Add Chief admission and resumable child waits to Project Tasks - #2226

Written-by: Codex

Latest composition at54a6bb5a8: current execution/governance/context merged;175 targeted tests and core lint pass. Current full verify NOT rerun; earlier full numbers below refer to their older named heads. Actual DSH native return with real Chief intake passed before the final stale-decision fence; final composed runtime validation remains pending. Requirements version changes now stop an old Attempt through the original pool lifecycle, and canonical claim revisions fence late transfer/split decisions before/after awaited authority. Actual SDK subprocess fixture covers version-change stop with acknowledgement/process exit. Custom Developer-capability parent resumes use child-source admission and producer Workspace mapping. Red regressions and self-review recorded. Still Draft; no main merge/deployment/frontend/control-plane change or independent Review.

Refs #2179; stacked on #2225 (4101275). Head4826723ccf02b159ccdd7ca0cbbb27ebffe631d0. This is the original implementation PR for this issue; remaining acceptance stays here/dependent stages, not a replacement PR.

New canonical shared Project Tasks start as proposals. Chief verifies goal, project impact and acceptance before a committed Effect can start execution. Requirements are versioned; each Attempt pins the full revision, so a scope-only change invalidates old evidence and creates a fresh rework snapshot. Requirements changes enter the existing Task inbox. A failed Attempt blocks the Task commitment instead of ending it. Member change requests ask Chief to judge revision/cancellation/reopening; public HTTP cannot submit Chief or role authority. Generic board transitions, human completion and legacy Workflow assign cannot bypass the new canonical contract. Persisted pre-contract Task delivery behavior remains covered separately.

A role may split independent child proposals after confirmed source exit. The parent retains its Task, logical Session and working summary; an unsealed Attempt/workspace continues, while a sealed candidate requires one successor Attempt, releases its execution claim/quota, then waits for Chief-adjudicated child results. Failed/cancelled children do not satisfy waits. One stable outbox/Handoff request resumes the original parent role after all conditions are satisfied; children never close the parent or prove integration. Existing Effects, pools and Task construction are reused. Tests cover concurrent resume, restart replay, unconfirmed exit, failed commits and preservation of previous summaries.

Actual DSH testing exposed two relevant defects: the resident native Chief used stale facts between jobs (fixed in original #2225), and the legacy Workflow gateway counted Chief intake as a development slot. The quota guard now shares released-parent semantics and excludes Chief control jobs. The runtime fixture exercises actual native Chief intake and controls only disposable host-verification gates, so queue/revocation checks do not depend on model timing or a framework delay.

Validation at this head: full TZ=UTC npm run verify 4593 passed,0 failures,0 skips, including4 real DSH runtime checks with deterministic inference. Selected129 Task/Chief/pool/delivery tests passed. Lifecycle coverage98.44%lines/77.97%branches; child-source module97.56%lines/76.60%branches; merge-metadata module100%lines/91.43%branches. Baseline-red evidence covers missing lifecycle, complete requirement revision and Attempt-vs-Task failure. Existing complete-role-policy budget guard caught growing PROJECT.md history: current invariants remain, exact dated reports moved to linked docs/history without raising the limit or truncating guidance. Architecture/subsystem/API notes, PROJECT/ROADMAP/LESSONS, changelog and generated patches are included. README rewrite remains last in #2189.

Chief dependency judgement now supports version-bound waivers and accepted replacements with evidence; cancellation/reopening notifies Chief, and stale replacements reblock integration. The private pre-input port commits accepted child Git refs and source admissions through the existing Effects before reserving parent execution. Only matching Chief acceptance, candidate/test/Review evidence and current authority can admit sources. Public configure permission remains unchanged; moved refs, active writers, failed commits and invalidated results are refused. Parent sealing requires every required source's actual ancestry. Actual Git multi-source tests exposed first-only MERGE_HEAD inspection; all pending parents are now bounded and verified for local worktrees/resource clones. These tests use explicit deterministic child-acceptance fixtures, not a provider-built full loop.

Remaining issue acceptance: full real-provider parallel collaboration, post-resume dependency-plan interruption/reconciliation, native physical Session restoration/inflight stop #2184, normalized atomic storage #2182, complete public receipts/history queries #2185, and alternate legacy creation/cutover compatibility #2186. Cancelled children remain blocked safely until resolved; this PR does not claim those remaining paths are complete. No new real-provider full Chief/child-development acceptance is claimed. No merge/deploy/restart, control-plane/UI edit or interruption of original frontend Task40/PR48. Draft; author self-review is not an independent Reviewer PASS.