@pennixrv/trellis 0.6.27 → 0.6.28

package/dist/migrations/manifests/0.6.27.json

@@ -0,0 +1,9 @@
+{
+  "version": "0.6.27",
+  "description": "Hardens the task-bound continuation record for safe cross-session handoff state.",
+  "breaking": false,
+  "recommendMigrate": false,
+  "changelog": "**Fixes:**\n- Rechecks task identity while a continuation record operation acquires its lock.\n- Keeps continuation writes bound to the direct current Trellis session.\n\n**Internal:**\n- Keeps continuation runtime state outside version-controlled project files.",
+  "migrations": [],
+  "notes": "No project migration is required. Existing projects can run the normal `trellis update` flow."
+}

package/dist/templates/trellis/index.d.ts

@@ -37,6 +37,7 @@ export declare const commonTaskContext: string;
 export declare const commonTaskStore: string;
 export declare const commonSessionContext: string;
 export declare const commonContinuationRecord: string;
+export declare const commonOwnershipRecord: string;
 export declare const commonPackagesContext: string;
 export declare const commonWorkflowPhase: string;
 export declare const commonTrellisConfig: string;

package/dist/templates/trellis/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/templates/trellis/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAcH,eAAO,MAAM,WAAW,QAAsC,CAAC;AAG/D,eAAO,MAAM,UAAU,QAA6C,CAAC;AACrE,eAAO,MAAM,WAAW,QAA0C,CAAC;AACnE,eAAO,MAAM,eAAe,QAA8C,CAAC;AAC3E,eAAO,MAAM,gBAAgB,QAAgD,CAAC;AAC9E,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,gBAAgB,QAAgD,CAAC;AAC9E,eAAO,MAAM,gBAAgB,QAAgD,CAAC;AAC9E,eAAO,MAAM,YAAY,QAA2C,CAAC;AACrE,eAAO,MAAM,QAAQ,QAAuC,CAAC;AAC7D,eAAO,MAAM,SAAS,QAAwC,CAAC;AAC/D,eAAO,MAAM,SAAS,QAAwC,CAAC;AAC/D,eAAO,MAAM,WAAW,QAA0C,CAAC;AACnE,eAAO,MAAM,WAAW,QAA0C,CAAC;AACnE,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAChF,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,oBAAoB,QAEhC,CAAC;AACF,eAAO,MAAM,wBAAwB,QAEpC,CAAC;AACF,eAAO,MAAM,qBAAqB,QAEjC,CAAC;AACF,eAAO,MAAM,mBAAmB,QAE/B,CAAC;AACF,eAAO,MAAM,mBAAmB,QAE/B,CAAC;AACF,eAAO,MAAM,gBAAgB,QAAgD,CAAC;AAG9E,eAAO,MAAM,kBAAkB,QAA2C,CAAC;AAC3E,eAAO,MAAM,mBAAmB,QAA4C,CAAC;AAC7E,eAAO,MAAM,UAAU,QAAkC,CAAC;AAC1D,eAAO,MAAM,gBAAgB,QAAyC,CAAC;AACvE,eAAO,MAAM,gBAAgB,QAAyC,CAAC;AACvE,eAAO,MAAM,qBAAqB,QAEjC,CAAC;AACF,eAAO,MAAM,mBAAmB,QAA4C,CAAC;AAG7E,eAAO,MAAM,kBAAkB,QAA8B,CAAC;AAC9D,eAAO,MAAM,kBAAkB,QAA8B,CAAC;AAC9D,eAAO,MAAM,iBAAiB,QAAgC,CAAC;AAC/D,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAMvE,eAAO,MAAM,sBAAsB,QAAsC,CAAC;AAC1E,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAClE,eAAO,MAAM,oBAAoB,QAAoC,CAAC;AAEtE;;GAEG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAwCnD;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAMlD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/templates/trellis/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAcH,eAAO,MAAM,WAAW,QAAsC,CAAC;AAG/D,eAAO,MAAM,UAAU,QAA6C,CAAC;AACrE,eAAO,MAAM,WAAW,QAA0C,CAAC;AACnE,eAAO,MAAM,eAAe,QAA8C,CAAC;AAC3E,eAAO,MAAM,gBAAgB,QAAgD,CAAC;AAC9E,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,gBAAgB,QAAgD,CAAC;AAC9E,eAAO,MAAM,gBAAgB,QAAgD,CAAC;AAC9E,eAAO,MAAM,YAAY,QAA2C,CAAC;AACrE,eAAO,MAAM,QAAQ,QAAuC,CAAC;AAC7D,eAAO,MAAM,SAAS,QAAwC,CAAC;AAC/D,eAAO,MAAM,SAAS,QAAwC,CAAC;AAC/D,eAAO,MAAM,WAAW,QAA0C,CAAC;AACnE,eAAO,MAAM,WAAW,QAA0C,CAAC;AACnE,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAChF,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,oBAAoB,QAEhC,CAAC;AACF,eAAO,MAAM,wBAAwB,QAEpC,CAAC;AACF,eAAO,MAAM,qBAAqB,QAEjC,CAAC;AACF,eAAO,MAAM,qBAAqB,QAEjC,CAAC;AACF,eAAO,MAAM,mBAAmB,QAE/B,CAAC;AACF,eAAO,MAAM,mBAAmB,QAE/B,CAAC;AACF,eAAO,MAAM,gBAAgB,QAAgD,CAAC;AAG9E,eAAO,MAAM,kBAAkB,QAA2C,CAAC;AAC3E,eAAO,MAAM,mBAAmB,QAA4C,CAAC;AAC7E,eAAO,MAAM,UAAU,QAAkC,CAAC;AAC1D,eAAO,MAAM,gBAAgB,QAAyC,CAAC;AACvE,eAAO,MAAM,gBAAgB,QAAyC,CAAC;AACvE,eAAO,MAAM,qBAAqB,QAEjC,CAAC;AACF,eAAO,MAAM,mBAAmB,QAA4C,CAAC;AAG7E,eAAO,MAAM,kBAAkB,QAA8B,CAAC;AAC9D,eAAO,MAAM,kBAAkB,QAA8B,CAAC;AAC9D,eAAO,MAAM,iBAAiB,QAAgC,CAAC;AAC/D,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAMvE,eAAO,MAAM,sBAAsB,QAAsC,CAAC;AAC1E,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAClE,eAAO,MAAM,oBAAoB,QAAoC,CAAC;AAEtE;;GAEG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAyCnD;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAMlD"}

package/dist/templates/trellis/index.js

@@ -47,6 +47,7 @@ export const commonTaskContext = readTemplate("scripts/common/task_context.py");
 export const commonTaskStore = readTemplate("scripts/common/task_store.py");
 export const commonSessionContext = readTemplate("scripts/common/session_context.py");
 export const commonContinuationRecord = readTemplate("scripts/common/continuation_record.py");
+export const commonOwnershipRecord = readTemplate("scripts/common/ownership_record.py");
 export const commonPackagesContext = readTemplate("scripts/common/packages_context.py");
 export const commonWorkflowPhase = readTemplate("scripts/common/workflow_phase.py");
 export const commonTrellisConfig = readTemplate("scripts/common/trellis_config.py");
@@ -97,6 +98,7 @@ export function getAllScripts() {
     scripts.set("common/task_store.py", commonTaskStore);
     scripts.set("common/session_context.py", commonSessionContext);
     scripts.set("common/continuation_record.py", commonContinuationRecord);
+    scripts.set("common/ownership_record.py", commonOwnershipRecord);
     scripts.set("common/packages_context.py", commonPackagesContext);
     scripts.set("common/workflow_phase.py", commonWorkflowPhase);
     scripts.set("common/trellis_config.py", commonTrellisConfig);

package/dist/templates/trellis/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/templates/trellis/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,gCAAgC;AAChC,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAE/D,0BAA0B;AAC1B,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,6BAA6B,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC,gCAAgC,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAC9C,mCAAmC,CACpC,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAClD,uCAAuC,CACxC,CAAC;AACF,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAC/C,oCAAoC,CACrC,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAC7C,kCAAkC,CACnC,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAC7C,kCAAkC,CACnC,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAE9E,wBAAwB;AACxB,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAC/C,6BAA6B,CAC9B,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAE7E,sBAAsB;AACtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAEvE,+CAA+C;AAC/C,gFAAgF;AAChF,iFAAiF;AACjF,qCAAqC;AACrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,eAAe;IACf,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAExC,SAAS;IACT,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,wBAAwB,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,qBAAqB,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IAEvD,OAAO;IACP,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/templates/trellis/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,gCAAgC;AAChC,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAE/D,0BAA0B;AAC1B,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,6BAA6B,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC,gCAAgC,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAC9C,mCAAmC,CACpC,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAClD,uCAAuC,CACxC,CAAC;AACF,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAC/C,oCAAoC,CACrC,CAAC;AACF,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAC/C,oCAAoC,CACrC,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAC7C,kCAAkC,CACnC,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAC7C,kCAAkC,CACnC,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAE9E,wBAAwB;AACxB,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAC/C,6BAA6B,CAC9B,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAE7E,sBAAsB;AACtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAEvE,+CAA+C;AAC/C,gFAAgF;AAChF,iFAAiF;AACjF,qCAAqC;AACrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,eAAe;IACf,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAExC,SAAS;IACT,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,wBAAwB,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,qBAAqB,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,qBAAqB,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IAEvD,OAAO;IACP,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/templates/trellis/scripts/common/ownership_record.py

@@ -0,0 +1,414 @@
+"""Task-bound ownership transfer for formal cross-session handoff."""
+
+from __future__ import annotations
+
+import json
+import os
+import secrets
+import tempfile
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from .active_task import clear_active_task, resolve_active_task, resolve_context_key, set_active_task
+from .continuation_record import (
+    ContinuationError,
+    SAFE_ID,
+    SHA256,
+    _digest,
+    _project_file,
+    _record_lock,
+    _safe_task_id,
+    _text,
+)
+from .io import read_json_checked
+from .paths import FILE_TASK_JSON, get_repo_root
+
+
+KIND = "trellis-handoff-ownership"
+SCHEMA_VERSION = 1
+STATES = {"quiescing", "sealed", "retiring", "ready", "claiming", "claimed", "consumed", "archived"}
+ARCHIVE_OBSERVATIONS = {"not_required", "observed"}
+MAX_RECORD_BYTES = 32 * 1024
+
+
+class OwnershipError(ContinuationError):
+    """Raised when a handoff ownership transition is unsafe or stale."""
+
+
+def _identity(value: Any, label: str) -> str:
+    value = _text(value, label, 160)
+    if not SAFE_ID.fullmatch(value):
+        raise OwnershipError(f"{label} is unsafe")
+    return value
+
+
+def _record_path(root: Path, task_id: str, handoff_id: str) -> Path:
+    task_id = _safe_task_id(task_id)
+    handoff_id = _identity(handoff_id, "handoff_id")
+    runtime = root / ".trellis" / ".runtime"
+    records = runtime / "handoff-ownership"
+    task_dir = records / task_id
+    if runtime.is_symlink() or records.is_symlink() or task_dir.is_symlink():
+        raise OwnershipError("ownership record directory is unsafe")
+    return task_dir / f"{handoff_id}.json"
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="microseconds").replace("+00:00", "Z")
+
+
+def _task_snapshot(root: Path, task_path: str) -> dict[str, str]:
+    path = _project_file(root, task_path, "task path")
+    relative = path.relative_to(root).as_posix()
+    if not relative.startswith(".trellis/tasks/"):
+        raise OwnershipError("task path is outside .trellis/tasks")
+    data, reason = read_json_checked(path / FILE_TASK_JSON)
+    if data is None:
+        raise OwnershipError(f"task.json is {reason}")
+    task_id = _safe_task_id(data.get("id") or data.get("name"))
+    return {"id": task_id, "path": relative, "status": _text(data.get("status"), "task.status", 64)}
+
+
+def _direct_context(root: Path, require_task: bool = False) -> tuple[str, Any]:
+    context_key = resolve_context_key()
+    if not context_key:
+        raise OwnershipError("no_direct_session_identity")
+    active = resolve_active_task(
+        root,
+        allow_single_session_fallback=False,
+        allow_environment_context=True,
+    )
+    if active.source_type == "session-fallback":
+        raise OwnershipError("session_fallback_untrusted")
+    if active.context_key != context_key:
+        raise OwnershipError("direct_session_identity_unstable")
+    if require_task and not active.task_path:
+        raise OwnershipError("no_direct_current_task")
+    return context_key, active
+
+
+def _new_record(task: dict[str, str], handoff_id: str, core_digest: str, source: str) -> dict[str, Any]:
+    if not SHA256.fullmatch(core_digest):
+        raise OwnershipError("core_digest is invalid")
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "kind": KIND,
+        "handoff_id": _identity(handoff_id, "handoff_id"),
+        "core_digest": core_digest,
+        "task": task,
+        "source_session_id": source,
+        "source_context_key": source,
+        "consumer_session_id": None,
+        "consumer_context_key": None,
+        "state": "quiescing",
+        "generation": 0,
+        "fencing_token": secrets.token_hex(16),
+        "archive_observation": None,
+        "event_id": f"event-{secrets.token_hex(12)}",
+        "previous_event_digest": None,
+        "updated_at": _now(),
+    }
+
+
+def _record_digest(record: dict[str, Any]) -> str:
+    return _digest({key: value for key, value in record.items() if key != "integrity"})
+
+
+def _decode(path: Path) -> dict[str, Any]:
+    if path.is_symlink() or not path.is_file() or path.stat().st_size > MAX_RECORD_BYTES:
+        raise OwnershipError("ownership record is unsafe or too large")
+    data, reason = read_json_checked(path)
+    if data is None:
+        raise OwnershipError(f"ownership record is {reason}")
+    required = {
+        "schema_version", "kind", "handoff_id", "core_digest", "task",
+        "source_session_id", "source_context_key", "consumer_session_id",
+        "consumer_context_key", "state", "generation", "fencing_token",
+        "archive_observation", "event_id", "previous_event_digest", "updated_at", "integrity",
+    }
+    if set(data) != required or data["schema_version"] != SCHEMA_VERSION or data["kind"] != KIND:
+        raise OwnershipError("ownership record schema is unsupported")
+    _identity(data["handoff_id"], "handoff_id")
+    if not SHA256.fullmatch(data["core_digest"]):
+        raise OwnershipError("core_digest is invalid")
+    task = data["task"]
+    if not isinstance(task, dict) or set(task) != {"id", "path", "status"}:
+        raise OwnershipError("ownership task is invalid")
+    _safe_task_id(task["id"])
+    _text(task["path"], "task.path", 1024)
+    _text(task["status"], "task.status", 64)
+    for key in ("source_session_id", "source_context_key"):
+        _identity(data[key], key)
+    for key in ("consumer_session_id", "consumer_context_key"):
+        if data[key] is not None:
+            _identity(data[key], key)
+    if data["state"] not in STATES or not isinstance(data["generation"], int) or data["generation"] < 0:
+        raise OwnershipError("ownership state is invalid")
+    _identity(data["fencing_token"], "fencing_token")
+    if data["archive_observation"] is not None and data["archive_observation"] not in ARCHIVE_OBSERVATIONS:
+        raise OwnershipError("archive observation is invalid")
+    _identity(data["event_id"], "event_id")
+    if data["previous_event_digest"] is not None and not SHA256.fullmatch(data["previous_event_digest"]):
+        raise OwnershipError("previous event digest is invalid")
+    _text(data["updated_at"], "updated_at", 128)
+    integrity = data["integrity"]
+    if not isinstance(integrity, dict) or set(integrity) != {"record_digest"} or not SHA256.fullmatch(integrity["record_digest"]):
+        raise OwnershipError("ownership integrity is invalid")
+    if integrity["record_digest"] != _record_digest(data):
+        raise OwnershipError("ownership record digest does not match")
+    return data
+
+
+def _write(path: Path, record: dict[str, Any]) -> str:
+    record["event_id"] = f"event-{secrets.token_hex(12)}"
+    record["updated_at"] = _now()
+    record["integrity"] = {"record_digest": _record_digest(record)}
+    encoded = json.dumps(record, ensure_ascii=True, indent=2, sort_keys=True) + "\n"
+    if len(encoded.encode("utf-8")) > MAX_RECORD_BYTES:
+        raise OwnershipError("ownership record is too large")
+    temporary: Path | None = None
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        with tempfile.NamedTemporaryFile("w", encoding="utf-8", dir=path.parent, delete=False) as handle:
+            temporary = Path(handle.name)
+            handle.write(encoded)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.chmod(temporary, 0o600)
+        os.replace(temporary, path)
+        directory_fd = os.open(path.parent, os.O_RDONLY)
+        try:
+            os.fsync(directory_fd)
+        finally:
+            os.close(directory_fd)
+    except OSError as exc:
+        if temporary is not None:
+            temporary.unlink(missing_ok=True)
+        raise OwnershipError("ownership record atomic write failed") from exc
+    return record["integrity"]["record_digest"]
+
+
+def _load(root: Path, task_id: str, handoff_id: str) -> tuple[Path, dict[str, Any]]:
+    path = _record_path(root, task_id, handoff_id)
+    if not path.exists():
+        raise OwnershipError("ownership record is absent")
+    return path, _decode(path)
+
+
+def _check(record: dict[str, Any], core_digest: str, expected_generation: int, actor: str) -> None:
+    if record["core_digest"] != core_digest:
+        raise OwnershipError("core_digest does not match")
+    if record["generation"] != expected_generation:
+        raise OwnershipError("expected ownership generation does not match")
+    if record["source_session_id"] != actor and record.get("consumer_session_id") != actor:
+        raise OwnershipError("session is not an ownership actor")
+
+
+def _public(record: dict[str, Any]) -> dict[str, Any]:
+    return {
+        "status": record["state"],
+        "handoff_id": record["handoff_id"],
+        "core_digest": record["core_digest"],
+        "task": record["task"],
+        "source_session_id": record["source_session_id"],
+        "consumer_session_id": record["consumer_session_id"],
+        "generation": record["generation"],
+        "archive_observation": record["archive_observation"],
+        "record_digest": record["integrity"]["record_digest"],
+        "updated_at": record["updated_at"],
+    }
+
+
+def quiesce(root: Path, task_path: str, handoff_id: str, core_digest: str, source_session_id: str) -> dict[str, Any]:
+    actor, active = _direct_context(root, require_task=True)
+    task = _task_snapshot(root, task_path)
+    if active.source_type != "session" or active.context_key != actor or active.task_path != task["path"]:
+        raise OwnershipError("source task is not the direct current task")
+    if _identity(source_session_id, "source_session_id") != actor:
+        raise OwnershipError("source_session_id does not match direct session")
+    path = _record_path(root, task["id"], handoff_id)
+    with _record_lock(path):
+        if path.exists():
+            raise OwnershipError("ownership record already exists")
+        record = _new_record(task, handoff_id, core_digest, actor)
+        digest = _write(path, record)
+    return {"status": "quiescing", "generation": 0, "record_digest": digest}
+
+
+def seal(root: Path, task_id: str, handoff_id: str, core_digest: str, expected_generation: int) -> dict[str, Any]:
+    actor, _ = _direct_context(root)
+    path, record = _load(root, task_id, handoff_id)
+    with _record_lock(path):
+        record = _decode(path)
+        _check(record, core_digest, expected_generation, actor)
+        if record["state"] != "quiescing" or record["source_session_id"] != actor:
+            raise OwnershipError("ownership record is not sealable by source")
+        record["previous_event_digest"] = record["integrity"]["record_digest"]
+        record["state"] = "sealed"
+        record["generation"] += 1
+        digest = _write(path, record)
+    return _public(record) | {"record_digest": digest}
+
+
+def retire(root: Path, task_id: str, handoff_id: str, core_digest: str, expected_generation: int, archive_observation: str) -> dict[str, Any]:
+    if archive_observation not in ARCHIVE_OBSERVATIONS:
+        raise OwnershipError("archive observation is invalid")
+    actor, active = _direct_context(root)
+    path, record = _load(root, task_id, handoff_id)
+    with _record_lock(path):
+        record = _decode(path)
+        _check(record, core_digest, expected_generation, actor)
+        if record["source_session_id"] != actor or record["state"] not in {"sealed", "retiring"}:
+            raise OwnershipError("ownership record is not retireable by source")
+        if record["state"] == "sealed":
+            if active.task_path != record["task"]["path"]:
+                raise OwnershipError("source task is not bound for retirement")
+            record["previous_event_digest"] = record["integrity"]["record_digest"]
+            record["state"] = "retiring"
+            record["archive_observation"] = archive_observation
+            record["generation"] += 1
+            record["fencing_token"] = secrets.token_hex(16)
+            _write(path, record)
+        elif record["archive_observation"] != archive_observation:
+            raise OwnershipError("archive observation does not match retirement")
+
+        active = resolve_active_task(root, allow_single_session_fallback=False)
+        if active.context_key != actor:
+            raise OwnershipError("direct_session_identity_unstable")
+        if active.task_path == record["task"]["path"]:
+            clear_active_task(root)
+        elif active.task_path:
+            raise OwnershipError("source task pointer changed during retirement")
+        active = resolve_active_task(root, allow_single_session_fallback=False)
+        if active.context_key != actor or active.task_path:
+            raise OwnershipError("source task retirement could not be verified; recovery_required")
+        record["previous_event_digest"] = record["integrity"]["record_digest"]
+        record["state"] = "ready"
+        record["generation"] += 1
+        digest = _write(path, record)
+    return _public(record) | {"record_digest": digest}
+
+
+def claim(root: Path, task_id: str, task_path: str, handoff_id: str, core_digest: str, expected_generation: int) -> dict[str, Any]:
+    actor, active = _direct_context(root)
+    path, record = _load(root, task_id, handoff_id)
+    with _record_lock(path):
+        record = _decode(path)
+        if record["core_digest"] != core_digest:
+            raise OwnershipError("expected ownership claim does not match")
+        if record["state"] == "claimed" and record.get("consumer_session_id") == actor:
+            if active.task_path != record["task"]["path"]:
+                raise OwnershipError("claimed consumer task pointer is missing")
+            return _public(record)
+        if record["state"] == "claiming" and record.get("consumer_session_id") == actor:
+            if active.task_path and active.task_path != record["task"]["path"]:
+                raise OwnershipError("target task pointer changed during claim; recovery_required")
+            if not active.task_path:
+                bound = set_active_task(record["task"]["path"], root)
+                if not bound:
+                    raise OwnershipError("target task binding failed; recovery_required")
+                active = resolve_active_task(root, allow_single_session_fallback=False)
+            if active.context_key != actor or active.task_path != record["task"]["path"]:
+                raise OwnershipError("target task binding could not be verified; recovery_required")
+            record["previous_event_digest"] = record["integrity"]["record_digest"]
+            record["state"] = "claimed"
+            record["generation"] += 1
+            digest = _write(path, record)
+            return _public(record) | {"record_digest": digest}
+        if record["generation"] != expected_generation:
+            raise OwnershipError("expected ownership claim does not match")
+        if record["state"] != "ready":
+            raise OwnershipError("ownership record is not claimable")
+        if active.task_path:
+            raise OwnershipError("target session already has a direct task")
+        task = _task_snapshot(root, task_path)
+        if task != record["task"]:
+            raise OwnershipError("target task does not match ownership record")
+        record["previous_event_digest"] = record["integrity"]["record_digest"]
+        record["state"] = "claiming"
+        record["consumer_session_id"] = actor
+        record["consumer_context_key"] = actor
+        record["generation"] += 1
+        record["fencing_token"] = secrets.token_hex(16)
+        _write(path, record)
+        bound = set_active_task(task["path"], root)
+        if not bound:
+            raise OwnershipError("target task binding failed; recovery_required")
+        active = resolve_active_task(root, allow_single_session_fallback=False)
+        if active.context_key != actor or active.task_path != task["path"]:
+            raise OwnershipError("target task binding could not be verified; recovery_required")
+        record["previous_event_digest"] = record["integrity"]["record_digest"]
+        record["state"] = "claimed"
+        record["generation"] += 1
+        digest = _write(path, record)
+    return _public(record) | {"record_digest": digest}
+
+
+def consume(root: Path, task_id: str, handoff_id: str, core_digest: str, expected_generation: int) -> dict[str, Any]:
+    actor, _ = _direct_context(root, require_task=True)
+    path, record = _load(root, task_id, handoff_id)
+    with _record_lock(path):
+        record = _decode(path)
+        if record["state"] == "consumed" and record.get("consumer_session_id") == actor:
+            return _public(record)
+        _check(record, core_digest, expected_generation, actor)
+        if record["state"] != "claimed" or record.get("consumer_session_id") != actor:
+            raise OwnershipError("ownership record is not consumable by current consumer")
+        record["previous_event_digest"] = record["integrity"]["record_digest"]
+        record["state"] = "consumed"
+        record["generation"] += 1
+        digest = _write(path, record)
+    return _public(record) | {"record_digest": digest}
+
+
+def archive(root: Path, task_id: str, handoff_id: str, core_digest: str, expected_generation: int) -> dict[str, Any]:
+    actor, _ = _direct_context(root, require_task=True)
+    path, record = _load(root, task_id, handoff_id)
+    with _record_lock(path):
+        record = _decode(path)
+        if record["state"] == "archived" and record.get("consumer_session_id") == actor:
+            return _public(record)
+        _check(record, core_digest, expected_generation, actor)
+        if record["state"] != "consumed" or record.get("consumer_session_id") != actor:
+            raise OwnershipError("ownership record is not archiveable by current consumer")
+        record["previous_event_digest"] = record["integrity"]["record_digest"]
+        record["state"] = "archived"
+        record["generation"] += 1
+        digest = _write(path, record)
+    return _public(record) | {"record_digest": digest}
+
+
+def status(root: Path | None, task_id: str, handoff_id: str, core_digest: str) -> dict[str, Any]:
+    root = (root or get_repo_root()).resolve()
+    _, record = _load(root, task_id, handoff_id)
+    if record["core_digest"] != core_digest:
+        raise OwnershipError("core_digest does not match")
+    return _public(record)
+
+
+def assert_task_mutation_allowed(root: Path, task_path: Path) -> None:
+    """Reject ordinary task pointer changes that would bypass ownership fencing."""
+    actor = resolve_context_key()
+    if not actor:
+        return
+    try:
+        task_id = _safe_task_id(task_path.name)
+    except ContinuationError:
+        return
+    relative = task_path.relative_to(root).as_posix()
+    records_dir = root / ".trellis" / ".runtime" / "handoff-ownership" / task_id
+    if not records_dir.is_dir() or records_dir.is_symlink():
+        return
+    for record_path in sorted(records_dir.glob("*.json")):
+        if record_path.is_symlink():
+            raise OwnershipError("ownership record is unsafe")
+        record = _decode(record_path)
+        if record["state"] not in STATES:
+            continue
+        if record["task"]["path"] != relative:
+            raise OwnershipError("ownership record task path does not match current task")
+        if record.get("consumer_session_id") == actor:
+            continue
+        if record["source_session_id"] == actor or record["state"] in {"retiring", "ready", "claiming", "claimed", "consumed", "archived"}:
+            raise OwnershipError("fencing_conflict: task is owned by another handoff session")

package/dist/templates/trellis/scripts/task.py

@@ -10,6 +10,7 @@ Usage:
     python3 task.py list-context <dir>          # List jsonl entries
     python3 task.py start <dir>                 # Set active task, record current branch
     python3 task.py current [--source] [--json] # Show active task
+    python3 task.py ownership <operation> ...   # Manage formal handoff task ownership
     python3 task.py finish                      # Clear active task
     python3 task.py set-branch <dir> <branch>   # Set git branch
     python3 task.py set-base-branch <dir> <branch>  # Set PR target branch
@@ -81,6 +82,17 @@ from common.continuation_record import (
     seal as seal_continuity,
     status as continuity_status,
 )
+from common.ownership_record import (
+    OwnershipError,
+    archive as archive_ownership,
+    assert_task_mutation_allowed,
+    claim as claim_ownership,
+    consume as consume_ownership,
+    quiesce as quiesce_ownership,
+    retire as retire_ownership,
+    seal as seal_ownership,
+    status as ownership_status,
+)
 
 
 # =============================================================================
@@ -198,6 +210,12 @@ def cmd_start(args: argparse.Namespace) -> int:
         print("Hint: Use task name (e.g., 'my-task') or full path (e.g., '.trellis/tasks/01-31-my-task')")
         return 1
 
+    try:
+        assert_task_mutation_allowed(repo_root, full_path)
+    except (OwnershipError, OSError) as exc:
+        print(colored(f"Error: {exc}", Colors.RED), file=sys.stderr)
+        return 2
+
     # Context-manifest gate (#573): a seeded-but-uncurated implement/check
     # manifest means every sub-agent dispatched for this task runs with zero
     # spec context, and nothing downstream surfaces that to the main session.
@@ -282,15 +300,22 @@ def cmd_start(args: argparse.Namespace) -> int:
 def cmd_finish(args: argparse.Namespace) -> int:
     """Clear active task."""
     repo_root = get_repo_root()
-    active = clear_active_task(repo_root)
+    active = resolve_active_task(repo_root)
     current = active.task_path
 
     if not current:
         print(colored("No current task set", Colors.YELLOW))
         return 0
 
+    try:
+        assert_task_mutation_allowed(repo_root, repo_root / current)
+    except (OwnershipError, OSError) as exc:
+        print(colored(f"Error: {exc}", Colors.RED), file=sys.stderr)
+        return 2
+
     # Resolve task.json path before clearing
     task_json_path = repo_root / current / FILE_TASK_JSON
+    clear_active_task(repo_root)
 
     print(colored(f"✓ Cleared current task (was: {current})", Colors.GREEN))
     print(f"Source: {active.source}")
@@ -382,6 +407,54 @@ def cmd_continuity(args: argparse.Namespace) -> int:
         return 2
 
 
+def cmd_ownership(args: argparse.Namespace) -> int:
+    """Manage the task-bound formal handoff ownership record."""
+    repo_root = get_repo_root()
+    if args.ownership_command == "status":
+        try:
+            result = ownership_status(repo_root, args.task_id, args.handoff_id, args.core_digest)
+        except (OwnershipError, OSError) as exc:
+            print(json.dumps({"status": "withheld", "reason": str(exc)}, ensure_ascii=False, sort_keys=True))
+            return 2
+        print(json.dumps(result, ensure_ascii=False, sort_keys=True))
+        return 0
+    if not getattr(args, "explicit_user_request", False):
+        print(colored("Error: ownership writes require --explicit-user-request", Colors.RED), file=sys.stderr)
+        return 2
+    try:
+        command = args.ownership_command
+        if command == "quiesce":
+            result = quiesce_ownership(
+                repo_root, args.task, args.handoff_id, args.core_digest, args.source_session_id
+            )
+        elif command == "seal":
+            result = seal_ownership(
+                repo_root, args.task_id, args.handoff_id, args.core_digest, args.expected_generation
+            )
+        elif command == "retire":
+            result = retire_ownership(
+                repo_root, args.task_id, args.handoff_id, args.core_digest,
+                args.expected_generation, args.archive_observation,
+            )
+        elif command == "claim":
+            result = claim_ownership(
+                repo_root, args.task_id, args.task, args.handoff_id, args.core_digest, args.expected_generation
+            )
+        elif command == "consume":
+            result = consume_ownership(
+                repo_root, args.task_id, args.handoff_id, args.core_digest, args.expected_generation
+            )
+        else:
+            result = archive_ownership(
+                repo_root, args.task_id, args.handoff_id, args.core_digest, args.expected_generation
+            )
+        print(json.dumps(result, ensure_ascii=False, sort_keys=True))
+        return 0
+    except (OwnershipError, OSError) as exc:
+        print(json.dumps({"status": "withheld", "reason": str(exc)}, ensure_ascii=False, sort_keys=True))
+        return 2
+
+
 # =============================================================================
 # Command: list
 # =============================================================================
@@ -743,6 +816,45 @@ def main() -> int:
     continuity_clear.add_argument("--expected", required=True, help="The current record digest or absent")
     continuity_clear.add_argument("--explicit-user-request", action="store_true", help="Required write confirmation")
 
+    # ownership
+    p_ownership = subparsers.add_parser("ownership", help="Manage formal handoff task ownership")
+    ownership_sub = p_ownership.add_subparsers(dest="ownership_command", required=True)
+
+    def add_ownership_common(parser, *, expected=False):
+        parser.add_argument("--task-id", required=True, help="Task id bound to the handoff")
+        parser.add_argument("--handoff-id", required=True, help="Immutable handoff id")
+        parser.add_argument("--core-digest", required=True, help="Immutable handoff core digest")
+        if expected:
+            parser.add_argument("--expected-generation", required=True, type=int)
+        parser.add_argument("--explicit-user-request", action="store_true", help="Required write confirmation")
+
+    ownership_quiesce = ownership_sub.add_parser("quiesce", help="Begin source handoff quiescence")
+    ownership_quiesce.add_argument("--task", required=True, help="Current task path")
+    ownership_quiesce.add_argument("--source-session-id", required=True)
+    add_ownership_common(ownership_quiesce)
+
+    ownership_seal = ownership_sub.add_parser("seal", help="Seal the source ownership boundary")
+    add_ownership_common(ownership_seal, expected=True)
+
+    ownership_retire = ownership_sub.add_parser("retire", help="Retire source and expose handoff")
+    ownership_retire.add_argument("--archive-observation", required=True, choices=("not_required", "observed"))
+    add_ownership_common(ownership_retire, expected=True)
+
+    ownership_claim = ownership_sub.add_parser("claim", help="Claim a ready handoff as this session")
+    ownership_claim.add_argument("--task", required=True, help="Task path to bind to this session")
+    add_ownership_common(ownership_claim, expected=True)
+
+    ownership_consume = ownership_sub.add_parser("consume", help="Record target consumption")
+    add_ownership_common(ownership_consume, expected=True)
+
+    ownership_archive = ownership_sub.add_parser("archive", help="Record post-consume retention archive")
+    add_ownership_common(ownership_archive, expected=True)
+
+    ownership_status_parser = ownership_sub.add_parser("status", help="Show ownership status")
+    add_ownership_common(ownership_status_parser)
+    ownership_status_parser.add_argument("--json", action="store_true", help="Output machine-readable JSON")
+    ownership_status_parser.set_defaults(explicit_user_request=True)
+
     # finish
     subparsers.add_parser("finish", help="Clear active task")
 
@@ -824,6 +936,7 @@ def main() -> int:
         "start": cmd_start,
         "current": cmd_current,
         "continuity": cmd_continuity,
+        "ownership": cmd_ownership,
         "finish": cmd_finish,
         "set-branch": cmd_set_branch,
         "set-base-branch": cmd_set_base_branch,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pennixrv/trellis",
-  "version": "0.6.27",
+  "version": "0.6.28",
   "description": "AI capabilities grow like ivy — Trellis provides the structure to guide them along a disciplined path",
   "type": "module",
   "main": "./dist/index.js",
@@ -34,7 +34,7 @@
     "inquirer": "^9.3.7",
     "undici": "^6.21.0",
     "zod": "^4.4.2",
-    "@pennixrv/trellis-core": "0.6.27"
+    "@pennixrv/trellis-core": "0.6.28"
   },
   "devDependencies": {
     "@eslint/js": "^9.18.0",