Preserve execution context and verify approved custom Project roles

LESSONS.md

@@ -654,3 +654,64 @@ its own role changes. Check the logical carrier as well as current human rights;
 keep separate private full-watch approval and Chief proposal authority. Changes
 stay invisible until the exact Effects intent is committed. A retired role keeps
 its history and does not silently move Tasks or invent worker exit evidence.
+
+
+### 2026-11-03 — A deleted Bot is not proof its native work stopped
+
+Seen 1× (native exit regression). A deletion may leave a failed archive or outstanding
+activity, and a missing worker handle can accidentally match undefined. Require exact
+native binding/generation and actual Agent cancellation plus whenIdle before freeing
+resources. Reuse SessionController rather than reading an uninjected agents service;
+real DSH caught that integration error while factory tests passed. Keep unknown old
+host execution held and retain the failed probe as evidence.
+
+
+### 2026-11-03 — Artifact responsibilities are not logical Bot names
+
+Seen 1× (approved custom-role regression). A new developer-capability role passed
+catalog governance but fixed-name policy/Workspace lookup prevented execution. Keep
+logical identity for Session, Workspace, lease and provenance; use the pinned capability
+for conventions, verification and SDK readOnly. Resolve artifact responsibilities
+explicitly on the Attempt instead of aliasing or duplicating Workspaces. Retired sources
+may finish retained claims, while new targets require the active catalog.
+
+
+### 2026-11-03 — Restoring a Session needs both input identity and archive admission
+
+Seen 1× (actual DSH native pool). Object coercion made different handoffs identical
+[object Object] strings, so old delivery dedupe swallowed a legitimate return. Serialize
+structured inputs with their durable IDs, retaining stable exact replay content. A
+restored archived Session also needs explicit unarchive after trusted binding: DSH
+correctly blocks its first step otherwise. Neither issue appeared in factory-only
+context tests; retain an actual model-request/history continuation regression.
+
+
+### 2026-11-03 — Native archive admission is an external action
+
+Seen 1× (NoOp-save regression). Bind/cancel callbacks resolving does not prove their
+metadata committed. Keep provisional native binding separate from activation, commit
+its Effects marker with the Session/lease worker first, then allow input/unarchive.
+The pre-step gate must cover startup inbox work as well as the ordinary delivery API.
+
+
+### 2026-11-03 — Preserve history without loading all of it into every role
+
+Seen 1× (full role-policy budget regression). New native/context contracts pushed the
+complete mandatory policy past its existing cap. Keep current owner rules and concise
+state in PROJECT.md; archive completed implementation/probe detail verbatim behind
+links. The mandatory source list and byte cap remain unchanged, and the existing
+all-role budget regression must pass without silently truncating instructions.
+
+
+### 2026-11-03 — Every exit consumer must use the same proof
+
+Seen 1× (actual pool adapter regression). Resource release had stopped trusting Bot
+absence, but its caller still returned exitConfirmed=true for an unknown missing Bot.
+Use one proof query at the initiative boundary too. Native Agent idle also excludes
+background jobs: stop/query registered work across earlier parts and child lineage,
+and preserve unknown occupancy until it settles. After restart reuse exact supervisor
+facts without auto-resuming an old worker or confusing a reused PID with ownership.
+
+### 2026-11-03 — Preserve context and recheck current authority separately
+
+Seen 1× (native pre-step and existing scheduler regressions). Admission-time rights do not cover role/resource revocation during a long execution. Reuse one live authority check and the existing pool stop/acknowledgement contract. Keep frozen persona/model for continuation, permit only the retained active retired-role claim, and do not await an Agent's idle inside its own pre-step hook. A resumed physical Session also exists in history: select its current live carrier for authorization. Recheck the actual human sender after awaiting the initiating authority.

ROADMAP.md

@@ -21,6 +21,11 @@ acceptance are #2183/#2185, compatibility #2186. This is source work, not live r
 
 Implement the 2026-11-02 convergence issues sequentially: Project boundaries, independent personal agents/authorization, execution and collaboration, context, Task/subtask lifecycle, SQLite/state, unified API/events, compatibility, then #2189 real deployment/README. Each issue has a separate main-repository branch/PR; no automatic merge or production rollout. #2171 includes repository relations, Owner closure and Chief-proposed/Owner-or-Maintainer-approved role governance. Execution integration for custom/retired roles remains in #2184; ancestor changes must propagate through the PR stack before final compatibility acceptance.
 
+Original #2184 follow-up adds native Task-role restoration metadata, cancellation/quiescence
+proofs and canonical-pool cwd retention. Custom-role verification now has direct artifact/SDK contract regressions; finish current-rights
+in-flight stop/reconcile and real-provider native acceptance before propagating the
+execution ancestor through collaboration/context/Task/state/API branches.
+
 ## Active fork roadmap — 2026-10-31
 
 Backend delivery branch `delivery/ai-centric-development-service` consolidates S1–S6 at1811e3b8f.
@@ -405,3 +410,17 @@ Delivery documentation follow-up: root README links the operation guide and full
 v1 API reference (parameters/results/permissions/replay/errors). Current JSON CLI,
 in-process service and incomplete real watch/UI acceptance remain explicit; no
 standalone frontend, OpenAPI service or runtime migration is implied.
+
+
+### Backend convergence #2184 — 2026-11-03
+
+SDK Task-role binding hardening: pinned shared definition snapshots, latest observed
+partial-thread recovery, verified legacy-key adoption, durable dispatch intent,
+explicit incompatible recovery, current rights/resource checks and truthful adapter
+capabilities. Native Task-role context restoration, parent waits, transactional Effects
+and external command receipts remain dependent acceptance; no live-provider or deploy
+claim from controlled process tests. README/API rewrite remains last (#2189).
+
+Native prior-host reconciliation now reuses verified supervisor process-group facts; native v2 registered-work/lineage and shared adapter-exit regressions guard against premature initiative transfer. In-flight current-rights abort and composed-stack acceptance remain active.
+
+Canonical ongoing role/resource authority checks now reuse native step/SDK input and the existing scheduler + pool stop. Frozen role context remains stable; current revoked rights stop execution, with unknown exit held. Compose descendants and verify parent Task resume/API projections next.

changelog.d/2184.fixed.md

@@ -0,0 +1 @@
+Preserve pinned Task-role definitions and latest SDK context across retries; reject incompatible or unconfirmed resumption, and persist execution intent before model input. Expose truthful adapter capability metadata. Preserve exact native Task-role Session bindings and context parts after confirmed quiescence, reject missing-Bot/undefined-handle exit assumptions, and fence retired or reclassified roles from stale restart. Execute approved custom roles with pinned capability conventions, SDK read/write policy and producer-attributed artifact verification; preserve retired active claims while blocking new retired-role work for Chief routing. Restore native pool returns through explicit archived-Session admission and identity-preserving structured input delivery, guarded by actual DSH single-resource context-continuation regression. Require committed native activation before model input or archive admission, including startup/inbox gates. Require shared physical-exit proof at initiative transfer, drain native registered work across parts/subagents, and reconcile exact previous host scopes without inferring exit from PID or Bot absence. Revalidate ongoing canonical role/resource authority through existing native steps, SDK input and scheduler passes; fence revoked claims and reuse confirmed lifecycle stop without replacing frozen role context.

core/src/host/hooks.js

@@ -222,7 +222,11 @@ export function install(rt) {
     }
     if (record && (stepTools.length > 0 || caps.length > 0 || preset || executionProject)) await rt.save()
     if (executionWorkspace) {
-      try { await rt.projectDelivery?.bindSession(executionWorkspace, { id: bot.id, sessionId: rt.chatOf(bot.id) }) }
+      try {
+        if (roleSession) await rt.projectDelivery?.nativeSessions?.bind(roleSession, executionWorkspace, bot.id)
+        await rt.projectDelivery?.bindSession(executionWorkspace, { id: bot.id, sessionId: rt.chatOf(bot.id) })
+        if (roleSession) await rt.projectDelivery?.nativeSessions?.activate(roleSession, bot.id)
+      }
       catch (error) { await rt.deleteBot(bot.id); throw error }
     }
     for (const [key, value] of Object.entries(fields ?? {})) fire('change', { botId: bot.id, plugin, key, value: clone(value), prev: undefined })
@@ -255,6 +259,7 @@ export function install(rt) {
       const last = view(rt.botOf(id))
       const remote = rt.botOf(id)?.remote
       const remoteChat = remote !== undefined
+      await rt.projectDelivery?.nativeSessions?.stop(id)
       const result = await deleteBot(id, ...rest)
       await rt.projectDelivery?.releaseSession(id)
       if (!remoteChat) {
@@ -787,6 +792,7 @@ export function install(rt) {
   }
   innerDeliver = rt.deliver
   rt.deliver = async (args) => {
+    if (rt.projectDelivery?.nativeSessions?.admits(args.toId) === false) throw Object.assign(new Error('Native execution is not admitted; confirm its durable activation or stop/recovery state before new input'), { code: 'bot/worker-stopping' })
     // Everything that is not a first, checked send still carries its sender: resumed, retried,
     // deferred and re-sent deliveries (and notices) are judged by the owner policy
     // now, since the Bot they name may have had its grant revoked, replaced or removed since.
@@ -1396,7 +1402,7 @@ export function install(rt) {
             },
             async release(id) {
               await lifecycle.release(id)
-              return !rt.botOf(id) && (!rt.state.projectHarnessWorkers?.[id] || rt.state.projectHarnessWorkers[id].status === 'released')
+              return rt.projectDelivery.exitConfirmed(id)
             },
             evidence({ attemptId }) {
               const attempt = rt.state.projectAttempts?.[attemptId]

core/src/host/project-delivery-template.js

@@ -1,5 +1,5 @@
 // One versioned path through the existing Workflow plugin; no second execution engine.
-export const DELIVERY_VERSION = 'project-delivery/v6'
+export const DELIVERY_VERSION = 'project-delivery/v7'
 export const DELIVERY_ROLES = ['developer', 'tester', 'reviewer']
 export function deliveryGraph(model = '') {
   return {