relay-flow 0.3.9-alpha → 0.3.11-alpha

package/internal/server/server.go

@@ -35,6 +35,7 @@ type Deps interface {
 	GetRunByTicket(ctx context.Context, ticket string) (run.Run, error)
 	RestartRun(ctx context.Context, ticket string) (run.Run, error)
 	CancelRun(ctx context.Context, ticket, reason string) error
+	BackfillClaimOwner(ctx context.Context, repo, ticket, workflow string) error
 
 	// Reports
 	HasProcessedReport(ctx context.Context, id run.ID, reportID string) (bool, error)
@@ -580,9 +581,10 @@ func (s *server) handleRuns(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *server) handleRunByTicket(w http.ResponseWriter, r *http.Request) {
-	// /runs/by-ticket/{key}           GET
-	// /runs/by-ticket/{key}/restart   POST
-	// /runs/by-ticket/{key}/cancel    POST
+	// /runs/by-ticket/{key}                  GET
+	// /runs/by-ticket/{key}/restart          POST
+	// /runs/by-ticket/{key}/cancel           POST
+	// /runs/by-ticket/{key}/backfill-owner   POST
 	rest := strings.TrimPrefix(r.URL.Path, "/runs/by-ticket/")
 	parts := strings.Split(rest, "/")
 	if len(parts) == 1 && parts[0] != "" {
@@ -643,5 +645,32 @@ func (s *server) handleRunByTicket(w http.ResponseWriter, r *http.Request) {
 		writeOK(w, http.StatusOK, map[string]string{"canceled": parts[0]})
 		return
 	}
+	if len(parts) == 2 && parts[0] != "" && parts[1] == "backfill-owner" {
+		if !methodOnly(w, r, http.MethodPost) {
+			return
+		}
+		var payload struct {
+			Repo     string `json:"repo"`
+			Workflow string `json:"workflow"`
+		}
+		body, err := readBody(r)
+		if err != nil {
+			writeErr(w, http.StatusBadRequest, "invalid", err.Error())
+			return
+		}
+		if err := decodeStrict(body, &payload); err != nil || strings.TrimSpace(payload.Repo) == "" || strings.TrimSpace(payload.Workflow) == "" {
+			if err == nil {
+				err = errors.New("repo and workflow are required")
+			}
+			writeErr(w, http.StatusBadRequest, "invalid", err.Error())
+			return
+		}
+		if err := s.deps.BackfillClaimOwner(r.Context(), payload.Repo, parts[0], payload.Workflow); err != nil {
+			mapErr(w, err)
+			return
+		}
+		writeOK(w, http.StatusOK, map[string]string{"backfilled": parts[0], "repo": payload.Repo, "workflow": payload.Workflow})
+		return
+	}
 	writeErr(w, http.StatusNotFound, "notFound", "run not found")
 }

package/internal/task/beads/beads.go

@@ -5,6 +5,8 @@ package beads
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -442,6 +444,71 @@ func claimLabel(workflow string) string {
 	return "wf:" + workflow
 }
 
+// claimOwnerLabel is a durable provider-owned provenance label. Beads stores
+// the normalized owner value in the adapter's filter space, while the label
+// carries only a hash so the marker is stable without exposing that value.
+// Reassignment never replaces the marker; an explicit provider-side handoff
+// is required to transfer ownership.
+const claimOwnerLabelPrefix = "wf-owner:"
+
+func claimOwnerToken(owner string) string {
+	owner = strings.ToLower(strings.TrimSpace(owner))
+	if owner == "" {
+		return ""
+	}
+	sum := sha256.Sum256([]byte(owner))
+	return hex.EncodeToString(sum[:])
+}
+
+func claimOwnerLabel(workflow, owner string) string {
+	token := claimOwnerToken(owner)
+	if token == "" {
+		return ""
+	}
+	return claimOwnerLabelPrefix + workflow + ":" + token
+}
+
+func claimOwnerMarkers(labels []string, workflow string) []string {
+	prefix := claimOwnerLabelPrefix + workflow + ":"
+	markers := make([]string, 0, 1)
+	for _, label := range labels {
+		if strings.HasPrefix(label, prefix) {
+			markers = append(markers, label)
+		}
+	}
+	return markers
+}
+
+func hasForeignClaimOwnerMarker(labels []string, workflow string) bool {
+	currentPrefix := claimOwnerLabelPrefix + workflow + ":"
+	for _, label := range labels {
+		if strings.HasPrefix(label, claimOwnerLabelPrefix) && !strings.HasPrefix(label, currentPrefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func claimOwnerMatches(labels []string, workflow string, assignees []string) bool {
+	markers := claimOwnerMarkers(labels, workflow)
+	if len(markers) != 1 {
+		return false
+	}
+	for _, assignee := range assignees {
+		if markers[0] == claimOwnerLabel(workflow, assignee) {
+			return true
+		}
+	}
+	return false
+}
+
+func claimedWorkflow(ticket task.Ticket) string {
+	if len(ticket.WorkflowClaims) != 1 || !strings.HasPrefix(ticket.WorkflowClaims[0], "wf:") {
+		return ""
+	}
+	return strings.TrimPrefix(ticket.WorkflowClaims[0], "wf:")
+}
+
 // CompileFilter compiles Beads-owned structured filters into a local matcher.
 // No Beads query language is accepted or sent to the CLI.
 func (s *system) CompileFilter(workflowTaskConfig config.RawValues) (func(task.Ticket) bool, error) {
@@ -473,6 +540,132 @@ func (s *system) CompileFilter(workflowTaskConfig config.RawValues) (func(task.T
 	}, nil
 }
 
+// CompileOwnershipFilter compiles only the effective Beads owner/assignee
+// predicate. Claimed routing must not re-run lifecycle filters.
+func (s *system) CompileOwnershipFilter(workflowTaskConfig config.RawValues) (func(task.Ticket) bool, error) {
+	assignees, err := s.ownershipAssignees(workflowTaskConfig)
+	if err != nil {
+		return nil, err
+	}
+	return func(ticket task.Ticket) bool {
+		if len(assignees) == 0 {
+			return true
+		}
+		workflow := claimedWorkflow(ticket)
+		owner := stringField(ticket.Fields, "assignee")
+		return workflow != "" && containsFold(assignees, owner) &&
+			claimOwnerMatches(stringSliceField(ticket.Fields, "labels"), workflow, []string{owner})
+	}, nil
+}
+
+func (s *system) ownershipAssignees(workflowTaskConfig config.RawValues) ([]string, error) {
+	merged := config.Merge(s.base, workflowTaskConfig)
+	cfg, err := decodeConfig(merged)
+	if err != nil {
+		return nil, err
+	}
+	return append([]string(nil), cfg.Filters.Assignees...), nil
+}
+
+func (s *system) ValidateOwnership(ctx context.Context, ticket task.TicketRef, workflow string, workflowTaskConfig config.RawValues) error {
+	assignees, err := s.ownershipAssignees(workflowTaskConfig)
+	if err != nil {
+		return err
+	}
+	if len(assignees) == 0 {
+		return nil
+	}
+	key := ticket.Key
+	if strings.TrimSpace(key) == "" {
+		key = ticket.ID
+	}
+	issue, err := s.cli.Show(ctx, key)
+	if err != nil {
+		return fmt.Errorf("beads: read ticket %s ownership: %w", key, err)
+	}
+	if !containsFold(assignees, issue.Assignee) || !claimOwnerMatches(issue.Labels, workflow, []string{issue.Assignee}) {
+		return &task.OwnershipMismatchError{Ticket: key, Workflow: workflow}
+	}
+	return nil
+}
+
+// ClaimIfOwned performs the final adapter-owned owner read before adding the
+// idempotent workflow label. The owner marker is added in the same bd update
+// as wf:, so retries can finish an interrupted claim without transferring it.
+func (s *system) ClaimIfOwned(ctx context.Context, ticket task.TicketRef, workflow string, workflowTaskConfig config.RawValues) error {
+	assignees, err := s.ownershipAssignees(workflowTaskConfig)
+	if err != nil {
+		return err
+	}
+	if len(assignees) == 0 {
+		return s.Claim(ctx, ticket, workflow)
+	}
+	key := ticket.Key
+	if strings.TrimSpace(key) == "" {
+		key = ticket.ID
+	}
+	issue, err := s.cli.Show(ctx, key)
+	if err != nil {
+		return fmt.Errorf("beads: read ticket %s before claim: %w", key, err)
+	}
+	markers := claimOwnerMarkers(issue.Labels, workflow)
+	if !containsFold(assignees, issue.Assignee) {
+		return &task.OwnershipMismatchError{Ticket: key, Workflow: workflow}
+	}
+	if hasForeignClaimOwnerMarker(issue.Labels, workflow) || len(markers) > 1 || (len(markers) == 1 && !claimOwnerMatches(issue.Labels, workflow, []string{issue.Assignee})) {
+		return &task.OwnershipMismatchError{Ticket: key, Workflow: workflow}
+	}
+	claims := extractWorkflowClaims(issue.Labels)
+	if len(claims) > 0 {
+		if len(claims) != 1 || claims[0] != claimLabel(workflow) || len(markers) != 1 {
+			return &task.OwnershipMismatchError{Ticket: key, Workflow: workflow}
+		}
+		return s.cli.Update(ctx, key, bdcli.UpdateInput{AddLabels: []string{markers[0], claimLabel(workflow)}})
+	}
+	if strings.TrimSpace(issue.Assignee) == "" {
+		return &task.OwnershipMismatchError{Ticket: key, Workflow: workflow}
+	}
+	ownerLabel := claimOwnerLabel(workflow, issue.Assignee)
+	if ownerLabel == "" {
+		return &task.OwnershipMismatchError{Ticket: key, Workflow: workflow}
+	}
+	return s.cli.Update(ctx, key, bdcli.UpdateInput{AddLabels: []string{ownerLabel, claimLabel(workflow)}})
+}
+
+// BackfillClaimOwner is an explicit repair operation for a legacy claim that
+// has no provenance marker. It only adds the durable marker after checking the
+// live owner; automatic routing never invokes it and never removes labels.
+func (s *system) BackfillClaimOwner(ctx context.Context, ticket task.TicketRef, workflow string, workflowTaskConfig config.RawValues) error {
+	assignees, err := s.ownershipAssignees(workflowTaskConfig)
+	if err != nil {
+		return err
+	}
+	if len(assignees) == 0 {
+		return nil
+	}
+	key := ticket.Key
+	if strings.TrimSpace(key) == "" {
+		key = ticket.ID
+	}
+	issue, err := s.cli.Show(ctx, key)
+	if err != nil {
+		return fmt.Errorf("beads: read ticket %s for ownership backfill: %w", key, err)
+	}
+	if !containsFold(assignees, issue.Assignee) ||
+		len(extractWorkflowClaims(issue.Labels)) != 1 ||
+		extractWorkflowClaims(issue.Labels)[0] != claimLabel(workflow) {
+		return &task.OwnershipMismatchError{Ticket: key, Workflow: workflow}
+	}
+	markers := claimOwnerMarkers(issue.Labels, workflow)
+	if len(markers) > 1 || (len(markers) == 1 && !claimOwnerMatches(issue.Labels, workflow, []string{issue.Assignee})) {
+		return &task.OwnershipMismatchError{Ticket: key, Workflow: workflow}
+	}
+	if len(markers) == 1 {
+		return nil
+	}
+	return s.cli.Update(ctx, key, bdcli.UpdateInput{AddLabels: []string{claimOwnerLabel(workflow, issue.Assignee)}})
+}
+
 func containsExact(values []string, want string) bool {
 	for _, value := range values {
 		if value == want {
@@ -960,7 +1153,12 @@ func (s *system) ResetForRecovery(ctx context.Context, parent task.TicketRef, ma
 }
 
 var (
-	_ task.System            = (*system)(nil)
-	_ task.LifecycleDefaults = (*system)(nil)
-	_ task.RestartPreparer   = (*system)(nil)
+	_ task.System                  = (*system)(nil)
+	_ task.OwnershipCapabilities   = (*system)(nil)
+	_ task.OwnershipFilterCompiler = (*system)(nil)
+	_ task.OwnershipValidator      = (*system)(nil)
+	_ task.ConditionalClaimer      = (*system)(nil)
+	_ task.ClaimOwnerBackfiller    = (*system)(nil)
+	_ task.LifecycleDefaults       = (*system)(nil)
+	_ task.RestartPreparer         = (*system)(nil)
 )

package/internal/task/beads/beads_test.go

@@ -222,6 +222,178 @@ func TestExtractWorkflowClaimsKeepsOnlyWorkflowLabels(t *testing.T) {
 	}
 }
 
+func TestBeadsClaimIfOwnedRejectsReassignmentBeforeLabelWrite(t *testing.T) {
+	client := &ownershipClient{issue: bdcli.Issue{ID: "demo-1", Assignee: "bob"}}
+	sys := &system{cli: client}
+	err := sys.ClaimIfOwned(context.Background(), task.TicketRef{Key: "demo-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice"}},
+	})
+	if !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("ClaimIfOwned error = %v, want ownership mismatch", err)
+	}
+	if len(client.updates) != 0 {
+		t.Fatalf("updates = %+v, want none after reassignment", client.updates)
+	}
+}
+
+func TestBeadsClaimIfOwnedUpdatesForCurrentOwner(t *testing.T) {
+	client := &ownershipClient{issue: bdcli.Issue{ID: "demo-1", Assignee: "Alice"}}
+	sys := &system{cli: client}
+	if err := sys.ClaimIfOwned(context.Background(), task.TicketRef{Key: "demo-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice"}},
+	}); err != nil {
+		t.Fatalf("ClaimIfOwned failed for current owner: %v", err)
+	}
+	wantLabels := []string{claimOwnerLabel("flow", "Alice"), "wf:flow"}
+	if len(client.updates) != 1 || !reflect.DeepEqual(client.updates[0].AddLabels, wantLabels) {
+		t.Fatalf("updates = %+v, want one owner+workflow label update %v", client.updates, wantLabels)
+	}
+}
+
+func TestBeadsCompileOwnershipFilterWithoutAssigneeDoesNotGateClaim(t *testing.T) {
+	sys := &system{}
+	matcher, err := sys.CompileOwnershipFilter(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !matcher(task.Ticket{WorkflowClaims: []string{"wf:flow"}, Fields: map[string]any{"assignee": "anyone"}}) {
+		t.Fatal("ownership matcher imposed an assignee gate without filters.assignees")
+	}
+}
+
+func TestBeadsCompileOwnershipFilterUsesEffectiveRootRepoWorkflowConfig(t *testing.T) {
+	sys := &system{base: config.RawValues{"filters": map[string]any{
+		"assignees": []any{"repo"},
+	}}}
+	matcher, err := sys.CompileOwnershipFilter(config.RawValues{"filters": map[string]any{
+		"assignees": []any{"workflow"},
+	}})
+	if err != nil {
+		t.Fatalf("CompileOwnershipFilter failed: %v", err)
+	}
+	if !matcher(task.Ticket{
+		WorkflowClaims: []string{"wf:flow"},
+		Fields: map[string]any{
+			"assignee": "workflow",
+			"labels":   []string{claimOwnerLabel("flow", "workflow")},
+		},
+	}) {
+		t.Fatal("workflow owner marker was rejected")
+	}
+	if matcher(task.Ticket{
+		WorkflowClaims: []string{"wf:flow"},
+		Fields: map[string]any{
+			"assignee": "reassigned",
+			"labels":   []string{claimOwnerLabel("flow", "workflow")},
+		},
+	}) {
+		t.Fatal("claimed route accepted a current-assignee mismatch")
+	}
+	if matcher(task.Ticket{
+		WorkflowClaims: []string{"wf:flow"},
+		Fields: map[string]any{
+			"assignee": "reassigned",
+			"labels":   []string{claimOwnerLabel("flow", "repo")},
+		},
+	}) {
+		t.Fatal("inherited repo owner marker bypassed workflow override")
+	}
+}
+
+func TestBeadsValidateOwnershipRejectsLegacyClaimWithoutProvenance(t *testing.T) {
+	client := &ownershipClient{issue: bdcli.Issue{ID: "demo-1", Assignee: "alice", Labels: []string{"wf:flow"}}}
+	sys := &system{cli: client}
+	err := sys.ValidateOwnership(context.Background(), task.TicketRef{Key: "demo-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice"}},
+	})
+	if !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("ValidateOwnership error = %v, want legacy-claim ownership mismatch", err)
+	}
+}
+
+func TestBeadsCompileOwnershipFilterRejectsProvenanceForAnotherAllowedOwner(t *testing.T) {
+	sys := &system{}
+	matcher, err := sys.CompileOwnershipFilter(config.RawValues{"filters": map[string]any{
+		"assignees": []any{"alice", "bob"},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if matcher(task.Ticket{
+		WorkflowClaims: []string{"wf:flow"},
+		Fields: map[string]any{
+			"assignee": "bob",
+			"labels":   []string{claimOwnerLabel("flow", "alice")},
+		},
+	}) {
+		t.Fatal("provenance for Alice was accepted for live owner Bob")
+	}
+}
+
+func TestBeadsClaimIfOwnedAcceptsClaimAppearingAfterPollForSameOwner(t *testing.T) {
+	client := &ownershipClient{issue: bdcli.Issue{ID: "demo-1", Assignee: "alice", Labels: []string{claimOwnerLabel("flow", "alice"), "wf:flow"}}}
+	sys := &system{cli: client}
+	if err := sys.ClaimIfOwned(context.Background(), task.TicketRef{Key: "demo-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice", "bob"}},
+	}); err != nil {
+		t.Fatalf("ClaimIfOwned rejected existing same-owner claim: %v", err)
+	}
+	if len(client.updates) != 1 {
+		t.Fatalf("idempotent claim updates = %+v, want one label update", client.updates)
+	}
+}
+
+func TestBeadsClaimIfOwnedRejectsAppearingClaimAfterReassignment(t *testing.T) {
+	client := &ownershipClient{issue: bdcli.Issue{ID: "demo-1", Assignee: "bob", Labels: []string{claimOwnerLabel("flow", "alice"), "wf:flow"}}}
+	sys := &system{cli: client}
+	err := sys.ClaimIfOwned(context.Background(), task.TicketRef{Key: "demo-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice", "bob"}},
+	})
+	if !errors.Is(err, task.ErrOwnershipMismatch) || len(client.updates) != 0 {
+		t.Fatalf("ClaimIfOwned error=%v updates=%+v, want mismatch with no writes", err, client.updates)
+	}
+}
+
+func TestBeadsValidateOwnershipRejectsCurrentAssigneeMismatch(t *testing.T) {
+	client := &ownershipClient{issue: bdcli.Issue{ID: "demo-1", Assignee: "bob", Labels: []string{claimOwnerLabel("flow", "alice"), "wf:flow"}}}
+	sys := &system{cli: client}
+	err := sys.ValidateOwnership(context.Background(), task.TicketRef{Key: "demo-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice"}},
+	})
+	if !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("ValidateOwnership error = %v, want current-assignee mismatch", err)
+	}
+}
+
+func TestBeadsBackfillLegacyClaimAddsOnlyProvenance(t *testing.T) {
+	client := &ownershipClient{issue: bdcli.Issue{ID: "demo-1", Assignee: "alice", Labels: []string{"wf:flow"}}}
+	sys := &system{cli: client}
+	if err := sys.BackfillClaimOwner(context.Background(), task.TicketRef{Key: "demo-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice"}},
+	}); err != nil {
+		t.Fatalf("BackfillClaimOwner failed: %v", err)
+	}
+	want := []string{claimOwnerLabel("flow", "alice")}
+	if len(client.updates) != 1 || !reflect.DeepEqual(client.updates[0].AddLabels, want) {
+		t.Fatalf("backfill updates = %+v, want provenance only %v", client.updates, want)
+	}
+}
+
+type ownershipClient struct {
+	bdcli.Client
+	issue   bdcli.Issue
+	updates []bdcli.UpdateInput
+}
+
+func (c *ownershipClient) Show(context.Context, string) (bdcli.Issue, error) {
+	return c.issue, nil
+}
+
+func (c *ownershipClient) Update(_ context.Context, _ string, input bdcli.UpdateInput) error {
+	c.updates = append(c.updates, input)
+	return nil
+}
+
 func TestRepositoryLabelIsStableAndValidated(t *testing.T) {
 	got, err := RepositoryLabel("Payments_API")
 	if err != nil {

package/internal/task/jira/effects_test.go

@@ -2,9 +2,13 @@ package jira
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"reflect"
 	"strings"
 	"testing"
 
+	"github.com/rajpopat27/relay-flow/internal/config"
 	"github.com/rajpopat27/relay-flow/internal/task"
 )
 
@@ -37,3 +41,85 @@ func TestCommentKeepsMarkerIdempotency(t *testing.T) {
 		t.Fatalf("posted comments = %v", fake.addedComments)
 	}
 }
+
+func TestJiraClaimIfOwnedRejectsReassignmentBeforeLabelWrite(t *testing.T) {
+	fake := &fakeJira{viewJSON: []byte(`{"id":"1","key":"PAY-1","fields":{"summary":"work","assignee":{"emailAddress":"bob@example.com"},"labels":[]}}`)}
+	sys := newSystemWithFake(t, fake)
+	err := sys.(task.ConditionalClaimer).ClaimIfOwned(context.Background(), task.TicketRef{Key: "PAY-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice@example.com"}},
+	})
+	if !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("ClaimIfOwned error = %v, want ownership mismatch", err)
+	}
+	if len(fake.labelCalls) != 0 {
+		t.Fatalf("label calls = %v, want none after reassignment", fake.labelCalls)
+	}
+}
+
+func TestJiraClaimIfOwnedAddsLabelForCurrentOwner(t *testing.T) {
+	fake := &fakeJira{viewJSON: []byte(`{"id":"1","key":"PAY-1","fields":{"summary":"work","assignee":{"emailAddress":"ALICE@EXAMPLE.COM"},"labels":[]}}`)}
+	sys := newSystemWithFake(t, fake)
+	if err := sys.(task.ConditionalClaimer).ClaimIfOwned(context.Background(), task.TicketRef{Key: "PAY-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice@example.com"}},
+	}); err != nil {
+		t.Fatalf("ClaimIfOwned failed for current owner: %v", err)
+	}
+	want := []string{
+		"PAY-1:" + claimOwnerLabel("flow", "alice@example.com"),
+		"PAY-1:wf:flow",
+	}
+	if !reflect.DeepEqual(fake.labelCalls, want) {
+		t.Fatalf("label calls = %v, want one owner+workflow label write %v", fake.labelCalls, want)
+	}
+}
+
+func TestJiraClaimIfOwnedAcceptsClaimAppearingAfterPollForSameOwner(t *testing.T) {
+	view := fmt.Sprintf(`{"id":"1","key":"PAY-1","fields":{"assignee":{"emailAddress":"alice@example.com"},"labels":[%q,"wf:flow"]}}`, claimOwnerLabel("flow", "alice@example.com"))
+	fake := &fakeJira{viewJSON: []byte(view)}
+	sys := newSystemWithFake(t, fake)
+	if err := sys.(task.ConditionalClaimer).ClaimIfOwned(context.Background(), task.TicketRef{Key: "PAY-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice@example.com", "bob@example.com"}},
+	}); err != nil {
+		t.Fatalf("ClaimIfOwned rejected an existing same-owner claim: %v", err)
+	}
+	if len(fake.labelCalls) != 2 {
+		t.Fatalf("idempotent claim label calls = %v, want owner and wf labels", fake.labelCalls)
+	}
+}
+
+func TestJiraClaimIfOwnedRejectsAppearingClaimAfterReassignment(t *testing.T) {
+	view := fmt.Sprintf(`{"id":"1","key":"PAY-1","fields":{"assignee":{"emailAddress":"bob@example.com"},"labels":[%q,"wf:flow"]}}`, claimOwnerLabel("flow", "alice@example.com"))
+	fake := &fakeJira{viewJSON: []byte(view)}
+	sys := newSystemWithFake(t, fake)
+	err := sys.(task.ConditionalClaimer).ClaimIfOwned(context.Background(), task.TicketRef{Key: "PAY-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice@example.com", "bob@example.com"}},
+	})
+	if !errors.Is(err, task.ErrOwnershipMismatch) || len(fake.labelCalls) != 0 {
+		t.Fatalf("ClaimIfOwned error=%v labels=%v, want mismatch with no writes", err, fake.labelCalls)
+	}
+}
+
+func TestJiraValidateOwnershipRejectsCurrentAssigneeMismatch(t *testing.T) {
+	fake := &fakeJira{viewJSON: []byte(fmt.Sprintf(`{"id":"1","key":"PAY-1","fields":{"assignee":{"emailAddress":"bob@example.com"},"labels":[%q,"wf:flow"]}}`, claimOwnerLabel("flow", "alice@example.com")))}
+	sys := newSystemWithFake(t, fake)
+	err := sys.(task.OwnershipValidator).ValidateOwnership(context.Background(), task.TicketRef{Key: "PAY-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice@example.com"}},
+	})
+	if !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("ValidateOwnership error = %v, want current-assignee mismatch", err)
+	}
+}
+
+func TestJiraBackfillLegacyClaimAddsOnlyProvenance(t *testing.T) {
+	fake := &fakeJira{viewJSON: []byte(`{"id":"1","key":"PAY-1","fields":{"assignee":{"emailAddress":"alice@example.com"},"labels":["wf:flow"]}}`)}
+	sys := newSystemWithFake(t, fake)
+	if err := sys.(task.ClaimOwnerBackfiller).BackfillClaimOwner(context.Background(), task.TicketRef{Key: "PAY-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice@example.com"}},
+	}); err != nil {
+		t.Fatalf("BackfillClaimOwner failed: %v", err)
+	}
+	want := []string{"PAY-1:" + claimOwnerLabel("flow", "alice@example.com")}
+	if !reflect.DeepEqual(fake.labelCalls, want) {
+		t.Fatalf("backfill label calls = %v, want provenance only %v", fake.labelCalls, want)
+	}
+}

package/internal/task/jira/filters_test.go

@@ -2,6 +2,7 @@ package jira
 
 import (
 	"context"
+	"errors"
 	"os"
 	"strings"
 	"testing"
@@ -338,3 +339,105 @@ func TestCompileFilterWithoutAssigneeDoesNotFilter(t *testing.T) {
 		t.Fatal("empty explicit assignee filter rejected a ticket")
 	}
 }
+
+func TestCompileOwnershipFilterWithoutAssigneeDoesNotGateClaim(t *testing.T) {
+	sys := newSystemWithFake(t, &fakeJira{})
+	matcher, err := sys.(task.OwnershipFilterCompiler).CompileOwnershipFilter(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !matcher(task.Ticket{WorkflowClaims: []string{"wf:flow"}, Fields: map[string]any{"assignee": "anyone"}}) {
+		t.Fatal("ownership matcher imposed an assignee gate without filters.assignees")
+	}
+}
+
+func TestCompileOwnershipFilterUsesEffectiveRootRepoWorkflowConfig(t *testing.T) {
+	sys, err := newSystem(context.Background(), &fakeClient{fake: &fakeJira{}}, task.RepoSpec{
+		Name: "payments",
+		RootConfig: config.RawValues{"filters": map[string]any{
+			"assignees": []any{"root@example.com"},
+		}},
+		RepoConfig: testRepoConfig(config.RawValues{"filters": map[string]any{
+			"assignees": []any{"repo@example.com"},
+		}}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	matcher, err := sys.CompileOwnershipFilter(config.RawValues{
+		"filters": map[string]any{"assignees": []any{"workflow@example.com"}},
+	})
+	if err != nil {
+		t.Fatalf("CompileOwnershipFilter failed: %v", err)
+	}
+	valid := task.Ticket{
+		WorkflowClaims: []string{"wf:flow"},
+		Fields: map[string]any{
+			"status":   "In Progress",
+			"assignee": "workflow@example.com",
+			"labels":   []string{claimOwnerLabel("flow", "workflow@example.com")},
+		},
+	}
+	if !matcher(valid) {
+		t.Fatal("effective workflow ownership marker was rejected")
+	}
+	invalid := valid
+	invalid.Fields = map[string]any{
+		"status":   "In Progress",
+		"assignee": "workflow@example.com",
+		"labels":   []string{claimOwnerLabel("flow", "repo@example.com")},
+	}
+	if matcher(invalid) {
+		t.Fatal("repo/root owner marker bypassed workflow ownership override")
+	}
+	if !matcher(task.Ticket{
+		WorkflowClaims: []string{"wf:flow"},
+		Fields: map[string]any{
+			"status":   "Done",
+			"assignee": "workflow@example.com",
+			"labels":   []string{claimOwnerLabel("flow", "workflow@example.com")},
+		},
+	}) {
+		t.Fatal("valid owner marker was rejected after a lifecycle status change")
+	}
+	if matcher(task.Ticket{
+		WorkflowClaims: []string{"wf:flow"},
+		Fields: map[string]any{
+			"status":   "Done",
+			"assignee": "someone-else@example.com",
+			"labels":   []string{claimOwnerLabel("flow", "workflow@example.com")},
+		},
+	}) {
+		t.Fatal("claimed route accepted a current-assignee mismatch")
+	}
+}
+
+func TestCompileOwnershipFilterRejectsProvenanceForAnotherAllowedOwner(t *testing.T) {
+	sys := newSystemWithFake(t, &fakeJira{})
+	matcher, err := sys.(task.OwnershipFilterCompiler).CompileOwnershipFilter(config.RawValues{"filters": map[string]any{
+		"assignees": []any{"alice@example.com", "bob@example.com"},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if matcher(task.Ticket{
+		WorkflowClaims: []string{"wf:flow"},
+		Fields: map[string]any{
+			"assignee": "bob@example.com",
+			"labels":   []string{claimOwnerLabel("flow", "alice@example.com")},
+		},
+	}) {
+		t.Fatal("provenance for Alice was accepted for live owner Bob")
+	}
+}
+
+func TestValidateOwnershipRejectsLegacyClaimWithoutProvenance(t *testing.T) {
+	fake := &fakeJira{viewJSON: []byte(`{"id":"1","key":"PAY-1","fields":{"assignee":{"emailAddress":"alice@example.com"},"labels":["wf:flow"]}}`)}
+	sys := newSystemWithFake(t, fake)
+	err := sys.(task.OwnershipValidator).ValidateOwnership(context.Background(), task.TicketRef{Key: "PAY-1"}, "flow", config.RawValues{
+		"filters": map[string]any{"assignees": []any{"alice@example.com"}},
+	})
+	if !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("ValidateOwnership error = %v, want legacy-claim ownership mismatch", err)
+	}
+}