints why and where to upgrade.
+    await env.DB.prepare(`
+      UPDATE device_authorizations SET status = 'refused', refusal_json = ?, aegis_id = ?, claimed_at = CURRENT_TIMESTAMP
+      WHERE attempt_id = ? AND status = 'pending'
+    `).bind(JSON.stringify(placement.refusal), principal.aegisId, body.attemptId).run();
+    return response(placement.refusal, placement.status);
+  }
 
+  const projectId = placement.projectId;
   const claimResult = await env.DB.prepare(`
-    UPDATE device_authorizations SET status = 'claimed', aegis_id = ?, aegis_email = ?, claimed_at = CURRENT_TIMESTAMP
+    UPDATE device_authorizations SET status = 'claimed', aegis_id = ?, aegis_email = ?, claimed_at = CURRENT_TIMESTAMP,
+      resolved_project_id = ?
     WHERE attempt_id = ? AND status = 'pending'
-  `).bind(principal.aegisId, body.email?.trim() || null, body.attemptId).run() as { meta?: { changes?: number } };
+  `).bind(principal.aegisId, body.email?.trim() || null, projectId === attempt.projectId ? null : projectId, body.attemptId).run() as { meta?: { changes?: number } };
   if (claimResult.meta?.changes !== 1) {
     return response({ error: "Device authorization was claimed by another session" }, 409);
   }
@@ -149,15 +241,47 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
   const existingKey = existingKeys.results.find((key) => {
     try {
       const projectIds = JSON.parse(key.projectIds) as unknown;
-      return Array.isArray(projectIds) && projectIds.includes(attempt.projectId);
+      return Array.isArray(projectIds) && projectIds.includes(projectId);
     } catch {
       return false;
     }
   });
   const now = new Date().toISOString();
-  const workspaceId = `workspace_${principal.aegisId}`;
+  const workspaceId = placement.workspaceId;
   const workspaceName = workspaceNameFromEmail(body.email) || (attempt.projectName ? `${attempt.projectName} workspace` : "My workspace");
   const environmentId = attempt.environment.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "default";
+  // Joining a teammate's project pairs this machine with it as it is: its
+  // name, apps, environments and the person's workspace role stay unchanged.
+  const projectRows = placement.joined ? [] : [
+    env.DB.prepare(`
+      INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider,
+        identity_kind, identity_key, identity_hash, identity_origin, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+      ON CONFLICT(id) DO UPDATE SET name = excluded.name, environment = excluded.environment,
+        storage_provider = excluded.storage_provider, workspace_id = excluded.workspace_id,
+        identity_kind = COALESCE(projects.identity_kind, excluded.identity_kind),
+        identity_key = COALESCE(projects.identity_key, excluded.identity_key),
+        identity_hash = COALESCE(projects.identity_hash, excluded.identity_hash),
+        identity_origin = COALESCE(projects.identity_origin, excluded.identity_origin)
+    `).bind(projectId, workspaceId, workspaceId, attempt.projectName, attempt.environment, currentStorageProvider(attempt.storageProvider), ...identityValues(identity)),
+    env.DB.prepare(`
+      INSERT INTO project_apps (id, project_id, name, type, is_default)
+      VALUES ('default', ?, ?, 'web', 1)
+      ON CONFLICT(project_id, id) DO UPDATE SET name = excluded.name
+    `).bind(projectId, attempt.projectName),
+    env.DB.prepare(`
+      -- A project that already has an environment keeps it: pairing
+      -- another machine must not add a same-named twin beside it.
+      INSERT INTO project_environments (id, project_id, app_id, name, base_url, status, is_default)
+      SELECT ?, ?, 'default', ?, '', 'active', 1
+      WHERE NOT EXISTS (SELECT 1 FROM project_environments WHERE project_id = ?)
+    `).bind(environmentId, projectId, attempt.environment, projectId),
+    env.DB.prepare(`
+      INSERT INTO project_memberships (project_id, aegis_id, role, status)
+      VALUES (?, ?, 'owner', 'active')
+      ON CONFLICT(project_id, aegis_id) DO UPDATE SET status = 'active'
+    `).bind(projectId, principal.aegisId),
+  ];
   if (existingKey) {
     try {
       await env.DB.batch([
@@ -172,27 +296,7 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
           VALUES (?, ?, 'owner', 'active')
           ON CONFLICT(workspace_id, aegis_id) DO UPDATE SET status = 'active'
         `).bind(workspaceId, principal.aegisId),
-        env.DB.prepare(`
-          INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, created_at)
-          VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
-          ON CONFLICT(id) DO UPDATE SET name = excluded.name, environment = excluded.environment,
-            storage_provider = excluded.storage_provider, workspace_id = excluded.workspace_id
-        `).bind(attempt.projectId, workspaceId, workspaceId, attempt.projectName, attempt.environment, currentStorageProvider(attempt.storageProvider)),
-        env.DB.prepare(`
-          INSERT INTO project_apps (id, project_id, name, type, is_default)
-          VALUES ('default', ?, ?, 'web', 1)
-          ON CONFLICT(project_id, id) DO UPDATE SET name = excluded.name
-        `).bind(attempt.projectId, attempt.projectName),
-        env.DB.prepare(`
-          INSERT INTO project_environments (id, project_id, app_id, name, base_url, status, is_default)
-          VALUES (?, ?, 'default', ?, '', 'active', 1)
-          ON CONFLICT(project_id, id) DO UPDATE SET app_id = excluded.app_id, name = excluded.name, is_default = 1
-        `).bind(environmentId, attempt.projectId, attempt.environment),
-        env.DB.prepare(`
-          INSERT INTO project_memberships (project_id, aegis_id, role, status)
-          VALUES (?, ?, 'owner', 'active')
-          ON CONFLICT(project_id, aegis_id) DO UPDATE SET status = 'active'
-        `).bind(attempt.projectId, principal.aegisId),
+        ...projectRows,
         env.DB.prepare(`
           UPDATE device_authorizations SET status = 'completed', aegis_id = ?, api_key_id = ?, completed_at = ?
           WHERE attempt_id = ? AND status = 'claimed'
@@ -202,7 +306,7 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
       await releaseClaimedDeviceAuthorization(env, body.attemptId);
       throw error;
     }
-    return response({ claimed: true, alreadyInitialized: true }, 200);
+    return response({ claimed: true, alreadyInitialized: true, projectId, joined: placement.joined }, 200);
   }
 
   const id = `key_${randomToken(12)}`;
@@ -221,32 +325,12 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
         VALUES (?, ?, 'owner', 'active')
         ON CONFLICT(workspace_id, aegis_id) DO UPDATE SET status = 'active'
       `).bind(workspaceId, principal.aegisId),
-      env.DB.prepare(`
-        INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
-        ON CONFLICT(id) DO UPDATE SET name = excluded.name, environment = excluded.environment,
-          storage_provider = excluded.storage_provider, workspace_id = excluded.workspace_id
-      `).bind(attempt.projectId, workspaceId, workspaceId, attempt.projectName, attempt.environment, currentStorageProvider(attempt.storageProvider)),
-      env.DB.prepare(`
-        INSERT INTO project_apps (id, project_id, name, type, is_default)
-        VALUES ('default', ?, ?, 'web', 1)
-        ON CONFLICT(project_id, id) DO UPDATE SET name = excluded.name
-      `).bind(attempt.projectId, attempt.projectName),
-      env.DB.prepare(`
-        INSERT INTO project_environments (id, project_id, app_id, name, base_url, status, is_default)
-        VALUES (?, ?, 'default', ?, '', 'active', 1)
-        ON CONFLICT(project_id, id) DO UPDATE SET app_id = excluded.app_id, name = excluded.name, is_default = 1
-      `).bind(environmentId, attempt.projectId, attempt.environment),
-      env.DB.prepare(`
-        INSERT INTO project_memberships (project_id, aegis_id, role, status)
-        VALUES (?, ?, 'owner', 'active')
-        ON CONFLICT(project_id, aegis_id) DO UPDATE SET status = 'active'
-      `).bind(attempt.projectId, principal.aegisId),
+      ...projectRows,
       env.DB.prepare(`
         INSERT INTO api_keys (id, aegis_id, name, token_hash, scopes_json, project_ids_json, expires_at)
         VALUES (?, ?, ?, ?, ?, ?, NULL)
       `).bind(id, principal.aegisId, `${attempt.projectName} CLI`, await sha256(token),
-        JSON.stringify(["projects:read", "projects:write", "runs:write", "artifacts:write"]), JSON.stringify([attempt.projectId])),
+        JSON.stringify(["projects:read", "projects:write", "runs:write", "artifacts:write"]), JSON.stringify([projectId])),
       env.DB.prepare(`
         UPDATE device_authorizations
         SET status = 'completed', aegis_id = ?, api_key_id = ?, encrypted_token = ?, token_iv = ?, completed_at = ?
@@ -257,7 +341,7 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
     await releaseClaimedDeviceAuthorization(env, body.attemptId);
     throw error;
   }
-  return response({ claimed: true, alreadyInitialized: false }, 200);
+  return response({ claimed: true, alreadyInitialized: false, projectId, joined: placement.joined }, 200);
 }
 
 async function releaseClaimedDeviceAuthorization(env: Env, attemptId: string): Promise<void> {
@@ -283,15 +367,18 @@ async function pollDeviceAuthorization(request: Request, env: Env): Promise<Resp
   if (!body?.attemptId || !body.pollSecret) return response({ error: "attemptId and pollSecret are required" }, 422);
   const attempt = await env.DB.prepare(`
     SELECT status, expires_at AS expiresAt, encrypted_token AS encryptedToken, token_iv AS tokenIv,
-           poll_secret_hash AS pollSecretHash, aegis_email AS aegisEmail
+           poll_secret_hash AS pollSecretHash, aegis_email AS aegisEmail, refusal_json AS refusalJson,
+           COALESCE(resolved_project_id, project_id) AS projectId
     FROM device_authorizations WHERE attempt_id = ?
   `).bind(body.attemptId).first<{
+    projectId: string;
     status: string;
     expiresAt: string;
     encryptedToken: string | null;
     tokenIv: string | null;
     pollSecretHash: string;
     aegisEmail: string | null;
+    refusalJson: string | null;
   }>();
   if (!attempt || !constantTimeEqual(await sha256(body.pollSecret), attempt.pollSecretHash)) {
     return response({ error: "Device authorization not found" }, 404);
@@ -302,92 +389,22 @@ async function pollDeviceAuthorization(request: Request, env: Env): Promise<Resp
     return response({ status: "expired" }, 410);
   }
   if (attempt.status === "pending") return response({ status: "pending" }, 202);
-  if (!attempt.encryptedToken || !attempt.tokenIv) return response({ status: "completed", alreadyInitialized: true }, 200);
+  if (attempt.status === "refused") {
+    const refusal = attempt.refusalJson ? JSON.parse(attempt.refusalJson) as Record<string, unknown> : { error: "Device registration was refused" };
+    return response({ status: "refused", ...refusal }, refusal.code === "plan_limit" || refusal.code === "free_workspace_exists" ? 402 : 409);
+  }
+  if (!attempt.encryptedToken || !attempt.tokenIv) return response({ status: "completed", alreadyInitialized: true, projectId: attempt.projectId }, 200);
   const result = await env.DB.prepare(`
     UPDATE device_authorizations SET encrypted_token = NULL, token_iv = NULL
     WHERE attempt_id = ? AND status = 'completed' AND encrypted_token = ?
   `).bind(body.attemptId, attempt.encryptedToken).run() as { meta?: { changes?: number } };
-  if (result.meta?.changes !== 1) return response({ status: "completed", alreadyInitialized: true }, 200);
+  if (result.meta?.changes !== 1) return response({ status: "completed", alreadyInitialized: true, projectId: attempt.projectId }, 200);
   const token = await decryptForSecret(
     attempt.encryptedToken,
     attempt.tokenIv,
     await sha256(body.pollSecret),
   );
-  return response({ status: "completed", alreadyInitialized: false, token, email: attempt.aegisEmail }, 200);
-}
-
-async function registerProject(request: Request, env: Env, principal: Principal): Promise<Response> {
-  if (!can(principal, "projects:write")) return response({ error: "Project registration is not allowed" }, 403);
-  const body = await request.json().catch(() => null) as {
-    id?: string;
-    name?: string;
-    appId?: string;
-    appName?: string;
-    workspaceId?: string;
-    workspaceName?: string;
-    tenantId?: string;
-    environment?: string;
-    storageProvider?: string;
-  } | null;
-  if (!body?.id || !body.name || !body.environment || !body.storageProvider) {
-    return response({ error: "id, name, environment, and storageProvider are required" }, 422);
-  }
-  if (!projectAllowed(principal, body.id)) return response({ error: "Project scope is not allowed" }, 403);
-  const workspaceId = body.workspaceId ?? body.tenantId ?? `workspace_${principal.aegisId}`;
-  const tenantId = body.tenantId ?? workspaceId;
-  const existingWorkspace = await env.DB.prepare(
-    "SELECT id FROM workspaces WHERE id = ?",
-  ).bind(workspaceId).first<{ id: string }>();
-  if (existingWorkspace && !(await memberOfWorkspace(env, principal, workspaceId, "workspace.write"))) {
-    return response({ error: "Workspace scope is not allowed" }, 403);
-  }
-  // Re-registering a project is how the CLI refreshes it, but only for people
-  // who may manage it; otherwise an id could be used to move someone else's
-  // project into another workspace.
-  const existingProject = await env.DB.prepare("SELECT workspace_id AS workspaceId FROM projects WHERE id = ?")
-    .bind(body.id).first<{ workspaceId: string }>();
-  if (existingProject && !(await memberOfProject(env, principal, body.id, "project.manage"))) {
-    return response({ error: "A project with this id already exists" }, 409);
-  }
-  if (existingProject && existingProject.workspaceId !== workspaceId) {
-    return response({ error: "This project belongs to another workspace" }, 409);
-  }
-  const joinedAt = new Date().toISOString();
-  await env.DB.batch([
-    env.DB.prepare(`
-      INSERT INTO aegis_users (id) VALUES (?) ON CONFLICT(id) DO NOTHING
-    `).bind(principal.aegisId),
-    env.DB.prepare(`
-      INSERT INTO workspaces (id, name, created_by)
-      VALUES (?, ?, ?)
-      ON CONFLICT(id) DO NOTHING
-    `).bind(workspaceId, body.workspaceName ?? workspaceId, principal.aegisId),
-    // Only the creator of a brand-new workspace becomes its owner; an existing
-    // membership (including a removed one) is left alone.
-    env.DB.prepare(`
-      INSERT INTO workspace_memberships (workspace_id, aegis_id, role, status, created_at)
-      SELECT ?, ?, 'owner', 'active', ?
-      WHERE NOT EXISTS (SELECT 1 FROM workspace_memberships WHERE workspace_id = ?)
-    `).bind(workspaceId, principal.aegisId, joinedAt, workspaceId),
-    env.DB.prepare(`
-      INSERT INTO project_apps (id, project_id, name, type, is_default)
-      VALUES (?, ?, ?, 'web', 1)
-      ON CONFLICT(project_id, id) DO NOTHING
-    `).bind(body.appId?.trim() || "default", body.id, body.appName?.trim() || body.name),
-    env.DB.prepare(`
-      INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
-      ON CONFLICT(id) DO UPDATE SET name = excluded.name, environment = excluded.environment,
-        storage_provider = excluded.storage_provider, workspace_id = excluded.workspace_id
-    `).bind(body.id, workspaceId, tenantId, body.name, body.environment, currentStorageProvider(body.storageProvider)),
-    env.DB.prepare(`
-      INSERT INTO project_memberships (project_id, aegis_id, role, status)
-      VALUES (?, ?, 'owner', 'active')
-      ON CONFLICT(project_id, aegis_id) DO NOTHING
-    `).bind(body.id, principal.aegisId),
-  ]);
-  await auditProject(env, principal, body.id, { action: "project.registered", targetType: "project", targetId: body.id, data: { environment: body.environment } }, request);
-  return response({ registered: true, projectId: body.id, workspaceId, tenantId }, 201);
+  return response({ status: "completed", alreadyInitialized: false, token, email: attempt.aegisEmail, projectId: attempt.projectId }, 200);
 }
 
 async function listWorkspaces(env: Env, principal: Principal): Promise<Response> {
@@ -400,7 +417,7 @@ async function listWorkspaces(env: Env, principal: Principal): Promise<Response>
   `).bind(principal.aegisId).all();
   const workspaces = await Promise.all(rows.results.map(async (workspace) => {
     const projects = await env.DB.prepare(`
-      SELECT p.id, p.name, p.environment, p.storage_provider AS storageProvider
+      SELECT p.id, p.name, p.environment, p.storage_provider AS storageProvider, p.locked_at AS lockedAt, p.inactive_at AS inactiveAt
       FROM projects p
       WHERE p.workspace_id = ? AND p.deleted_at IS NULL
       ORDER BY p.created_at ASC
@@ -461,6 +478,10 @@ async function createManagedProject(request: Request, env: Env, principal: Princ
   if (!can(principal, "projects:write") && !can(principal, "*")) return response({ error: "Project creation is not allowed" }, 403);
   const body = await request.json().catch(() => null) as {
     id?: string; name?: string; workspaceId?: string; environment?: string; storageProvider?: string;
+    /** Which app this is (src/registry/project-identity.ts): a git remote plus the app's folder, or a domain. */
+    identity?: unknown;
+    /** The app's site; a public one identifies the project by its domain when no identity is sent. */
+    appUrl?: unknown;
   } | null;
   const projectId = body?.id?.trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-|-$/g, "");
   const name = body?.name?.trim();
@@ -469,14 +490,32 @@ async function createManagedProject(request: Request, env: Env, principal: Princ
     return response({ error: "id, name, workspaceId, environment, and storageProvider are required" }, 422);
   }
   if (!(await memberOfWorkspace(env, principal, workspaceId, "workspace.write"))) return response({ error: "Workspace scope is not allowed" }, 403);
+  const identity = body.identity !== undefined && body.identity !== null
+    ? await readIdentity(body.identity)
+    : await readIdentity(body.appUrl ? { appUrl: body.appUrl } : null);
+  if (identity === "invalid") return invalidIdentity();
+  if (identity) {
+    // One app is one project: the same app in this workspace is the project that's already here.
+    const existing = await workspaceProjectWithIdentity(env, workspaceId, identity.hash);
+    if (existing) {
+      return response({
+        project: { id: existing.id, name: existing.name, workspaceId, inactiveAt: existing.inactiveAt },
+        existing: true,
+        identity: identityView({ identityKind: identity.kind, identityKey: identity.key }),
+      }, 200);
+    }
+    const inUse = await identityInUse(env, principal, workspaceId, identity);
+    if (inUse) return inUse;
+  }
   const projectLimit = await checkProjectLimit(env, workspaceId);
   if (projectLimit) return projectLimit;
   try {
     await env.DB.batch([
       env.DB.prepare(`
-        INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, storage_mode, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
-      `).bind(projectId, workspaceId, workspaceId, name, body.environment.trim(), currentStorageProvider(body.storageProvider), storageModeOf(body.storageProvider)),
+        INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, storage_mode,
+          identity_kind, identity_key, identity_hash, identity_origin, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+      `).bind(projectId, workspaceId, workspaceId, name, body.environment.trim(), currentStorageProvider(body.storageProvider), storageModeOf(body.storageProvider), ...identityValues(identity)),
       env.DB.prepare("INSERT INTO project_memberships (project_id, aegis_id, role, status) VALUES (?, ?, 'owner', 'active')")
         .bind(projectId, principal.aegisId),
       env.DB.prepare("INSERT INTO project_apps (id, project_id, name, type, is_default) VALUES ('default', ?, ?, 'web', 1)")
@@ -485,8 +524,12 @@ async function createManagedProject(request: Request, env: Env, principal: Princ
   } catch {
     return response({ error: "A project with this id already exists" }, 409);
   }
-  await auditProject(env, principal, projectId, { action: "project.created", targetType: "project", targetId: projectId }, request);
-  return response({ project: { id: projectId, name, workspaceId, environment: body.environment.trim(), storageProvider: body.storageProvider.trim() } }, 201);
+  const view = identity ? identityView({ identityKind: identity.kind, identityKey: identity.key }) : null;
+  await auditProject(env, principal, projectId, { action: "project.created", targetType: "project", targetId: projectId, ...(view ? { data: { identity: view.label } } : {}) }, request);
+  return response({
+    project: { id: projectId, name, workspaceId, environment: body.environment.trim(), storageProvider: body.storageProvider.trim() },
+    identity: view,
+  }, 201);
 }
 
 async function updateProject(request: Request, env: Env, principal: Principal, projectId: string): Promise<Response> {
@@ -586,7 +629,8 @@ async function listProjects(env: Env, principal: Principal): Promise<Response> {
            END AS workspaceName,
            p.tenant_id AS tenantId, p.name, p.environment,
            p.storage_provider AS storageProvider, p.storage_mode AS storageMode,
-           p.default_execution_mode AS defaultExecutionMode, p.locked_at AS lockedAt, p.created_at AS createdAt
+           p.default_execution_mode AS defaultExecutionMode, p.task_approval_mode AS taskApprovalMode, p.locked_at AS lockedAt,
+           p.inactive_at AS inactiveAt, p.identity_kind AS identityKind, p.identity_key AS identityKey, p.created_at AS createdAt
     FROM projects p
     JOIN workspace_memberships wm ON wm.workspace_id = p.workspace_id
     JOIN workspaces w ON w.id = p.workspace_id
@@ -622,8 +666,10 @@ async function listProjects(env: Env, principal: Principal): Promise<Response> {
       status: string;
       isDefault: number;
     }>();
+    const { identityKind, identityKey, ...rest } = project as Record<string, unknown> & { identityKind?: string | null; identityKey?: string | null };
     return {
-      ...project,
+      ...rest,
+      identity: identityView({ identityKind, identityKey }),
       apps: apps.results.map((app) => ({
         ...app,
         location: app.location ?? undefined,
@@ -717,6 +763,14 @@ async function createEnvironment(
     "SELECT id FROM project_apps WHERE project_id = ? AND id = ?",
   ).bind(projectId, appId).first<{ id: string }>();
   if (!app) return response({ error: "App does not belong to this project" }, 422);
+  // Two environments with one name can't be told apart in the picker.
+  const sameName = await env.DB.prepare(
+    "SELECT id FROM project_environments WHERE project_id = ? AND COALESCE(app_id, 'default') = ? AND lower(trim(name)) = lower(?)",
+  ).bind(projectId, appId, body.name.trim()).first<{ id: string }>();
+  if (sameName) return response({ error: `This app already has an environment named "${body.name.trim()}" (${sameName.id})` }, 409);
+  // A project with no identity yet is identified by its public site's domain.
+  const identityRefusal = await claimDomainIdentity(env, principal, projectId, body.baseUrl.trim());
+  if (identityRefusal) return identityRefusal;
   try {
     await env.DB.prepare(`
       INSERT INTO project_environments (id, project_id, app_id, name, base_url, api_url)
@@ -773,6 +827,9 @@ async function updateEnvironment(
       .bind(projectId, body.appId.trim()).first<{ id: string }>();
     if (!app) return response({ error: "App does not belong to this project" }, 422);
   }
+  // A project with no identity yet is identified by its public site's domain.
+  const identityRefusal = await claimDomainIdentity(env, principal, projectId, baseUrl);
+  if (identityRefusal) return identityRefusal;
   const result = await env.DB.prepare(`
     UPDATE project_environments
     SET app_id = COALESCE(?, app_id), name = ?, base_url = ?, api_url = ?, status = COALESCE(?, status),
@@ -911,7 +968,7 @@ function parseJsonColumn(value: unknown): unknown {
 }
 
 function hydrateRun<T extends Record<string, unknown>>(row: T) {
-  const { targetsJson, targetResultsJson, fixFromJson, ...rest } = row as Record<string, unknown>;
+  const { targetsJson, targetResultsJson, fixFromJson, caseScopeJson, ...rest } = row as Record<string, unknown>;
   const started = typeof rest.startedAt === "string" ? Date.parse(`${rest.startedAt.replace(" ", "T")}Z`) : NaN;
   const completed = typeof rest.completedAt === "string" ? Date.parse(`${rest.completedAt.replace(" ", "T")}Z`) : NaN;
   return {
@@ -919,10 +976,34 @@ function hydrateRun<T extends Record<string, unknown>>(row: T) {
     targets: parseJsonColumn(targetsJson),
     targetResults: parseJsonColumn(targetResultsJson),
     fixFrom: parseJsonColumn(fixFromJson),
+    caseScope: parseJsonColumn(caseScopeJson),
     durationMs: Number.isFinite(started) && Number.isFinite(completed) ? Math.max(0, completed - started) : null,
   };
 }
 
+/**
+ * Run evidence follows its run: once the run is past the plan's history, its
+ * objects are hidden too (the retention job deletes both). Evidence of a run
+ * the registry no longer knows is judged by when it was written.
+ */
+async function runEvidenceVisibility(env: Env, projectId: string): Promise<ArtifactVisibility | undefined> {
+  const cutoff = await historyCutoffFor(env, await workspaceOfProject(env, projectId));
+  if (!cutoff) return undefined;
+  const expired = new Map<string, boolean | null>();
+  return async (key, uploaded) => {
+    const runId = runIdOfArtifactKey(projectId, key);
+    if (!runId) return true;
+    if (!expired.has(runId)) {
+      const run = await env.DB.prepare("SELECT status, completed_at AS completedAt, requested_at AS requestedAt FROM runs WHERE id = ? AND project_id = ?")
+        .bind(runId, projectId).first<{ status: string; completedAt: string | null; requestedAt: string | null }>();
+      expired.set(runId, run ? runExpired(run, cutoff) : null);
+    }
+    const known = expired.get(runId);
+    if (known === null || known === undefined) return !uploaded || uploaded.getTime() >= Date.parse(cutoff);
+    return !known;
+  };
+}
+
 async function listRuns(env: Env, principal: Principal, projectId: string): Promise<Response> {
   if (!(await memberOfProject(env, principal, projectId))) return response({ error: "Project scope is not allowed" }, 403);
   const cutoff = await historyCutoffFor(env, await workspaceOfProject(env, projectId));
@@ -938,9 +1019,9 @@ async function listRuns(env: Env, principal: Principal, projectId: string): Prom
            manifest_key AS manifestKey, requested_at AS requestedAt,
            started_at AS startedAt, completed_at AS completedAt,
            targets_json AS targetsJson, environment_base_url AS environmentBaseUrl,
-           target_results_json AS targetResultsJson, fix_from_json AS fixFromJson,
+           target_results_json AS targetResultsJson, fix_from_json AS fixFromJson, case_scope_json AS caseScopeJson,
            execution_mode AS executionMode, blocked_reason AS blockedReason, billed_minutes AS billedMinutes,
-           trigger_source AS triggerSource, repo_full_name AS repoFullName, commit_sha AS commitSha, pr_number AS prNumber,
+           trigger_source AS triggerSource, repo_full_name AS repoFullName, commit_sha AS commitSha, pr_number AS prNumber, check_run_id AS checkRunId,
            gitlab_binding_id AS gitlabBindingId
     FROM runs
     WHERE project_id = ? AND (? IS NULL OR COALESCE(completed_at, requested_at) >= ? OR status NOT IN ('success', 'partial', 'error', 'cancelled'))
@@ -952,6 +1033,8 @@ async function listRuns(env: Env, principal: Principal, projectId: string): Prom
 async function createRun(request: Request, env: Env, principal: Principal, projectId: string, ctx: ExecutionContext, internal: InternalRunFields = {}): Promise<Response> {
   if (!can(principal, "runs:write") && !can(principal, "*")) return response({ error: "Run creation is not allowed" }, 403);
   if (!(await memberOfProject(env, principal, projectId, "project.write"))) return response({ error: "Project scope is not allowed" }, 403);
+  const paused = await projectInactiveRefusal(env, projectId);
+  if (paused) return paused;
   const body = await requestJson(request);
   const planId = typeof body?.planId === "string" ? body.planId.trim() : "";
   const idempotencyKey = typeof body?.idempotencyKey === "string" ? body.idempotencyKey.trim() : "";
@@ -1025,8 +1108,8 @@ async function createRun(request: Request, env: Env, principal: Principal, proje
   const targets = matrix.targets.length > 0 ? matrix.targets : null;
   await env.DB.prepare(`
     INSERT INTO runs (id, project_id, tenant_id, plan_id, journey_id, journey_revision, environment_id, requested_by, idempotency_key, driver, platform, targets_json, environment_base_url, fix_from_json, execution_mode, workspace_id,
-      trigger_source, repo_full_name, commit_sha, pr_number, github_installation_id, gitlab_binding_id)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      trigger_source, repo_full_name, commit_sha, pr_number, github_installation_id, gitlab_binding_id, case_scope_json)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).bind(
     runId, projectId, project?.tenantId ?? `tenant_${principal.aegisId}`, planId, draft.journeyId,
     Number.isFinite(Number(body?.journeyRevision)) ? Number(body?.journeyRevision) : null,
@@ -1044,6 +1127,7 @@ async function createRun(request: Request, env: Env, principal: Principal, proje
     internal.prNumber ?? null,
     internal.githubInstallationId ?? null,
     internal.gitlabBindingId ?? null,
+    internal.caseScope ? JSON.stringify(internal.caseScope) : null,
   ).run();
   await appendRunEvent(env, runId, "queued", { status: "queued", targets, environmentBaseUrl, executionMode });
   await broadcastProjectEvent(env, projectId, { type: "job_queued", runId, projectId, planId, executionMode });
@@ -1053,6 +1137,7 @@ async function createRun(request: Request, env: Env, principal: Principal, proje
     run: {
       id: runId, projectId, planId, journeyId: draft.journeyId, status: "queued", executionMode,
       environmentId, environmentBaseUrl, targets, targetResults: null, durationMs: null, fixFrom,
+      caseScope: internal.caseScope ?? null,
     },
   }, 201);
 }
@@ -1069,11 +1154,15 @@ async function getRun(env: Env, principal: Principal, runId: string): Promise<Re
            manifest_key AS manifestKey, requested_at AS requestedAt,
            started_at AS startedAt, completed_at AS completedAt,
            targets_json AS targetsJson, environment_base_url AS environmentBaseUrl,
-           target_results_json AS targetResultsJson, fix_from_json AS fixFromJson,
+           target_results_json AS targetResultsJson, fix_from_json AS fixFromJson, case_scope_json AS caseScopeJson,
            execution_mode AS executionMode, blocked_reason AS blockedReason, billed_minutes AS billedMinutes
     FROM runs WHERE id = ?
   `).bind(runId).first<{ projectId: string } & Record<string, unknown>>();
   if (!run || !(await memberOfProject(env, principal, run.projectId))) return response({ error: "Run not found" }, 404);
+  const workspaceId = await workspaceOfProject(env, run.projectId);
+  if (runExpired({ status: String(run.status), completedAt: run.completedAt as string | null, requestedAt: run.requestedAt as string | null }, await historyCutoffFor(env, workspaceId))) {
+    return response({ error: "This run is older than your plan's run history. Upgrade to keep history longer.", code: "history_expired", ...billingLinks(env, workspaceId) }, 404);
+  }
   const events = await env.DB.prepare(`
     SELECT sequence, type, payload_json AS payload, created_at AS createdAt
     FROM run_events WHERE run_id = ? ORDER BY sequence ASC
@@ -1088,10 +1177,12 @@ async function claimRun(request: Request, env: Env, principal: Principal, runId:
   if (!workerId) return response({ error: "workerId is required" }, 422);
   const run = await env.DB.prepare(`
     SELECT project_id AS projectId, targets_json AS targetsJson, environment_base_url AS environmentBaseUrl,
-           fix_from_json AS fixFromJson, execution_mode AS executionMode, workspace_id AS workspaceId, status
+           fix_from_json AS fixFromJson, case_scope_json AS caseScopeJson, execution_mode AS executionMode, workspace_id AS workspaceId, status
     FROM runs WHERE id = ?
-  `).bind(runId).first<{ projectId: string; targetsJson: string | null; environmentBaseUrl: string | null; fixFromJson: string | null; executionMode: string; workspaceId: string | null; status: string }>();
+  `).bind(runId).first<{ projectId: string; targetsJson: string | null; environmentBaseUrl: string | null; fixFromJson: string | null; caseScopeJson: string | null; executionMode: string; workspaceId: string | null; status: string }>();
   if (!run || !(await memberOfProject(env, principal, run.projectId, "project.write"))) return response({ error: "Run not found" }, 404);
+  const paused = await projectInactiveRefusal(env, run.projectId);
+  if (paused) return paused;
   // Bugmole Cloud runs are billed; only Bugmole's own runners may take them.
   if (run.executionMode === "cloud") return response({ error: "This run is queued for Bugmole Cloud" }, 409);
   const lease = new Date(Date.now() + 60_000).toISOString();
@@ -1116,6 +1207,7 @@ async function claimRun(request: Request, env: Env, principal: Principal, runId:
     environmentBaseUrl: run.environmentBaseUrl,
     targets: parseJsonColumn(run.targetsJson),
     fixFrom: parseJsonColumn(run.fixFromJson),
+    caseScope: parseJsonColumn(run.caseScopeJson),
   });
 }
 
@@ -1201,16 +1293,35 @@ const taskSelect = `
          idempotency_key AS idempotencyKey, requested_at AS requestedAt,
          started_at AS startedAt, completed_at AS completedAt, device_session_id AS deviceSessionId,
          attempts, next_attempt_at AS nextAttemptAt,
-         execution_mode AS executionMode, billed_minutes AS billedMinutes
+         execution_mode AS executionMode, billed_minutes AS billedMinutes,
+         approved_at AS approvedAt, approved_by AS approvedBy,
+         reviewed_at AS reviewedAt, reviewed_by AS reviewedBy, review_note AS reviewNote
   FROM agent_tasks
 `;
 
 
-async function listAgentTasks(env: Env, principal: Principal, projectId: string): Promise<Response> {
+// A worker on someone's machine lists its project's tasks on every poll, with
+// the machine's API key. That is how the registry knows a machine is
+// connected: resume won't queue a machine-only task on a cloud project with
+// none. Written at most once a minute, whatever the poll rate.
+async function noteLocalWorker(env: Env, principal: Principal, projectId: string): Promise<void> {
+  if (!principal.apiKeyId || principal.runner) return;
+  const now = Date.now();
+  await env.DB.prepare(`
+    UPDATE projects SET local_worker_seen_at = ?
+    WHERE id = ? AND (local_worker_seen_at IS NULL OR local_worker_seen_at < ?)
+  `).bind(new Date(now).toISOString(), projectId, new Date(now - LOCAL_WORKER_SEEN_THROTTLE_MS).toISOString()).run();
+}
+
+async function listAgentTasks(env: Env, principal: Principal, projectId: string, ctx: ExecutionContext): Promise<Response> {
   if (!(await memberOfProject(env, principal, projectId))) return response({ error: "Project scope is not allowed" }, 403);
-  const rows = await env.DB.prepare(`${taskSelect} WHERE project_id = ? ORDER BY priority DESC, requested_at ASC LIMIT 100`)
-    .bind(projectId).all();
-  return response({ tasks: rows.results });
+  ctx.waitUntil(noteLocalWorker(env, principal, projectId).catch(() => undefined));
+  const [rows, project] = await Promise.all([
+    env.DB.prepare(`${taskSelect} WHERE project_id = ? ORDER BY priority DESC, requested_at ASC LIMIT 100`).bind(projectId).all(),
+    env.DB.prepare("SELECT local_worker_seen_at AS localWorkerSeenAt FROM projects WHERE id = ?")
+      .bind(projectId).first<{ localWorkerSeenAt: string | null }>(),
+  ]);
+  return response({ tasks: rows.results, localWorkerSeenAt: project?.localWorkerSeenAt ?? null });
 }
 
 function extractDiscoveryUrl(description: string): string | null {
@@ -1251,6 +1362,17 @@ async function fillDiscoveredEnvironmentUrl(env: Env, projectId: string, descrip
       .bind(origin, projectId, existing.id).run();
     return;
   }
+  // An environment that isn't marked default (made by hand, or by an older
+  // onboarding) is still the project's environment: promote it rather than
+  // add a second "Production" beside it.
+  const other = await env.DB.prepare(
+    "SELECT id, base_url AS baseUrl FROM project_environments WHERE project_id = ? ORDER BY rowid LIMIT 1",
+  ).bind(projectId).first<{ id: string; baseUrl: string }>();
+  if (other) {
+    await env.DB.prepare("UPDATE project_environments SET is_default = 1, base_url = CASE WHEN base_url = '' THEN ? ELSE base_url END WHERE project_id = ? AND id = ?")
+      .bind(origin, projectId, other.id).run();
+    return;
+  }
   const app = await env.DB.prepare("SELECT id FROM project_apps WHERE project_id = ? AND is_default = 1")
     .bind(projectId).first<{ id: string }>();
   if (!app) return;
@@ -1265,6 +1387,8 @@ async function createAgentTask(request: Request, env: Env, principal: Principal,
     return response({ error: "Task creation is not allowed" }, 403);
   }
   if (!(await memberOfProject(env, principal, projectId, "project.write"))) return response({ error: "Project scope is not allowed" }, 403);
+  const paused = await projectInactiveRefusal(env, projectId);
+  if (paused) return paused;
   const body = await requestJson(request) as {
     title?: string; description?: string; taskType?: string; idempotencyKey?: string; priority?: number;
     journeyId?: string; journeyRevision?: number; deviceSessionId?: string; stepId?: string;
@@ -1297,7 +1421,14 @@ async function createAgentTask(request: Request, env: Env, principal: Principal,
       if (domainProblem) return domainProblem;
     }
   }
+  // The project's approval mode decides whether this task can start by
+  // itself or waits for someone to press Approve.
+  const approvalMode = approvalModeOf((await env.DB.prepare("SELECT task_approval_mode AS mode FROM projects WHERE id = ?")
+    .bind(projectId).first<{ mode: string }>())?.mode) ?? DEFAULT_APPROVAL_MODE;
+  const approvedBy = needsApproval(approvalMode, taskType) ? null : autoApprover(approvalMode);
   const queued = (taskId: string) => {
+    // Waiting for approval isn't queued for a runner yet; approving it is.
+    if (!approvedBy) return;
     for (const hook of taskQueuedHooks) ctx.waitUntil(hook(env, { taskId, projectId, workspaceId: taskWorkspaceId, executionMode }));
   };
   const existing = await env.DB.prepare(`${taskSelect} WHERE project_id = ? AND idempotency_key = ?`)
@@ -1317,7 +1448,8 @@ async function createAgentTask(request: Request, env: Env, principal: Principal,
         attempts = 0, next_attempt_at = NULL,
         execution_mode = ?, workspace_id = ?, claimed_at = NULL, billed_at = NULL, billed_minutes = NULL,
         blocked_reason = NULL, dispatch_attempts = 0, next_dispatch_at = NULL,
-        requested_at = CURRENT_TIMESTAMP, started_at = NULL, completed_at = NULL
+        requested_at = CURRENT_TIMESTAMP, started_at = NULL, completed_at = NULL,
+        approved_at = CASE WHEN ? IS NULL THEN NULL ELSE CURRENT_TIMESTAMP END, approved_by = ?
       WHERE id = ?
     `).bind(
       title, description, taskType,
@@ -1326,6 +1458,7 @@ async function createAgentTask(request: Request, env: Env, principal: Principal,
       typeof body?.deviceSessionId === "string" ? body.deviceSessionId : null,
       typeof body?.stepId === "string" ? body.stepId : null,
       executionMode, taskWorkspaceId,
+      approvedBy, approvedBy,
       existing.id,
     ).run();
     await broadcastProjectEvent(env, projectId, { type: "task_event", taskId: existing.id, projectId, status: "queued" });
@@ -1337,8 +1470,8 @@ async function createAgentTask(request: Request, env: Env, principal: Principal,
   const taskId = id("task");
   await env.DB.prepare(`
     INSERT INTO agent_tasks
-      (id, project_id, tenant_id, title, description, task_type, priority, requested_by, idempotency_key, journey_id, journey_revision, device_session_id, step_id, execution_mode, workspace_id)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      (id, project_id, tenant_id, title, description, task_type, priority, requested_by, idempotency_key, journey_id, journey_revision, device_session_id, step_id, execution_mode, workspace_id, approved_at, approved_by)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CASE WHEN ? IS NULL THEN NULL ELSE CURRENT_TIMESTAMP END, ?)
   `).bind(
     taskId, projectId, project?.tenantId ?? `tenant_${principal.aegisId}`, title, description, taskType,
     Number.isFinite(Number(body?.priority)) ? Number(body?.priority) : 0, principal.aegisId, idempotencyKey,
@@ -1346,6 +1479,7 @@ async function createAgentTask(request: Request, env: Env, principal: Principal,
     typeof body?.deviceSessionId === "string" ? body.deviceSessionId : null,
     typeof body?.stepId === "string" ? body.stepId : null,
     executionMode, taskWorkspaceId,
+    approvedBy, approvedBy,
   ).run();
   await broadcastProjectEvent(env, projectId, { type: "task_event", taskId, projectId, status: "queued" });
   queued(taskId);
@@ -1362,6 +1496,8 @@ async function claimAgentTask(request: Request, env: Env, principal: Principal,
     .bind(taskId).first<{ projectId: string; executionMode: string }>();
   if (!task || !(await memberOfProject(env, principal, task.projectId, "project.write"))) return response({ error: "Task not found" }, 404);
   if (task.executionMode === "cloud") return response({ error: "This task is queued for Bugmole Cloud" }, 409);
+  const paused = await projectInactiveRefusal(env, task.projectId);
+  if (paused) return paused;
   const lease = new Date(Date.now() + 60_000).toISOString();
   const deviceSessionId = typeof body?.deviceSessionId === "string" ? body.deviceSessionId : null;
   // Claiming is what counts as an attempt: it's the only point both the
@@ -1375,8 +1511,11 @@ async function claimAgentTask(request: Request, env: Env, principal: Principal,
     WHERE id = ? AND attempts < ${MAX_TASK_ATTEMPTS}
       AND (next_attempt_at IS NULL OR next_attempt_at <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
       AND (status = 'queued' OR status = 'blocked' OR (status = 'running' AND lease_expires_at < strftime('%Y-%m-%dT%H:%M:%fZ', 'now')))
+      AND approved_at IS NOT NULL
   `).bind(workerId, lease, deviceSessionId, taskId).run() as { meta?: { changes?: number } };
   if (claimed.meta?.changes !== 1) {
+    const waiting = await env.DB.prepare("SELECT 1 AS waiting FROM agent_tasks WHERE id = ? AND approved_at IS NULL").bind(taskId).first();
+    if (waiting) return response({ error: "Task is waiting for approval" }, 409);
     return response({ error: "Task is already claimed, complete, or has exhausted its attempts" }, 409);
   }
   await broadcastProjectEvent(env, task.projectId, { type: "task_event", taskId, projectId: task.projectId, status: "running", workerId });
@@ -1393,11 +1532,25 @@ async function updateAgentTask(request: Request, env: Env, principal: Principal,
   `).bind(taskId).first<{ projectId: string; workerId: string | null; taskType: string; attempts: number; status: string; executionMode: string; workspaceId: string | null; description: string | null }>();
   if (!task || !(await memberOfProject(env, principal, task.projectId, "project.write"))) return response({ error: "Task not found" }, 404);
   if (task.workerId && body?.workerId !== task.workerId) return response({ error: "Worker lease does not match" }, 409);
-  const status = typeof body?.status === "string" ? body.status : "running";
-  if (!["running", "blocked", "completed", "error"].includes(status)) return response({ error: "Invalid task status" }, 422);
-  if (status === "completed" && task.taskType === "ui" && (!body?.parityAuditId || typeof body?.parityMatchScore !== "number")) {
+  const reported = typeof body?.status === "string" ? body.status : "running";
+  if (!["running", "blocked", "completed", "error"].includes(reported)) return response({ error: "Invalid task status" }, 422);
+  if (reported === "completed" && task.taskType === "ui" && (!body?.parityAuditId || typeof body?.parityMatchScore !== "number")) {
     return response({ error: "UI tasks require parityAuditId and parityMatchScore before completion" }, 422);
   }
+  // A task in review is the worker's finished work waiting for a person.
+  // Reporting completed again (the agent and its driver both close it) is a
+  // no-op; anything else would overwrite what the reviewer is looking at.
+  if (task.status === IN_REVIEW) {
+    if (reported !== "completed") return response({ error: "Task is waiting for review" }, 409);
+    return response({ updated: false, inReview: true, message: "Task is already waiting for review.", task: await env.DB.prepare(`${taskSelect} WHERE id = ?`).bind(taskId).first() });
+  }
+  // Completion review follows the approval mode, the same risk model as
+  // starting: the worker says completed, the project decides whether a
+  // person looks at it first.
+  const mode = reported === "completed"
+    ? approvalModeOf((await env.DB.prepare("SELECT task_approval_mode AS mode FROM projects WHERE id = ?").bind(task.projectId).first<{ mode: string }>())?.mode) ?? DEFAULT_APPROVAL_MODE
+    : DEFAULT_APPROVAL_MODE;
+  const status = reported === "completed" ? completionStatus(mode, task.taskType) : reported;
   // Falling back to blocked schedules the next attempt rather than making
   // the task immediately eligible again on the worker's next 5s poll.
   const nextAttemptAt = status === "blocked" ? backoffUntil(task.attempts ?? 0) : null;
@@ -1409,7 +1562,7 @@ async function updateAgentTask(request: Request, env: Env, principal: Principal,
       completed_at = CASE WHEN ? IN ('completed', 'error') THEN CURRENT_TIMESTAMP ELSE completed_at END
     WHERE id = ?
   `).bind(
-    status, new Date(Date.now() + 60_000).toISOString(),
+    status, status === IN_REVIEW ? null : new Date(Date.now() + 60_000).toISOString(),
     typeof body?.progressMessage === "string" ? body.progressMessage : null,
     body?.continuation ? JSON.stringify(body.continuation) : null,
     typeof body?.parityMatchScore === "number" ? body.parityMatchScore : null,
@@ -1422,8 +1575,10 @@ async function updateAgentTask(request: Request, env: Env, principal: Principal,
   if (status === "completed" && task.taskType === "discovery") {
     await fillDiscoveredEnvironmentUrl(env, task.projectId, task.description);
   }
-  await broadcastProjectEvent(env, task.projectId, { type: "task_event", taskId, projectId: task.projectId, status, ...body });
-  const terminal = status === "completed" || status === "error";
+  await broadcastProjectEvent(env, task.projectId, { type: "task_event", taskId, projectId: task.projectId, ...body, status });
+  // In review, the worker's part is over: it stops being metered and frees
+  // its cloud slot, though the task isn't completed until someone accepts it.
+  const terminal = status === "completed" || status === "error" || status === IN_REVIEW;
   if (status !== task.status) {
     const event = {
       taskId, projectId: task.projectId, workspaceId: task.workspaceId, executionMode: task.executionMode,
@@ -1440,34 +1595,170 @@ async function updateAgentTask(request: Request, env: Env, principal: Principal,
   }
   return response({
     updated: true,
+    ...(status === IN_REVIEW ? { inReview: true, message: inReviewMessage(mode) } : {}),
     task: await env.DB.prepare(`${taskSelect} WHERE id = ?`).bind(taskId).first(),
     ...(stop ? { stop: true, reason: stop.reason, message: stop.message } : {}),
   });
 }
 
+// Reviewing is a person's call on work an AI worker says it finished. Only a
+// person may make it — never an API key or runner, or an agent could accept
+// its own work — and only someone who can manage the project.
+async function reviewTarget(env: Env, principal: Principal, taskId: string) {
+  if (principal.apiKeyId || principal.runner) return { error: response({ error: "Only a person can review a task" }, 403) };
+  const task = await env.DB.prepare(`
+    SELECT project_id AS projectId, status, task_type AS taskType, description,
+           execution_mode AS executionMode, workspace_id AS workspaceId, approved_at AS approvedAt
+    FROM agent_tasks WHERE id = ?
+  `).bind(taskId).first<{ projectId: string; status: string; taskType: string; description: string | null; executionMode: "self" | "cloud"; workspaceId: string | null; approvedAt: string | null }>();
+  if (!task || !(await memberOfProject(env, principal, task.projectId))) return { error: response({ error: "Task not found" }, 404) };
+  if (!(await memberOfProject(env, principal, task.projectId, "project.manage"))) return { error: response({ error: "Only project managers can review tasks" }, 403) };
+  if (task.status !== IN_REVIEW) return { error: response({ error: "Only a task in review can be accepted or sent back" }, 409) };
+  return { task };
+}
+
+async function acceptAgentTask(request: Request, env: Env, principal: Principal, taskId: string, ctx: ExecutionContext): Promise<Response> {
+  const target = await reviewTarget(env, principal, taskId);
+  if (target.error) return target.error;
+  const { task } = target;
+  const body = await requestJson(request);
+  const note = typeof body?.note === "string" && body.note.trim() ? body.note.trim().slice(0, REVIEW_NOTE_MAX) : null;
+  const reviewer = principal.email || principal.aegisId;
+  const updated = await env.DB.prepare(`
+    UPDATE agent_tasks SET status = 'completed', completed_at = CURRENT_TIMESTAMP,
+      reviewed_at = CURRENT_TIMESTAMP, reviewed_by = ?, review_note = ?
+    WHERE id = ? AND status = ?
+  `).bind(reviewer, note, taskId, IN_REVIEW).run();
+  if ((updated.meta?.changes ?? 0) === 0) return response({ error: "Only a task in review can be accepted or sent back" }, 409);
+  if (task.taskType === "discovery") await fillDiscoveredEnvironmentUrl(env, task.projectId, task.description);
+  await auditProject(env, principal, task.projectId, { action: "task.review_accepted", targetType: "task", targetId: taskId, ...(note ? { data: { note } } : {}) }, request);
+  await broadcastProjectEvent(env, task.projectId, { type: "task_event", taskId, projectId: task.projectId, status: "completed" });
+  const event = {
+    taskId, projectId: task.projectId, workspaceId: task.workspaceId, executionMode: task.executionMode,
+    // Already metered when it went into review; fromDispatcher keeps the
+    // metering hook from dispatching again for a slot freed back then.
+    status: "completed", previousStatus: IN_REVIEW, terminal: true, fromDispatcher: true,
+  };
+  for (const hook of taskChangedHooks) ctx.waitUntil(hook(env, event));
+  return response({ accepted: true, task: await env.DB.prepare(`${taskSelect} WHERE id = ?`).bind(taskId).first() });
+}
+
+async function sendBackAgentTask(request: Request, env: Env, principal: Principal, taskId: string, ctx: ExecutionContext): Promise<Response> {
+  const target = await reviewTarget(env, principal, taskId);
+  if (target.error) return target.error;
+  const { task } = target;
+  const body = await requestJson(request);
+  const note = typeof body?.note === "string" ? body.note.trim().slice(0, REVIEW_NOTE_MAX) : "";
+  if (!note) return response({ error: "Say what needs to change in note" }, 422);
+  const fields = sentBackTaskFields(note);
+  const reviewer = principal.email || principal.aegisId;
+  // The approval stands: the reviewer is asking for more of the same work.
+  const updated = await env.DB.prepare(`
+    UPDATE agent_tasks SET status = ?, attempts = ?, next_attempt_at = NULL, lease_expires_at = NULL,
+      worker_id = NULL, error_message = NULL, completed_at = NULL,
+      progress_message = ?, heartbeat_at = CURRENT_TIMESTAMP,
+      claimed_at = NULL, billed_at = NULL, billed_minutes = NULL,
+      blocked_reason = NULL, dispatch_attempts = 0, next_dispatch_at = NULL,
+      reviewed_at = CURRENT_TIMESTAMP, reviewed_by = ?, review_note = ?
+    WHERE id = ? AND status = ?
+  `).bind(fields.status, fields.attempts, fields.progressMessage, reviewer, fields.reviewNote, taskId, IN_REVIEW).run();
+  if ((updated.meta?.changes ?? 0) === 0) return response({ error: "Only a task in review can be accepted or sent back" }, 409);
+  await auditProject(env, principal, task.projectId, { action: "task.review_sent_back", targetType: "task", targetId: taskId, data: { note } }, request);
+  await broadcastProjectEvent(env, task.projectId, { type: "task_event", taskId, projectId: task.projectId, status: "queued", progressMessage: fields.progressMessage });
+  if (task.approvedAt) {
+    for (const hook of taskQueuedHooks) ctx.waitUntil(hook(env, { taskId, projectId: task.projectId, workspaceId: task.workspaceId, executionMode: task.executionMode }));
+  }
+  return response({ sentBack: true, task: await env.DB.prepare(`${taskSelect} WHERE id = ?`).bind(taskId).first() });
+}
+
 // The counterpart to cancelling: a human answering what a parked task asked
 // for and putting it back in the queue. Same trust boundary as cancel (no
 // worker-lease check — the worker that gave up is exactly who we are
 // overriding), and the attempt cap is deliberately not consulted, since
 // being over it is the normal reason to be here.
-async function resumeAgentTask(request: Request, env: Env, principal: Principal, taskId: string): Promise<Response> {
+//
+// Resuming used to only flip the row back to queued. A cloud task then sat
+// until the next cron tick (the dispatcher was never told), and a task only a
+// machine can run went back into a queue nothing on a cloud project ever
+// reads. Now a cloud task is handed to the dispatcher as approving does, a
+// machine-only task on a cloud project with no machine connected is refused
+// with what to do instead, and a discovery can be moved to Bugmole Cloud with
+// `executionMode: "cloud"`. Approval is decided again by the project's mode
+// (see resumedApproval).
+async function resumeAgentTask(request: Request, env: Env, principal: Principal, taskId: string, ctx: ExecutionContext): Promise<Response> {
   if (!can(principal, "tasks:write") && !can(principal, "runs:write") && !can(principal, "*")) return response({ error: "Task resume is not allowed" }, 403);
-  const task = await env.DB.prepare("SELECT project_id AS projectId, status, lease_expires_at AS leaseExpiresAt FROM agent_tasks WHERE id = ?")
-    .bind(taskId).first<{ projectId: string; status: string; leaseExpiresAt: string | null }>();
+  const task = await env.DB.prepare(`
+    SELECT project_id AS projectId, status, lease_expires_at AS leaseExpiresAt, task_type AS taskType,
+           execution_mode AS executionMode, workspace_id AS workspaceId, description,
+           approved_at AS approvedAt, approved_by AS approvedBy
+    FROM agent_tasks WHERE id = ?
+  `).bind(taskId).first<{
+    projectId: string; status: string; leaseExpiresAt: string | null; taskType: string; executionMode: "self" | "cloud";
+    workspaceId: string | null; description: string | null; approvedAt: string | null; approvedBy: string | null;
+  }>();
   if (!task || !(await memberOfProject(env, principal, task.projectId, "project.write"))) return response({ error: "Task not found" }, 404);
   if (!isResumableTask(task)) {
-    return response({ error: task.status === "completed" ? "Task is already finished" : "Task is still held by a live worker" }, 409);
+    return response({
+      error: task.status === "completed" ? "Task is already finished"
+        : task.status === IN_REVIEW ? "Task is waiting for review; accept it or send it back"
+          : "Task is still held by a live worker",
+    }, 409);
   }
   const body = await requestJson(request);
+  const project = await env.DB.prepare(`
+    SELECT storage_mode AS storageMode, default_execution_mode AS defaultExecutionMode,
+           local_worker_seen_at AS localWorkerSeenAt, task_approval_mode AS approvalMode
+    FROM projects WHERE id = ?
+  `).bind(task.projectId).first<{ storageMode: string; defaultExecutionMode: string; localWorkerSeenAt: string | null; approvalMode: string }>();
+  let executionMode = task.executionMode;
+  let workspaceId = task.workspaceId;
+  const requested = (body as { executionMode?: unknown } | null)?.executionMode;
+  if (requested !== undefined && requested !== executionMode) {
+    // Moving to the cloud passes the same checks as starting there.
+    if (requested !== "cloud") return response({ error: "A task can only be moved to Bugmole Cloud" }, 422);
+    if (task.taskType !== "discovery") return response({ error: "Only discovery can run on Bugmole Cloud" }, 422);
+    workspaceId = await workspaceOfProject(env, task.projectId);
+    if (!workspaceId) return response({ error: "This project isn't in a workspace" }, 422);
+    const storageProblem = await cloudStorageError(env, task.projectId);
+    if (storageProblem) return storageProblem;
+    const accountProblem = await cloudAccountError(env, principal, workspaceId);
+    if (accountProblem) return accountProblem;
+    const blocked = await checkCloudRun(env, workspaceId);
+    if (blocked) return blocked;
+    const discoveryUrl = extractDiscoveryUrl(task.description ?? "");
+    if (!discoveryUrl) return response({ error: "Discovery needs an http(s) URL to explore" }, 422);
+    const domainProblem = await requireVerifiedDomainForCloud(env, workspaceId, discoveryUrl);
+    if (domainProblem) return domainProblem;
+    executionMode = "cloud";
+  }
+  const placement = resumePlacement({ executionMode, taskType: task.taskType }, project ?? {});
+  if (placement.kind === "stranded") {
+    return response({ error: strandedTaskMessage(placement.canRunInCloud), code: "needs_local_worker", canRunInCloud: placement.canRunInCloud }, 409);
+  }
   const note = typeof body?.note === "string" && body.note.trim() ? body.note.trim() : "Resumed by user";
   const fields = resumedTaskFields();
+  const { approvedBy } = resumedApproval(task, approvalModeOf(project?.approvalMode) ?? DEFAULT_APPROVAL_MODE);
+  // SET expressions read the row as it was, so a person's approval keeps its time.
   await env.DB.prepare(`
     UPDATE agent_tasks SET status = ?, attempts = ?, next_attempt_at = NULL, lease_expires_at = NULL,
       worker_id = NULL, error_message = NULL, completed_at = NULL,
-      progress_message = ?, heartbeat_at = CURRENT_TIMESTAMP
+      progress_message = ?, heartbeat_at = CURRENT_TIMESTAMP,
+      execution_mode = ?, workspace_id = ?,
+      claimed_at = NULL, billed_at = NULL, billed_minutes = NULL,
+      blocked_reason = NULL, dispatch_attempts = 0, next_dispatch_at = NULL,
+      approved_at = CASE WHEN ? IS NULL THEN NULL
+                         WHEN approved_by IS ? AND approved_at IS NOT NULL THEN approved_at
+                         ELSE CURRENT_TIMESTAMP END,
+      approved_by = ?
     WHERE id = ?
-  `).bind(fields.status, fields.attempts, note, taskId).run();
+  `).bind(fields.status, fields.attempts, note, executionMode, workspaceId, approvedBy, approvedBy, approvedBy, taskId).run();
   await broadcastProjectEvent(env, task.projectId, { type: "task_event", taskId, projectId: task.projectId, status: fields.status, progressMessage: note });
+  // A cloud task is only ever started by the dispatcher, so tell it now
+  // rather than leaving the task to the next cron tick. One that waits for
+  // approval again is handed over when someone approves it.
+  if (approvedBy) {
+    for (const hook of taskQueuedHooks) ctx.waitUntil(hook(env, { taskId, projectId: task.projectId, workspaceId, executionMode }));
+  }
   return response({ resumed: true, task: await env.DB.prepare(`${taskSelect} WHERE id = ?`).bind(taskId).first() });
 }
 
@@ -1476,6 +1767,29 @@ async function resumeAgentTask(request: Request, env: Env, principal: Principal,
 // lease check (`body.workerId` must match `worker_id`) deliberately doesn't
 // apply here, since the whole point is overriding a task that's stuck
 // (claimed by a worker that died, or never should have been claimed).
+// Approving is a person's go-ahead for a task the project's approval mode held
+// back. Like cancel and resume it is a human action on the task, so it needs
+// project management rights rather than a worker lease.
+async function approveAgentTask(request: Request, env: Env, principal: Principal, taskId: string, ctx: ExecutionContext): Promise<Response> {
+  if (!can(principal, "tasks:write") && !can(principal, "runs:write") && !can(principal, "*")) return response({ error: "Task approval is not allowed" }, 403);
+  const task = await env.DB.prepare(`
+    SELECT project_id AS projectId, status, approved_at AS approvedAt, execution_mode AS executionMode, workspace_id AS workspaceId
+    FROM agent_tasks WHERE id = ?
+  `).bind(taskId).first<{ projectId: string; status: string; approvedAt: string | null; executionMode: "self" | "cloud"; workspaceId: string | null }>();
+  if (!task || !(await memberOfProject(env, principal, task.projectId, "project.write"))) return response({ error: "Task not found" }, 404);
+  if (!(await memberOfProject(env, principal, task.projectId, "project.manage"))) return response({ error: "Only project managers can approve tasks" }, 403);
+  if (task.approvedAt) return response({ error: "Task is already approved" }, 409);
+  if (!["queued", "blocked"].includes(task.status)) return response({ error: "Only a waiting task can be approved" }, 409);
+  const approvedBy = principal.email || principal.aegisId;
+  await env.DB.prepare("UPDATE agent_tasks SET approved_at = CURRENT_TIMESTAMP, approved_by = ? WHERE id = ? AND approved_at IS NULL")
+    .bind(approvedBy, taskId).run();
+  await auditProject(env, principal, task.projectId, { action: "task.approved", targetType: "task", targetId: taskId }, request);
+  await broadcastProjectEvent(env, task.projectId, { type: "task_event", taskId, projectId: task.projectId, status: task.status });
+  // A cloud task was never handed to a runner while it waited; do that now.
+  for (const hook of taskQueuedHooks) ctx.waitUntil(hook(env, { taskId, projectId: task.projectId, workspaceId: task.workspaceId, executionMode: task.executionMode }));
+  return response({ approved: true, task: await env.DB.prepare(`${taskSelect} WHERE id = ?`).bind(taskId).first() });
+}
+
 async function cancelAgentTask(request: Request, env: Env, principal: Principal, taskId: string): Promise<Response> {
   if (!can(principal, "tasks:write") && !can(principal, "runs:write") && !can(principal, "*")) return response({ error: "Task cancellation is not allowed" }, 403);
   const task = await env.DB.prepare("SELECT project_id AS projectId, status FROM agent_tasks WHERE id = ?")
@@ -2006,9 +2320,10 @@ const registryWorker = {
     if (artifactsMatch && request.method === "GET") {
       const projectId = decodeURIComponent(artifactsMatch[1]);
       if (!(await memberOfProject(env, principal, projectId))) return response({ error: "Project scope is not allowed" }, 403);
+      const visible = await runEvidenceVisibility(env, projectId);
       return artifactsMatch[2]
-        ? getProjectArtifact(env.ARTIFACTS, projectId, url)
-        : listProjectArtifacts(env.ARTIFACTS, projectId, url);
+        ? getProjectArtifact(env.ARTIFACTS, projectId, url, visible)
+        : listProjectArtifacts(env.ARTIFACTS, projectId, url, visible);
     }
     const runMatch = url.pathname.match(/^\/api\/runs\/([^/]+)$/);
     if (runMatch && request.method === "GET") return getRun(env, principal, decodeURIComponent(runMatch[1]));
@@ -2016,14 +2331,20 @@ const registryWorker = {
     const claimMatch = url.pathname.match(/^\/api\/runs\/([^/]+)\/claim$/);
     if (claimMatch && request.method === "POST") return claimRun(request, env, principal, decodeURIComponent(claimMatch[1]), context);
     const tasksMatch = url.pathname.match(/^\/api\/projects\/([^/]+)\/tasks$/);
-    if (tasksMatch && request.method === "GET") return listAgentTasks(env, principal, decodeURIComponent(tasksMatch[1]));
+    if (tasksMatch && request.method === "GET") return listAgentTasks(env, principal, decodeURIComponent(tasksMatch[1]), context);
     if (tasksMatch && request.method === "POST") return createAgentTask(request, env, principal, decodeURIComponent(tasksMatch[1]), context);
     const taskClaimMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)\/claim$/);
     if (taskClaimMatch && request.method === "POST") return claimAgentTask(request, env, principal, decodeURIComponent(taskClaimMatch[1]));
     const taskCancelMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)\/cancel$/);
     if (taskCancelMatch && request.method === "POST") return cancelAgentTask(request, env, principal, decodeURIComponent(taskCancelMatch[1]));
+    const taskApproveMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)\/approve$/);
+    if (taskApproveMatch && request.method === "POST") return approveAgentTask(request, env, principal, decodeURIComponent(taskApproveMatch[1]), context);
+    const taskAcceptMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)\/accept$/);
+    if (taskAcceptMatch && request.method === "POST") return acceptAgentTask(request, env, principal, decodeURIComponent(taskAcceptMatch[1]), context);
+    const taskSendBackMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)\/send-back$/);
+    if (taskSendBackMatch && request.method === "POST") return sendBackAgentTask(request, env, principal, decodeURIComponent(taskSendBackMatch[1]), context);
     const taskResumeMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)\/resume$/);
-    if (taskResumeMatch && request.method === "POST") return resumeAgentTask(request, env, principal, decodeURIComponent(taskResumeMatch[1]));
+    if (taskResumeMatch && request.method === "POST") return resumeAgentTask(request, env, principal, decodeURIComponent(taskResumeMatch[1]), context);
     const taskMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)$/);
     if (taskMatch && request.method === "POST") return updateAgentTask(request, env, principal, decodeURIComponent(taskMatch[1]), context);
     if (request.method === "GET" && url.pathname === "/api/device-sessions") return listDeviceSessions(env, principal);