@opengeni/worker-bundle 0.27.3 → 0.28.3-canary.0

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   startContextCompactionPendingMonitor,
   startSessionRecoveryMonitor,
   startTurnCapacityMonitor
-} from "./chunk-BARTLVBK.js";
+} from "./chunk-A4XQWVZK.js";
 
 // src/index.ts
 import {
@@ -781,7 +781,7 @@ function temporalWorkflowExecutionNotFound(error) {
   return isGrpcServiceError(error) && error.code === 5;
 }
 async function createDefaultWorkerActivities(role, dependencies = {}) {
-  return role === "control" ? (await import("./activities-control-WZRFEIJH.js")).createControlActivities(dependencies) : (await import("./activities-turn-V7J34ZOF.js")).createTurnActivities(dependencies);
+  return role === "control" ? (await import("./activities-control-JUBMDBDZ.js")).createControlActivities(dependencies) : (await import("./activities-turn-I2ZKGZE6.js")).createTurnActivities(dependencies);
 }
 function resolveOpenGeniWorkflowDefinition(moduleUrl = import.meta.url) {
   const modulePath = fileURLToPath(moduleUrl).replaceAll("\\", "/");

package/dist/observability-metrics.d.ts

@@ -91,15 +91,23 @@ export declare function recordWorkerDeathRecoveryMetrics(observability: Observab
 export declare class TurnLifecycleMetrics {
     private readonly observability;
     private readonly options;
-    private readonly turns;
+    private readonly attempts;
     private timer;
     constructor(observability: Observability, options?: {
         now?: () => number;
         refreshIntervalMs?: number;
     });
-    start(turnId: string): void;
-    progress(turnId: string): void;
-    finish(turnId: string, outcome: TurnOutcome | null, durationSeconds?: number): void;
+    start(input: {
+        attemptId: string;
+    }): void;
+    progress(input: {
+        attemptId: string;
+    }): void;
+    finish(input: {
+        attemptId: string;
+        outcome: TurnOutcome | null;
+        durationSeconds?: number;
+    }): void;
     refreshGauges(): void;
     stop(): void;
     private oldestInflightAgeSeconds;

package/dist/sandbox-archive-storage.d.ts

@@ -1,4 +1,5 @@
-import type { ObjectStorage } from "@opengeni/storage";
+import { type ObjectStorage } from "@opengeni/storage";
+import type { VerifiedHostWorkspaceArchive } from "@opengeni/runtime/sandbox";
 import { type WorkspaceArchiveDescriptor, type WorkspaceArchiveObjectRef } from "@opengeni/contracts";
 export declare class WorkspaceArchiveObjectStorageRequiredError extends Error {
     readonly code: "workspace_archive_object_storage_required";
@@ -13,15 +14,26 @@ export declare function putTarWorkspaceArchiveObject(input: {
     archive: {
         bytes: Uint8Array;
         descriptor: WorkspaceArchiveDescriptor;
-    };
+    } | VerifiedHostWorkspaceArchive;
 }): Promise<WorkspaceArchiveObjectRef>;
+/** The caller owns a fresh candidate returned by this module. A thrown or lost
+ * database response is UNKNOWN: it may have committed, so never delete on catch.
+ * Only the transaction's exact candidate disposition can authorize cleanup. */
+export declare function persistWorkspaceArchiveCandidate<T extends {
+    wrote: boolean;
+    candidateDisposition?: "adopted" | "already_referenced" | "unused";
+}>(input: {
+    objectStorage?: ObjectStorage | null;
+    ref?: WorkspaceArchiveObjectRef;
+    persist: () => Promise<T>;
+}): Promise<T>;
 export declare function putVersion1TarArchiveOrInline(input: {
     backend: string;
     objectStorage?: ObjectStorage | null | undefined;
     accountId: string;
     workspaceId: string;
     sandboxGroupId: string;
-    archive: {
+    archive: VerifiedHostWorkspaceArchive | {
         bytes: Uint8Array;
         descriptor: WorkspaceArchiveDescriptor;
         base64: string;

package/dist/sandbox-resume.d.ts

@@ -1,7 +1,7 @@
 import { type Settings } from "@opengeni/config";
 import { readLease, reinstateTurnLeaseHolder, SandboxLeaseSupersededError, type Database, type LeaseHolderKind } from "@opengeni/db";
 import { establishSandboxSessionFromEnvelope, type EstablishedSandboxSession, type RuntimeMetricsHooks } from "@opengeni/runtime";
-import type { ObjectStorage } from "@opengeni/storage";
+import { type ObjectStorage } from "@opengeni/storage";
 import type { Observability } from "@opengeni/observability";
 export type ResumeHolderKind = LeaseHolderKind;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "0.27.3",
+  "version": "0.28.3-canary.0",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,22 +54,22 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "^0.5.1",
-    "@opengeni/capabilities": "^0.3.3",
-    "@opengeni/codemode": "^0.5.3",
-    "@opengeni/codex": "^0.2.22",
-    "@opengeni/config": "^1.0.4",
-    "@opengeni/contracts": "^2.15.2",
-    "@opengeni/core": "^2.8.3",
-    "@opengeni/db": "^4.2.2",
-    "@opengeni/documents": "^0.8.23",
-    "@opengeni/events": "^0.4.21",
-    "@opengeni/github": "^0.7.7",
-    "@opengeni/network": "^0.3.1",
-    "@opengeni/observability": "^0.8.23",
-    "@opengeni/runtime": "^2.4.3",
-    "@opengeni/storage": "^0.2.124",
-    "@opengeni/xai-subscription": "^0.1.4",
+    "@opengeni/agent-proto": "^0.5.1-canary.25",
+    "@opengeni/capabilities": "^0.3.3-canary.7",
+    "@opengeni/codemode": "^0.5.5-canary.0",
+    "@opengeni/codex": "^0.2.22-canary.7",
+    "@opengeni/config": "^1.1.1-canary.0",
+    "@opengeni/contracts": "^3.0.1-canary.0",
+    "@opengeni/core": "^2.9.3-canary.0",
+    "@opengeni/db": "^4.3.2-canary.0",
+    "@opengeni/documents": "^0.8.26-canary.0",
+    "@opengeni/events": "^0.4.24-canary.0",
+    "@opengeni/github": "^0.7.9-canary.0",
+    "@opengeni/network": "^0.3.1-canary.7",
+    "@opengeni/observability": "^0.8.25-canary.0",
+    "@opengeni/runtime": "^2.5.2-canary.0",
+    "@opengeni/storage": "^0.2.126-canary.0",
+    "@opengeni/xai-subscription": "^0.1.4-canary.7",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/agent-build.ts

@@ -6,6 +6,8 @@ import {
   setXaiSessionAccountPin,
   getWorkspaceVideoGenerationPolicy,
   loadWorkspaceVercelAiGatewayCredentialLease,
+  getExternalLinkTurnAuthorization,
+  getSessionTurnForAttempt,
 } from "@opengeni/db";
 import {
   formatSkillCatalog,
@@ -569,11 +571,39 @@ export async function buildTurnAgent(deps: BuildTurnAgentDeps) {
     outcome: "completed",
     durationSeconds: (performance.now() - postToolPreparationStartedAt) / 1_000,
   });
+  const linkedToolAuthority = await getExternalLinkTurnAuthorization(
+    db,
+    {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+    },
+    turn.id,
+  );
+  if (linkedToolAuthority && !linkedToolAuthority.authorized)
+    throw new Error("Native identity link was revoked");
   const agent = (() => {
     const agentConstructionStartedAt = performance.now();
     let agentConstructionOutcome: "completed" | "failed" = "completed";
     try {
       return runtime.buildAgent(eventing.modelRunSettings, runtimeResources, {
+        ...(linkedToolAuthority
+          ? {
+              authorizeAttemptExecution: async () => {
+                const current = await getSessionTurnForAttempt(
+                  db,
+                  input.workspaceId,
+                  input.sessionId,
+                  input.attemptId,
+                );
+                if (
+                  !current ||
+                  current.id !== turn.id ||
+                  current.executionGeneration !== turn.executionGeneration
+                )
+                  throw new Error("The linked agent attempt is no longer authorized");
+              },
+            }
+          : {}),
         ...(preparedTools.inputWaitYield ? { inputWaitYield: preparedTools.inputWaitYield } : {}),
         reasoningEffort: turn.reasoningEffort,
         latencyMode: turnExecutionPolicy.latencyMode,
@@ -677,7 +707,6 @@ export async function buildTurnAgent(deps: BuildTurnAgentDeps) {
             }),
         onRetainableSessionImageOutput: media.retainSessionImageAtToolBoundary,
         skillCatalog: deps.skillCatalog,
-        serverSkillReading: true,
         ...(!structuredWorkspacePolicyActive && workspaceAgentInstructions
           ? { instructionsTemplate: workspaceAgentInstructions }
           : {}),

package/src/activities/agent-turn/claim.ts

@@ -347,7 +347,7 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
     });
     return attached.action === "claimed" && attached.turn.id === turn.id;
   };
-  turnLifecycleMetricsFor(observability).start(attempt.turnId);
+  turnLifecycleMetricsFor(observability).start({ attemptId: input.attemptId });
   // §7.5 P3 — pass the accepted billing attribution (externally funded turns
   // bypass OpenGeni credit/token gates)
   // AND the optional host `entitlements` port (when bound, its admitRun replaces
@@ -451,7 +451,7 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
     }
     recordCanonicalStartupMilestones(appended.canonicalStartupMilestones);
     if (inputs.length > 0) {
-      turnLifecycleMetricsFor(observability).progress(attempt.turnId!);
+      turnLifecycleMetricsFor(observability).progress({ attemptId: input.attemptId });
     }
     activityContext?.heartbeat({
       ...heartbeatDetails,
@@ -515,7 +515,7 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
       return false;
     }
     recordCanonicalStartupMilestones(result.canonicalStartupMilestones);
-    turnLifecycleMetricsFor(observability).progress(attempt.turnId!);
+    turnLifecycleMetricsFor(observability).progress({ attemptId: input.attemptId });
     await publishDurableSessionEvents(bus, input.workspaceId, input.sessionId, result.events);
     if (inputSettlement.turnStatus === "requires_action") {
       // The settlement transaction committed the parent's child_requires_action

package/src/activities/agent-turn/finalization.ts

@@ -1,5 +1,6 @@
 import {
   commitSessionAttemptQuiescence,
+  listPendingSessionTurns,
   recordCodexAccountUsageWithWakeTargets,
   releaseCodexCredentialLease,
   releaseXaiCredentialLease,
@@ -20,7 +21,11 @@ import type {
   SessionAttemptQuiescenceProof,
   TurnActivityServices as ActivityServices,
 } from "../types";
-import { captureWorkspaceRevision, openFreshWorkspaceCaptureSession } from "../workspace-capture";
+import {
+  captureWhileIdle,
+  captureWorkspaceRevision,
+  openFreshWorkspaceCaptureSession,
+} from "../workspace-capture";
 import { type ChannelASession } from "@opengeni/runtime/sandbox";
 import { createModelCheckpointMemoryCollector } from "../../model-checkpoint-memory-collector";
 import {
@@ -488,49 +493,60 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
       deadlineRotationRequested: sandboxState.deadlineRotationRequested,
     });
     if (
+      settings.workspaceCaptureEnabled &&
       runTurnEndPersistence &&
       attempt.turnId &&
       sandboxState.resolvedSandbox &&
       sandboxState.setupBoxSession &&
       sandboxState.sandboxGroupId
     ) {
-      // Block new periodic snapshots, then drain any one already in flight.
-      // Keep the lease heartbeat itself running: capture may legitimately
-      // exceed the 90s holder TTL, and the reaper must remain unable to drain
-      // the exact box while this holder still reads it.
+      // Review reads yield to queued work. Recovery snapshots have their own
+      // physical-settlement requirement and are drained later in finalization.
       sandboxState.turnEndCaptureInProgress = true;
-      if (sandboxState.snapshotInFlight) {
-        await waitForWarmSnapshot(
-          sandboxState.snapshotInFlight,
-          settings.sandboxSnapshotTimeoutMs,
-          finalizerSignal,
-        );
-      }
-      const captureEstablished = sandboxState.resolvedSandbox.established;
-      await captureWorkspaceRevision({
-        db,
-        objectStorage,
-        settings,
-        publish: async (events) => {
-          await publishDurableSessionEvents(bus, input.workspaceId, input.sessionId, events);
-        },
-        session: sandboxState.setupBoxSession as ChannelASession,
-        openReadSession: async () =>
-          await openFreshWorkspaceCaptureSession({
-            backendId: captureEstablished.backendId,
-            client: captureEstablished.client,
-            session: sandboxState.setupBoxSession as ChannelASession,
-            expectedInstanceId: captureEstablished.instanceId,
-          }),
-        leaseEpoch: sandboxState.resolvedSandbox.leaseEpoch,
-        sandboxGroupId: sandboxState.sandboxGroupId,
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        sessionId: input.sessionId,
-        turnId: attempt.turnId,
-        attemptId: input.attemptId,
-        observability,
+      const captureSandbox = sandboxState.resolvedSandbox;
+      const captureSession = sandboxState.setupBoxSession as ChannelASession;
+      const captureGroupId = sandboxState.sandboxGroupId;
+      const captureTurnId = attempt.turnId;
+      await captureWhileIdle({
         ...(finalizerSignal ? { signal: finalizerSignal } : {}),
+        hasPendingWork: async () =>
+          (await listPendingSessionTurns(db, input.workspaceId, input.sessionId)).some(
+            (turn) => turn.id !== captureTurnId,
+          ),
+        capture: async (signal) => {
+          if (sandboxState.snapshotInFlight) {
+            await waitForWarmSnapshot(
+              sandboxState.snapshotInFlight,
+              settings.sandboxSnapshotTimeoutMs,
+              signal,
+            );
+          }
+          if (signal.aborted) return;
+          await captureWorkspaceRevision({
+            db,
+            objectStorage,
+            settings,
+            publish: async (events) =>
+              publishDurableSessionEvents(bus, input.workspaceId, input.sessionId, events),
+            session: captureSession,
+            openReadSession: async () =>
+              openFreshWorkspaceCaptureSession({
+                backendId: captureSandbox.established.backendId,
+                client: captureSandbox.established.client,
+                session: captureSession,
+                expectedInstanceId: captureSandbox.established.instanceId,
+              }),
+            leaseEpoch: captureSandbox.leaseEpoch,
+            sandboxGroupId: captureGroupId,
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            sessionId: input.sessionId,
+            turnId: captureTurnId,
+            attemptId: input.attemptId,
+            observability,
+            signal,
+          });
+        },
       });
     }
     eventing.toolPreparationClosing = true;
@@ -729,12 +745,17 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
       status: finalizationError ? "cleanup_failed" : control.activityStatus,
       durationSeconds,
     });
-    if (attempt.turnId && control.activityStatus !== "unknown") {
-      turnLifecycleMetricsFor(observability).finish(
-        attempt.turnId,
-        control.turnMetricOutcome,
+    if (attempt.turnId) {
+      // This registry describes physical activity ownership, not durable turn
+      // settlement. Always clear the exact attempt when its activity unwinds,
+      // even when failure settlement could not classify an outcome. Otherwise
+      // a recovered successor can make progress while the predecessor leaves a
+      // process-local false stuck-turn alert behind.
+      turnLifecycleMetricsFor(observability).finish({
+        attemptId: input.attemptId,
+        outcome: control.turnMetricOutcome,
         durationSeconds,
-      );
+      });
     }
     activitySpan.end({
       attributes: {

package/src/activities/agent-turn/model-usage.ts

@@ -129,8 +129,17 @@ export const createSessionTitleModelUsageEventState = createCompactionModelUsage
 
 export function modelResponseContextSignal(
   state: ModelResponseEventState,
+  responseCountBeforeStream = 0,
 ): { revision: number; totalTokens: number } | null {
-  return state.contextSignal;
+  const signal = state.contextSignal;
+  // A compaction retry creates a new SDK request counter, but usage identities
+  // remain activity-wide. Never bind a pre-stream report to a reused request
+  // ordinal; translate only this stream's reports without mutating usage state.
+  if (!signal || signal.revision <= responseCountBeforeStream) return null;
+  return {
+    revision: signal.revision - responseCountBeforeStream,
+    totalTokens: signal.totalTokens,
+  };
 }
 
 export function assertModelResponseLatencyMode(input: {

package/src/activities/agent-turn/skill-read.ts

@@ -1,9 +1,8 @@
 import type { AttemptToolDefinition } from "@opengeni/codemode";
 import {
-  assertSkillRelativePath,
+  listSkillPaths,
   PORTABLE_SKILL_MAX_FILES,
   readSkillFiles,
-  SKILL_READ_MAX_OUTPUT_BYTES,
   SKILL_READ_MAX_PATHS,
   type SkillTextFile,
 } from "@opengeni/runtime/skill-library";
@@ -74,7 +73,7 @@ export function createSkillReadAttemptToolDefinition(input: {
       const files = metadata ? metadata.files : (loaded as readonly SkillTextFile[]);
       const selected =
         args.listFiles === true
-          ? listSkillPaths(files)
+          ? listSkillPaths(files, PORTABLE_SKILL_MAX_FILES)
           : readSkillFiles(files, args.paths as string[] | undefined);
       const output = {
         ...(metadata
@@ -97,21 +96,3 @@ export function createSkillReadAttemptToolDefinition(input: {
     },
   };
 }
-
-/** Inventory never reads or serializes file bodies, including the entry point. */
-function listSkillPaths(files: readonly SkillTextFile[]): { paths: string[] } {
-  if (files.length > PORTABLE_SKILL_MAX_FILES) {
-    throw new Error(`Skill inventory exceeds ${PORTABLE_SKILL_MAX_FILES} files.`);
-  }
-  const seen = new Set<string>();
-  for (const { path } of files) {
-    assertSkillRelativePath(path);
-    if (seen.has(path)) throw new Error(`Duplicate stored Skill path: ${path}`);
-    seen.add(path);
-  }
-  const result = { paths: [...seen].sort() };
-  if (Buffer.byteLength(JSON.stringify(result), "utf8") > SKILL_READ_MAX_OUTPUT_BYTES) {
-    throw new Error("Skill inventory exceeds the read output limit.");
-  }
-  return result;
-}

package/src/activities/agent-turn/stream-attempt.ts

@@ -865,7 +865,8 @@ export async function runTurnStreamAttempt(
                 },
               }
             : {}),
-          contextCompactionSignal: () => modelResponseContextSignal(modelResponseState),
+          contextCompactionSignal: () =>
+            modelResponseContextSignal(modelResponseState, responseCountBeforeStream),
           contextCompactionRequested: () =>
             isSessionCompactionRequested(db, input.workspaceId, input.sessionId),
           onModelPreparationPhase: (measurement) => {
@@ -1061,7 +1062,7 @@ export async function runTurnStreamAttempt(
           currentToolBatchCallIds = new Set<string>();
           currentToolBatchCompletedCallIds = new Set<string>();
           await historySink.reconcileConversationTruth();
-          turnLifecycleMetricsFor(observability).progress(attempt.turnId!);
+          turnLifecycleMetricsFor(observability).progress({ attemptId: input.attemptId });
           modelCheckpointMemoryCollector.schedule(observability);
           try {
             await ensureRunAllowed(

package/src/activities/agent-turn/tool-environment.ts

@@ -1,6 +1,8 @@
 import { getWorkspaceConnectionModelRestrictions } from "@opengeni/db";
 import {
   beginConnectorActionExecution,
+  getExternalLinkTurnAuthorization,
+  getSessionTurnForAttempt,
   getWorkspaceVideoGenerationPolicy,
   listSkillDescriptors,
   completeConnectorActionExecution,
@@ -51,6 +53,7 @@ import {
   resolveWorkspaceModelSelection,
   withFrozenPersonalConnectionDelegations,
   resolveSessionToolPolicy,
+  hasPermission,
 } from "@opengeni/core";
 import { loadWorkspaceEnvironmentForRunWithCredentials } from "../environment";
 import { withFirstPartyTools } from "../goals";
@@ -60,7 +63,10 @@ import { ToolResultSpill } from "./tool-result-spill";
 import { createTurnMediaArtifacts } from "./media-artifacts";
 import { SandboxChannelAService } from "@opengeni/runtime/sandbox";
 import { sandboxRunAs } from "@opengeni/runtime";
-import { type ToolAuthNeededPayload } from "@opengeni/contracts";
+import {
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  type ToolAuthNeededPayload,
+} from "@opengeni/contracts";
 
 import {
   rollingSafeToolAuthNeededPayload,
@@ -508,6 +514,21 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         };
       })()
     : undefined;
+  const linkedAuthority = await getExternalLinkTurnAuthorization(
+    db,
+    {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+    },
+    turn.id,
+  );
+  if (linkedAuthority && !linkedAuthority.authorized)
+    throw new Error("Native identity link was revoked");
+  const effectiveFirstPartyPermissions = linkedAuthority
+    ? (session.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS).filter(
+        (permission) => hasPermission(linkedAuthority.permissions, permission),
+      )
+    : session.firstPartyMcpPermissions;
   const selectedFirstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
     runSettings,
     session.firstPartyMcpTools,
@@ -519,16 +540,21 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       title: session.title,
       titleSource: session.titleSource,
       firstPartyMcpTools: selectedFirstPartyMcpTools,
-      firstPartyMcpPermissions: session.firstPartyMcpPermissions,
+      firstPartyMcpPermissions: effectiveFirstPartyPermissions,
     }),
     parallelGenerationAvailable: typeof runtime.generateSessionTitle === "function",
   });
   const googleDrivePublicationAllowed =
     selectedFirstPartyMcpTools.includes("editable_artifact_export") &&
     selectedFirstPartyMcpTools.includes("editable_artifact_export_status") &&
-    (!session.firstPartyMcpPermissions?.length ||
-      (session.firstPartyMcpPermissions.includes("artifacts:read") &&
-        session.firstPartyMcpPermissions.includes("artifacts:publish")));
+    hasPermission(
+      [...(effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS)],
+      "artifacts:read",
+    ) &&
+    hasPermission(
+      [...(effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS)],
+      "artifacts:publish",
+    );
   const googleDriveConnectorBindings: readonly AttemptConnectorActionBinding[] =
     googleDrivePublicationTool && googleDrivePublicationTarget && googleDrivePublicationAllowed
       ? [
@@ -760,9 +786,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         attemptId: input.attemptId,
         executionGeneration: attempt.executionGeneration,
       },
-      ...(session.firstPartyMcpPermissions?.length
-        ? { permissions: session.firstPartyMcpPermissions }
-        : {}),
+      ...(effectiveFirstPartyPermissions ? { permissions: effectiveFirstPartyPermissions } : {}),
       selectedTools: selectedFirstPartyMcpTools,
       subjectId: "worker:first-party-mcp",
       subjectLabel: "OpenGeni worker",
@@ -852,6 +876,24 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         ...(credentialSubjectId ? { credentialSubjectId } : {}),
         ...(codexAppsAuth ? { codexAppsAuth } : {}),
         resolveCredential,
+        ...(linkedAuthority
+          ? {
+              authorizeAttemptExecution: async () => {
+                const current = await getSessionTurnForAttempt(
+                  db,
+                  input.workspaceId,
+                  input.sessionId,
+                  input.attemptId,
+                );
+                if (
+                  !current ||
+                  current.id !== turn.id ||
+                  current.executionGeneration !== attempt.executionGeneration
+                )
+                  throw new Error("The linked agent attempt is no longer authorized");
+              },
+            }
+          : {}),
         onAuthNeeded: publishToolAuthNeeded,
         materializeConnectorAttachments,
         refreshOwnedCommand: async (commandId) => {
@@ -885,8 +927,8 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         },
         // Manager-style sessions carry a creation-validated permission set
         // for their first-party MCP token; null keeps the fixed default.
-        ...(session.firstPartyMcpPermissions?.length
-          ? { firstPartyPermissions: session.firstPartyMcpPermissions }
+        ...(effectiveFirstPartyPermissions
+          ? { firstPartyPermissions: effectiveFirstPartyPermissions }
           : {}),
         firstPartyTools: titleToolPlan.remoteFirstPartyMcpTools,
         nestedAgentDepth: session.nestedAgentDepth,

package/src/activities/goals.ts

@@ -286,6 +286,8 @@ export function goalContinuationPrompt(
     "Continuation behavior:",
     "- This goal persists across turns. A runtime boundary can end one turn without shrinking the objective; the next continuation resumes the same full objective.",
     "- Keep working until the requested end state is true and verified. Do not end the turn merely because one useful action completed, and do not redefine success around a smaller or easier task.",
+    "- An incomplete-status report is not a substitute for continuing the work. If the remaining problem can be investigated or addressed within your current authority, continue that work in this turn rather than returning another equivalent status-only final.",
+    "- Distinguish unfinished work from a blocker that actually requires human input or external change; use the existing waiting and blocked audits only when their conditions hold.",
     "- Temporary rough edges are acceptable while the work is moving in the right direction. Completion still requires the requested end state to be true and verified.",
     "",
     "Work from evidence:",

package/src/activities/mcp-credentials.ts

@@ -3,6 +3,8 @@ import type { ConnectionCredentialsPort } from "@opengeni/contracts";
 import {
   buildConnectionTokenResolver,
   buildHostConnectionTokenResolver,
+  getSessionTurnForAttempt,
+  authorizeDirectHostMcpUse,
   resolveAcceptedConnectionUse,
   sessionTenancyProductActivated,
   type Database,
@@ -26,13 +28,18 @@ export function connectionTokenResolverForTurn(input: {
   attemptId: string;
   turn: SessionTurnForExecution;
   authorizeAcceptedUse?: typeof resolveAcceptedConnectionUse;
+  /** Test seam; production always reads the canonical active-attempt projection. */
+  getHostTurnForAttempt?: typeof getSessionTurnForAttempt;
   /** Test seam for the activation fence on pre-snapshot workspace refs. */
   isSessionTenancyProductActivated?: typeof sessionTenancyProductActivated;
   /** Optional; used only for content-free compatibility-lane counters. */
   observability?: Observability | null | undefined;
 }): (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult> {
   const hostResolver = input.connectionCredentials?.mcpCredentials;
-  const baseResolver = hostResolver
+  const readHostTurn = input.getHostTurnForAttempt ?? getSessionTurnForAttempt;
+  const hostDb = input.db;
+  const nativeResolver = buildConnectionTokenResolver(input.db, input.settings);
+  const configuredResolver = hostResolver
     ? buildHostConnectionTokenResolver(hostResolver, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -44,8 +51,40 @@ export function connectionTokenResolverForTurn(input: {
         initiator: input.turn.initiator,
         initiatorContext: input.turn.initiatorContext,
         surface: "model",
+        // Only immutable captured direct-turn authority is currently supported.
+        // Direct, scheduled and exact causal/child snapshots are validated;
+        // no authority follows merely from a binding or creator identity.
+        authorizeDurableBinding: (request) => authorizeDirectHostMcpUse(hostDb, request),
+        authorizeExecution: async (request) => {
+          // Native UUID references already pass the accepted-use boundary below.
+          // Legacy opaque host IDs retain their compatibility path, but not a
+          // right to execute after their accepted attempt has stopped.
+          if (
+            request.connectionRef.authoritySource !== "host" &&
+            (!request.connectionRef.connectionId ||
+              OPENGENI_CONNECTION_ID_PATTERN.test(request.connectionRef.connectionId))
+          )
+            return true;
+          if (!request.attemptId) return false;
+          const current = await readHostTurn(
+            hostDb,
+            request.workspaceId,
+            request.sessionId,
+            request.attemptId,
+          );
+          return (
+            current !== null &&
+            current.id === request.turnId &&
+            current.executionGeneration === request.executionGeneration
+          );
+        },
       })
-    : buildConnectionTokenResolver(input.db, input.settings);
+    : nativeResolver;
+  const baseResolver = (request: ResolveConnectionCredentialInput) =>
+    input.connectionCredentials?.mcpAuthoritySource === "host" &&
+    request.connectionRef.authoritySource !== "host"
+      ? nativeResolver(request)
+      : configuredResolver(request);
   return async (request) => {
     // Host-owned refs carry explicit provenance because their opaque ids may
     // themselves be valid UUIDs. They never enter OpenGeni's native connection
@@ -76,6 +115,7 @@ export function connectionTokenResolverForTurn(input: {
     // so UUID-shaped host ids are unambiguous.
     if (
       hostResolver &&
+      input.connectionCredentials?.mcpAuthoritySource !== "host" &&
       request.connectionRef.connectionId &&
       !OPENGENI_CONNECTION_ID_PATTERN.test(request.connectionRef.connectionId)
     ) {