Add Chief admission and resumable child waits to Project Tasks

LESSONS.md

@@ -655,6 +655,16 @@ old active label and verifies Task/Attempt/generation and blocked state survive.
 
 2026-11-03 Seen 1×: a resident native Session may retain its system definition after bot metadata changes. Put each current job protocol/facts in the actual turn input; keep prior context historical and preserve the Session. The explicit Task scope fence caught stale-job output during #2179 admission verification.
 
+### 2026-11-03 — A child result is neither parent completion nor integration
+
+Seen 1× while implementing #2179. Reusing old group aggregation would accept cancelled children and close the parent automatically. Project waits require Chief-adjudicated child outcomes and keep an explicit parent integration continuation. Releasing workers must also free the parent execution quota; an unknown lease still consumes it. Resuming the old claim must not manufacture a second source work-summary revision for the same completed execution.
+
+#2179 acceptance review: compare the complete requirements revision, not just title/criteria, before closing a candidate. A scope-only change still invalidates old evidence. A failed Attempt blocks the new Task commitment; it cannot silently become a terminal Task failure.
+
+#2179 policy-budget regression: active memory plus historical progress reports exceeded the existing complete-role-policy budget. Retain active invariants, archive dated candidate/run narratives with a source link, and preserve their full text. Do not raise the context ceiling, silently truncate required guidance, or reuse archived test counts as current evidence.
+
+#2179 integration regression: `git rev-parse MERGE_HEAD` returns only the first parent of an octopus merge. Validate every bounded registered MERGE_HEAD entry before sealing; an admitted first source cannot conceal an unapproved second parent. Preserve the staged index on rejection.
+
 
 ### 2026-11-03 — Public Chief cannot borrow its approver's identity
 
@@ -733,3 +743,7 @@ Seen 1× (composed role governance/contract regression). Confirming an old sourc
 ### 2026-11-03 — Logical role IDs are not execution carrier IDs
 
 Seen 1× (composed actual DSH native input failure). A canonical claim keeps the logical Bot in botId and the temporary executor in workerId. Context input fences must compare the carrier with workerId; conflating them sends healthy work to Chief admission failure before any execution.
+
+### 2026-11-03 — Fence old-plan decisions as well as external effects
+
+Seen 1× (late Task requirement response regression). Stopping on the next scheduler pass alone leaves a window for an old turn to transfer/split. Bind current claims to the Task requirement revision and recheck after authorization; use actual old Attempt snapshot revisions for compatible prior claims. Keep publication evidence fences too.

ROADMAP.md

@@ -440,6 +440,14 @@ verification must name exact runtime source hashes, not borrow deterministic tes
 
 #2177 follow-up: validate two sequential native Chief jobs against fresh per-turn facts while retaining the same resident Session; dependent Task admission runtime acceptance remains #2179.
 
+### 2026-11-03 — Project Task contract (#2179)
+
+New shared Tasks have Chief admission and versioned requirements. Existing Task/pool/Effects records carry independent child proposals, a released parent wait and one stable resume Handoff; child failure/cancellation never satisfies a wait. Original parent role context and workspaces are retained. Raw legacy board transitions cannot bypass the new contract, while persisted pre-contract Tasks keep their original semantics. Chief callback, rollback, exit and duplicate-resume tests are distinct from real-provider full child integration acceptance; native restore2184, storage2182 and public event/receipt2185 dependencies remain open. README simplification2189 remains last.
+
+#2179 retains legacy Workflow delivery compatibility while requiring Chief admission for new Tasks on either path. Chief runtime quota is independent of execution slots; waiting parent lease state remains authoritative. Full real-provider child integration and native physical restoration are still dependency acceptance, not implied by deterministic runtime tests.
+
+#2179 follow-up: Chief dependency waivers/substitutions retain exact outcome versions and explicit judgement evidence. Accepted child code enters the existing durable integration gates before parent execution; source admission is not merging or parent acceptance. Actual Git multi-parent sealing tests use deterministic child acceptance fixtures. Full real-provider parallel collaboration and native physical restoration remain pending.
+
 Native prior-host reconciliation now reuses verified supervisor process-group facts; native v2 registered-work/lineage and shared adapter-exit regressions guard against premature initiative transfer. In-flight current-rights abort and composed-stack acceptance remain active.
 
 Canonical ongoing role/resource authority checks now reuse native step/SDK input and the existing scheduler + pool stop. Frozen role context remains stable; current revoked rights stop execution, with unknown exit held. Compose descendants and verify parent Task resume/API projections next.

changelog.d/2179.added.md

@@ -0,0 +1 @@
+Add Chief-admitted Project Task contracts, versioned requirements and parallel child waits that resume the original parent role through existing pools and Effects. Preserve pre-contract delivery behavior and refuse legacy board bypasses for new Tasks. Add versioned Chief dependency waiver/replacement decisions and private durable accepted-child source admission; preserve parent integration/acceptance gates and verify every pending Git merge parent. Compose approved custom role capabilities and native continuation; changing canonical requirements stops the old Attempt before successor execution, while preserving its Task-role Session.

core/index.js

@@ -16,6 +16,7 @@ import * as projectChiefControl from './src/host/project-chief-control.js'
 import * as projectScheduledTasks from './src/host/project-scheduled-tasks.js'
 import * as projectDelegations from './src/host/project-delegations.js'
 import * as projectGithubRead from './src/host/project-github-read.js'
+import * as projectTaskLifecycle from './src/host/project-task-lifecycle.js'
 import * as projectPools from './src/host/project-pools.js'
 import * as projectScheduler from './src/host/project-scheduler.js'
 import * as workbenchState from './src/host/workbench-state.js'
@@ -82,7 +83,7 @@ export const inject = ['llm', 'tools', 'systemPrompt', 'sessionController', 'ses
 // the functions other modules call; they call them through `rt` at run time, never during
 // install. Listeners run and tools are listed in registration order, so this order holds:
 // usage meters model requests after every listener that rewrites them.
-const MODULES = [diagnostics, store, projectEffects, projectInputs, harness, memberAuth, platformIdentity, projectAccess, projectDevelopment, projectExecutionBoundary, projectResources, projectHarness, projectRuntimeSetup, projectDelivery, projectDelegations, projectAgents, projectCredentials, projectGithubRead, projectPools, projectScheduledTasks, projectSources, projectChiefControl, projectScheduler, workbenchState, authz, personalAgentAuth, models, permissions, turns, busyAck, steeringInterrupt, delivery, roster, folders, agents, prompt, timeContext, tools, decisions, projectState, meetings, chatIndex, groups, roomMembership, reach, tasks, projectBoard, taskDrive, approvals, resume, memory, parts, images, secrets, connectors, connectorAccess, capabilities, schedules, projectAssistant, projectChief, projectTeam, automationDefault, browser, usage, update, dshUpdate, hooks, remoteChat, workflowStore, channel]
+const MODULES = [diagnostics, store, projectEffects, projectTaskLifecycle, projectInputs, harness, memberAuth, platformIdentity, projectAccess, projectDevelopment, projectExecutionBoundary, projectResources, projectHarness, projectRuntimeSetup, projectDelivery, projectDelegations, projectAgents, projectCredentials, projectGithubRead, projectPools, projectScheduledTasks, projectSources, projectChiefControl, projectScheduler, workbenchState, authz, personalAgentAuth, models, permissions, turns, busyAck, steeringInterrupt, delivery, roster, folders, agents, prompt, timeContext, tools, decisions, projectState, meetings, chatIndex, groups, roomMembership, reach, tasks, projectBoard, taskDrive, approvals, resume, memory, parts, images, secrets, connectors, connectorAccess, capabilities, schedules, projectAssistant, projectChief, projectTeam, automationDefault, browser, usage, update, dshUpdate, hooks, remoteChat, workflowStore, channel]
 
 export function apply(ctx, config = {}) {
   const rt = createRuntime(ctx, config)

core/src/host/project-access.js

@@ -1,4 +1,5 @@
 // Project-scoped human authorization. Instance-wide and private Bot APIs keep their own gates.
+import { releasedParentWait } from './project-scheduler.js'
 import { createHash, randomBytes } from 'node:crypto'
 import { ownEntry, setEntry } from './store.js'
 import { roleOf, rolesOf } from '../shared/project-policy.js'
@@ -38,7 +39,7 @@ export function install(rt) {
     defaultBranch: project.defaultBranch ?? 'main', workDir: project.workDir ?? null,
     status: project.status, createdAt: project.createdAt, updatedAt: project.updatedAt,
     role: roleOf(project, actor?.memberId), quota: project.quota ?? { maxConcurrent: 2 } })
-  const activeRuns = id => Object.values(state.projectExecutions ?? {}).filter(run => run.projectId === id && ['running', 'queued', 'paused', 'working'].includes(run.status))
+  const activeRuns = id => Object.values(state.projectExecutions ?? {}).filter(run => run.projectId === id && run.kind !== 'chief-control' && !releasedParentWait(state, run.attemptId) && ['running', 'queued', 'paused', 'working'].includes(run.status))
   function safeDetail(id, actor) {
     const detail = rt.projects.detail(id, actor)
     return { ...detail, project: safeProject(detail.project, actor), permissions: {
@@ -79,6 +80,7 @@ export function install(rt) {
       const task = ownEntry(state.tasks, String(body.taskId ?? ''))
       if (!task || task.projectId !== id) throw refusal('A Project Run needs a Task from this Project')
       rt.requireProjectAccess(actor, id, 'task-write', task)
+      rt.projectTaskLifecycle?.requireExecutable(task)
       payload = { workflowId: item.id, taskId: task.id, title: task.title, brief: task.note ?? task.title, projectId: id, callerBotId: project.chief?.botId }
       const existing = activeRuns(id).find(run => run.taskId === task.id)
       if (existing) {

core/src/host/project-agents.js

@@ -266,7 +266,7 @@ export function createProjectAgents(rt) {
     if (existingTask) return structuredClone(existingTask)
     const projectTaskKind = body.projectTaskKind ?? 'code'
     if (!['code', 'decision', 'release'].includes(projectTaskKind)) throw refuse('Unknown impactful Task kind')
-    const fields = { title, criteria: clean(body.criteria, 2000), note: clean(body.note, 2000), projectTaskKind }
+    const fields = { title, criteria: clean(body.criteria, 2000), note: clean(body.note, 2000), impact: clean(body.impact, 2000), scope: clean(body.scope, 2000), projectTaskKind }
     if (!canPublish) {
       const row = { id: `proposal-${randomUUID()}`, projectId: agent.projectId, memberId: actor.memberId, fields, requestKey, createdAt: Date.now() }
       setEntry(proposals(), row.id, row)
@@ -363,7 +363,7 @@ export function createProjectAgents(rt) {
     await rt.save()
     const finish = async result => {
       try { if (delegations.get(agent.id)?.id !== delegation.id || delegation.revoked) throw refuse('Chief execution was revoked'); await onResult({ ...result, executionEvidence: { ...result.executionEvidence, chiefRunId: runId, carrierGeneration: agent.carrierGeneration } }); agent.lastRequest.phase = result.ok ? 'completed' : 'failed' }
-      finally { restorePrompt(); if (delegations.get(agent.id)?.id === delegation.id) delegations.delete(agent.id); await rt.save() }
+      finally { restorePrompt(); if (delegations.get(agent.id)?.id === delegation.id) delegations.delete(agent.id); await rt.save(); rt.projectScheduler?.wake() }
     }
     delegation.finishChiefJob = finish
     try {
@@ -790,7 +790,7 @@ export function install(rt) {
     ['project_agent_roles', { role: { type: 'string' }, offset: { type: 'number' }, expectedSha256: { type: 'string' } }, 'Read the current Project role catalog or one bounded exact role-definition source.', async (args, bot) => { const current = await rt.projectAgents.actorOf(bot); return rt.projectRoleGovernance.catalog({ ...args, projectId: current.agent.projectId }, current.actor) }],
     ['project_agent_role_propose', { requestId: { type: 'string', required: true }, action: { type: 'string', required: true }, role: { type: 'string', required: true }, reason: { type: 'string', required: true }, fields: { type: 'object', properties: {}, additionalProperties: true } }, 'Resident Chief proposes add/update/remove of a role. A separate current Maintainer/Owner must approve; this tool cannot apply or approve it.', async (args, bot) => rt.projectAgents.proposeRole(bot, args)],
     ['project_agent_memory', { text: { type: 'string', required: true } }, 'Save a private user/project note; never publish it.', async (args, bot) => rt.projectAgents.memory(bot, args.text)],
-    ['project_agent_task', { title: { type: 'string', required: true }, criteria: { type: 'string' }, note: { type: 'string' }, projectTaskKind: { type: 'string', description: 'code, decision or release; ordinary questions are conversation handoffs' } }, 'Propose a Task privately, or create from the current public request.', async (args, bot) => rt.projectAgents.task(bot, args)],
+    ['project_agent_task', { title: { type: 'string', required: true }, criteria: { type: 'string' }, impact: { type: 'string' }, scope: { type: 'string' }, note: { type: 'string' }, projectTaskKind: { type: 'string', description: 'code, decision or release; ordinary questions are conversation handoffs' } }, 'Propose a Task privately, or create from the current public request.', async (args, bot) => rt.projectAgents.task(bot, args)],
     ['project_agent_suggest_closure', { reason: { type: 'string', required: true } }, 'Recommend Project closure without creating a Task or granting closure rights. The Owner must personally double-confirm.', async (args, bot) => rt.projectAgents.suggestClosure(bot, args)],
     ['project_agent_consultations', { operation: { type: 'string' }, consultationId: { type: 'string' }, requestId: { type: 'string' }, text: { type: 'string' }, publish: { type: 'boolean' } }, 'Read your own Chief questions or reply. Safe answers remain private until human approval; watch replies enter the existing Task inbox.', async (args, bot) => rt.projectAgents.agentConsultations(bot, args)],
     ['project_agent_chief', { text: { type: 'string', required: true }, requestId: { type: 'string', required: true } }, 'Ask Chief an ordinary question without creating a Task. The answer returns to this private conversation.', async (args, bot) => rt.projectAgents.askChief(bot, args)],