relay-flow 0.3.9-alpha → 0.3.11-alpha

package/internal/execution/goworkflows/engine_test.go

@@ -72,13 +72,16 @@ func TestMailboxDescriptionAndLaunchPromptAreTaskSystemNeutral(t *testing.T) {
 			t.Fatal(err)
 		}
 		want := "Task system: " + taskSystem + "\nUse the " + taskSystem + " tools to read the parent ticket PAY-101.\n\nYour mailbox is PAY-234. Read its description and comments for node instructions and feedback.\n\nKeep the summary brief, and make the feedback as detailed and actionable as possible for the next agent.\n\nReturn the complete report directly. Relay-flow will show a native TUI approval dialog after the report is valid. Do not use OpenCode's Question tool for relay-flow approval."
+		if taskSystem == "jira" {
+			want = "Read the description of your assigned Jira task:\nacli jira workitem view \"PAY-234\" --fields \"summary,description\" --json\n\nFollow the work instructions, valid routes, and report format in that description."
+		}
 		if prompt != want {
 			t.Fatalf("RenderPrompt(%s) = %q, want %q", taskSystem, prompt, want)
 		}
-		if strings.Contains(prompt, "Jira") || strings.Contains(prompt, "subtask") {
+		if taskSystem != "jira" && (strings.Contains(prompt, "Jira") || strings.Contains(prompt, "subtask")) {
 			t.Fatalf("launch prompt contains task-system-specific mailbox wording: %q", prompt)
 		}
-		if strings.Contains(prompt, "STATUS:") || strings.Contains(prompt, node.Description) {
+		if strings.Contains(prompt, "STATUS:") || (taskSystem != "jira" && strings.Contains(prompt, node.Description)) {
 			t.Fatalf("launch prompt duplicates mailbox instructions: %q", prompt)
 		}
 	}
@@ -467,6 +470,7 @@ func TestTransitionOrdering(t *testing.T) {
 	log := newEventLog()
 	sys := newFakeTaskSystem(log)
 	fr := newFakeRunner(log)
+	fh := newFakeHarness(log)
 	wf := workflow.Workflow{
 		Name: "reviewFlow", Repos: []string{"payments"},
 		Nodes: map[string]workflow.Node{
@@ -485,7 +489,7 @@ func TestTransitionOrdering(t *testing.T) {
 		},
 	}
 	engine := newEngine(t, goworkflows.Dependencies{
-		Repos: repoRegistryWith("payments", sys), Runner: fr, Harness: newFakeHarness(log),
+		Repos: repoRegistryWith("payments", sys), Runner: fr, Harness: fh,
 	})
 	rid, _ := startRun(engine, wf)
 	waitFor(t, 10*time.Second, func() bool {
@@ -510,6 +514,16 @@ func TestTransitionOrdering(t *testing.T) {
 		t.Fatalf("HITL status was not set before terminal start; events=%v", events)
 	}
 
+	var sawReviewFeedback bool
+	for _, call := range fh.promptCalls() {
+		if call.Data.Node == "review" && call.Data.PreviousFeedback == "review it" {
+			sawReviewFeedback = true
+		}
+	}
+	if !sawReviewFeedback {
+		t.Fatalf("next node prompt did not receive selected feedback: %+v", fh.promptCalls())
+	}
+
 	// Exact cross-primitive order, observed through the fake-adapter and fake-
 	// runner call logs (the settled observation seam):
 	// summary(current) -> feedback(selected next) -> CompleteMailbox(current)

package/internal/execution/goworkflows/fakes_test.go

@@ -73,6 +73,7 @@ type fakeTaskSystem struct {
 	labels        map[string][]string // mailbox key -> labels
 	specs         []task.MailboxSpec
 	comments      []recordedComment
+	hasCommentN   int
 	resets        []string
 	renderText    func(task.TextKind, task.TextData) (string, error)
 
@@ -115,6 +116,18 @@ func (s *fakeTaskSystem) CompileFilter(config.RawValues) (func(task.Ticket) bool
 	return func(task.Ticket) bool { return true }, nil
 }
 
+func (s *fakeTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func (s *fakeTaskSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	return nil
+}
+
+func (s *fakeTaskSystem) ClaimIfOwned(ctx context.Context, ref task.TicketRef, workflowName string, _ config.RawValues) error {
+	return s.Claim(ctx, ref, workflowName)
+}
+
 func (s *fakeTaskSystem) Claim(_ context.Context, ref task.TicketRef, wf string) error {
 	s.log.add("claim:" + ref.Key + ":" + wf)
 	return nil
@@ -208,6 +221,7 @@ func (s *fakeTaskSystem) CompleteMailbox(_ context.Context, mb task.Mailbox) err
 
 func (s *fakeTaskSystem) HasComment(_ context.Context, target task.Target, marker string) (bool, error) {
 	s.mu.Lock()
+	s.hasCommentN++
 	defer s.mu.Unlock()
 	for _, c := range s.comments {
 		if c.Marker == marker {
@@ -267,6 +281,12 @@ func (s *fakeTaskSystem) ResetForRecovery(_ context.Context, parent task.TicketR
 	return nil
 }
 
+func (s *fakeTaskSystem) hasCommentCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.hasCommentN
+}
+
 func (s *fakeTaskSystem) commentBodies(key string) []recordedComment {
 	s.mu.Lock()
 	defer s.mu.Unlock()

package/internal/execution/goworkflows/interpreter.go

@@ -205,6 +205,7 @@ func (a *Activities) runGraph(ctx goworkflow.Context, start run.Start) error {
 	}
 
 	current := target
+	previousFeedback := ""
 	seenReportIDs := map[string]bool{}
 	lastStepByNode := map[string]int64{}
 	lastDepthByNode := map[string]int{}
@@ -292,20 +293,22 @@ func (a *Activities) runGraph(ctx goworkflow.Context, start run.Start) error {
 			Ticket:      start.Ticket.Key,
 			Node:        current,
 			NodeType:    node.Type,
+			AutoReject:  node.AutoReject,
 			Agent:       node.Agent,
 			Title:       title,
 			NudgePrompt: node.NudgePrompt,
 			PromptData: harness.PromptData{
-				TaskSystem:      a.TaskSystem,
-				Ticket:          start.Ticket.Key,
-				Workflow:        wf.Name,
-				Repo:            start.Repo,
-				Node:            current,
-				NodeType:        node.Type,
-				Agent:           node.Agent,
-				NodeDescription: node.Description,
-				NextSteps:       nextStepsText(nextSteps),
-				Mailbox:         mb.Key,
+				TaskSystem:       a.TaskSystem,
+				Ticket:           start.Ticket.Key,
+				Workflow:         wf.Name,
+				Repo:             start.Repo,
+				Node:             current,
+				NodeType:         node.Type,
+				Agent:            node.Agent,
+				NodeDescription:  node.Description,
+				NextSteps:        nextStepsText(nextSteps),
+				Mailbox:          mb.Key,
+				PreviousFeedback: previousFeedback,
 			},
 			NextSteps: nextSteps,
 		}
@@ -394,7 +397,9 @@ func (a *Activities) runGraph(ctx goworkflow.Context, start run.Start) error {
 		stepMessage := report.Summary.Completed
 		if report.Status == workflow.OutcomeFailure {
 			stepStatus = run.StepFailed
-			stepMessage = report.Summary.IssuesDiscovered
+			if report.Summary.IssuesDiscovered != workflow.None {
+				stepMessage = report.Summary.IssuesDiscovered
+			}
 		}
 		stepFinished := goworkflow.Now(ctx).UTC()
 		if _, err := retryLoop(ctx, start.ID, a, work, current,
@@ -464,6 +469,7 @@ func (a *Activities) runGraph(ctx goworkflow.Context, start run.Start) error {
 			return err
 		}
 
+		previousFeedback = report.Feedback.RequiredActions
 		current = next
 	}
 
@@ -760,11 +766,19 @@ func nextStepsText(routes []workflow.Route) string {
 }
 
 func renderSummaryReport(r workflow.Report) string {
+	if r.Summary.Commits == workflow.None && r.Summary.NotCompleted == workflow.None &&
+		r.Summary.IssuesDiscovered == workflow.None && r.Summary.Verification == workflow.None && r.Summary.Notes == workflow.None {
+		return r.Summary.Completed
+	}
 	return fmt.Sprintf("COMPLETED:\n%s\n\nCOMMITS:\n%s\n\nNOT COMPLETED:\n%s\n\nISSUES DISCOVERED:\n%s\n\nVERIFICATION:\n%s\n\nNOTES:\n%s",
 		r.Summary.Completed, r.Summary.Commits, r.Summary.NotCompleted, r.Summary.IssuesDiscovered, r.Summary.Verification, r.Summary.Notes)
 }
 
 func renderFeedbackReport(r workflow.Report) string {
+	if r.Summary.Commits == workflow.None && r.Feedback.ReasonForNextStep == workflow.None &&
+		r.Feedback.RelevantContext == workflow.None && r.Feedback.ExpectedResult == workflow.None {
+		return r.Feedback.RequiredActions
+	}
 	return fmt.Sprintf("COMMITS:\n%s\n\nREASON FOR NEXT STEP:\n%s\n\nREQUIRED ACTIONS:\n%s\n\nRELEVANT CONTEXT:\n%s\n\nEXPECTED RESULT:\n%s",
 		r.Summary.Commits, r.Feedback.ReasonForNextStep, r.Feedback.RequiredActions, r.Feedback.RelevantContext, r.Feedback.ExpectedResult)
 }

package/internal/execution/goworkflows/mailbox_test.go

@@ -41,6 +41,33 @@ func threeNodeWorkflow() workflow.Workflow {
 	}
 }
 
+func TestCompactMailboxTemplateDoesNotAppendGenericInstructions(t *testing.T) {
+	wf := threeNodeWorkflow()
+	sys := newFakeTaskSystem(newEventLog())
+	sys.renderText = func(_ task.TextKind, data task.TextData) (string, error) {
+		return data.Ticket + " / " + data.Node + " — " + data.NodeType + " — " + data.Agent +
+			"\n" + data.NodeDescription + "\nSuccess routes:\n" + data.SuccessRoutes +
+			"\nFailure routes:\n" + data.FailureRoutes + "\n" + data.Report, nil
+	}
+	specs, err := goworkflows.RenderMailboxSpecs(sys, run.Work{
+		Parent: task.TicketRef{Key: "PAY-101"}, Repo: "payments", Workflow: wf.Name,
+	}, &wf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, spec := range specs {
+		for _, required := range []string{"PAY-101 / " + spec.Node, wf.Nodes[spec.Node].Description,
+			"Success routes:", "Failure routes:", " — when: ", workflow.ReportFormat} {
+			if !strings.Contains(spec.Description, required) {
+				t.Fatalf("mailbox %s description lacks %q: %q", spec.Node, required, spec.Description)
+			}
+		}
+		if strings.Contains(spec.Description, "Required report format:") {
+			t.Fatalf("mailbox %s appended generic instructions: %q", spec.Node, spec.Description)
+		}
+	}
+}
+
 func TestMailboxesEnsuredForWorkNodesOnly(t *testing.T) {
 	log := newEventLog()
 	sys := newFakeTaskSystem(log)
@@ -107,7 +134,7 @@ func TestMailboxesEnsuredForWorkNodesOnly(t *testing.T) {
 				t.Fatalf("%s description lacks route explanation %q: %q", node, when, d)
 			}
 		}
-		for _, required := range []string{"Required report format:", "STATUS:", "COMMITS:", "FEEDBACK:"} {
+		for _, required := range []string{"Required report format:", "STATUS:", "NEXT STEP:", "SUMMARY:", "FEEDBACK:"} {
 			if !strings.Contains(d, required) {
 				t.Fatalf("%s description lacks %q: %q", node, required, d)
 			}

package/internal/execution/goworkflows/ownership_test.go

@@ -0,0 +1,259 @@
+package goworkflows_test
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/execution/goworkflows"
+	"github.com/rajpopat27/relay-flow/internal/identity"
+	recoverpkg "github.com/rajpopat27/relay-flow/internal/recover"
+	"github.com/rajpopat27/relay-flow/internal/router"
+	"github.com/rajpopat27/relay-flow/internal/run"
+	"github.com/rajpopat27/relay-flow/internal/task"
+	"github.com/rajpopat27/relay-flow/internal/workflow"
+)
+
+// ownershipCompositionState models the provider-owned labels and current
+// assignee shared by two independent relay-flow databases. The adapter fake
+// persists a durable wf-owner marker when the first server claims the ticket.
+type ownershipCompositionState struct {
+	mu       sync.Mutex
+	assignee string
+	labels   []string
+}
+
+type ownershipCompositionTaskSystem struct {
+	*fakeTaskSystem
+	owner string
+	state *ownershipCompositionState
+}
+
+func newOwnershipCompositionTaskSystem(owner string, state *ownershipCompositionState, log *eventLog) *ownershipCompositionTaskSystem {
+	return &ownershipCompositionTaskSystem{
+		fakeTaskSystem: newFakeTaskSystem(log), owner: owner, state: state,
+	}
+}
+
+func (s *ownershipCompositionTaskSystem) Poll(context.Context) ([]task.Ticket, error) {
+	s.state.mu.Lock()
+	defer s.state.mu.Unlock()
+	claims := make([]string, 0, 1)
+	for _, label := range s.state.labels {
+		if len(label) > len("wf:") && label[:len("wf:")] == "wf:" {
+			claims = append(claims, label)
+		}
+	}
+	return []task.Ticket{{
+		ID: "1", Key: "PAY-101", Title: "ownership composition",
+		WorkflowClaims: claims,
+		Fields: map[string]any{
+			"assignee": s.state.assignee,
+			"labels":   append([]string(nil), s.state.labels...),
+		},
+	}}, nil
+}
+
+func (s *ownershipCompositionTaskSystem) CompileFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(ticket task.Ticket) bool {
+		assignee, _ := ticket.Fields["assignee"].(string)
+		return assignee == s.owner
+	}, nil
+}
+
+func (s *ownershipCompositionTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(ticket task.Ticket) bool {
+		if len(ticket.WorkflowClaims) != 1 {
+			return false
+		}
+		assignee, _ := ticket.Fields["assignee"].(string)
+		if assignee != s.owner {
+			return false
+		}
+		want := "wf-owner:" + ticket.WorkflowClaims[0][len("wf:"):] + ":" + s.owner
+		labels, _ := ticket.Fields["labels"].([]string)
+		for _, label := range labels {
+			if label == want {
+				return true
+			}
+		}
+		return false
+	}, nil
+}
+
+func (s *ownershipCompositionTaskSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	s.state.mu.Lock()
+	defer s.state.mu.Unlock()
+	if s.hasOwnerMarkerLocked("ownershipFlow") {
+		return nil
+	}
+	return &task.OwnershipMismatchError{Ticket: "PAY-101", Workflow: "ownershipFlow"}
+}
+
+func (s *ownershipCompositionTaskSystem) BackfillClaimOwner(context.Context, task.TicketRef, string, config.RawValues) error {
+	s.state.mu.Lock()
+	defer s.state.mu.Unlock()
+	if !containsLabel(s.state.labels, "wf:ownershipFlow") {
+		return &task.OwnershipMismatchError{Ticket: "PAY-101", Workflow: "ownershipFlow"}
+	}
+	marker := "wf-owner:ownershipFlow:" + s.owner
+	if !containsLabel(s.state.labels, marker) {
+		s.state.labels = append(s.state.labels, marker)
+	}
+	return nil
+}
+
+func (s *ownershipCompositionTaskSystem) ClaimIfOwned(ctx context.Context, ticket task.TicketRef, workflowName string, _ config.RawValues) error {
+	s.state.mu.Lock()
+	defer s.state.mu.Unlock()
+	if s.state.assignee != s.owner {
+		return &task.OwnershipMismatchError{Ticket: ticket.Key, Workflow: workflowName}
+	}
+	ownerMarker := "wf-owner:" + workflowName + ":" + s.owner
+	claim := "wf:" + workflowName
+	for _, label := range s.state.labels {
+		if label == ownerMarker && containsLabel(s.state.labels, claim) {
+			return nil
+		}
+		if len(label) > len("wf:") && label[:len("wf:")] == "wf:" {
+			return &task.OwnershipMismatchError{Ticket: ticket.Key, Workflow: workflowName}
+		}
+	}
+	s.state.labels = append(s.state.labels, ownerMarker, claim)
+	return nil
+}
+
+func (s *ownershipCompositionTaskSystem) hasOwnerMarkerLocked(workflowName string) bool {
+	return containsLabel(s.state.labels, "wf-owner:"+workflowName+":"+s.owner)
+}
+
+func containsLabel(labels []string, want string) bool {
+	for _, label := range labels {
+		if label == want {
+			return true
+		}
+	}
+	return false
+}
+
+func TestExplicitLegacyBackfillPreservesClaimAndEnablesRoutingAndRecovery(t *testing.T) {
+	state := &ownershipCompositionState{assignee: "alice", labels: []string{"wf:ownershipFlow"}}
+	log := newEventLog()
+	sys := newOwnershipCompositionTaskSystem("alice", state, log)
+	reg := repoRegistryWith("payments", sys)
+	wf := linearWorkflow(false)
+	wf.Name = "ownershipFlow"
+	wf.TaskConfig = config.RawValues{"filters": map[string]any{"assignees": []any{"currentUser()"}}}
+	if err := reg.BindWorkflows([]*workflow.Workflow{&wf}); err != nil {
+		t.Fatal(err)
+	}
+	workflowReg := &workflow.Registry{}
+	workflowReg.Replace(&wf)
+	fr := newFakeRunner(log)
+	engine := newEngine(t, goworkflows.Dependencies{Repos: reg, Runner: fr, Harness: newFakeHarness(log)})
+	manager := &run.RunManager{Executor: engine, Runs: engine, Repos: reg, Workflows: workflowReg}
+	if err := manager.BackfillClaimOwner(context.Background(), "payments", "PAY-101", "ownershipFlow"); err != nil {
+		t.Fatalf("explicit backfill failed: %v", err)
+	}
+	state.mu.Lock()
+	labels := append([]string(nil), state.labels...)
+	state.mu.Unlock()
+	if !containsLabel(labels, "wf:ownershipFlow") || !containsLabel(labels, "wf-owner:ownershipFlow:alice") || len(labels) != 2 {
+		t.Fatalf("backfill labels = %v, want preserved claim plus one provenance marker", labels)
+	}
+	rp, _ := reg.Get("payments")
+	ticket, _ := sys.Poll(context.Background())
+	if _, err := router.ResolveWorkflow(rp, ticket[0]); err != nil {
+		t.Fatalf("backfilled claim did not route normally: %v", err)
+	}
+	specsFor := func(system task.System, work run.Work, w *workflow.Workflow) ([]task.MailboxSpec, error) {
+		return goworkflows.RenderMailboxSpecs(system, work, w)
+	}
+	if err := recoverpkg.FromTaskSystem(context.Background(), reg, fr, manager, specsFor); err != nil {
+		t.Fatalf("backfilled claim did not recover: %v", err)
+	}
+	if runs, err := engine.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "ownershipFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 1 {
+		t.Fatalf("recovered runs = %v, %v; want one run", runs, err)
+	}
+}
+
+func TestIndependentRunDatabasesCannotTakeOverReassignedClaim(t *testing.T) {
+	state := &ownershipCompositionState{assignee: "alice"}
+	logA, logB := newEventLog(), newEventLog()
+	sysA := newOwnershipCompositionTaskSystem("alice", state, logA)
+	sysB := newOwnershipCompositionTaskSystem("bob", state, logB)
+	regA := repoRegistryWith("payments", sysA)
+	regB := repoRegistryWith("payments", sysB)
+	wf := linearWorkflow(false)
+	wf.Name = "ownershipFlow"
+	wf.TaskConfig = config.RawValues{"filters": map[string]any{
+		"assignees": []any{"currentUser()"},
+	}}
+	if err := regA.BindWorkflows([]*workflow.Workflow{&wf}); err != nil {
+		t.Fatal(err)
+	}
+	if err := regB.BindWorkflows([]*workflow.Workflow{&wf}); err != nil {
+		t.Fatal(err)
+	}
+
+	engineA := newEngine(t, goworkflows.Dependencies{
+		Repos: regA, Runner: newFakeRunner(logA), Harness: newFakeHarness(logA),
+	})
+	engineB := newEngine(t, goworkflows.Dependencies{
+		Repos: regB, Runner: newFakeRunner(logB), Harness: newFakeHarness(logB),
+	})
+	managerA := &run.RunManager{Executor: engineA, Runs: engineA}
+	managerB := &run.RunManager{Executor: engineB, Runs: engineB}
+
+	ticketA, err := sysA.Poll(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	rpA, _ := regA.Get("payments")
+	resolvedA, err := router.ResolveWorkflow(rpA, ticketA[0])
+	if err != nil {
+		t.Fatalf("owner A route failed: %v", err)
+	}
+	if err := managerA.EnsureRun(context.Background(), rpA, resolvedA, ticketA[0]); err != nil {
+		t.Fatalf("owner A EnsureRun failed: %v", err)
+	}
+	waitFor(t, 10*time.Second, func() bool {
+		current, err := engineA.GetRun(context.Background(), identity.NewRunID("payments", "ownershipFlow", "PAY-101"))
+		return err == nil && current.State != run.StateCompleted && current.State != run.StateCanceled
+	})
+
+	state.mu.Lock()
+	state.assignee = "bob"
+	state.mu.Unlock()
+	ticketB, err := sysB.Poll(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	rpB, _ := regB.Get("payments")
+	if _, err := router.ResolveWorkflow(rpB, ticketB[0]); !errors.Is(err, router.ErrClaimOwnerMismatch) {
+		t.Fatalf("owner B route error = %v, want claim-owner-mismatch", err)
+	}
+	if err := managerB.EnsureRun(context.Background(), rpB, &wf, ticketB[0]); !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("owner B EnsureRun error = %v, want ownership mismatch", err)
+	}
+	if runs, err := engineB.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "ownershipFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 0 {
+		t.Fatalf("owner B database runs = %v, %v; want none", runs, err)
+	}
+
+	// Reassignment is a current-owner mismatch for both servers. The
+	// original durable run remains in database A, but neither server calls
+	// EnsureRun to reconcile or create execution state after the mismatch.
+	ticketAAfterReassignment, _ := sysA.Poll(context.Background())
+	if _, err := router.ResolveWorkflow(rpA, ticketAAfterReassignment[0]); !errors.Is(err, router.ErrClaimOwnerMismatch) {
+		t.Fatalf("owner A route after reassignment = %v, want claim-owner-mismatch", err)
+	}
+	if err := managerA.EnsureRun(context.Background(), rpA, &wf, ticketAAfterReassignment[0]); !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("owner A EnsureRun after reassignment = %v, want ownership mismatch", err)
+	}
+	if runs, err := engineA.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "ownershipFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 1 {
+		t.Fatalf("owner A database runs after reassignment = %v, %v; want one existing run", runs, err)
+	}
+}

package/internal/execution/goworkflows/recovery_test.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/cschleiden/go-workflows/backend/history"
+	"github.com/rajpopat27/relay-flow/internal/config"
 	"github.com/rajpopat27/relay-flow/internal/execution/goworkflows"
 	"github.com/rajpopat27/relay-flow/internal/identity"
 	recoverpkg "github.com/rajpopat27/relay-flow/internal/recover"
@@ -1358,7 +1359,7 @@ func TestDatabaseFileIsOwnerOnly(t *testing.T) {
 // task.System/runner.Runner plus the real engine and the real RunManager.
 // Rewritten in 6.3 from a test-local copy so the production wiring is
 // actually covered.
-func recoverTickets(ctx context.Context, engine *goworkflows.Engine, sys *fakeTaskSystem, fr *fakeRunner, wf workflow.Workflow) error {
+func recoverTickets(ctx context.Context, engine *goworkflows.Engine, sys task.System, fr *fakeRunner, wf workflow.Workflow) error {
 	reg := repo.NewRegistry()
 	reg.Replace(&repo.Repo{
 		Name:       "payments",
@@ -1376,6 +1377,85 @@ func recoverTickets(ctx context.Context, engine *goworkflows.Engine, sys *fakeTa
 	return recoverpkg.FromTaskSystem(ctx, reg, fr, rm, specsFor)
 }
 
+type mismatchedRecoveryTaskSystem struct{ *fakeTaskSystem }
+
+type legacyRecoveryTaskSystem struct{ *fakeTaskSystem }
+
+func (s *legacyRecoveryTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(task.Ticket) bool { return false }, nil
+}
+
+func (s *mismatchedRecoveryTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	// Let the router resolve the claim; the current-provider read below is the
+	// mismatch gate being exercised by this recovery regression.
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func (s *mismatchedRecoveryTaskSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	return &task.OwnershipMismatchError{Ticket: "PAY-101", Workflow: "basicFlow"}
+}
+
+func TestServeRecoverSkipsOwnerMismatchBeforeMutations(t *testing.T) {
+	log := newEventLog()
+	base := newFakeTaskSystem(log)
+	sys := &mismatchedRecoveryTaskSystem{fakeTaskSystem: base}
+	sys.parentsToRecover = []task.Ticket{{ID: "1", Key: "PAY-101", WorkflowClaims: []string{"wf:basicFlow"}}}
+	fr := newFakeRunner(log)
+	engine := newEngine(t, goworkflows.Dependencies{
+		Repos: repoRegistryWith("payments", sys), Runner: fr, Harness: newFakeHarness(log),
+	})
+	wf := linearWorkflow(false)
+	reg := repo.NewRegistry()
+	reg.Replace(&repo.Repo{Name: "payments", Path: "/srv/payments", TaskSystem: sys})
+	if err := reg.BindWorkflows([]*workflow.Workflow{&wf}); err != nil {
+		t.Fatal(err)
+	}
+	rm := &run.RunManager{Executor: engine, Runs: engine}
+	specsFor := func(system task.System, work run.Work, w *workflow.Workflow) ([]task.MailboxSpec, error) {
+		return goworkflows.RenderMailboxSpecs(system, work, w)
+	}
+	if err := recoverpkg.FromTaskSystem(context.Background(), reg, fr, rm, specsFor); err != nil {
+		t.Fatalf("recovery failed on owner mismatch: %v", err)
+	}
+	if len(fr.closedRun) != 0 {
+		t.Fatalf("CloseTerminals calls = %v, want none", fr.closedRun)
+	}
+	if base.hasCommentCount() != 0 {
+		t.Fatalf("HasComment calls = %d, want none before owner rejection", base.hasCommentCount())
+	}
+	if len(base.resets) != 0 {
+		t.Fatalf("ResetForRecovery calls = %v, want none", base.resets)
+	}
+	for _, event := range log.all() {
+		if strings.HasPrefix(event, "ensureMailboxes:") || strings.HasPrefix(event, "createMailbox:") {
+			t.Fatalf("mailbox mutation after owner mismatch: %v", log.all())
+		}
+	}
+	if runs, err := engine.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "basicFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 0 {
+		t.Fatalf("durable runs after owner mismatch = %v, %v; want none", runs, err)
+	}
+}
+
+func TestServeRecoverSkipsLegacyClaimWithoutProvenance(t *testing.T) {
+	log := newEventLog()
+	base := newFakeTaskSystem(log)
+	sys := &legacyRecoveryTaskSystem{fakeTaskSystem: base}
+	sys.parentsToRecover = []task.Ticket{{ID: "1", Key: "PAY-101", WorkflowClaims: []string{"wf:basicFlow"}}}
+	fr := newFakeRunner(log)
+	engine := newEngine(t, goworkflows.Dependencies{
+		Repos: repoRegistryWith("payments", sys), Runner: fr, Harness: newFakeHarness(log),
+	})
+	if err := recoverTickets(context.Background(), engine, sys, fr, linearWorkflow(false)); err != nil {
+		t.Fatalf("legacy-claim recovery failed: %v", err)
+	}
+	if len(fr.closedRun) != 0 || base.hasCommentCount() != 0 || len(base.resets) != 0 {
+		t.Fatalf("legacy claim caused recovery side effects: closed=%v comments=%d resets=%v", fr.closedRun, base.hasCommentCount(), base.resets)
+	}
+	if runs, err := engine.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "basicFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 0 {
+		t.Fatalf("legacy claim durable runs = %v, %v; want none", runs, err)
+	}
+}
+
 func TestServeRecoverRebuildsFreshRuns(t *testing.T) {
 	log := newEventLog()
 	sys := newFakeTaskSystem(log)

package/internal/execution/temporal/activities.go

@@ -85,7 +85,11 @@ func (a *Activities) EnsureMailboxes(ctx context.Context, w run.Work, specs []ta
 		if err != nil {
 			return nil, fmt.Errorf("render mailbox %q description: %w", specs[i].Node, err)
 		}
-		specs[i].Description = appendText(custom, specs[i].Description)
+		if data.Report != "" && strings.Contains(custom, data.Report) {
+			specs[i].Description = custom
+		} else {
+			specs[i].Description = appendText(custom, specs[i].Description)
+		}
 	}
 	return sys.EnsureMailboxes(ctx, w.Parent, w.Workflow, specs)
 }
@@ -486,26 +490,9 @@ func MailboxSpecForNode(wf *workflow.Workflow, ticketKey, name string, n workflo
 	var b strings.Builder
 	b.WriteString(`Required report format:
 
-STATUS: success | failure
-NEXT STEP: <one valid node name>
-
-SUMMARY:
-COMPLETED:
-COMMITS:
-NOT COMPLETED:
-ISSUES DISCOVERED:
-VERIFICATION:
-NOTES:
-
-FEEDBACK:
-REASON FOR NEXT STEP:
-REQUIRED ACTIONS:
-RELEVANT CONTEXT:
-EXPECTED RESULT:
+` + workflow.ReportFormat + `
 
-Every field is required; use None for an intentionally empty section. COMMITS must contain the relevant commit IDs or None.
-
-Node names identify workflow stages; they are not task-system statuses. STATUS describes whether the work at this node succeeded or failed, not the status of the parent or mailbox. NEXT STEP must name exactly one target listed below for that STATUS. Submit one report only: its SUMMARY is written to this current mailbox, while its FEEDBACK is written only to the selected next node's mailbox. For review nodes, put requested changes in FEEDBACK and select the node responsible for acting on them. Relay-flow and the task system own parent and mailbox status changes. When NEXT STEP is end, every FEEDBACK field must be None.`)
+Node names identify workflow stages; they are not task-system statuses. STATUS describes whether the work at this node succeeded or failed, not the status of the parent or mailbox. NEXT STEP must name exactly one target listed below for that STATUS. Submit one report only: its SUMMARY is written to this current mailbox, while its FEEDBACK is written only to the selected next node's mailbox. For review nodes, put requested changes in FEEDBACK and select the node responsible for acting on them. Relay-flow and the task system own parent and mailbox status changes. When NEXT STEP is end, FEEDBACK must be None.`)
 	writeRoutes := func(label string, routes []workflow.Route) {
 		if len(routes) == 0 {
 			return
@@ -533,7 +520,7 @@ Node names identify workflow stages; they are not task-system statuses. STATUS d
 			Agent: n.Agent, NodeDescription: n.Description,
 			NextSteps:     nextStepsText(append(append([]workflow.Route{}, n.OnSuccess...), n.OnFailure...)),
 			SuccessRoutes: successRoutes, FailureRoutes: failureRoutes,
-			Mailbox: ticketKey + ":" + name,
+			Mailbox: ticketKey + ":" + name, Report: workflow.ReportFormat,
 		},
 	}
 }
@@ -567,7 +554,11 @@ func RenderMailboxSpecs(sys task.System, w run.Work, wf *workflow.Workflow) ([]t
 		if err != nil {
 			return nil, fmt.Errorf("render mailbox %q description: %w", specs[i].Node, err)
 		}
-		specs[i].Description = appendText(custom, specs[i].Description)
+		if data.Report != "" && strings.Contains(custom, data.Report) {
+			specs[i].Description = custom
+		} else {
+			specs[i].Description = appendText(custom, specs[i].Description)
+		}
 	}
 	return specs, nil
 }