relay-flow 0.3.9-alpha → 0.3.11-alpha

package/internal/recover/recover.go

@@ -50,6 +50,12 @@ func FromTaskSystem(ctx context.Context, repoReg *repo.Registry, rnr runner.Runn
 			slog.Warn("recover: skip repository with unavailable task system", "repo", rp.Name, "error", rp.TaskSystemError)
 			continue
 		}
+		capabilities, ok := rp.TaskSystem.(task.OwnershipCapabilities)
+		if !ok {
+			slog.Warn("recover: skip repository without ownership capabilities", "repo", rp.Name,
+				"outcome", "ownership-capability-missing")
+			continue
+		}
 		tickets, err := rp.TaskSystem.Poll(ctx)
 		if err != nil {
 			return fmt.Errorf("repo %q poll: %w", rp.Name, err)
@@ -65,9 +71,32 @@ func FromTaskSystem(ctx context.Context, repoReg *repo.Registry, rnr runner.Runn
 				continue
 			}
 			if err != nil {
-				slog.Warn("recover: skip ticket with invalid claim", "ticket", ticket.Key, "error", err)
+				var ownerMismatch *router.ClaimOwnerMismatchError
+				var invalid *router.InvalidClaimError
+				if errors.As(err, &ownerMismatch) {
+					slog.Info("recover route outcome", "repo", rp.Name, "ticket", ticket.Key,
+						"workflow", ownerMismatch.Workflow, "outcome", "claim-owner-mismatch", "error", err)
+				} else if errors.As(err, &invalid) {
+					slog.Warn("recover route outcome", "repo", rp.Name, "ticket", ticket.Key,
+						"workflow", invalid.Workflow, "outcome", "invalid-claim", "error", err)
+				} else {
+					slog.Warn("recover route outcome", "repo", rp.Name, "ticket", ticket.Key,
+						"outcome", "error", "error", err)
+				}
 				continue
 			}
+			// Router ownership uses the poll snapshot. Re-read the current
+			// provider-owned ticket before any recovery mutation so a
+			// poll-to-recovery reassignment cannot close terminals or reset
+			// mailboxes for the wrong owner.
+			if err := capabilities.ValidateOwnership(ctx, ticket.Ref(), wf.Name, wf.TaskConfig); err != nil {
+				if errors.Is(err, task.ErrOwnershipMismatch) {
+					slog.Info("recover route outcome", "repo", rp.Name, "ticket", ticket.Key,
+						"workflow", wf.Name, "outcome", "claim-owner-mismatch", "error", err)
+					continue
+				}
+				return fmt.Errorf("repo %q ticket %s validate ownership: %w", rp.Name, ticket.Key, err)
+			}
 			// Skip canceled parents: the cancellation marker is the
 			// task-system recovery record.
 			runID := identity.NewRunID(rp.Name, wf.Name, ticket.Key)

package/internal/repo/binding_test.go

@@ -1,6 +1,7 @@
 package repo
 
 import (
+	"context"
 	"errors"
 	"strings"
 	"testing"
@@ -15,6 +16,21 @@ type bindingTaskSystem struct {
 	compileErr map[string]error
 }
 
+type ownershipBindingTaskSystem struct{ bindingTaskSystem }
+
+type legacyBindingTaskSystem struct{ task.System }
+
+func (legacyBindingTaskSystem) CompileFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func (s ownershipBindingTaskSystem) CompileOwnershipFilter(values config.RawValues) (func(task.Ticket) bool, error) {
+	owner, _ := values["owner"].(string)
+	return func(ticket task.Ticket) bool {
+		return owner == "" || ticket.Fields["assignee"] == owner
+	}, nil
+}
+
 func (s bindingTaskSystem) CompileFilter(values config.RawValues) (func(task.Ticket) bool, error) {
 	if name, ok := values["name"].(string); ok {
 		if err := s.compileErr[name]; err != nil {
@@ -25,6 +41,53 @@ func (s bindingTaskSystem) CompileFilter(values config.RawValues) (func(task.Tic
 	return func(task.Ticket) bool { return true }, nil
 }
 
+func (s bindingTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func (s bindingTaskSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	return nil
+}
+
+func (s bindingTaskSystem) ClaimIfOwned(ctx context.Context, ticket task.TicketRef, workflow string, _ config.RawValues) error {
+	return s.Claim(ctx, ticket, workflow)
+}
+
+func TestBindWorkflowsRejectsMissingOwnershipCapabilities(t *testing.T) {
+	registered := &Repo{Name: "payments", TaskSystem: legacyBindingTaskSystem{}}
+	registry := NewRegistry()
+	registry.Replace(registered)
+	wf := &workflow.Workflow{Name: "legacyFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy}
+	if err := registry.BindWorkflows([]*workflow.Workflow{wf}); err == nil || !strings.Contains(err.Error(), "ownership capabilities") {
+		t.Fatalf("BindWorkflows error = %v, want missing-capability failure", err)
+	}
+	if bindings := registered.Bindings(); len(bindings) != 0 {
+		t.Fatalf("bindings = %#v, want none after capability rejection", bindings)
+	}
+}
+
+func TestBindWorkflowsPublishesSeparateOwnershipMatcher(t *testing.T) {
+	system := ownershipBindingTaskSystem{bindingTaskSystem: bindingTaskSystem{}}
+	registered := &Repo{Name: "payments", TaskSystem: system}
+	registry := NewRegistry()
+	registry.Replace(registered)
+	wf := &workflow.Workflow{
+		Name: "ownerFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy,
+		TaskConfig: config.RawValues{"owner": "alice"},
+	}
+	if err := registry.BindWorkflows([]*workflow.Workflow{wf}); err != nil {
+		t.Fatal(err)
+	}
+	bindings := registered.Bindings()
+	if len(bindings) != 1 || bindings[0].Ownership == nil {
+		t.Fatalf("bindings = %#v, want a published ownership matcher", bindings)
+	}
+	if !bindings[0].Ownership(task.Ticket{Fields: map[string]any{"assignee": "alice"}}) ||
+		bindings[0].Ownership(task.Ticket{Fields: map[string]any{"assignee": "bob"}}) {
+		t.Fatal("published ownership matcher did not enforce the adapter predicate")
+	}
+}
+
 func TestBindWorkflowsIsolatedPublishesHealthyWorkflows(t *testing.T) {
 	system := bindingTaskSystem{compileErr: map[string]error{"bad": errors.New("invalid filter")}}
 	registered := &Repo{Name: "payments", TaskSystem: system}

package/internal/repo/repo.go

@@ -16,8 +16,11 @@ import (
 // repo. Repo.Workflows is a derived in-memory index rebuilt at startup and
 // after workflow submission/removal; Workflow.Repos is the source of truth.
 type WorkflowBinding struct {
-	Workflow *workflow.Workflow
-	Match    func(task.Ticket) bool
+	Workflow  *workflow.Workflow
+	Match     func(task.Ticket) bool
+	// Ownership is compiled from the adapter-owned durable claim-owner
+	// predicate. It is mandatory for published automatic-routing bindings.
+	Ownership func(task.Ticket) bool
 }
 
 type Info struct {
@@ -124,8 +127,9 @@ func (r *Registry) BindWorkflowsIsolated(workflows []*workflow.Workflow) []Bindi
 
 func (r *Registry) bindWorkflows(workflows []*workflow.Workflow, isolate bool) ([]BindingIssue, error) {
 	type binding struct {
-		wf    *workflow.Workflow
-		match func(task.Ticket) bool
+		wf        *workflow.Workflow
+		match     func(task.Ticket) bool
+		ownership func(task.Ticket) bool
 	}
 	byRepo := map[string][]binding{}
 	issues := []BindingIssue{}
@@ -171,7 +175,44 @@ func (r *Registry) bindWorkflows(workflows []*workflow.Workflow, isolate bool) (
 				failed = true
 				break
 			}
-			byRepo[repoName] = append(byRepo[repoName], binding{wf: wf, match: match})
+			// Ownership is a separate matcher so a claimed ticket can bypass
+			// lifecycle filters while still remaining isolated to the adapter's
+			// effective assignee/owner. All automatic-routing adapters must
+			// expose the complete capability set; there is no unrestricted Claim
+			// fallback for a missing capability.
+			capabilities, ok := rp.TaskSystem.(task.OwnershipCapabilities)
+			if !ok {
+				err = fmt.Errorf("workflow %q repo %q: task system lacks required ownership capabilities", wf.Name, repoName)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
+			}
+			ownership, err := capabilities.CompileOwnershipFilter(wf.TaskConfig)
+			if err != nil {
+				err = fmt.Errorf("workflow %q repo %q: compile ownership filter: %w", wf.Name, repoName, err)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
+			}
+			if ownership == nil {
+				err = fmt.Errorf("workflow %q repo %q: ownership compiler returned a nil matcher", wf.Name, repoName)
+				if !isolate {
+					return nil, err
+				}
+				wf.MarkBlocked(err.Error(), wf.RepairCommand)
+				issues = append(issues, BindingIssue{Workflow: wf, Error: err})
+				failed = true
+				break
+			}
+			byRepo[repoName] = append(byRepo[repoName], binding{wf: wf, match: match, ownership: ownership})
 		}
 		if failed {
 			// A workflow is all-or-nothing across its referenced repositories;
@@ -197,7 +238,7 @@ func (r *Registry) bindWorkflows(workflows []*workflow.Workflow, isolate bool) (
 		binds := byRepo[name]
 		next := make([]WorkflowBinding, 0, len(binds))
 		for _, b := range binds {
-			next = append(next, WorkflowBinding{Workflow: b.wf, Match: b.match})
+			next = append(next, WorkflowBinding{Workflow: b.wf, Match: b.match, Ownership: b.ownership})
 		}
 		sort.Slice(next, func(i, j int) bool { return next[i].Workflow.Name < next[j].Workflow.Name })
 		rp.bindingsMu.Lock()

package/internal/router/router.go

@@ -17,6 +17,11 @@ import (
 // polling handler ignores it.
 var ErrNoMatch = errors.New("ticket matches no workflow")
 
+// ErrClaimOwnerMismatch means a ticket's single workflow claim is valid for
+// this repo but the task adapter's ownership matcher rejects the current
+// owner. It is distinct from invalid claims and no-match routing.
+var ErrClaimOwnerMismatch = errors.New("claimed ticket owner does not match workflow")
+
 // AmbiguousError means an unclaimed ticket matches more than one workflow.
 // No ticket mutation occurs.
 type AmbiguousError struct {
@@ -40,14 +45,32 @@ func (e *InvalidClaimError) Error() string {
 	return fmt.Sprintf("ticket %s has invalid workflow claim %q for repo %s", e.Ticket, e.Workflow, e.Repo)
 }
 
+// ClaimOwnerMismatchError means a single claim names a workflow bound to the
+// repo, but its adapter-owned ownership matcher rejects the current ticket.
+type ClaimOwnerMismatchError struct {
+	Ticket   string
+	Workflow string
+	Repo     string
+}
+
+func (e *ClaimOwnerMismatchError) Error() string {
+	return fmt.Sprintf("ticket %s claim %q has a current owner that does not match repo %s", e.Ticket, e.Workflow, e.Repo)
+}
+
+func (e *ClaimOwnerMismatchError) Unwrap() error { return ErrClaimOwnerMismatch }
+
 const claimPrefix = "wf:"
 
 // ResolveWorkflow routes a ticket to exactly one workflow following the
 // deterministic routing order: multiple claims are invalid; a single claim
-// resolves directly from repo bindings without re-running filters; an
-// unknown or unbound claim is invalid; otherwise precompiled matchers run —
-// zero matches is ErrNoMatch, one match wins, several is ambiguous.
+// resolves directly from repo bindings after the adapter-owned ownership
+// matcher accepts it; an unknown or unbound claim is invalid; otherwise
+// precompiled lifecycle matchers run — zero matches is ErrNoMatch, one match
+// wins, several is ambiguous.
 func ResolveWorkflow(registered *repo.Repo, ticket task.Ticket) (*workflow.Workflow, error) {
+	if registered == nil {
+		return nil, &InvalidClaimError{Ticket: ticket.Key, Workflow: "", Repo: ""}
+	}
 	claims := ticket.WorkflowClaims
 	if len(claims) > 1 {
 		return nil, &InvalidClaimError{Ticket: ticket.Key, Workflow: strings.Join(claims, ","), Repo: registered.Name}
@@ -56,9 +79,20 @@ func ResolveWorkflow(registered *repo.Repo, ticket task.Ticket) (*workflow.Workf
 	if len(claims) == 1 {
 		name := strings.TrimPrefix(claims[0], claimPrefix)
 		for _, b := range bindings {
-			if b.Workflow.Name == name {
-				return b.Workflow, nil
+			if b.Workflow.Name != name {
+				continue
+			}
+			// A claimed ticket intentionally bypasses the complete matcher,
+			// preserving lifecycle routing after status/label changes. The
+			// separate ownership matcher is the only claimed-path gate. A
+			// missing published matcher fails closed rather than transferring a
+			// legacy claim to whichever server sees it first.
+			if b.Ownership == nil || !b.Ownership(ticket) {
+				return nil, &ClaimOwnerMismatchError{
+					Ticket: ticket.Key, Workflow: name, Repo: registered.Name,
+				}
 			}
+			return b.Workflow, nil
 		}
 		return nil, &InvalidClaimError{Ticket: ticket.Key, Workflow: name, Repo: registered.Name}
 	}

package/internal/router/router_test.go

@@ -36,7 +36,14 @@ func wf(name string) *workflow.Workflow {
 }
 
 func binding(w *workflow.Workflow, match func(task.Ticket) bool) repo.WorkflowBinding {
-	return repo.WorkflowBinding{Workflow: w, Match: match}
+	return repo.WorkflowBinding{
+		Workflow: w, Match: match,
+		Ownership: func(task.Ticket) bool { return true },
+	}
+}
+
+func ownedBinding(w *workflow.Workflow, match, ownership func(task.Ticket) bool) repo.WorkflowBinding {
+	return repo.WorkflowBinding{Workflow: w, Match: match, Ownership: ownership}
 }
 
 func repoWith(bindings ...repo.WorkflowBinding) *repo.Repo {
@@ -87,6 +94,53 @@ func TestUnknownClaimInvalid(t *testing.T) {
 	}
 }
 
+func TestClaimOwnerMismatchSkipsLifecycleMatcher(t *testing.T) {
+	lifecycleCalled := false
+	r := repoWith(ownedBinding(wf("basicFlow"), func(task.Ticket) bool {
+		lifecycleCalled = true
+		return false
+	}, func(task.Ticket) bool {
+		return false
+	}))
+	ticket := task.Ticket{
+		Key:            "PAY-101",
+		WorkflowClaims: []string{"wf:basicFlow"},
+		Fields:         map[string]any{"assignee": "bob@example.com", "status": "In Progress"},
+	}
+
+	_, err := router.ResolveWorkflow(r, ticket)
+	var mismatch *router.ClaimOwnerMismatchError
+	if !errors.As(err, &mismatch) || !errors.Is(err, router.ErrClaimOwnerMismatch) {
+		t.Fatalf("err = %v, want ClaimOwnerMismatchError", err)
+	}
+	if lifecycleCalled {
+		t.Fatal("claimed route evaluated the complete lifecycle matcher")
+	}
+}
+
+func TestClaimOwnerMatchBypassesChangedLifecycleFields(t *testing.T) {
+	lifecycleCalled := false
+	r := repoWith(ownedBinding(wf("basicFlow"), func(task.Ticket) bool {
+		lifecycleCalled = true
+		return false
+	}, func(ticket task.Ticket) bool {
+		return ticket.Fields["assignee"] == "alice@example.com"
+	}))
+	ticket := task.Ticket{
+		Key:            "PAY-101",
+		WorkflowClaims: []string{"wf:basicFlow"},
+		Fields:         map[string]any{"assignee": "alice@example.com", "status": "In Progress"},
+	}
+
+	got, err := router.ResolveWorkflow(r, ticket)
+	if err != nil || got.Name != "basicFlow" {
+		t.Fatalf("ResolveWorkflow = %v, %v; want basicFlow", got, err)
+	}
+	if lifecycleCalled {
+		t.Fatal("claimed route evaluated the complete lifecycle matcher")
+	}
+}
+
 func TestClaimForWorkflowNotBoundToRepo(t *testing.T) {
 	// otherFlow exists but targets another repo, so it is not in this
 	// repo's bindings.
@@ -158,6 +212,18 @@ func (routingTaskSystem) CompileFilter(config.RawValues) (func(task.Ticket) bool
 	return func(task.Ticket) bool { return true }, nil
 }
 
+func (routingTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func (routingTaskSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	return nil
+}
+
+func (routingTaskSystem) ClaimIfOwned(context.Context, task.TicketRef, string, config.RawValues) error {
+	return nil
+}
+
 func TestPollerRoutesWhileBindingsAreReplaced(t *testing.T) {
 	registry := repo.NewRegistry()
 	registered := &repo.Repo{Name: "payments", TaskSystem: routingTaskSystem{}}

package/internal/run/manager.go

@@ -2,6 +2,7 @@ package run
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 	"sync"
@@ -62,7 +63,10 @@ func newerRun(candidate, current Run) bool {
 // is already assigned to this workflow, reuses the newest active execution
 // attempt, checks the stable logical cancellation marker before recreating a
 // missing claimed run, then ensures the durable run with a value snapshot of
-// the workflow.
+// the workflow. If an already-running ticket is later reassigned, automatic
+// polling keeps the original claim/run with its original owner and refuses
+// to reconcile it; ownership transfer is an explicit operator action, never
+// an automatic duplicate run or cross-database handoff.
 func (m *RunManager) EnsureRun(ctx context.Context, rp *repo.Repo, wf *workflow.Workflow, ticket task.Ticket) error {
 	if rp == nil {
 		return fmt.Errorf("ensure run: repository is unavailable")
@@ -76,6 +80,10 @@ func (m *RunManager) EnsureRun(ctx context.Context, rp *repo.Repo, wf *workflow.
 	if wf == nil {
 		return fmt.Errorf("ensure run repo %q: workflow is unavailable", rp.Name)
 	}
+	capabilities, ok := rp.TaskSystem.(task.OwnershipCapabilities)
+	if !ok {
+		return fmt.Errorf("ensure run repo %q: task system lacks required ownership capabilities", rp.Name)
+	}
 	if m.Gate != nil {
 		m.Gate.Lock()
 		defer m.Gate.Unlock()
@@ -115,6 +123,40 @@ func (m *RunManager) EnsureRun(ctx context.Context, rp *repo.Repo, wf *workflow.
 		}
 	}
 
+	// Router ownership is evaluated from the poll snapshot. Revalidate a
+	// claimed ticket through the adapter before any run lookup, cancellation
+	// marker check, or durable execution creation so a reassignment cannot
+	// reach the claim-before-run recovery path. Explicit run restart is a
+	// separate operator-authorized path and does not use this automatic gate.
+	if claimed {
+		// Re-apply the published poll-snapshot matcher as a guard for direct
+		// callers that bypass the router. The adapter re-read below remains the
+		// race-closing check for provider state that changed after Poll.
+		for _, binding := range rp.Bindings() {
+			if binding.Workflow == nil || binding.Workflow.Name != wf.Name || binding.Ownership == nil {
+				continue
+			}
+			if !binding.Ownership(ticket) {
+				err := &task.OwnershipMismatchError{Ticket: ticket.Key, Workflow: wf.Name}
+				slog.Info("ensure-run outcome",
+					"ticket", ticket.Key, "repo", rp.Name, "workflow", wf.Name,
+					"runID", string(id), "outcome", "claim-owner-mismatch", "stage", "ownership", "error", err)
+				return fmt.Errorf("validate ownership for claimed ticket %s: %w", ticket.Key, err)
+			}
+			break
+		}
+		if err := capabilities.ValidateOwnership(ctx, ticket.Ref(), wf.Name, wf.TaskConfig); err != nil {
+			outcome := "ownership-error"
+			if errors.Is(err, task.ErrOwnershipMismatch) {
+				outcome = "claim-owner-mismatch"
+			}
+			slog.Info("ensure-run outcome",
+				"ticket", ticket.Key, "repo", rp.Name, "workflow", wf.Name,
+				"runID", string(id), "outcome", outcome, "stage", "ownership", "error", err)
+			return fmt.Errorf("validate ownership for claimed ticket %s: %w", ticket.Key, err)
+		}
+	}
+
 	var candidates []Run
 	if m.Runs != nil {
 		var err error
@@ -160,10 +202,15 @@ func (m *RunManager) EnsureRun(ctx context.Context, rp *repo.Repo, wf *workflow.
 	}
 
 	if !claimed {
-		if err := rp.TaskSystem.Claim(ctx, ticket.Ref(), wf.Name); err != nil {
+		err := capabilities.ClaimIfOwned(ctx, ticket.Ref(), wf.Name, wf.TaskConfig)
+		if err != nil {
+			outcome := "error"
+			if errors.Is(err, task.ErrOwnershipMismatch) {
+				outcome = "claim-owner-mismatch"
+			}
 			slog.Info("ensure-run outcome",
 				"ticket", ticket.Key, "repo", rp.Name, "workflow", wf.Name, "runID", string(id),
-				"outcome", "error", "stage", "claim", "error", err)
+				"outcome", outcome, "stage", "claim", "error", err)
 			return fmt.Errorf("claim %s for workflow %s: %w", ticket.Key, wf.Name, err)
 		}
 	} else {
@@ -210,6 +257,46 @@ func (m *RunManager) ensure(ctx context.Context, start Start) error {
 	return nil
 }
 
+// BackfillClaimOwner performs an explicit provider-side repair for a legacy
+// workflow claim. It only adds adapter-owned provenance; it never routes,
+// starts, cancels, or recreates a run and never removes the wf: claim.
+func (m *RunManager) BackfillClaimOwner(ctx context.Context, repoName, ticket, workflowName string) error {
+	if m.Gate != nil {
+		m.Gate.Lock()
+		defer m.Gate.Unlock()
+	}
+	if m.Repos == nil || m.Workflows == nil {
+		return fmt.Errorf("backfill claim owner: repository/workflow registries are not configured")
+	}
+	rp, ok := m.Repos.Get(repoName)
+	if !ok {
+		return fmt.Errorf("backfill claim owner: repo %q is not registered", repoName)
+	}
+	wf, ok := m.Workflows.Get(workflowName)
+	if !ok {
+		return fmt.Errorf("backfill claim owner: workflow %q is not stored", workflowName)
+	}
+	bound := false
+	for _, name := range wf.Repos {
+		if name == repoName {
+			bound = true
+			break
+		}
+	}
+	if !bound {
+		return fmt.Errorf("backfill claim owner: workflow %q does not target repo %q", workflowName, repoName)
+	}
+	backfiller, ok := rp.TaskSystem.(task.ClaimOwnerBackfiller)
+	if !ok {
+		return fmt.Errorf("backfill claim owner: task system for repo %q does not support explicit ownership backfill", repoName)
+	}
+	if err := backfiller.BackfillClaimOwner(ctx, task.TicketRef{Key: ticket}, workflowName, wf.TaskConfig); err != nil {
+		return fmt.Errorf("backfill claim owner for %s: %w", ticket, err)
+	}
+	slog.Info("claim-owner backfill", "repo", repoName, "ticket", ticket, "workflow", workflowName, "outcome", "provenance-added")
+	return nil
+}
+
 // RestartByTicket creates or returns the one active fresh attempt for a
 // canceled ticket. It resolves the repo and latest workflow from the current
 // registries, so the new durable snapshot is never copied from the canceled

package/internal/run/run_manager_test.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/rajpopat27/relay-flow/internal/config"
 	"github.com/rajpopat27/relay-flow/internal/identity"
 	"github.com/rajpopat27/relay-flow/internal/repo"
 	"github.com/rajpopat27/relay-flow/internal/run"
@@ -52,12 +53,33 @@ func (s *recordingSystem) Claim(_ context.Context, ref task.TicketRef, wf string
 	return s.claimErr
 }
 
+func (s *recordingSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func (s *recordingSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	return nil
+}
+
+func (s *recordingSystem) ClaimIfOwned(ctx context.Context, ref task.TicketRef, wf string, _ config.RawValues) error {
+	return s.Claim(ctx, ref, wf)
+}
+
 func (s *recordingSystem) HasComment(_ context.Context, _ task.Target, marker string) (bool, error) {
 	s.hasCommentN++
 	s.markers = append(s.markers, marker)
 	return s.hasCancel, nil
 }
 
+type ownershipRecordingSystem struct {
+	*recordingSystem
+	ownershipErr error
+}
+
+func (s *ownershipRecordingSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	return s.ownershipErr
+}
+
 // fakeExecutor records EnsureRun calls into the shared log.
 type fakeExecutor struct {
 	log     *eventLog
@@ -243,6 +265,26 @@ func TestCancellationMarkerSkipsRunCreation(t *testing.T) {
 	}
 }
 
+func TestMismatchedClaimStopsBeforeCancellationOrRunCreation(t *testing.T) {
+	log := newEventLog()
+	base := &recordingSystem{log: log, hasCancel: true}
+	sys := &ownershipRecordingSystem{
+		recordingSystem: base,
+		ownershipErr:    &task.OwnershipMismatchError{Ticket: "PAY-101", Workflow: "basicFlow"},
+	}
+	exec := &fakeExecutor{log: log}
+	m := &run.RunManager{Executor: exec, Runs: &fakeQueries{byTicket: map[string]run.Run{}}}
+	ticket := task.Ticket{ID: "1", Key: "PAY-101", WorkflowClaims: []string{"wf:basicFlow"}}
+
+	err := m.EnsureRun(context.Background(), testRepo(sys), testWorkflow("basicFlow"), ticket)
+	if !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("EnsureRun error = %v, want ownership mismatch", err)
+	}
+	if base.hasCommentN != 0 || len(exec.ensures) != 0 {
+		t.Fatalf("mismatched owner reached recovery/run creation: comments=%d ensures=%d", base.hasCommentN, len(exec.ensures))
+	}
+}
+
 func TestDeterministicRunID(t *testing.T) {
 	log := newEventLog()
 	sys := &recordingSystem{log: log}
@@ -360,6 +402,38 @@ func TestRestartByTicketCreatesNumericFreshAttempt(t *testing.T) {
 	}
 }
 
+func TestRestartByTicketRemainsExplicitOperatorOwnerBypass(t *testing.T) {
+	log := newEventLog()
+	base := &recordingSystem{log: log}
+	sys := &ownershipRecordingSystem{
+		recordingSystem: base,
+		ownershipErr:    &task.OwnershipMismatchError{Ticket: "PAY-101", Workflow: "basicFlow"},
+	}
+	wf := testWorkflow("basicFlow")
+	previous := run.Run{
+		ID:   identity.NewRunID("payments", wf.Name, "PAY-101"),
+		Repo: "payments", Workflow: wf.Name,
+		Ticket: task.TicketRef{ID: "1", Key: "PAY-101"}, State: run.StateCanceled,
+	}
+	queries := &fakeQueries{
+		byTicket: map[string]run.Run{"PAY-101": previous},
+		list:     []run.Run{previous},
+	}
+	exec := &fakeExecutor{log: log, created: true}
+	repos := repo.NewRegistry()
+	repos.Replace(testRepo(sys))
+	workflows := &workflow.Registry{}
+	workflows.Replace(wf)
+	m := &run.RunManager{Executor: exec, Runs: queries, Repos: repos, Workflows: workflows}
+
+	if _, err := m.RestartByTicket(context.Background(), "PAY-101"); err != nil {
+		t.Fatalf("explicit restart was blocked by automatic ownership gate: %v", err)
+	}
+	if len(exec.ensures) != 1 {
+		t.Fatalf("explicit restart ensured %d runs, want 1", len(exec.ensures))
+	}
+}
+
 func TestRestartByTicketIsIdempotentForActiveFreshAttempt(t *testing.T) {
 	attempt := run.Run{
 		ID: "payments/basicFlow/PAY-101~attempt~2", LogicalID: "payments/basicFlow/PAY-101", AttemptID: 2,

package/internal/server/api_test.go

@@ -95,6 +95,19 @@ func TestErrorEnvelopeAndStatusMapping(t *testing.T) {
 	}
 }
 
+func TestLegacyClaimBackfillEndpointIsExplicit(t *testing.T) {
+	fake := &fakeServices{}
+	c, cleanup := startHandler(t, fake)
+	defer cleanup()
+	code, env := do(t, c, http.MethodPost, "http://relay/runs/by-ticket/PAY-101/backfill-owner", []byte(`{"repo":"payments","workflow":"basicFlow"}`))
+	if code != http.StatusOK || !env.OK {
+		t.Fatalf("backfill endpoint: code=%d env=%+v, want 200 ok", code, env)
+	}
+	if len(fake.backfills) != 1 || fake.backfills[0] != "payments:PAY-101:basicFlow" {
+		t.Fatalf("backfill calls = %v, want one explicit provider repair", fake.backfills)
+	}
+}
+
 func TestWorkflowConflictMapsTo409(t *testing.T) {
 	// basicFlow is seeded with an active run, so replacement conflicts -> 409.
 	c, cleanup := startHandler(t, &fakeServices{activeWorkflows: map[string]bool{"basicFlow": true}})

package/internal/server/client.go

@@ -281,6 +281,13 @@ func (c *Client) CancelRun(ctx context.Context, ticket, reason string) error {
 	return c.call(ctx, http.MethodPost, "/runs/by-ticket/"+url.PathEscape(ticket)+"/cancel", payload, nil)
 }
 
+// BackfillClaimOwner explicitly repairs a legacy workflow claim by asking the
+// selected repo adapter to add provenance without changing the claim.
+func (c *Client) BackfillClaimOwner(ctx context.Context, repoName, ticket, workflow string) error {
+	payload, _ := json.Marshal(map[string]string{"repo": repoName, "workflow": workflow})
+	return c.call(ctx, http.MethodPost, "/runs/by-ticket/"+url.PathEscape(ticket)+"/backfill-owner", payload, nil)
+}
+
 // ListRuns returns runs matching the filter.
 func (c *Client) ListRuns(ctx context.Context, filter run.Filter) ([]run.Run, error) {
 	q := url.Values{}

package/internal/server/fixture_test.go

@@ -39,6 +39,7 @@ type fakeServices struct {
 	restartRun         run.Run
 	restartErr         error
 	restarts           []string
+	backfills          []string
 	registrationValues []config.RawValues
 	ensureRepoCalls    []runner.RepoCandidate
 	ensureRepoErr      error
@@ -111,6 +112,10 @@ func (f *fakeServices) CancelRun(_ context.Context, ticket, _ string) error {
 	}
 	return errNotFound{ticket}
 }
+func (f *fakeServices) BackfillClaimOwner(_ context.Context, repoName, ticket, workflow string) error {
+	f.backfills = append(f.backfills, repoName+":"+ticket+":"+workflow)
+	return nil
+}
 
 func (f *fakeServices) SubmitReport(ctx context.Context, _ run.ReportRequest) (run.ReportAck, error) {
 	f.submittedReports++