@moretea-labs/forge 1.5.0 → 1.6.0

package/src/runtime/control-plane/execution/direct-edit-work-completion.ts

@@ -1,8 +1,11 @@
 import { createHash } from 'crypto';
 import { getEditSession, listEditSessions, type EditSession } from '../../../cli/editing/edit-session';
+import { globMatches } from '../../../cli/mcp/paths';
 import { runProcess } from '../../../effects/process-runner';
-import { getWorkContract, recordWorkCompletionReceipt } from '../facade/work-contract-store';
-import { isTerminalWorkContractStatus, type DirectEditWorkCompletionReceipt } from '../facade/types';
+import { completeRequirementFromWork } from '../persistence/requirement-store';
+import { getWorkContract, recordWorkCompletionReceipt, updateWorkContract } from '../facade/work-contract-store';
+import { isDirectEditWorkCompletionReceipt, isTerminalWorkContractStatus, type DirectEditWorkCompletionReceipt, type WorkReconciliationRecord } from '../facade/types';
+import { effectiveVerificationEvidence } from './verification-evidence';
 
 export interface DirectEditWorkCompletionReconciliation {
   completedWorkIds: string[];
@@ -149,3 +152,155 @@ export function reconcileFinalizedDirectEditWorksAfterCommit(input: {
 
   return { completedWorkIds, examinedSessionIds, skipped, targetBranch, targetRevision };
 }
+
+export interface ReviewedDirectEditWorkReconciliationInput {
+  controllerHome: string;
+  repoId: string;
+  checkoutId: string;
+  repoRoot: string;
+  workId: string;
+  targetBranch: string;
+  targetRevision: string;
+  comparedPaths: string[];
+  reviewer: string;
+  rationale: string;
+  cleanupOwnershipProof: string;
+  reviewedAt?: string;
+}
+
+function exactCommit(repoRoot: string, revision: string, label: string): string {
+  const result = git(repoRoot, ['rev-parse', '--verify', `${revision}^{commit}`]);
+  if (!result.ok || !result.stdout.trim()) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_${label}_INVALID`);
+  return result.stdout.trim();
+}
+
+function comparedRevisionPaths(repoRoot: string, baseRevision: string, targetRevision: string): string[] {
+  const result = git(repoRoot, ['diff', '--name-only', '-z', baseRevision, targetRevision]);
+  if (!result.ok) throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_CHANGED_PATHS_UNAVAILABLE');
+  return [...new Set(result.stdout.split('\0').filter(Boolean))].sort((left, right) => left.localeCompare(right));
+}
+
+function normalizedComparedPaths(paths: string[]): string[] {
+  const normalized = [...new Set(paths.map((path) => path.trim()))].sort((left, right) => left.localeCompare(right));
+  if (normalized.length === 0 || normalized.length > 100 || normalized.some((path) => !path || path.startsWith('/') || path.includes('\0') || path.split('/').some((part) => part === '' || part === '.' || part === '..'))) {
+    throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_PATHS_INVALID');
+  }
+  return normalized;
+}
+
+/**
+ * Explicitly close a historically delivered Direct Edit Work whose original
+ * edit-session binding was missed. This is never inferred: the caller must
+ * supply the exact accepted revision and the complete reviewed path set.
+ */
+export function acceptReviewedDirectEditWorkReconciliation(input: ReviewedDirectEditWorkReconciliationInput): {
+  workId: string;
+  reconciliation: WorkReconciliationRecord;
+  receipt: DirectEditWorkCompletionReceipt;
+} {
+  const work = getWorkContract({ controllerHome: input.controllerHome, repoId: input.repoId }, input.workId);
+  if (!work || work.repoId !== input.repoId) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_WORK_NOT_FOUND: ${input.workId}`);
+  if (work.checkoutId && work.checkoutId !== input.checkoutId) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_CHECKOUT_MISMATCH: ${input.workId}`);
+  if (work.completionReceipt) {
+    const completionReceipt = work.completionReceipt;
+    if (isDirectEditWorkCompletionReceipt(completionReceipt) && completionReceipt.reconciliationId) {
+      const existing = work.reconciliations.find((entry) => entry.reconciliationId === completionReceipt.reconciliationId);
+      if (existing) return { workId: work.workId, reconciliation: existing, receipt: completionReceipt };
+    }
+    throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_WORK_TERMINAL: ${input.workId}`);
+  }
+  if (isTerminalWorkContractStatus(work.status) || work.workKind !== 'repository_change') {
+    throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_WORK_NOT_ELIGIBLE: ${input.workId}`);
+  }
+  if (!work.baseRevision?.trim()) throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_BASE_REVISION_MISSING');
+
+  const baseRevision = exactCommit(input.repoRoot, work.baseRevision, 'BASE_REVISION');
+  const targetRevision = exactCommit(input.repoRoot, input.targetRevision.trim(), 'TARGET_REVISION');
+  const targetBranch = input.targetBranch.trim();
+  if (!targetBranch) throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_TARGET_BRANCH_REQUIRED');
+  if (!git(input.repoRoot, ['merge-base', '--is-ancestor', baseRevision, targetRevision]).ok) {
+    throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_TARGET_NOT_DESCENDANT');
+  }
+  if (!git(input.repoRoot, ['merge-base', '--is-ancestor', targetRevision, targetBranch]).ok) {
+    throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_TARGET_UNREACHABLE');
+  }
+
+  const comparedPaths = normalizedComparedPaths(input.comparedPaths);
+  const actualPaths = comparedRevisionPaths(input.repoRoot, baseRevision, targetRevision);
+  if (comparedPaths.length !== actualPaths.length || comparedPaths.some((path, index) => path !== actualPaths[index])) {
+    throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_PATH_COMPARISON_MISMATCH');
+  }
+  for (const path of comparedPaths) {
+    if (work.forbiddenPaths.some((pattern) => globMatches(pattern, path))) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_FORBIDDEN_PATH: ${path}`);
+    if (work.allowedPaths.length > 0 && !work.allowedPaths.some((pattern) => globMatches(pattern, path))) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_PATH_OUT_OF_SCOPE: ${path}`);
+  }
+  const dirty = git(input.repoRoot, ['status', '--porcelain=v1', '--', ...comparedPaths]);
+  if (!dirty.ok || dirty.stdout.trim()) throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_OWNED_PATHS_DIRTY');
+
+  let verifiedAt = new Date().toISOString();
+  for (const checkId of work.checks) {
+    const current = effectiveVerificationEvidence(work.checkRefs, {
+      sourceRevision: targetRevision,
+      checkId,
+      requestedChecks: work.checks,
+    }).find((entry) => entry.current && entry.record.outcome === 'valid_pass');
+    if (!current) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_CHECK_EVIDENCE_STALE: ${checkId}`);
+    verifiedAt = current.record.completedAt ?? current.record.recordedAt ?? verifiedAt;
+  }
+
+  const reviewer = input.reviewer.trim();
+  const rationale = input.rationale.trim();
+  const cleanupOwnershipProof = input.cleanupOwnershipProof.trim();
+  const reviewedAt = input.reviewedAt ?? new Date().toISOString();
+  if (!reviewer || !rationale || !cleanupOwnershipProof || Number.isNaN(Date.parse(reviewedAt))) {
+    throw new Error('DIRECT_EDIT_WORK_RECONCILIATION_REVIEW_METADATA_INVALID');
+  }
+  const reconciliationId = `RECNC-${createHash('sha256').update([input.repoId, input.workId, baseRevision, targetRevision, comparedPaths.join('\0'), reviewer, reviewedAt].join('\0')).digest('hex').slice(0, 16)}`;
+  const reconciliation: WorkReconciliationRecord = {
+    schemaVersion: 1,
+    reconciliationId,
+    originalExpectedRevision: targetRevision,
+    observedTargetRevision: targetRevision,
+    baseRevision,
+    targetBranch,
+    reachable: true,
+    method: 'owned_path_tree',
+    comparedPaths,
+    reviewer: reviewer.slice(0, 200),
+    reviewedAt,
+    unrecoverableStages: ['receipt'],
+    cleanupOwnershipProof: cleanupOwnershipProof.slice(0, 2_000),
+    rationale: rationale.slice(0, 2_000),
+    outcome: 'accepted_equivalence',
+  };
+  updateWorkContract({ controllerHome: input.controllerHome, repoId: input.repoId }, input.workId, {
+    reconciliations: [reconciliation, ...work.reconciliations.filter((entry) => entry.reconciliationId !== reconciliationId)],
+  });
+
+  const recordedAt = new Date().toISOString();
+  const receipt: DirectEditWorkCompletionReceipt = {
+    schemaVersion: 1,
+    receiptId: `REC-direct-edit-reconciled-${createHash('sha256').update(`${input.repoId}\0${input.workId}\0${reconciliationId}\0${targetRevision}`).digest('hex').slice(0, 20)}`,
+    source: 'direct_edit_work',
+    workId: input.workId,
+    reconciliationId,
+    targetBranch,
+    targetRevision,
+    sourceRevision: targetRevision,
+    baseRevision,
+    changedPaths: comparedPaths,
+    delivery: { kind: 'commit', status: 'integrated', strategy: 'already_integrated', reachable: true, recordedAt },
+    cleanup: { status: 'complete', warnings: [], blockers: [], recordedAt },
+    verifiedAt,
+    recordedAt,
+  };
+  const recorded = recordWorkCompletionReceipt(
+    { controllerHome: input.controllerHome, repoId: input.repoId },
+    input.workId,
+    receipt,
+    'completed_changed',
+    'repository_change',
+  );
+  if (recorded.requirementId) completeRequirementFromWork({ controllerHome: input.controllerHome }, { requirementId: recorded.requirementId, work: recorded });
+  return { workId: input.workId, reconciliation, receipt };
+}

package/src/runtime/control-plane/execution/execution-identity.ts

@@ -134,6 +134,53 @@ function gitPath(root: string, args: string[]): string | undefined {
   }
 }
 
+interface GitExecutionSnapshot {
+  topLevel?: string;
+  commonDirectory?: string;
+  branch?: string;
+  head?: string;
+}
+
+function resolvedGitPath(root: string, value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  try {
+    return realpathSync(isAbsolute(value) ? value : resolve(root, value));
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Read the checkout identity in one Git child process on the normal committed
+ * path. This preserves the same fail-closed fields as the former six probes;
+ * unborn repositories fall back to the individual observations because HEAD is
+ * intentionally absent there.
+ */
+function gitExecutionSnapshot(root: string): GitExecutionSnapshot {
+  const combined = gitText(root, ['rev-parse', '--show-toplevel', '--git-common-dir', 'HEAD', '--abbrev-ref', 'HEAD']);
+  if (combined) {
+    const lines = combined.split('\n').map((line) => line.trim());
+    if (lines.length >= 4) {
+      return {
+        topLevel: resolvedGitPath(root, lines[0]),
+        commonDirectory: resolvedGitPath(root, lines[1]),
+        head: lines[2] || undefined,
+        branch: lines[3] && lines[3] !== 'HEAD' ? lines[3] : undefined,
+      };
+    }
+  }
+  // Rare unborn/failure fallback keeps legacy behavior rather than turning a
+  // missing HEAD into a false workspace identity failure.
+  const topLevel = gitPath(root, ['rev-parse', '--show-toplevel']);
+  const commonDirectory = gitPath(root, ['rev-parse', '--git-common-dir']);
+  return {
+    topLevel,
+    commonDirectory,
+    branch: topLevel ? gitText(topLevel, ['branch', '--show-current']) : undefined,
+    head: topLevel ? gitText(topLevel, ['rev-parse', '--verify', 'HEAD']) : undefined,
+  };
+}
+
 export function classifyGitCommonDirectoryDrift(input: {
   repoId: string;
   checkoutId: string;
@@ -304,18 +351,15 @@ export function assertExecutionIdentity(input: {
         actual: resolvedCwd,
       });
     }
-    const gitTopLevel = gitPath(resolvedCwd, ['rev-parse', '--show-toplevel']);
-    const gitCommonDirectory = gitPath(resolvedCwd, ['rev-parse', '--git-common-dir']);
-    const currentBranch = gitTopLevel ? gitText(gitTopLevel, ['branch', '--show-current']) : undefined;
-    const currentHead = gitTopLevel ? gitText(gitTopLevel, ['rev-parse', '--verify', 'HEAD']) : undefined;
+    const gitSnapshot = gitExecutionSnapshot(resolvedCwd);
     return Object.freeze({
       ...identity,
       canonicalRoot: workspaceRoot,
       resolvedCwd,
-      gitTopLevel,
-      gitCommonDirectory,
-      currentBranch,
-      currentHead,
+      gitTopLevel: gitSnapshot.topLevel,
+      gitCommonDirectory: gitSnapshot.commonDirectory,
+      currentBranch: gitSnapshot.branch,
+      currentHead: gitSnapshot.head,
     });
   }
 
@@ -377,7 +421,8 @@ export function assertExecutionIdentity(input: {
     });
   }
 
-  const gitTopLevel = gitPath(resolvedCwd, ['rev-parse', '--show-toplevel']);
+  const gitSnapshot = gitExecutionSnapshot(resolvedCwd);
+  const gitTopLevel = gitSnapshot.topLevel;
   if (!gitTopLevel || !samePath(gitTopLevel, registeredRoot)) {
     fail('GIT_TOPLEVEL_MISMATCH', 'Git top-level differs from expected checkout root', {
       repoId: identity.repositoryId,
@@ -387,9 +432,15 @@ export function assertExecutionIdentity(input: {
     });
   }
 
-  const gitCommonDirectory = gitPath(resolvedCwd, ['rev-parse', '--git-common-dir']);
-  const registeredCommonDirectory = gitPath(registeredRoot, ['rev-parse', '--git-common-dir']);
-  const repositoryCommonDirectory = gitPath(registered.canonicalRoot, ['rev-parse', '--git-common-dir']);
+  const gitCommonDirectory = gitSnapshot.commonDirectory;
+  // Once the observed top-level is proven equal to registeredRoot, querying the
+  // same checkout again cannot add identity evidence. Only a linked worktree
+  // needs one extra canonical-repository common-dir observation.
+  const registeredCommonDirectory = gitCommonDirectory;
+  const repositoryRoot = realpathOrFail(registered.canonicalRoot, 'WORKTREE_MISSING', 'repository canonical root');
+  const repositoryCommonDirectory = samePath(repositoryRoot, registeredRoot)
+    ? gitCommonDirectory
+    : gitPath(repositoryRoot, ['rev-parse', '--git-common-dir']);
   const commonDirectoryDrift = classifyGitCommonDirectoryDrift({
     repoId: identity.repositoryId,
     checkoutId: identity.checkoutId,
@@ -423,8 +474,8 @@ export function assertExecutionIdentity(input: {
     });
   }
 
-  const currentBranch = gitText(registeredRoot, ['branch', '--show-current']);
-  const currentHead = gitText(registeredRoot, ['rev-parse', '--verify', 'HEAD']);
+  const currentBranch = gitSnapshot.branch;
+  const currentHead = gitSnapshot.head;
   if (identity.branch && currentBranch !== identity.branch) {
     fail('WORK_HANDLE_BRANCH_CHANGED', 'branch drifted from execution identity', {
       repoId: identity.repositoryId,

package/src/runtime/control-plane/execution/validation.ts

@@ -32,6 +32,10 @@ function gitText(root: string, args: string[]): string | undefined {
     : undefined;
 }
 
+function gitSucceeds(root: string, args: string[]): boolean {
+  return spawnSync('git', ['-C', root, ...args], { stdio: 'ignore', timeout: 10_000 }).status === 0;
+}
+
 function fail(code: string, message: string): never {
   throw new Error(`${code}: ${message}`);
 }
@@ -44,7 +48,7 @@ export function assertWorkHandleLifecycle(handle: WorkHandleState, operation: 'i
   const allowed: Record<typeof operation, readonly WorkHandleState['state'][]> = {
     inspect: ['prepared', 'editing', 'validating', 'committed', 'merged', 'failed', 'failed_terminal_cleanup', 'cleaned'],
     execute: ['prepared', 'editing'],
-    validate: ['prepared', 'editing', 'validating', 'committed', 'merged'],
+    validate: ['prepared', 'editing', 'validating', 'committed', 'merged', 'failed'],
     finalize: ['prepared', 'editing', 'validating', 'committed', 'merged', 'failed_terminal_cleanup', 'cleaned', 'failed'],
   };
   if (!allowed[operation].includes(handle.state)) {
@@ -99,7 +103,16 @@ export function validateWorkHandle(
   const currentBranch = gitText(root, ['branch', '--show-current']);
   const currentHead = gitText(root, ['rev-parse', '--verify', 'HEAD']);
   if (currentBranch !== handle.branch) fail('WORK_HANDLE_BRANCH_CHANGED', `expected ${handle.branch}, found ${currentBranch ?? 'detached'}`);
-  if (handle.expectedHead && currentHead !== handle.expectedHead) fail('WORK_HANDLE_HEAD_CHANGED', `expected ${handle.expectedHead}, found ${currentHead ?? 'missing'}`);
+  const managedWorkProgress = (operation === 'validate' || operation === 'finalize')
+    && handle.managedWorktree
+    && Boolean(handle.expectedHead && currentHead)
+    && gitSucceeds(root, ['merge-base', '--is-ancestor', handle.expectedHead!, currentHead!]);
+  if (handle.expectedHead && currentHead !== handle.expectedHead && !managedWorkProgress) {
+    fail('WORK_HANDLE_HEAD_CHANGED', `expected ${handle.expectedHead}, found ${currentHead ?? 'missing'}`);
+  }
+  if (managedWorkProgress && currentHead !== handle.expectedHead) {
+    warnings.push('Managed Worktree HEAD advanced from the prepared revision by Work-owned descendant commits; validation/finalization will use the current Work state.');
+  }
 
   if (level === 'full') {
     const validation = validateRepository(repository.repoId, controllerHome);

package/src/runtime/control-plane/execution/work-terminal-cleanup.ts

@@ -544,6 +544,38 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
   current = persist(input.controllerHome, current, receipt);
   if (receipt.blockers.length > 0) return { handle: current, receipt };
 
+  // A Work running in the selected/current checkout owns lifecycle and process
+  // leases, but it does not own the checkout/branch as disposable resources.
+  // Closing that Work therefore releases ownership without attempting git
+  // worktree removal, branch deletion, checkout-registry removal, or prune.
+  if (!current.managedWorktree) {
+    receipt.worktree.status = 'already_removed';
+    receipt.worktree.reason = 'Not applicable: Work did not create a managed worktree.';
+    receipt.branchCleanup.status = 'retained';
+    receipt.branchCleanup.reason = 'Current checkout branch is repository-owned, not Work-owned.';
+    receipt.checkoutRegistry.status = 'already_removed';
+    receipt.checkoutRegistry.reason = 'Not applicable: current checkout registration is retained.';
+    receipt.prune.status = 'done';
+    receipt.prune.reason = 'Not applicable: no managed worktree was removed.';
+    receipt.complete = true;
+    receipt.partial = false;
+    receipt.completedAt = receipt.completedAt ?? nowIso();
+    const finalization = {
+      ...current.finalization,
+      commit: current.finalization.commit === 'pending' ? 'skipped' as const : current.finalization.commit,
+      merge: current.finalization.merge === 'pending' ? 'skipped' as const : current.finalization.merge,
+      branchCleanup: 'skipped' as const,
+      worktreeCleanup: 'skipped' as const,
+      lastError: preservedFailure,
+    };
+    current = transitionWorkHandle(input.controllerHome, current, 'cleaned', {
+      failureReason: landed ? undefined : preservedFailure,
+      cleanupReceipt: receipt,
+      finalization,
+    });
+    return { handle: current, receipt };
+  }
+
   const target = selectTerminalCleanupTarget(repository, current);
   let registeredPath: string | undefined;
   try {

package/src/runtime/control-plane/execution/work-validation-reconciler.ts

@@ -98,10 +98,10 @@ export function projectWorkValidationOutcome(
   }
 
   transitionWorkContractPhase(options, contractId, {
-    phase: 'cleanup',
-    status: 'failed',
-    state: 'failed',
-    summary: summary ?? 'Validation infrastructure failed; terminal cleanup is required without treating this as an acceptance failure.',
+    phase: 'verification',
+    status: 'running',
+    state: 'blocked',
+    summary: summary ?? 'Validation infrastructure failed; retain the finite Work for retry without treating this as an acceptance failure.',
     evidenceRefs: contract.evidenceRefs,
   });
   updateWorkContract(options, contractId, {
@@ -127,8 +127,8 @@ function settleInfrastructureFailure(
  * Converge a persisted Work validation run from durable Process receipts.
  *
  * No command is launched here. Missing/running bindings stay pending; timeout,
- * cancellation, missing process state, or malformed receipt makes the Work
- * terminally failed for cleanup without classifying it as an acceptance failure.
+ * cancellation, missing process state, or malformed receipt makes the execution
+ * attempt retryable without classifying it as an acceptance failure or destroying Work.
  */
 export function reconcileWorkValidation(
   controllerHome: string,
@@ -173,7 +173,6 @@ export function reconcileWorkValidation(
         repoId: handle.repositoryId,
         checkoutId: handle.checkoutId,
         workId: handle.workId,
-        executionSessionId: handle.sessionId,
         checkId,
         processId: binding.processId,
         ...(currentIdentity ? {

package/src/runtime/control-plane/execution/work-verification-snapshot.ts

@@ -18,7 +18,7 @@ import { globMatches, normalizeMcpRelativePath } from '../../../cli/mcp/paths';
 import { sanitizeFileComponent } from '../../shared/json-files';
 
 const STALE_SNAPSHOT_MS = 6 * 60 * 60_000;
-const SNAPSHOT_MARKER = '.forge-work-verification-snapshot.json';
+const SNAPSHOT_MARKER = '.ai/harness/controller/work-verification-snapshot.json';
 
 export interface WorkVerificationSnapshotScope {
   workId: string;
@@ -156,6 +156,7 @@ export function materializeWorkVerificationSnapshot(input: {
       allowedPaths: [...input.scope.allowedPaths].sort(),
       forbiddenPaths: [...input.scope.forbiddenPaths].sort(),
     })).digest('hex');
+    mkdirSync(dirname(join(root, SNAPSHOT_MARKER)), { recursive: true });
     writeFileSync(join(root, SNAPSHOT_MARKER), `${JSON.stringify({ schemaVersion: 1, ...input.scope, sourceHead, includedPaths, excludedPaths, ownershipDigest }, null, 2)}\n`);
     return { root, sourceHead, includedPaths, excludedPaths, ownershipDigest };
   } catch (error) {

package/src/runtime/control-plane/facade/capability-registry.ts

@@ -150,7 +150,7 @@ const CORE_CAPABILITIES: CapabilityDescriptor[] = [
     risk: 'unknown',
     exposedVia: 'rh_work',
     schemaExposure: 'stable_static',
-    summary: 'Use typed browser target, snapshot, domain grant, and plugin actions when browser capability is configured.',
+    summary: 'Use typed HTTP(S) browser navigation, snapshot, and interaction actions when browser capability is configured.',
   },
   {
     capabilityId: 'platform.ios',

package/src/runtime/control-plane/facade/controller-session-store.ts

@@ -68,8 +68,10 @@ function claimedSession(
   const leaseExpiresAt = new Date(
     Date.parse(claimedAt) + Math.max(1_000, Math.min(input.leaseMs ?? 300_000, 3_600_000)),
   ).toISOString();
+  const previousPrincipal = previous?.principalId?.trim() || previous?.controllerId;
+  const inputPrincipal = input.principalId?.trim() || input.controllerId;
   const sameOwner = previous?.controllerId === input.controllerId
-    && previous.sessionId === input.sessionId
+    && previousPrincipal === inputPrincipal
     && (previous.controllerInstanceId ?? '') === (input.controllerInstanceId?.trim() ?? '');
   const claimGeneration = sameOwner
     ? Math.max(1, previous?.claimGeneration ?? 1)
@@ -116,6 +118,11 @@ export function getControllerSession(options: ControllerSessionStoreOptions, wor
   return activeSession(read(options), workId);
 }
 
+export function listControllerSessions(options: ControllerSessionStoreOptions): ControllerSession[] {
+  const at = Date.now();
+  return read(options).sessions.filter((session) => Date.parse(session.leaseExpiresAt) > at);
+}
+
 /**
  * Strict claim used for first ownership acquisition and explicit release/reclaim flows.
  * A live claim with any different controller or transport session remains fenced.
@@ -142,10 +149,10 @@ export function claimControllerSession(
 }
 
 /**
- * Resume a claim after transport replacement without allowing same-epoch stealing.
- * The authenticated principal must remain identical, and a different session id
- * is accepted only when the previous execution session is gone/invalidated or
- * belongs to a different Controller instance (the normal rollout boundary).
+ * Resume a claim after transport replacement. Durable Work ownership belongs to
+ * the authenticated principal/controller epoch, not to one MCP transport session.
+ * A same-principal session rotation therefore preserves ownership generation;
+ * a controller-epoch change is recovery and advances the generation fence.
  */
 export function resumeControllerSession(
   options: ControllerSessionStoreOptions,
@@ -172,14 +179,6 @@ export function resumeControllerSession(
       if (current.controllerId !== input.controllerId) {
         throw new Error(`WORK_ALREADY_CLAIMED: ${input.workId} is owned by ${current.controllerId}`);
       }
-      if (current.sessionId !== input.sessionId) {
-        const priorInstance = current.controllerInstanceId?.trim() || priorExecution?.controllerInstanceId?.trim();
-        const priorSessionUnavailable = !priorExecution || Boolean(priorExecution.invalidatedAt);
-        const crossedControllerEpoch = Boolean(priorInstance && priorInstance !== input.controllerInstanceId.trim());
-        if (!priorSessionUnavailable && !crossedControllerEpoch) {
-          throw new Error(`WORK_ALREADY_CLAIMED: ${input.workId} has an active session ${current.sessionId}`);
-        }
-      }
       return persistClaim(options, store, input, current);
     },
   );

package/src/runtime/control-plane/facade/goal-workloop-access.ts

@@ -161,9 +161,14 @@ export function runGoalWorkloop(
       secretAccess: args.secret_access === true,
       risk: typeof args.risk === 'string' ? args.risk as CapabilityRisk : undefined,
     },
-    requestedBy: args.requested_by === 'user' || args.requested_by === 'system' || args.requested_by === 'scheduler'
+    requestedBy: args.requested_by === 'chatgpt' || args.requested_by === 'user' || args.requested_by === 'system' || args.requested_by === 'scheduler'
       ? args.requested_by
-      : 'chatgpt',
+      : 'user',
+    relatedWorkId: typeof args.related_work_id === 'string' ? args.related_work_id : undefined,
+    workRelation: args.work_relation === 'continue' || args.work_relation === 'extend' || args.work_relation === 'parallel' || args.work_relation === 'new_goal'
+      ? args.work_relation
+      : undefined,
+    requirementId: typeof args.requirement_id === 'string' ? args.requirement_id : undefined,
     taskId: typeof args.task_id === 'string' ? args.task_id : undefined,
     issueId: typeof args.issue_id === 'string' ? args.issue_id : undefined,
     approvalConfirmed: args.approval_confirmed === true,