feat(handoff): add durable scoped message fabric

active-runtime/app/agent_event_bus.py

@@ -13,6 +13,7 @@ from hashlib import sha256
 from pathlib import Path
 import json
 from typing import Any
+from message_handoff import stable_event_id
 
 
 def utc_now() -> str:
@@ -55,13 +56,18 @@ class AgentEventBus:
         payload: dict[str, Any],
         correlation_id: str | None = None,
     ) -> dict[str, Any]:
-        event_id = "evt_" + sha256(
-            json.dumps(
-                {"kind": kind, "source": source, "summary": summary, "payload": payload},
-                sort_keys=True,
-                ensure_ascii=False,
-            ).encode("utf-8")
-        ).hexdigest()[:16]
+        event_id = stable_event_id(
+            source=source, target=target, message_type=kind, payload=payload,
+            tenant_id=(payload.get('tenant_id') if isinstance(payload, dict) else None),
+            user_id=(payload.get('user_id') if isinstance(payload, dict) else None),
+            project_id=(payload.get('project_id') if isinstance(payload, dict) else None),
+            conversation_id=(payload.get('conversation_id') if isinstance(payload, dict) else None),
+            task_id=(payload.get('task_id') if isinstance(payload, dict) else None),
+            run_id=(payload.get('run_id') if isinstance(payload, dict) else None),
+            causation_id=(payload.get('causation_id') if isinstance(payload, dict) else None),
+            sequence=(payload.get('sequence') if isinstance(payload, dict) else None),
+            idempotency_key=(payload.get('idempotency_key') if isinstance(payload, dict) else None),
+        )
         event = AgentEvent(event_id, kind, source, target, summary, payload, correlation_id=correlation_id)
         self._write("pending", event.to_dict())
         self._audit("created", event.to_dict())

active-runtime/app/aios_authority_git_executor.py

@@ -94,6 +94,91 @@ class AuthorityGitExecutor:
         self._git(["worktree", "add", "--detach", str(path), base_oid])
         return path
 
+    def recover_failed_detached_worktree_exact(
+        self,
+        *,
+        path: Path,
+        expected_oid: str,
+        stale_oid: str,
+        target_ref: str,
+    ) -> str:
+        """Recreate one exact clean, detached, single-attempt worktree at its durable head."""
+        _oid(expected_oid, "expected_oid")
+        _oid(stale_oid, "stale_oid")
+        if not TASK_BRANCH_RE.fullmatch(target_ref):
+            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
+        if self.read_ref(target_ref) is not None:
+            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
+        if (
+            not path.is_absolute()
+            or path.parent != self.worktree_root
+            or path.name in {"", ".", ".."}
+            or path.is_symlink()
+            or not path.is_dir()
+        ):
+            raise AuthorityGitError("WORKTREE_RECOVERY_PATH_INVALID")
+        head = subprocess.run(
+            ["git", "-C", str(path), "rev-parse", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if head.returncode != 0 or head.stdout.strip() != stale_oid or stale_oid == expected_oid:
+            raise AuthorityGitError("WORKTREE_RECOVERY_HEAD_INVALID")
+        symbolic = subprocess.run(
+            ["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if symbolic.returncode != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_DETACHED")
+        status = subprocess.run(
+            ["git", "-C", str(path), "status", "--porcelain=v1", "--untracked-files=all"],
+            text=True, capture_output=True, check=False,
+        )
+        if status.returncode != 0 or status.stdout:
+            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_CLEAN")
+        parents = self._git(["rev-list", "--parents", "-n", "1", stale_oid]).split()
+        if parents != [stale_oid, expected_oid]:
+            raise AuthorityGitError("WORKTREE_RECOVERY_LINEAGE_INVALID")
+        registered = [
+            line.removeprefix("worktree ")
+            for line in self._git(["worktree", "list", "--porcelain"]).splitlines()
+            if line.startswith("worktree ")
+        ]
+        if registered.count(str(path)) != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_REGISTRATION_INVALID")
+        self._git(["worktree", "remove", "--force", str(path)])
+        if path.exists() or path.is_symlink():
+            raise AuthorityGitError("WORKTREE_RECOVERY_REMOVE_FAILED")
+        recreated = self.create_detached_worktree(expected_oid, path.name, path.parent)
+        readback = subprocess.run(
+            ["git", "-C", str(recreated), "rev-parse", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        detached = subprocess.run(
+            ["git", "-C", str(recreated), "symbolic-ref", "-q", "HEAD"],
+            text=True, capture_output=True, check=False,
+        )
+        if readback.returncode != 0 or readback.stdout.strip() != expected_oid or detached.returncode != 1:
+            raise AuthorityGitError("WORKTREE_RECOVERY_READBACK_MISMATCH")
+        return stale_oid
+
+    def create_task_branch_CAS(self, branch: str, expected_base_oid: str, new_oid: str) -> str:
+        if not TASK_BRANCH_RE.fullmatch(branch):
+            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
+        _oid(expected_base_oid, "expected_base_oid")
+        _oid(new_oid, "new_oid")
+        current = self.read_ref(branch)
+        if current is not None:
+            if current == new_oid:
+                return new_oid
+            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
+        if not self.ancestry_check(expected_base_oid, new_oid):
+            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
+        self._git(["update-ref", branch, new_oid, "0" * 40])
+        readback = self.read_ref(branch)
+        if readback != new_oid:
+            raise AuthorityGitError("AUTHORITY_CREATE_READBACK_MISMATCH")
+        return readback
+
     def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
         if not TASK_BRANCH_RE.fullmatch(branch):
             raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")

active-runtime/app/aios_chatgpt_bridge_v2_server.py

@@ -142,6 +142,31 @@ class GovernedRuntime:
         worktree_path = self.config.state_root / "worktrees" / _safe(lease.task_id)
         if worktree_path.exists():
             workspace = DetachedGitWorkspace(worktree_path)
+            stale_oid = workspace.head_oid()
+            if stale_oid != lease.expected_branch_oid or not workspace.is_detached():
+                durable = self._matching_durable_lease(lease)
+                row = resolved_controller.store.read(resolved_job_id)
+                exact_recovery = (
+                    lease.branch_mode == "CREATE_NEW"
+                    and durable is not None
+                    and str(durable[1].get("job_id") or "") == resolved_job_id
+                    and str(durable[1].get("state") or "") == "ACTIVE"
+                    and str(durable[1].get("current_head_oid") or "") == lease.expected_branch_oid
+                    and int(durable[1].get("generation")) == lease.generation
+                    and str(row.get("state") or "") == "EXECUTING"
+                    and str(row.get("side_effect_state") or "") == "IN_PROGRESS"
+                    and self.authority.read_ref("refs/heads/" + lease.target_branch) is None
+                    and workspace.is_detached()
+                )
+                if not exact_recovery:
+                    raise RuntimeError("WORKTREE_HEAD_MISMATCH")
+                self.authority.recover_failed_detached_worktree_exact(
+                    path=worktree_path,
+                    expected_oid=lease.expected_branch_oid,
+                    stale_oid=stale_oid,
+                    target_ref="refs/heads/" + lease.target_branch,
+                )
+                workspace = DetachedGitWorkspace(worktree_path)
         else:
             self.authority.create_detached_worktree(
                 lease.expected_branch_oid,
@@ -427,6 +452,14 @@ class GovernedRuntime:
         if durable is not None:
             if str(durable[1].get("job_id") or "") != binding.job_id:
                 raise RuntimeError("LEASE_BINDING_CONFLICT")
+            try:
+                durable_expires_at = datetime.fromisoformat(
+                    str(durable[1]["lease_expires_at"]).replace("Z", "+00:00")
+                ).astimezone(timezone.utc)
+            except (KeyError, TypeError, ValueError) as exc:
+                raise RuntimeError("DURABLE_BINDING_INVALID") from exc
+            if durable_expires_at <= datetime.now(timezone.utc):
+                return self.renew_writer_lease(request)
             return self._lease_response(
                 binding,
                 recovered=False,

active-runtime/app/aios_continuation_executor.py

@@ -51,11 +51,13 @@ class AuthorityPort(Protocol):
     def branch_exists(self, branch: str) -> bool: ...
     def branch_head(self, branch: str) -> str: ...
     def is_ancestor(self, older: str, newer: str) -> bool: ...
+    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str: ...
     def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
 
 
 class RemotePort(Protocol):
     def repository_identity(self) -> str: ...
+    def push_new_exact(self, branch: str, new: str) -> None: ...
     def push_exact(self, branch: str, expected: str, new: str) -> None: ...
     def read_git_ref(self, branch: str) -> str | None: ...
     def read_api_branch(self, branch: str) -> str | None: ...
@@ -103,6 +105,9 @@ class AuthorityGitAdapter:
     def is_ancestor(self, older: str, newer: str) -> bool:
         return self.executor.ancestry_check(older, newer)
 
+    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str:
+        return self.executor.create_task_branch_CAS(self._ref(branch), expected_base, new)
+
     def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
         return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
 
@@ -258,6 +263,15 @@ class GiteaContinuationRemote:
             raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
         return oid
 
+    def push_new_exact(self, branch: str, new: str) -> None:
+        self._require_projected()
+        self.repository_identity()
+        if self.read_git_ref(branch) is not None:
+            raise ContinuationExecutionError("GITEA_TARGET_BRANCH_ALREADY_EXISTS")
+        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
+        if self.read_git_ref(branch) != new:
+            raise ContinuationExecutionError("GITEA_CREATE_READBACK_MISMATCH")
+
     def push_exact(self, branch: str, expected: str, new: str) -> None:
         self._require_projected()
         self.repository_identity()
@@ -424,8 +438,19 @@ class ContinuationExecutor:
 
     def _validate_preflight(self, binding: ContinuationRuntimeBinding, *, job_id: str | None = None) -> None:
         request = binding.request
-        normalized = validate_writer_lease_request_v2(self._request_mapping(request), self.authority)
-        if normalized != {**self._request_mapping(request), "create_target_branch": False, "worktree_mode": "detached_at_expected_head", "cas_ref_update_required": True}:
+        request_mapping = self._request_mapping(request)
+        normalized = validate_writer_lease_request_v2(request_mapping, self.authority)
+        expected_normalized = {
+            **request_mapping,
+            "create_target_branch": request.branch_mode == "CREATE_NEW",
+            "worktree_mode": (
+                "detached_at_base_oid"
+                if request.branch_mode == "CREATE_NEW"
+                else "detached_at_expected_head"
+            ),
+            "cas_ref_update_required": True,
+        }
+        if normalized != expected_normalized:
             raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
         if not binding.original_receipt_valid or not binding.original_grant_consumed:
             raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
@@ -495,15 +520,18 @@ class ContinuationExecutor:
             self.credential.project()
             projected = True
             row = self.controller.store.read(binding.job_id)
-            if JobState(row["state"]) == JobState.REQUESTED:
+            state = JobState(row["state"])
+            if state == JobState.REQUESTED:
                 self.controller.advance(
                     binding.job_id,
                     JobState.AUTHORIZED,
                     side_effect_state="AUTHORIZED",
                     receipt={"task_id": request.task_id, "original_grant_consumed": True},
+                    expected_revision=int(row["revision"]),
                 )
                 row = self.controller.store.read(binding.job_id)
-            if JobState(row["state"]) == JobState.AUTHORIZED:
+                state = JobState(row["state"])
+            if state == JobState.AUTHORIZED:
                 self.controller.lease_job(
                     binding.job_id,
                     lease_id=f"lease-{binding.job_id}",
@@ -513,12 +541,25 @@ class ContinuationExecutor:
                     lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
                     expected_revision=int(row["revision"]),
                 )
-            self.controller.advance(binding.job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY")
-            self.controller.advance(binding.job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.LEASED:
+                self.controller.advance(binding.job_id, JobState.WORKTREE_READY,
+                                        side_effect_state="WORKTREE_READY", expected_revision=int(row["revision"]))
+                row = self.controller.store.read(binding.job_id)
+                state = JobState(row["state"])
+            if state == JobState.WORKTREE_READY:
+                self.controller.advance(binding.job_id, JobState.EXECUTING,
+                                        side_effect_state="IN_PROGRESS", expected_revision=int(row["revision"]))
+            elif state != JobState.EXECUTING:
+                raise ContinuationExecutionError("JOB_EXECUTION_STATE_INVALID")
             new_oid = self.workspace.commit_files(commit.files, commit.message)
             if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
                 raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
-            authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
+            if request.branch_mode == "CREATE_NEW":
+                authority_oid = self.authority.create_task_branch_cas(request.target_branch, request.base_oid, new_oid)
+            else:
+                authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
             if authority_oid != new_oid:
                 raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
             self.controller.advance(
@@ -529,7 +570,10 @@ class ContinuationExecutor:
             )
             try:
                 self.controller.advance(binding.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
-                self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
+                if request.branch_mode == "CREATE_NEW":
+                    self.remote.push_new_exact(request.target_branch, new_oid)
+                else:
+                    self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
             except Exception:
                 return self._remote_pending(binding.job_id, authority_oid, new_oid)
             return self._finish_remote_verification(

active-runtime/app/message_handoff.py

@@ -0,0 +1,413 @@
+from __future__ import annotations
+
+import dataclasses
+import datetime as dt
+import hashlib
+import json
+import sqlite3
+from pathlib import Path
+from typing import Any, Iterable, Mapping
+
+UTC = dt.timezone.utc
+_ALLOWED_CONFIDENTIALITY = frozenset({"public", "tenant", "project", "private", "run"})
+_PRIVILEGED = frozenset({"*", "admin", "system.admin", "message.admin", "task.admin"})
+
+
+class HandoffError(RuntimeError):
+    code = "HANDOFF_ERROR"
+
+
+class MessageScopeMismatch(HandoffError):
+    code = "MESSAGE_SCOPE_MISMATCH_DENY"
+
+
+class ConfidentialityScopeDenied(HandoffError):
+    code = "MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"
+
+
+class MessageExpired(HandoffError):
+    code = "MESSAGE_EXPIRED"
+
+
+class SequenceGap(HandoffError):
+    code = "MESSAGE_SEQUENCE_GAP_DETECT"
+
+
+class SequenceConflict(HandoffError):
+    code = "MESSAGE_SEQUENCE_CONFLICT"
+
+
+class IdempotencyConflict(HandoffError):
+    code = "MESSAGE_IDEMPOTENCY_CONFLICT"
+
+
+def _utcnow() -> dt.datetime:
+    return dt.datetime.now(UTC)
+
+
+def _iso(value: dt.datetime | str | None) -> str | None:
+    if value is None:
+        return None
+    parsed = dt.datetime.fromisoformat(value.replace("Z", "+00:00")) if isinstance(value, str) else value
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=UTC)
+    return parsed.astimezone(UTC).isoformat()
+
+
+def _canonical(value: Any) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str)
+
+
+def _sha(value: Any) -> str:
+    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
+
+
+def _clean(value: Any) -> str | None:
+    if value is None:
+        return None
+    text = str(value).strip()
+    return text or None
+
+
+def _tuple_scope(value: Iterable[str] | str | None) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        value = value.split(",")
+    return tuple(sorted({str(item).strip() for item in value if str(item).strip()}))
+
+
+@dataclasses.dataclass(frozen=True)
+class DeliveryContext:
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+    capabilities: tuple[str, ...] = ()
+
+    @classmethod
+    def from_actor(cls, actor: Any) -> "DeliveryContext":
+        def get(name: str) -> Any:
+            if isinstance(actor, Mapping):
+                return actor.get(name)
+            return getattr(actor, name, None)
+        return cls(
+            tenant_id=_clean(get("tenant_id")),
+            user_id=_clean(get("user_id")),
+            project_id=_clean(get("project_id")),
+            conversation_id=_clean(get("conversation_id")),
+            run_id=_clean(get("run_id")),
+            capabilities=_tuple_scope(get("capabilities") or get("capability_scope")),
+        )
+
+    @property
+    def privileged(self) -> bool:
+        return bool(set(self.capabilities) & _PRIVILEGED)
+
+
+@dataclasses.dataclass(frozen=True)
+class MessageEnvelope:
+    source: str
+    target: str
+    message_type: str
+    payload: Mapping[str, Any]
+    sequence: int
+    idempotency_key: str
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    task_id: str | None = None
+    run_id: str | None = None
+    causation_id: str | None = None
+    capability_scope: tuple[str, ...] = ()
+    confidentiality_scope: str = "private"
+    expires_at: str | None = None
+    created_at: str = dataclasses.field(default_factory=lambda: _iso(_utcnow()) or "")
+    envelope_id: str = ""
+
+    def __post_init__(self) -> None:
+        for field in ("source", "target", "message_type", "idempotency_key", "tenant_id", "user_id",
+                      "project_id", "conversation_id", "task_id", "run_id", "causation_id"):
+            object.__setattr__(self, field, _clean(getattr(self, field)) if field not in {
+                "source", "target", "message_type", "idempotency_key"
+            } else (_clean(getattr(self, field)) or ""))
+        object.__setattr__(self, "capability_scope", _tuple_scope(self.capability_scope))
+        object.__setattr__(self, "confidentiality_scope", (_clean(self.confidentiality_scope) or "private").lower())
+        object.__setattr__(self, "expires_at", _iso(self.expires_at))
+        object.__setattr__(self, "created_at", _iso(self.created_at) or "")
+        if not self.source or not self.target or not self.message_type or not self.idempotency_key:
+            raise ValueError("MESSAGE_ENVELOPE_IDENTITY_REQUIRED")
+        if not isinstance(self.sequence, int) or self.sequence < 1:
+            raise ValueError("MESSAGE_SEQUENCE_MUST_BE_POSITIVE")
+        if self.confidentiality_scope not in _ALLOWED_CONFIDENTIALITY:
+            raise ValueError("MESSAGE_CONFIDENTIALITY_SCOPE_INVALID")
+        if self.confidentiality_scope != "public" and self.tenant_id is None:
+            raise ValueError("MESSAGE_TENANT_REQUIRED")
+        if self.confidentiality_scope in {"project", "private", "run"} and self.project_id is None:
+            raise ValueError("MESSAGE_PROJECT_REQUIRED")
+        if self.confidentiality_scope in {"private", "run"} and self.user_id is None:
+            raise ValueError("MESSAGE_USER_REQUIRED")
+        if self.confidentiality_scope == "run" and self.run_id is None:
+            raise ValueError("MESSAGE_RUN_REQUIRED")
+        expected = stable_event_id(
+            source=self.source, target=self.target, message_type=self.message_type, payload=self.payload,
+            tenant_id=self.tenant_id, user_id=self.user_id, project_id=self.project_id,
+            conversation_id=self.conversation_id, task_id=self.task_id, run_id=self.run_id,
+            causation_id=self.causation_id, sequence=self.sequence, idempotency_key=self.idempotency_key,
+        )
+        if self.envelope_id and self.envelope_id != expected:
+            raise ValueError("MESSAGE_ENVELOPE_ID_MISMATCH")
+        object.__setattr__(self, "envelope_id", expected)
+
+    @property
+    def payload_sha256(self) -> str:
+        return _sha(self.payload)
+
+    @property
+    def stream_key(self) -> str:
+        return _sha({
+            "tenant_id": self.tenant_id, "source": self.source, "target": self.target,
+            "conversation_id": self.conversation_id, "task_id": self.task_id, "run_id": self.run_id,
+        })
+
+    def is_expired(self, *, now: dt.datetime | None = None) -> bool:
+        if self.expires_at is None:
+            return False
+        return dt.datetime.fromisoformat(self.expires_at) <= (now or _utcnow()).astimezone(UTC)
+
+    def as_record(self) -> dict[str, Any]:
+        return {
+            "envelope_id": self.envelope_id, "stream_key": self.stream_key, "source": self.source,
+            "target": self.target, "message_type": self.message_type, "payload_json": _canonical(self.payload),
+            "payload_sha256": self.payload_sha256, "tenant_id": self.tenant_id, "user_id": self.user_id,
+            "project_id": self.project_id, "conversation_id": self.conversation_id, "task_id": self.task_id,
+            "run_id": self.run_id, "causation_id": self.causation_id, "sequence": self.sequence,
+            "capability_scope_json": _canonical(self.capability_scope),
+            "confidentiality_scope": self.confidentiality_scope, "idempotency_key": self.idempotency_key,
+            "expires_at": self.expires_at, "created_at": self.created_at,
+        }
+
+
+def stable_event_id(*, source: Any, target: Any, message_type: Any, payload: Any,
+                    tenant_id: Any = None, user_id: Any = None, project_id: Any = None,
+                    conversation_id: Any = None, task_id: Any = None, run_id: Any = None,
+                    causation_id: Any = None, sequence: Any = None, idempotency_key: Any = None) -> str:
+    return _sha({
+        "source": _clean(source), "target": _clean(target), "message_type": _clean(message_type),
+        "payload_sha256": _sha(payload), "tenant_id": _clean(tenant_id), "user_id": _clean(user_id),
+        "project_id": _clean(project_id), "conversation_id": _clean(conversation_id),
+        "task_id": _clean(task_id), "run_id": _clean(run_id), "causation_id": _clean(causation_id),
+        "sequence": sequence, "idempotency_key": _clean(idempotency_key),
+    })
+
+
+def bind_envelope_scope(envelope: MessageEnvelope, actor: Any) -> MessageEnvelope:
+    ctx = DeliveryContext.from_actor(actor)
+    if ctx.privileged:
+        return envelope
+    if ctx.tenant_id is None:
+        if envelope.tenant_id is not None:
+            raise MessageScopeMismatch(MessageScopeMismatch.code)
+        return envelope
+    updates: dict[str, Any] = {}
+    for field in ("tenant_id", "user_id", "project_id", "conversation_id", "run_id"):
+        trusted = getattr(ctx, field)
+        requested = getattr(envelope, field)
+        if requested is not None and requested != trusted:
+            raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:{field}")
+        if requested is None and trusted is not None:
+            updates[field] = trusted
+    if not updates:
+        return envelope
+    data = dataclasses.asdict(envelope)
+    data.update(updates)
+    data["envelope_id"] = ""
+    return MessageEnvelope(**data)
+
+
+def authorize_delivery(actor: Any, envelope: MessageEnvelope) -> None:
+    ctx = DeliveryContext.from_actor(actor)
+    if ctx.privileged:
+        return
+    if not set(envelope.capability_scope).issubset(set(ctx.capabilities)):
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:capability")
+    if envelope.confidentiality_scope == "public":
+        return
+    if ctx.tenant_id != envelope.tenant_id:
+        raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:tenant_id")
+    if envelope.confidentiality_scope in {"project", "private", "run"} and ctx.project_id != envelope.project_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:project_id")
+    if envelope.confidentiality_scope in {"private", "run"} and ctx.user_id != envelope.user_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:user_id")
+    if envelope.confidentiality_scope == "run" and ctx.run_id != envelope.run_id:
+        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:run_id")
+
+
+_SCHEMA = """
+CREATE TABLE IF NOT EXISTS message_handoff (
+  envelope_id TEXT PRIMARY KEY,
+  stream_key TEXT NOT NULL,
+  source TEXT NOT NULL,
+  target TEXT NOT NULL,
+  message_type TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  payload_sha256 TEXT NOT NULL,
+  tenant_id TEXT,
+  user_id TEXT,
+  project_id TEXT,
+  conversation_id TEXT,
+  task_id TEXT,
+  run_id TEXT,
+  causation_id TEXT,
+  sequence INTEGER NOT NULL CHECK(sequence >= 1),
+  capability_scope_json TEXT NOT NULL,
+  confidentiality_scope TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  expires_at TEXT,
+  created_at TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'PENDING',
+  delivered_at TEXT,
+  acked_at TEXT,
+  UNIQUE(stream_key, idempotency_key),
+  UNIQUE(stream_key, sequence)
+);
+CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
+  ON message_handoff(target, status, created_at);
+CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
+  ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);
+"""
+
+
+class DurableHandoffStore:
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path)
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        with self._connect() as conn:
+            conn.executescript(_SCHEMA)
+
+    def _connect(self) -> sqlite3.Connection:
+        conn = sqlite3.connect(self.path, timeout=30.0)
+        conn.row_factory = sqlite3.Row
+        conn.execute("PRAGMA foreign_keys=ON")
+        conn.execute("PRAGMA busy_timeout=30000")
+        return conn
+
+    @staticmethod
+    def _from_row(row: sqlite3.Row) -> MessageEnvelope:
+        return MessageEnvelope(
+            source=row["source"], target=row["target"], message_type=row["message_type"],
+            payload=json.loads(row["payload_json"]), tenant_id=row["tenant_id"], user_id=row["user_id"],
+            project_id=row["project_id"], conversation_id=row["conversation_id"], task_id=row["task_id"],
+            run_id=row["run_id"], causation_id=row["causation_id"], sequence=int(row["sequence"]),
+            capability_scope=tuple(json.loads(row["capability_scope_json"])),
+            confidentiality_scope=row["confidentiality_scope"], idempotency_key=row["idempotency_key"],
+            expires_at=row["expires_at"], created_at=row["created_at"], envelope_id=row["envelope_id"],
+        )
+
+    def put(self, envelope: MessageEnvelope) -> tuple[str, MessageEnvelope]:
+        if envelope.is_expired():
+            raise MessageExpired(MessageExpired.code)
+        record = envelope.as_record()
+        with self._connect() as conn:
+            conn.execute("BEGIN IMMEDIATE")
+            replay = conn.execute(
+                "SELECT * FROM message_handoff WHERE stream_key=? AND idempotency_key=?",
+                (envelope.stream_key, envelope.idempotency_key),
+            ).fetchone()
+            if replay is not None:
+                existing = self._from_row(replay)
+                if existing.envelope_id != envelope.envelope_id or existing.payload_sha256 != envelope.payload_sha256:
+                    raise IdempotencyConflict(IdempotencyConflict.code)
+                conn.commit()
+                return "REPLAY", existing
+            seq = conn.execute(
+                "SELECT * FROM message_handoff WHERE stream_key=? AND sequence=?",
+                (envelope.stream_key, envelope.sequence),
+            ).fetchone()
+            if seq is not None:
+                existing = self._from_row(seq)
+                if existing.envelope_id == envelope.envelope_id:
+                    conn.commit()
+                    return "REPLAY", existing
+                raise SequenceConflict(SequenceConflict.code)
+            maximum = int(conn.execute(
+                "SELECT COALESCE(MAX(sequence),0) FROM message_handoff WHERE stream_key=?",
+                (envelope.stream_key,),
+            ).fetchone()[0])
+            expected = maximum + 1
+            if envelope.sequence != expected:
+                raise SequenceGap(f"{SequenceGap.code}:expected={expected}:actual={envelope.sequence}")
+            columns = tuple(record)
+            placeholders = ",".join("?" for _ in columns)
+            conn.execute(
+                f"INSERT INTO message_handoff ({','.join(columns)}) VALUES ({placeholders})",
+                tuple(record[column] for column in columns),
+            )
+            conn.commit()
+            return "CREATED", envelope
+
+    def get(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        with self._connect() as conn:
+            row = conn.execute("SELECT * FROM message_handoff WHERE envelope_id=?", (envelope_id,)).fetchone()
+            if row is None:
+                raise KeyError(envelope_id)
+            envelope = self._from_row(row)
+            if envelope.is_expired():
+                conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope_id,))
+                conn.commit()
+                raise MessageExpired(MessageExpired.code)
+            authorize_delivery(actor, envelope)
+            return envelope
+
+    def pending(self, *, target: str, actor: Any, limit: int = 100) -> list[MessageEnvelope]:
+        if not 1 <= limit <= 1000:
+            raise ValueError("MESSAGE_PENDING_LIMIT_INVALID")
+        visible: list[MessageEnvelope] = []
+        with self._connect() as conn:
+            rows = conn.execute(
+                "SELECT * FROM message_handoff WHERE target=? AND status='PENDING' ORDER BY created_at, sequence LIMIT ?",
+                (target, limit),
+            ).fetchall()
+            for row in rows:
+                envelope = self._from_row(row)
+                if envelope.is_expired():
+                    conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope.envelope_id,))
+                    continue
+                try:
+                    authorize_delivery(actor, envelope)
+                except HandoffError:
+                    continue
+                visible.append(envelope)
+            conn.commit()
+        return visible
+
+    def mark_delivered(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        envelope = self.get(envelope_id, actor=actor)
+        with self._connect() as conn:
+            conn.execute(
+                "UPDATE message_handoff SET status='DELIVERED', delivered_at=? "
+                "WHERE envelope_id=? AND status='PENDING'",
+                (_iso(_utcnow()), envelope_id),
+            )
+            conn.commit()
+        return envelope
+
+    def acknowledge(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
+        envelope = self.get(envelope_id, actor=actor)
+        with self._connect() as conn:
+            conn.execute(
+                "UPDATE message_handoff SET status='ACKED', acked_at=? WHERE envelope_id=?",
+                (_iso(_utcnow()), envelope_id),
+            )
+            conn.commit()
+        return envelope
+
+
+class HandoffFabric:
+    def __init__(self, store: DurableHandoffStore) -> None:
+        self.store = store
+
+    def publish(self, envelope: MessageEnvelope, *, actor: Any | None = None) -> tuple[str, MessageEnvelope]:
+        return self.store.put(bind_envelope_scope(envelope, actor) if actor is not None else envelope)

active-runtime/app/message_handoff_adapters.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from message_handoff import MessageEnvelope
+
+
+def _get(value: Any, *names: str, default: Any = None) -> Any:
+    for name in names:
+        if isinstance(value, Mapping) and name in value:
+            return value[name]
+        if hasattr(value, name):
+            return getattr(value, name)
+    return default
+
+
+def agent_event_to_envelope(event: Any, *, target: str | None = None, sequence: int = 1,
+                            idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    payload = _get(event, "payload", "data", default={}) or {}
+    target = target or _get(event, "target", "recipient")
+    if not target:
+        raise ValueError("MESSAGE_TARGET_REQUIRED")
+    return MessageEnvelope(
+        source=str(_get(event, "source", "producer", "agent_id", default="agent-event")),
+        target=str(target),
+        message_type=str(_get(event, "event_type", "type", "message_type", default="agent.event")),
+        payload=dict(payload),
+        sequence=sequence,
+        idempotency_key=idempotency_key or str(_get(event, "id", "event_id", default="")) or f"agent-event:{sequence}",
+        causation_id=_get(event, "causation_id"),
+        **scope,
+    )
+
+
+def taskplane_event_to_envelope(event: Any, *, target: str, sequence: int = 1,
+                                idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    data = _get(event, "data", "payload", default={}) or {}
+    event_id = str(_get(event, "id", "event_id", default=""))
+    return MessageEnvelope(
+        source=str(_get(event, "source", default="task-plane")),
+        target=target,
+        message_type=str(_get(event, "type", "event_type", default="task.event")),
+        payload=dict(data),
+        sequence=sequence,
+        idempotency_key=idempotency_key or event_id or f"task-event:{sequence}",
+        causation_id=event_id or None,
+        **scope,
+    )
+
+
+def legacy_message_to_envelope(message: Any, *, target: str | None = None, sequence: int = 1,
+                               idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
+    payload = _get(message, "payload", "data", "body", "content", default={})
+    if not isinstance(payload, Mapping):
+        payload = {"value": payload}
+    target = target or _get(message, "target", "recipient", "receiver")
+    if not target:
+        raise ValueError("MESSAGE_TARGET_REQUIRED")
+    source = _get(message, "source", "sender", "agent_id", default="legacy-message-bus")
+    kind = _get(message, "message_type", "type", "kind", default="legacy.message")
+    identifier = _get(message, "id", "message_id", "event_id")
+    return MessageEnvelope(
+        source=str(source), target=str(target), message_type=str(kind), payload=dict(payload),
+        sequence=sequence,
+        idempotency_key=idempotency_key or (str(identifier) if identifier else f"legacy:{sequence}"),
+        causation_id=str(identifier) if identifier else None,
+        **scope,
+    )

active-runtime/app/task_plane/api.py

@@ -34,6 +34,7 @@ from .models import (
 )
 from .policy import PolicyEngine
 from .store import TaskPlaneStore
+from .scope import bind_task_scope
 from .worker_registry import WorkerRegistry
 
 
@@ -68,28 +69,54 @@ class TaskPlaneService:
         self.delegation = DelegationEngine(store)
         self.store.probe_attestation_verifier = self.policy.probe_attestation_verifier
 
-    def create_task(self, body: dict[str, Any], idempotency_key: str | None = None) -> dict[str, Any]:
+    def _authorized_task(self, task_id: str, actor: str, action: str) -> TaskRecord:
+        task = self.store.get_task(task_id, self.policy.actor_context(actor))
+        self.policy.assert_allowed(action, actor, task=task)
+        return task
+
+    def create_task(
+        self,
+        body: dict[str, Any],
+        idempotency_key: str | None = None,
+        *,
+        actor_identity: str | None = None,
+    ) -> dict[str, Any]:
         if body.get("parent_task_id"):
             raise ForbiddenError("child tasks must use the delegate endpoint")
         issuer = body.get("issuer", {})
-        actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
+        declared_actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
+        actor = actor_identity or declared_actor
         self.policy.assert_allowed("create", actor)
         try:
             plan = TaskPlan.from_dict(body)
         except (TypeError, ValueError) as exc:
             raise ValidationError("invalid task plan") from exc
+        if actor_identity is not None:
+            plan = bind_task_scope(
+                plan, self.policy.actor_context(actor_identity), public_create=True
+            )
         task = self.store.create_task_with_event(plan, idempotency_key=idempotency_key)
         return task.to_dict()
 
     def list_tasks(self, actor: str | None = None) -> list[dict[str, Any]]:
+        context = None
         if actor is not None:
             self.policy.assert_allowed("read", actor)
-        return [task.to_dict(include_task=False) for task in self.store.list_tasks()]
+            context = self.policy.actor_context(actor)
+        return [
+            task.to_dict(include_task=False)
+            for task in self.store.list_tasks(context)
+        ]
 
     def get_task(self, task_id: str, actor: str | None = None) -> dict[str, Any]:
+        context = None
         if actor is not None:
-            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
-        return self.store.get_task(task_id).to_dict()
+            self.policy.assert_allowed("read", actor)
+            context = self.policy.actor_context(actor)
+        task = self.store.get_task(task_id, context)
+        if actor is not None:
+            self.policy.assert_allowed("read", actor, task=task)
+        return task.to_dict()
 
     def get_worker(self, worker_id: str, actor: str | None = None) -> dict[str, Any]:
         if actor is not None:
@@ -163,9 +190,8 @@ class TaskPlaneService:
         if not worker_id:
             raise ValidationError("worker_id required")
 
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "claim")
         self.policy.assert_readonly_worker_binding(actor, str(worker_id))
-        self.policy.assert_allowed("claim", actor, task=task)
         lease_seconds = _bounded_int(
             body.get("lease_seconds", 30), "lease_seconds", 1, 3600
         )
@@ -184,10 +210,9 @@ class TaskPlaneService:
         if not claim_id:
             raise ValidationError("claim_id required")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "heartbeat")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("heartbeat", actor, task=task)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
         lease_seconds = _bounded_int(
@@ -206,10 +231,9 @@ class TaskPlaneService:
         message = body.get("message")
         if progress is None:
             raise ValidationError("progress required")
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "progress")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("progress", actor, task=task)
         if task.task_plan.data_classification == "credential-secret":
             if message not in {None, ""} or contains_secret_text(stage):
                 raise ValidationError(
@@ -234,7 +258,7 @@ class TaskPlaneService:
         if not claim_id:
             raise ValidationError("claim_id required")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
-        task = self.store.get_task(task_id)
+        task = self._authorized_task(task_id, actor, "result")
 
         status = body.get("status", "COMPLETED")
         outputs = body.get("outputs", [])
@@ -247,7 +271,6 @@ class TaskPlaneService:
             raise ValidationError("evidence items must be objects")
         claim = self.store.get_claim(claim_id)
         self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
-        self.policy.assert_allowed("result", actor, task=task)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
         if task.task_plan.data_classification == "credential-secret":
@@ -326,8 +349,7 @@ class TaskPlaneService:
         reason = body.get("reason", "failed")
         actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
         self.policy.assert_allowed("fail", actor)
-        task = self.store.get_task(task_id)
-        self.policy.assert_allowed("fail", actor, task=task)
+        task = self._authorized_task(task_id, actor, "fail")
         claim = self.store.get_claim(claim_id)
         if claim.worker_identity != actor:
             raise ForbiddenError("claim identity mismatch")
@@ -339,8 +361,7 @@ class TaskPlaneService:
         actor = body.get("actor_identity") or body.get("worker_identity") or "owner"
         self.policy.assert_allowed("cancel", actor)
         reason = body.get("reason", "cancelled")
-        task = self.store.get_task(task_id)
-        self.policy.assert_allowed("cancel", actor, task=task)
+        task = self._authorized_task(task_id, actor, "cancel")
         updated = self.store.cancel_task_with_event(
             task_id, task.revision, reason=reason
         )
@@ -349,8 +370,7 @@ class TaskPlaneService:
     def delegate(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
         actor = body.get("actor_identity") or "owner"
         self.policy.assert_allowed("delegate", actor)
-        parent = self.store.get_task(task_id)
-        self.policy.assert_allowed("delegate", actor, task=parent)
+        parent = self._authorized_task(task_id, actor, "delegate")
         if "task" in body:
             try:
                 child_plan = TaskPlan.from_dict(body["task"])
@@ -364,25 +384,31 @@ class TaskPlaneService:
             except (TypeError, ValueError) as exc:
                 raise ValidationError("invalid child task plan") from exc
         child_plan.parent_task_id = task_id
+        child_plan = bind_task_scope(
+            child_plan, self.policy.actor_context(actor), public_create=False
+        )
         child = self.delegation.delegate(task_id, child_plan, caller=actor)
         return child.to_dict()
 
     def get_events(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
         if actor is not None:
-            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
+            self._authorized_task(task_id, actor, "audit")
+        else:
+            self.store.get_task(task_id)
         return self.store.list_events(task_id)
 
     def get_evidence(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
         if actor is not None:
-            self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
+            self._authorized_task(task_id, actor, "audit")
+        else:
+            self.store.get_task(task_id)
         return self.evidence.list(task_id)
 
     def get_children(self, task_id: str, actor: str | None = None) -> list[str]:
         if actor is not None:
-            self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
-        self.store.get_task(task_id)
+            self._authorized_task(task_id, actor, "read")
+        else:
+            self.store.get_task(task_id)
         return self.store.list_children(task_id)
 
 
@@ -506,7 +532,11 @@ class TaskPlaneRequestHandler(BaseHTTPRequestHandler):
                 ):
                     raise ForbiddenError("issuer identity mismatch")
                 body["issuer"] = {"type": "authenticated", "id": identity}
-                return 201, self.service.create_task(body or {}, headers.get("idempotency-key"))
+                return 201, self.service.create_task(
+                    body or {},
+                    headers.get("idempotency-key"),
+                    actor_identity=identity,
+                )
             if body.get("actor_identity") not in {None, identity}:
                 raise ForbiddenError("actor identity mismatch")
             body["actor_identity"] = identity

active-runtime/app/task_plane/events.py

@@ -106,3 +106,8 @@ class DurableOutboxDispatcher:
             receipt=str(receipt) if receipt else None,
             error=None if receipt else f"{adapter.name} receipt unavailable",
         )
+
+# R4.2 P0-B compatibility adapter.
+def to_handoff_envelope(event, *, target, sequence=1, idempotency_key=None, **scope):
+    from message_handoff_adapters import taskplane_event_to_envelope
+    return taskplane_event_to_envelope(event, target=target, sequence=sequence, idempotency_key=idempotency_key, **scope)

active-runtime/app/task_plane/models.py

@@ -13,6 +13,8 @@ from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from typing import Any
 
+from .scope import normalize_task_scope
+
 
 SENSITIVE_KEYS = {
     "secret",
@@ -66,6 +68,12 @@ TASK_PLAN_KEYS = {
     "allowed_input_paths",
     "allowed_output_paths",
     "output_policy",
+    "scope_type",
+    "tenant_id",
+    "user_id",
+    "project_id",
+    "conversation_id",
+    "run_id",
 }
 
 
@@ -237,6 +245,12 @@ class TaskPlan:
     schema_version: int = 1
     task_id: str | None = None
     task_type: str = "code.change"
+    scope_type: str = "legacy"
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
     issuer: dict[str, Any] = field(default_factory=dict)
     intent: str | None = None
     required_capabilities: list[str] = field(default_factory=list)
@@ -311,10 +325,17 @@ class TaskPlan:
                 raise ValueError("credential-secret requires metadata-only logging")
             if output_policy != "hash-count-status-only":
                 raise ValueError("credential-secret requires restricted output")
+        scope = normalize_task_scope(data)
         return cls(
             schema_version=schema_version,
             task_id=validate_identifier(data["task_id"], "task_id"),
             task_type=validate_type(data.get("task_type", "code.change"), "task_type"),
+            scope_type=scope.scope_type,
+            tenant_id=scope.tenant_id,
+            user_id=scope.user_id,
+            project_id=scope.project_id,
+            conversation_id=scope.conversation_id,
+            run_id=scope.run_id,
             issuer=issuer,
             intent=data.get("intent"),
             required_capabilities=_normalize_list(data.get("required_capabilities", [])),
@@ -348,6 +369,12 @@ class TaskPlan:
             "schema_version": self.schema_version,
             "task_id": self.task_id,
             "task_type": self.task_type,
+            "scope_type": self.scope_type,
+            "tenant_id": self.tenant_id,
+            "user_id": self.user_id,
+            "project_id": self.project_id,
+            "conversation_id": self.conversation_id,
+            "run_id": self.run_id,
             "issuer": self.issuer,
             "intent": self.intent,
             "required_capabilities": list(self.required_capabilities),

active-runtime/app/task_plane/policy.py

@@ -3,10 +3,11 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import Callable
+from typing import Any, Callable, Mapping
 
 from .errors import ForbiddenError, LockedError
 from .models import ProbeEvidence, ResultEnvelope, TaskRecord
+from .scope import TaskActorContext, actor_context as build_actor_context
 
 
 RISK_RANK = {"low": 1, "medium": 2, "high": 3}
@@ -93,6 +94,10 @@ class PolicyEngine:
         result_signature_verifier: Callable[[ResultEnvelope], bool] | None = None,
         probe_attestation_verifier: Callable[[ProbeEvidence], bool] | None = None,
         identity_capabilities: dict[str, set[str]] | None = None,
+        identity_actor_contexts: Mapping[
+            str, TaskActorContext | Mapping[str, Any]
+        ]
+        | None = None,
         admin_identities: set[str] | None = None,
         readonly_worker_execution_enabled: bool = False,
         readonly_worker_profiles: list[ReadonlyWorkerProfile] | None = None,
@@ -109,12 +114,26 @@ class PolicyEngine:
             identity: set(capabilities)
             for identity, capabilities in (identity_capabilities or {}).items()
         }
+        self.identity_actor_contexts = dict(identity_actor_contexts or {})
         self.admin_identities = set(admin_identities or ())
         self.readonly_worker_execution_enabled = readonly_worker_execution_enabled
         self.readonly_worker_profiles = {
             profile.identity: profile for profile in (readonly_worker_profiles or [])
         }
 
+    def actor_context(self, identity: str) -> TaskActorContext:
+        configured = self.identity_actor_contexts.get(
+            identity, self.identity_actor_contexts.get("*")
+        )
+        capabilities = set(
+            self.identity_capabilities.get(
+                identity, self.identity_capabilities.get("*", set())
+            )
+        )
+        if identity in self.admin_identities:
+            capabilities.add("task.admin")
+        return build_actor_context(identity, configured, capabilities)
+
     def _readonly_worker_allows(
         self, action: str, actor: str, task: TaskRecord | None
     ) -> bool:

active-runtime/app/task_plane/scope.py

@@ -0,0 +1,181 @@
+"""Trusted TaskPlane scope model and SQL authorization helpers."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, replace
+from typing import Any, Mapping
+
+from .errors import ForbiddenError, ValidationError
+
+SCOPE_FIELDS = ("tenant_id", "user_id", "project_id", "conversation_id", "run_id")
+PRIVILEGED_CAPABILITIES = frozenset(
+    {"*", "admin", "system.admin", "task.admin", "task.read.all"}
+)
+
+
+def _value(value: Any, field: str) -> Any:
+    if hasattr(value, "task_plan"):
+        value = value.task_plan
+    if isinstance(value, Mapping):
+        return value.get(field)
+    return getattr(value, field, None)
+
+
+def _text(value: Any) -> str | None:
+    if value is None:
+        return None
+    result = str(value).strip()
+    return result or None
+
+
+@dataclass(frozen=True)
+class TaskScope:
+    scope_type: str
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+
+
+@dataclass(frozen=True)
+class TaskActorContext:
+    identity: str
+    scope_type: str = "legacy"
+    tenant_id: str | None = None
+    user_id: str | None = None
+    project_id: str | None = None
+    conversation_id: str | None = None
+    run_id: str | None = None
+    capabilities: frozenset[str] = frozenset()
+
+
+def normalize_task_scope(value: Any) -> TaskScope:
+    fields = {field: _text(_value(value, field)) for field in SCOPE_FIELDS}
+    declared = _text(_value(value, "scope_type"))
+    if declared is None:
+        declared = "tenant" if fields["tenant_id"] else "legacy"
+    if declared == "tenant":
+        if fields["tenant_id"] is None:
+            raise ValidationError(
+                "tenant scope requires tenant_id", code="TASK_SCOPE_TENANT_ID_REQUIRED"
+            )
+    elif declared == "legacy":
+        if any(fields.values()):
+            raise ValidationError(
+                "legacy scope cannot contain scoped ownership",
+                code="TASK_SCOPE_LEGACY_WITH_SCOPED_FIELDS",
+            )
+    elif declared == "system":
+        if any(fields[field] for field in ("tenant_id", "user_id", "project_id", "conversation_id")):
+            raise ValidationError(
+                "system scope cannot contain tenant ownership",
+                code="TASK_SCOPE_SYSTEM_WITH_TENANT_FIELDS",
+            )
+    else:
+        raise ValidationError("invalid task scope type", code="TASK_SCOPE_TYPE_INVALID")
+    return TaskScope(declared, **fields)
+
+
+def actor_is_privileged(actor: TaskActorContext) -> bool:
+    return bool(actor.capabilities & PRIVILEGED_CAPABILITIES)
+
+
+def actor_context(
+    identity: str,
+    configured: TaskActorContext | Mapping[str, Any] | None,
+    capabilities: set[str] | frozenset[str],
+) -> TaskActorContext:
+    if isinstance(configured, TaskActorContext):
+        context = configured
+    else:
+        data = dict(configured or {})
+        data.pop("identity", None)
+        data.pop("capabilities", None)
+        context = TaskActorContext(identity=str(identity), **data)
+    scope = normalize_task_scope(context)
+    return replace(
+        context,
+        identity=str(identity),
+        scope_type=scope.scope_type,
+        tenant_id=scope.tenant_id,
+        user_id=scope.user_id,
+        project_id=scope.project_id,
+        conversation_id=scope.conversation_id,
+        run_id=scope.run_id,
+        capabilities=frozenset(str(item) for item in capabilities),
+    )
+
+
+def bind_task_scope(plan: Any, actor: TaskActorContext, *, public_create: bool) -> Any:
+    requested = normalize_task_scope(plan)
+    if actor_is_privileged(actor):
+        trusted = normalize_task_scope(actor)
+        if requested.scope_type == "legacy" and trusted.scope_type != "legacy":
+            plan.scope_type = trusted.scope_type
+            for field in SCOPE_FIELDS:
+                setattr(plan, field, getattr(actor, field))
+        return plan
+    trusted = normalize_task_scope(actor)
+    if public_create and trusted.scope_type == "legacy":
+        raise ForbiddenError(
+            "authenticated identity has no tenant scope",
+            code="TASK_ACTOR_SCOPE_UNAVAILABLE",
+        )
+    if trusted.scope_type != "tenant":
+        if requested.scope_type == "legacy":
+            plan.scope_type = trusted.scope_type
+            for field in SCOPE_FIELDS:
+                setattr(plan, field, getattr(actor, field))
+            return plan
+        if requested.scope_type != trusted.scope_type:
+            raise ForbiddenError("task scope mismatch", code="TASK_SCOPE_MISMATCH_DENY")
+        return plan
+    if requested.scope_type not in {"legacy", "tenant"}:
+        raise ForbiddenError("task scope mismatch", code="TASK_SCOPE_MISMATCH_DENY")
+    updates: dict[str, Any] = {"scope_type": "tenant"}
+    for field in SCOPE_FIELDS:
+        declared = getattr(requested, field)
+        authoritative = getattr(actor, field)
+        if declared is not None and declared != authoritative:
+            raise ForbiddenError(
+                "task scope mismatch",
+                code="TASK_SCOPE_MISMATCH_DENY",
+                details={"field": field},
+            )
+        updates[field] = authoritative
+    for field, item in updates.items():
+        setattr(plan, field, item)
+    return plan
+
+
+def actor_scope_sql(actor: TaskActorContext | None) -> tuple[str, tuple[Any, ...]]:
+    if actor is None or actor_is_privileged(actor):
+        return "", ()
+    scope = normalize_task_scope(actor)
+    if scope.scope_type == "legacy":
+        return "scope_type = 'legacy'", ()
+    if scope.scope_type == "system":
+        return "scope_type = 'system'", ()
+    clauses = ["scope_type = 'tenant'", "tenant_id = ?"]
+    params: list[Any] = [scope.tenant_id]
+    for field in ("user_id", "project_id", "conversation_id", "run_id"):
+        value = getattr(scope, field)
+        if value is None:
+            clauses.append(f"{field} IS NULL")
+        else:
+            clauses.append(f"({field} IS NULL OR {field} = ?)")
+            params.append(value)
+    return " AND ".join(clauses), tuple(params)
+
+
+def task_scope_values(value: Any) -> tuple[str | None, ...]:
+    scope = normalize_task_scope(value)
+    return (
+        scope.scope_type,
+        scope.tenant_id,
+        scope.user_id,
+        scope.project_id,
+        scope.conversation_id,
+        scope.run_id,
+    )

active-runtime/app/task_plane/store.py

@@ -32,6 +32,7 @@ from .models import (
     redact_value,
     validate_identifier,
 )
+from .scope import TaskActorContext, actor_scope_sql, task_scope_values
 
 
 EventEnvelope = tuple[str, str, str, str, str, float]
@@ -134,6 +135,12 @@ class TaskPlaneStore:
                     status TEXT NOT NULL,
                     task_json TEXT NOT NULL,
                     task_type TEXT NOT NULL,
+                    scope_type TEXT NOT NULL DEFAULT 'legacy',
+                    tenant_id TEXT,
+                    user_id TEXT,
+                    project_id TEXT,
+                    conversation_id TEXT,
+                    run_id TEXT,
                     root_task_id TEXT NOT NULL,
                     parent_task_id TEXT,
                     correlation_id TEXT,
@@ -272,6 +279,21 @@ class TaskPlaneStore:
                 )
                 """
             )
+            self._ensure_columns(
+                "tasks",
+                {
+                    "scope_type": "TEXT NOT NULL DEFAULT 'legacy'",
+                    "tenant_id": "TEXT",
+                    "user_id": "TEXT",
+                    "project_id": "TEXT",
+                    "conversation_id": "TEXT",
+                    "run_id": "TEXT",
+                },
+            )
+            self.conn.execute(
+                "UPDATE tasks SET scope_type='legacy' "
+                "WHERE scope_type IS NULL OR TRIM(scope_type)=''"
+            )
             self._ensure_columns(
                 "workers",
                 {
@@ -299,6 +321,14 @@ class TaskPlaneStore:
             )
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_tasks_status ON tasks(status)")
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_tasks_parent ON tasks(parent_task_id)")
+            self.conn.execute(
+                "CREATE INDEX IF NOT EXISTS ix_tasks_scope_tenant_project "
+                "ON tasks(scope_type, tenant_id, project_id)"
+            )
+            self.conn.execute(
+                "CREATE INDEX IF NOT EXISTS ix_tasks_scope_owner "
+                "ON tasks(scope_type, tenant_id, user_id, conversation_id, run_id)"
+            )
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_workers_status ON workers(status)")
             self.conn.execute("CREATE INDEX IF NOT EXISTS ix_claims_task ON claims(task_id)")
             self.conn.execute(
@@ -347,6 +377,42 @@ class TaskPlaneStore:
             raise NotFoundError("task")
         task_json = json.loads(row["task_json"])
         task_plan = TaskPlan.from_dict(task_json)
+        stored_scope = tuple(
+            row[field]
+            for field in (
+                "scope_type",
+                "tenant_id",
+                "user_id",
+                "project_id",
+                "conversation_id",
+                "run_id",
+            )
+        )
+        json_has_scope = any(
+            field in task_json
+            for field in (
+                "scope_type",
+                "tenant_id",
+                "user_id",
+                "project_id",
+                "conversation_id",
+                "run_id",
+            )
+        )
+        if json_has_scope and stored_scope != task_scope_values(task_plan):
+            raise ConflictError(
+                "task scope persistence mismatch",
+                code="TASK_SCOPE_PERSISTENCE_MISMATCH",
+            )
+        if not json_has_scope:
+            (
+                task_plan.scope_type,
+                task_plan.tenant_id,
+                task_plan.user_id,
+                task_plan.project_id,
+                task_plan.conversation_id,
+                task_plan.run_id,
+            ) = stored_scope
         task_plan.parent_task_id = row["parent_task_id"]
         task_plan.correlation_id = row["correlation_id"]
         return TaskRecord(
@@ -389,6 +455,7 @@ class TaskPlaneStore:
         task_id = task_plan.task_id or f"task-{uuid.uuid4()}"
         task_plan.task_id = task_id
         task_json = redact_value(task_plan.to_dict(redact=False))
+        scope_values = task_scope_values(task_plan)
         now = _now()
         with self._transaction():
             if idempotency_key:
@@ -397,7 +464,11 @@ class TaskPlaneStore:
                     (idempotency_key,),
                 ).fetchone()
                 if existing:
-                    if _canonical(json.loads(existing["task_json"])) != _canonical(task_json):
+                    existing_plan = TaskPlan.from_dict(
+                        json.loads(existing["task_json"])
+                    )
+                    existing_json = redact_value(existing_plan.to_dict(redact=False))
+                    if _canonical(existing_json) != _canonical(task_json):
                         raise ConflictError("idempotency key payload mismatch")
                     return self.get_task(existing["task_id"])
             root_task_id = task_id
@@ -412,14 +483,18 @@ class TaskPlaneStore:
             self.conn.execute(
                 """
                 INSERT INTO tasks
-                (task_id, revision, status, task_json, task_type, root_task_id, parent_task_id, correlation_id, idempotency_key, created_at, updated_at, failure_reason)
-                VALUES (?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
+                (task_id, revision, status, task_json, task_type,
+                 scope_type, tenant_id, user_id, project_id, conversation_id, run_id,
+                 root_task_id, parent_task_id, correlation_id, idempotency_key,
+                 created_at, updated_at, failure_reason)
+                VALUES (?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
                 """,
                 (
                     task_id,
                     "CREATED",
                     json.dumps(task_json, ensure_ascii=False),
                     task_plan.task_type,
+                    *scope_values,
                     root_task_id,
                     task_plan.parent_task_id,
                     task_plan.correlation_id,
@@ -451,21 +526,30 @@ class TaskPlaneStore:
                 )
             return self.get_task(task.task_id)
 
-    def get_task(self, task_id: str) -> TaskRecord:
+    def get_task(
+        self, task_id: str, actor_context: TaskActorContext | None = None
+    ) -> TaskRecord:
         task_id = _validated_id(task_id, "task_id")
+        predicate, scope_params = actor_scope_sql(actor_context)
+        sql = "SELECT * FROM tasks WHERE task_id=?"
+        if predicate:
+            sql += f" AND ({predicate})"
         with self._lock:
-            row = self.conn.execute(
-                "SELECT * FROM tasks WHERE task_id=?", (task_id,)
-            ).fetchone()
+            row = self.conn.execute(sql, (task_id, *scope_params)).fetchone()
         if row is None:
             raise NotFoundError(f"task {task_id} not found")
         return self._row_to_task(row)
 
-    def list_tasks(self) -> list[TaskRecord]:
+    def list_tasks(
+        self, actor_context: TaskActorContext | None = None
+    ) -> list[TaskRecord]:
+        predicate, scope_params = actor_scope_sql(actor_context)
+        sql = "SELECT * FROM tasks"
+        if predicate:
+            sql += f" WHERE ({predicate})"
+        sql += " ORDER BY created_at DESC"
         with self._lock:
-            rows = self.conn.execute(
-                "SELECT * FROM tasks ORDER BY created_at DESC"
-            ).fetchall()
+            rows = self.conn.execute(sql, scope_params).fetchall()
         return [self._row_to_task(row) for row in rows]
 
     def get_task_budget(self, task_id: str) -> Budget:

db/migrations/20260817_message_handoff.sql

@@ -0,0 +1,36 @@
+-- R4.2 P0-B durable Message/Handoff Fabric.
+-- Forward-only. The existing 20260707 message_outbox remains a compatibility source.
+
+CREATE TABLE IF NOT EXISTS message_handoff (
+  envelope_id TEXT PRIMARY KEY,
+  stream_key TEXT NOT NULL,
+  source TEXT NOT NULL,
+  target TEXT NOT NULL,
+  message_type TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  payload_sha256 TEXT NOT NULL,
+  tenant_id TEXT,
+  user_id TEXT,
+  project_id TEXT,
+  conversation_id TEXT,
+  task_id TEXT,
+  run_id TEXT,
+  causation_id TEXT,
+  sequence INTEGER NOT NULL CHECK(sequence >= 1),
+  capability_scope_json TEXT NOT NULL,
+  confidentiality_scope TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  expires_at TEXT,
+  created_at TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'PENDING',
+  delivered_at TEXT,
+  acked_at TEXT,
+  UNIQUE(stream_key, idempotency_key),
+  UNIQUE(stream_key, sequence)
+);
+
+CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
+  ON message_handoff(target, status, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
+  ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);

docs/superpowers/specs/2026-08-16-r42-p0a-taskplane-scope-isolation-design.md

@@ -0,0 +1,54 @@
+# R4.2 P0-A TaskPlane Scope Isolation Design
+
+Status: approved candidate design. This document is not evidence of a protected-main merge or production deployment.
+
+## Boundary
+
+- Task: `r42-p0a-taskplane-scope-isolation-20260816`
+- Governed Job: `job-3fd743b51971c6007923699c1233f84c`
+- Repository: `aios/aios`
+- Base: `0eb6e1a864edfdaeef37b438991707a110e21558`
+- Target branch: `agent/r42-p0a-taskplane-scope-isolation-20260816`
+- Generation: `1`
+
+The implementation reuses this exact boundary. It does not create a replacement Task, Job, branch, generation, or idempotency key.
+
+## Model and invariants
+
+`TaskPlan` gains first-class `scope_type`, `tenant_id`, `user_id`, `project_id`, `conversation_id`, and `run_id` fields. The fields participate in accepted-key validation, parsing, serialization, persistence, and authorization.
+
+Historical rows without scope data normalize to `scope_type=legacy`; no tenant is inferred. Tenant-scoped tasks require a non-empty `tenant_id`. System/global resources use an explicit `scope_type=system` invariant and do not receive a fabricated tenant. A task may add user, project, conversation, and run ownership within its tenant.
+
+## Trusted ActorContext
+
+TaskPlane defines a small immutable `TaskActorContext` used only for authorization. The HTTP authenticator returns an identity. `PolicyEngine` resolves that identity through server-owned policy configuration into the effective context and capabilities. Request fields such as `tenant_id`, `user_id`, `group_id`, and `role` are declarations only and never expand authority.
+
+Public create, list, and get paths always use the resolved context. Internal compatibility calls may omit a context and retain explicit legacy behavior, but the HTTP adapter never uses that path.
+
+## Persistence
+
+SQLite remains the current runtime. `_create_schema()` performs an idempotent forward migration that adds the six scope columns and indexes, then backfills only missing `scope_type` values to `legacy`.
+
+New writes persist scope in both the canonical `task_json` representation and first-class columns. Reads accept historical JSON without scope, using legacy columns, but reject a new-row mismatch between JSON and columns. SQL list/get predicates are parameterized and applied before row hydration.
+
+PostgreSQL remains a separate migration target and is not claimed by this change.
+
+## Authorization flow
+
+1. HTTP bearer authentication yields an identity.
+2. `PolicyEngine` verifies capability and resolves the identity to `TaskActorContext`.
+3. Create binds the requested scope to the trusted context and rejects mismatches.
+4. List/get pass the trusted context to `TaskPlaneStore`.
+5. Store applies tenant and ownership predicates in SQL; privileged capabilities may explicitly cross scope.
+
+Tenant actors cannot read legacy tasks, another tenant, or mismatched owned resources. Legacy actors can only read legacy tasks. System actors require explicit privileged capability for cross-scope access.
+
+## Failure behavior
+
+Missing tenant scope, forged scope, unknown scope types, JSON/column divergence, and unauthorized list/get operations fail closed with canonical TaskPlane errors. Public get does not reveal whether an out-of-scope task exists.
+
+## Verification
+
+Tests exercise real model round trips, SQLite migration/restart, Service/Policy/Store wiring, tenant A versus tenant B list/get denial, ownership filtering, forged create payload rejection, legacy isolation, privileged access, and SQL parameterization. Existing TaskPlane API, RBAC, recovery/security, and security-contract suites remain mandatory.
+
+The candidate is complete only after real `TASK_CLAIMED`, `TASK_HEARTBEAT`, exact WriterLease, governed commit, OID convergence, result submission, and `TASK_VERIFIED`. Protected main and production remain unchanged.

docs/task-plane/r42-p0a-scope-isolation.md

@@ -0,0 +1,9 @@
+# R4.2 P0-A TaskPlane Scope Isolation
+
+Status: candidate implementation. This is not proof of protected-main promotion or production deployment.
+
+Task scope is now represented by `scope_type`, `tenant_id`, `user_id`, `project_id`, `conversation_id`, and `run_id` in the model and SQLite persistence. Historical rows become `legacy`; their tenant is never guessed. Tenant tasks require `tenant_id`. System resources use `scope_type=system` without a fabricated tenant.
+
+The HTTP adapter uses the authenticated identity. `PolicyEngine` resolves that identity through server-owned `identity_actor_contexts`; request payload fields do not grant scope. Public create binds the trusted scope, and public list/get apply parameterized scope predicates in `TaskPlaneStore`.
+
+SQLite is the current runtime database. PostgreSQL remains a separate migration and runtime-acceptance gate.

docs/task-plane/r42-p0b-message-handoff-fabric.md

@@ -0,0 +1,38 @@
+# R4.2 P0-B — Durable Message / Handoff Fabric
+
+Status: candidate implementation; not evidence of protected-main merge or Production deployment.
+
+`MessageEnvelope` is the single durable handoff identity and carries source/target/type, tenant/user/
+project/conversation/task/run scope, causation, sequence, capability scope, confidentiality scope,
+idempotency key, expiry and delivery state.
+
+Identity includes **target + scope + sequence + idempotency key + payload hash**, fixing the existing
+AgentEventBus target collision. Server ActorContext is authoritative; caller scope may narrow but may
+not widen/forge trusted tenant/user/project/conversation/run fields.
+
+`DurableHandoffStore` provides SQLite durability in the current runtime. Each logical stream has
+unique `(stream_key, idempotency_key)` and `(stream_key, sequence)`. Exact retry returns `REPLAY`;
+changed payload under the same key is rejected; sequence gaps are rejected; expired messages are not
+delivered.
+
+Confidentiality scopes:
+
+- public: no tenant requirement
+- tenant: same tenant
+- project: same tenant + project
+- private: same tenant + project + user
+- run: same tenant + project + user + run
+
+Required `capability_scope` must be present on the authenticated delivery actor unless the actor is
+explicitly administrative.
+
+Compatibility adapters convert AgentEventBus events, TaskPlane CloudEvents and legacy Agent OS
+MessageBus messages into the durable envelope. Existing message_outbox remains intact as a migration
+source; P0-B does not delete or silently rewrite it.
+
+Required gates:
+`MESSAGE_SCOPE_MISMATCH_DENY`, `MESSAGE_TARGET_COLLISION_DENY`, `MESSAGE_IDEMPOTENCY_REPLAY`,
+`MESSAGE_SEQUENCE_GAP_DETECT`, `MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE`,
+`HANDOFF_CROSS_TENANT_DENY`, plus existing P0-A TaskPlane scope/security regressions.
+
+SQLite remains current runtime persistence. PostgreSQL remains a separate migration gate.

runtime/agent-os/message_bus.py

@@ -48,3 +48,8 @@ class MessageBus:
         messages = list(self.queue)
         self.queue.clear()
         return messages
+
+# R4.2 P0-B compatibility adapter.
+def to_handoff_envelope(message, *, target=None, sequence=1, idempotency_key=None, **scope):
+    from message_handoff_adapters import legacy_message_to_envelope
+    return legacy_message_to_envelope(message, target=target, sequence=sequence, idempotency_key=idempotency_key, **scope)

tests/task_plane/public_interface/test_shadow_client_rbac.py

@@ -45,6 +45,9 @@ class ShadowClientRBACPublicInterfaceTests(unittest.TestCase):
             identity_verifier=self.IdentityVerifier({"shadow-client"}),
             execution_enabled=False,
             identity_capabilities={"shadow-client": set(capabilities)},
+            identity_actor_contexts={
+                "shadow-client": {"scope_type": "system"}
+            },
         )
         service = self.TaskPlaneService(store, policy=policy)
 

tests/task_plane/public_interface/test_task_plane_scope_isolation.py

@@ -0,0 +1,298 @@
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import sys
+import threading
+import urllib.error
+import urllib.request
+from http.server import ThreadingHTTPServer
+
+import pytest
+
+ROOT = os.getcwd()
+if os.path.join(ROOT, "active-runtime") not in sys.path:
+    sys.path.append(os.path.join(ROOT, "active-runtime"))
+
+from app.task_plane.api import TaskPlaneRequestHandler, TaskPlaneService
+from app.task_plane.errors import ForbiddenError, NotFoundError, ValidationError
+from app.task_plane.models import TaskPlan
+from app.task_plane.policy import PolicyEngine
+from app.task_plane.store import TaskPlaneStore
+
+
+def _policy() -> PolicyEngine:
+    return PolicyEngine(
+        identity_capabilities={
+            "actor-a": {"task.creator", "task.read"},
+            "actor-b": {"task.creator", "task.read"},
+            "reader-a": {"task.read"},
+            "reader-b": {"task.read"},
+            "owner": {"task.creator", "task.read", "task.read.all"},
+            "unbound": {"task.creator", "task.read"},
+        },
+        identity_actor_contexts={
+            "actor-a": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a",
+                "user_id": "user-a",
+                "project_id": "project-a",
+                "conversation_id": "conversation-a",
+                "run_id": "run-a",
+            },
+            "reader-a": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a",
+                "user_id": "user-a",
+                "project_id": "project-a",
+                "conversation_id": "conversation-a",
+                "run_id": "run-a",
+            },
+            "actor-b": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            "reader-b": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            "owner": {"scope_type": "system"},
+        },
+    )
+
+
+def _service() -> TaskPlaneService:
+    return TaskPlaneService(TaskPlaneStore(":memory:"), policy=_policy())
+
+
+def test_taskplan_scope_fields_round_trip_as_first_class_values() -> None:
+    plan = TaskPlan.from_dict(
+        {
+            "task_id": "task-scope-roundtrip",
+            "scope_type": "tenant",
+            "tenant_id": "tenant-a",
+            "user_id": "user-a",
+            "project_id": "project-a",
+            "conversation_id": "conversation-a",
+            "run_id": "run-a",
+        }
+    )
+    payload = plan.to_dict()
+    assert TaskPlan.from_dict(payload).to_dict() == payload
+
+
+def test_tenant_scope_requires_tenant_id_and_system_scope_does_not() -> None:
+    with pytest.raises(ValidationError) as exc:
+        TaskPlan.from_dict({"task_id": "task-missing-tenant", "scope_type": "tenant"})
+    assert exc.value.error_code == "TASK_SCOPE_TENANT_ID_REQUIRED"
+    system = TaskPlan.from_dict(
+        {"task_id": "task-system", "scope_type": "system", "run_id": "system-run"}
+    )
+    assert system.tenant_id is None
+
+
+def test_ACTOR_BINDING_AUTHZ_MERGE_uses_server_scope() -> None:
+    service = _service()
+    created = service.create_task(
+        {"task_id": "task-a", "task_type": "code.change"},
+        actor_identity="actor-a",
+    )
+    assert created["plan"]["tenant_id"] == "tenant-a"
+    assert created["plan"]["user_id"] == "user-a"
+    assert created["plan"]["project_id"] == "project-a"
+    declared = service.create_task(
+        {
+            "task_id": "task-a-declared",
+            "tenant_id": "tenant-a",
+            "user_id": "user-a",
+            "project_id": "project-a",
+            "conversation_id": "conversation-a",
+            "run_id": "run-a",
+        },
+        actor_identity="actor-a",
+    )
+    assert declared["plan"]["scope_type"] == "tenant"
+
+
+def test_TASK_SCOPE_MISMATCH_DENY_rejects_forged_client_scope() -> None:
+    service = _service()
+    with pytest.raises(ForbiddenError) as exc:
+        service.create_task(
+            {
+                "task_id": "task-forged",
+                "scope_type": "tenant",
+                "tenant_id": "tenant-b",
+                "user_id": "user-b",
+                "project_id": "project-b",
+            },
+            actor_identity="actor-a",
+        )
+    assert exc.value.error_code == "TASK_SCOPE_MISMATCH_DENY"
+
+
+def test_public_create_fails_closed_without_server_actor_scope() -> None:
+    service = _service()
+    with pytest.raises(ForbiddenError) as exc:
+        service.create_task(
+            {"task_id": "task-unbound"}, actor_identity="unbound"
+        )
+    assert exc.value.error_code == "TASK_ACTOR_SCOPE_UNAVAILABLE"
+
+
+def test_TASKPLANE_LIST_AUTHZ_DENY_and_TASK_OWNERSHIP_FILTER() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    service.create_task({"task_id": "task-b"}, actor_identity="actor-b")
+    assert [item["task_id"] for item in service.list_tasks("reader-a")] == ["task-a"]
+    assert [item["task_id"] for item in service.list_tasks("reader-b")] == ["task-b"]
+
+
+def test_TASKPLANE_GET_AUTHZ_DENY_does_not_disclose_cross_tenant_task() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    with pytest.raises(NotFoundError):
+        service.get_task("task-a", "reader-b")
+
+
+def test_http_authentication_drives_server_scope_and_cross_tenant_404() -> None:
+    service = _service()
+
+    class Handler(TaskPlaneRequestHandler):
+        pass
+
+    Handler.service = service
+    Handler.authenticator = lambda token: {
+        "token-a": "actor-a",
+        "token-b": "reader-b",
+    }.get(token)
+    server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    base = f"http://127.0.0.1:{server.server_port}"
+    try:
+        request = urllib.request.Request(
+            base + "/tasks",
+            data=json.dumps({"task_id": "task-http-a"}).encode(),
+            headers={
+                "Authorization": "Bearer token-a",
+                "Content-Type": "application/json",
+            },
+            method="POST",
+        )
+        with urllib.request.urlopen(request, timeout=3) as response:
+            created = json.loads(response.read())
+        assert created["plan"]["tenant_id"] == "tenant-a"
+
+        denied = urllib.request.Request(
+            base + "/tasks/task-http-a",
+            headers={"Authorization": "Bearer token-b"},
+        )
+        with pytest.raises(urllib.error.HTTPError) as exc:
+            urllib.request.urlopen(denied, timeout=3)
+        assert exc.value.code == 404
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=3)
+
+
+def test_mutating_endpoint_is_scoped_before_cancel() -> None:
+    policy = PolicyEngine(
+        execution_enabled=True,
+        identity_capabilities={
+            "actor-a": {"task.creator", "task.read"},
+            "actor-b": {"task.cancel"},
+        },
+        identity_actor_contexts={
+            "actor-a": {"scope_type": "tenant", "tenant_id": "tenant-a"},
+            "actor-b": {"scope_type": "tenant", "tenant_id": "tenant-b"},
+        },
+    )
+    service = TaskPlaneService(TaskPlaneStore(":memory:"), policy=policy)
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    with pytest.raises(NotFoundError):
+        service.cancel("task-a", {"actor_identity": "actor-b"})
+
+
+def test_privileged_server_actor_can_cross_scope() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    service.create_task({"task_id": "task-b"}, actor_identity="actor-b")
+    assert {item["task_id"] for item in service.list_tasks("owner")} == {
+        "task-a",
+        "task-b",
+    }
+
+
+def test_scope_sql_parameters_do_not_interpolate_tenant_values() -> None:
+    service = _service()
+    service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
+    policy = PolicyEngine(
+        identity_capabilities={"attacker": {"task.read"}},
+        identity_actor_contexts={
+            "attacker": {
+                "scope_type": "tenant",
+                "tenant_id": "tenant-a' OR 1=1 --",
+            }
+        },
+    )
+    attacker_service = TaskPlaneService(service.store, policy=policy)
+    assert attacker_service.list_tasks("attacker") == []
+
+
+def test_existing_sqlite_rows_migrate_to_legacy_without_tenant_guess(tmp_path) -> None:
+    path = tmp_path / "legacy.sqlite3"
+    connection = sqlite3.connect(path)
+    connection.execute(
+        """
+        CREATE TABLE tasks (
+            task_id TEXT PRIMARY KEY, revision INTEGER NOT NULL, status TEXT NOT NULL,
+            task_json TEXT NOT NULL, task_type TEXT NOT NULL, root_task_id TEXT NOT NULL,
+            parent_task_id TEXT, correlation_id TEXT, idempotency_key TEXT UNIQUE,
+            created_at REAL NOT NULL, updated_at REAL NOT NULL, failure_reason TEXT
+        )
+        """
+    )
+    connection.execute(
+        "INSERT INTO tasks VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",
+        (
+            "task-legacy",
+            1,
+            "CREATED",
+            json.dumps({"task_id": "task-legacy"}),
+            "code.change",
+            "task-legacy",
+            None,
+            None,
+            "legacy-key",
+            1.0,
+            1.0,
+            None,
+        ),
+    )
+    connection.commit()
+    connection.close()
+
+    store = TaskPlaneStore(str(path))
+    task = store.get_task("task-legacy")
+    assert task.task_plan.scope_type == "legacy"
+    assert task.task_plan.tenant_id is None
+    replay = store.create_task(
+        TaskPlan.from_dict({"task_id": "task-legacy"}),
+        idempotency_key="legacy-key",
+    )
+    assert replay.task_id == "task-legacy"
+    assert tuple(
+        store.conn.execute(
+            "SELECT scope_type,tenant_id FROM tasks WHERE task_id='task-legacy'"
+        ).fetchone()
+    ) == ("legacy", None)
+    tenant_context = _policy().actor_context("reader-a")
+    with pytest.raises(NotFoundError):
+        store.get_task("task-legacy", tenant_context)
+    store.close()

tests/test_agent_event_bus.py

@@ -20,3 +20,12 @@ def test_unified_event_flow():
 
     dashboard = AgentEventDashboard(bus).overview()
     assert dashboard["audit"]["enabled"] is True
+
+
+def test_target_changes_event_identity(tmp_path):
+    bus = AgentEventBus(tmp_path)
+    first = bus.publish('test', 'same', 'user-a', 'same summary', {'value': 1})
+    second = bus.publish('test', 'same', 'user-b', 'same summary', {'value': 1})
+    first_id = first.get('id') if isinstance(first, dict) else getattr(first, 'id', first)
+    second_id = second.get('id') if isinstance(second, dict) else getattr(second, 'id', second)
+    assert first_id != second_id

tests/test_continuation_runtime_normalization.py

@@ -29,6 +29,20 @@ class Authority:
         assert ref == "refs/heads/" + BRANCH
         return self.head
 
+    def commit_exists(self, oid: str) -> bool:
+        return oid == BASE
+
+    def branch_exists(self, branch: str) -> bool:
+        assert branch == BRANCH
+        return self.head is not None
+
+    def branch_head(self, branch: str) -> str:
+        assert branch == BRANCH and self.head is not None
+        return self.head
+
+    def is_ancestor(self, older: str, newer: str) -> bool:
+        return older == BASE and newer == BASE
+
 
 def lease(**overrides: object) -> WriterLeaseRequestV2:
     values = {
@@ -116,6 +130,7 @@ def test_openapi_contract_parses_and_requires_exact_commit_lineage() -> None:
 
 def test_changed_production_files_pass_secret_scan() -> None:
     paths = [
+        Path("active-runtime/app/aios_authority_git_executor.py"),
         Path("active-runtime/app/aios_chatgpt_bridge_v2_server.py"),
         Path("active-runtime/app/aios_continuation_executor.py"),
         Path("active-runtime/app/aios_continuation_lease.py"),
@@ -173,3 +188,117 @@ def test_remote_verified_job_is_not_completed_when_head_cas_callback_fails() ->
         )
 
     assert executor.controller.states == [JobState.REMOTE_VERIFIED]
+
+
+@pytest.mark.parametrize("branch_mode", ("CREATE_NEW", "CONTINUE_EXISTING"))
+def test_executor_preflight_accepts_the_exact_mode_dependent_normalized_shape(
+    branch_mode: str,
+) -> None:
+    from datetime import datetime, timedelta, timezone
+    from aios_continuation_executor import (
+        ContinuationPermissions,
+        ContinuationRuntimeBinding,
+    )
+
+    request = lease(branch_mode=branch_mode)
+    now = datetime.now(timezone.utc)
+    executor = ContinuationExecutor.__new__(ContinuationExecutor)
+    executor.authority = Authority(None if branch_mode == "CREATE_NEW" else BASE)
+    executor.now = lambda: now
+    executor._max_generation = lambda _branch, *, exclude_job_id=None: 0
+    executor.workspace = SimpleNamespace(
+        is_detached=lambda: True,
+        head_oid=lambda: BASE,
+    )
+    executor.remote = SimpleNamespace(repository_identity=lambda: REPO)
+    binding = ContinuationRuntimeBinding(
+        request=request,
+        job_id=JOB,
+        workspace_path=Path("/tmp/continuation-normalization-test"),
+        lease_not_before=now - timedelta(seconds=1),
+        lease_expires_at=now + timedelta(seconds=60),
+        original_receipt_valid=True,
+        original_grant_consumed=True,
+        permissions=ContinuationPermissions(),
+    )
+
+    executor._validate_preflight(binding, job_id=JOB)
+
+
+def test_create_new_executor_resumes_executing_and_uses_absence_bound_writers() -> None:
+    from datetime import datetime, timedelta, timezone
+    from aios_continuation_executor import (
+        ContinuationCommit,
+        ContinuationPermissions,
+        ContinuationRuntimeBinding,
+    )
+
+    new_oid = "b" * 40
+
+    class Store:
+        def read(self, _job_id: str) -> dict[str, object]:
+            return {"state": "EXECUTING", "revision": 4}
+
+    class Controller:
+        def __init__(self) -> None:
+            self.store = Store()
+            self.advanced: list[str] = []
+
+        def advance(self, _job_id: str, state: JobState, **_kwargs: object) -> object:
+            self.advanced.append(state.value)
+            return SimpleNamespace(as_dict=lambda: {"state": state.value})
+
+    class Workspace:
+        def commit_files(self, _files: object, _message: str) -> str:
+            return new_oid
+
+    class CreateAuthority:
+        def __init__(self) -> None:
+            self.created: list[tuple[str, str, str]] = []
+
+        def is_ancestor(self, older: str, newer: str) -> bool:
+            return older == BASE and newer == new_oid
+
+        def create_task_branch_cas(self, branch: str, base: str, new: str) -> str:
+            self.created.append((branch, base, new))
+            return new
+
+        def compare_and_swap_branch(self, *_args: object) -> str:
+            raise AssertionError("existing-branch CAS must not serve CREATE_NEW")
+
+    class CreateRemote:
+        def __init__(self) -> None:
+            self.created: list[tuple[str, str]] = []
+
+        def push_new_exact(self, branch: str, new: str) -> None:
+            self.created.append((branch, new))
+
+        def push_exact(self, *_args: object) -> None:
+            raise AssertionError("existing-branch push must not serve CREATE_NEW")
+
+    class Credential:
+        def project(self) -> None: pass
+        def revoke(self) -> None: pass
+
+    controller=Controller(); authority=CreateAuthority(); remote=CreateRemote()
+    executor=ContinuationExecutor(controller,authority,Workspace(),remote,Credential())
+    executor._validate_preflight=lambda *_args,**_kwargs: None
+    executor._finish_remote_verification=lambda *_args,**_kwargs: {
+        "job_id":JOB,"state":"COMPLETED","receipt":{"authority_oid":new_oid,"commit_visible":True}
+    }
+    now=datetime.now(timezone.utc)
+    binding=ContinuationRuntimeBinding(
+        request=lease(branch_mode="CREATE_NEW"),job_id=JOB,
+        workspace_path=Path("/tmp/create-new-executor-resume"),
+        lease_not_before=now-timedelta(seconds=1),lease_expires_at=now+timedelta(seconds=60),
+        original_receipt_valid=True,original_grant_consumed=True,
+        permissions=ContinuationPermissions(),
+    )
+    result=executor.execute(
+        binding,ContinuationCommit("create-new-test",{"docs/test.txt":b"ok"},"test")
+    )
+
+    assert result["state"]=="COMPLETED"
+    assert authority.created==[(BRANCH,BASE,new_oid)]
+    assert remote.created==[(BRANCH,new_oid)]
+    assert controller.advanced==["LOCAL_VERIFIED","REMOTE_SYNCING"]

tests/test_message_handoff.py

@@ -0,0 +1,127 @@
+from __future__ import annotations
+
+import datetime as dt
+import pathlib
+import sys
+
+import pytest
+
+APP = pathlib.Path(__file__).resolve().parents[1] / "active-runtime" / "app"
+if str(APP) not in sys.path:
+    sys.path.insert(0, str(APP))
+
+from message_handoff import (
+    ConfidentialityScopeDenied,
+    DeliveryContext,
+    DurableHandoffStore,
+    HandoffFabric,
+    IdempotencyConflict,
+    MessageEnvelope,
+    MessageExpired,
+    MessageScopeMismatch,
+    SequenceGap,
+    authorize_delivery,
+    bind_envelope_scope,
+    stable_event_id,
+)
+
+
+def actor(**overrides):
+    values = dict(
+        tenant_id="tenant-a", user_id="user-a", project_id="project-a",
+        conversation_id="conversation-a", run_id="run-a",
+        capabilities=("task.read", "message.read"),
+    )
+    values.update(overrides)
+    return DeliveryContext(**values)
+
+
+def envelope(**overrides):
+    values = dict(
+        source="agent-a", target="agent-b", message_type="handoff.request", payload={"value": 1},
+        tenant_id="tenant-a", user_id="user-a", project_id="project-a",
+        conversation_id="conversation-a", task_id="task-a", run_id="run-a",
+        sequence=1, idempotency_key="idem-1", capability_scope=("message.read",),
+        confidentiality_scope="private",
+    )
+    values.update(overrides)
+    return MessageEnvelope(**values)
+
+
+def test_MESSAGE_TARGET_COLLISION_DENY():
+    a = stable_event_id(source="a", target="user-a", message_type="event", payload={"x": 1},
+                        tenant_id="tenant-a", sequence=1, idempotency_key="same")
+    b = stable_event_id(source="a", target="user-b", message_type="event", payload={"x": 1},
+                        tenant_id="tenant-a", sequence=1, idempotency_key="same")
+    assert a != b
+
+
+def test_MESSAGE_SCOPE_MISMATCH_DENY():
+    with pytest.raises(MessageScopeMismatch, match="MESSAGE_SCOPE_MISMATCH_DENY"):
+        bind_envelope_scope(envelope(tenant_id="tenant-b"), actor())
+
+
+def test_HANDOFF_CROSS_TENANT_DENY(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    env = envelope()
+    store.put(env)
+    with pytest.raises(MessageScopeMismatch, match="MESSAGE_SCOPE_MISMATCH_DENY"):
+        store.get(env.envelope_id, actor=actor(tenant_id="tenant-b"))
+
+
+def test_MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE():
+    with pytest.raises(ConfidentialityScopeDenied, match="MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"):
+        authorize_delivery(actor(project_id="project-b"), envelope(confidentiality_scope="project"))
+    with pytest.raises(ConfidentialityScopeDenied, match="MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"):
+        authorize_delivery(actor(), envelope(capability_scope=("message.read", "secret.read")))
+
+
+def test_MESSAGE_IDEMPOTENCY_REPLAY(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    env = envelope()
+    assert store.put(env)[0] == "CREATED"
+    status, replay = store.put(env)
+    assert status == "REPLAY"
+    assert replay.envelope_id == env.envelope_id
+    with pytest.raises(IdempotencyConflict, match="MESSAGE_IDEMPOTENCY_CONFLICT"):
+        store.put(envelope(payload={"value": 2}))
+
+
+def test_MESSAGE_SEQUENCE_GAP_DETECT(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    store.put(envelope(sequence=1, idempotency_key="one"))
+    with pytest.raises(SequenceGap, match="MESSAGE_SEQUENCE_GAP_DETECT"):
+        store.put(envelope(sequence=3, idempotency_key="three"))
+
+
+def test_sequence_advances_and_scope_filters_pending(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    store.put(envelope(sequence=1, idempotency_key="one"))
+    store.put(envelope(sequence=2, idempotency_key="two", payload={"value": 2}))
+    assert [item.sequence for item in store.pending(target="agent-b", actor=actor())] == [1, 2]
+    assert store.pending(target="agent-b", actor=actor(tenant_id="tenant-b")) == []
+
+
+def test_expired_message_rejected(tmp_path):
+    expired = (dt.datetime.now(dt.timezone.utc) - dt.timedelta(seconds=1)).isoformat()
+    with pytest.raises(MessageExpired, match="MESSAGE_EXPIRED"):
+        DurableHandoffStore(tmp_path / "handoff.sqlite3").put(envelope(expires_at=expired))
+
+
+def test_server_actor_binding_fills_scope_and_recomputes_identity():
+    public = MessageEnvelope(
+        source="agent-a", target="agent-b", message_type="handoff.request", payload={"value": 1},
+        sequence=1, idempotency_key="bind-1", confidentiality_scope="public",
+    )
+    bound = bind_envelope_scope(public, actor())
+    assert (bound.tenant_id, bound.user_id, bound.project_id, bound.run_id) == (
+        "tenant-a", "user-a", "project-a", "run-a"
+    )
+    assert bound.envelope_id != public.envelope_id
+
+
+def test_handoff_fabric_publish_is_durable(tmp_path):
+    store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
+    status, env = HandoffFabric(store).publish(envelope(), actor=actor())
+    assert status == "CREATED"
+    assert store.get(env.envelope_id, actor=actor()).payload == {"value": 1}

tests/test_writer_lease_recovery.py

@@ -706,3 +706,58 @@ def test_completed_response_with_invalid_oid_uses_canonical_oid_error(tmp_path:
             ("lease-" + binding.job_id,),
         ).fetchone()
     assert tuple(row) == (BASE, 0)
+
+
+def test_acquire_renews_an_expired_matching_durable_lease_with_revision_cas(tmp_path: Path) -> None:
+    runtime = make_runtime(tmp_path)
+    create_durable_lease(runtime)
+    runtime.runtimes.clear()
+
+    result = runtime.acquire_lease(writer_request())
+
+    expires_at, revision = durable_row(runtime)
+    assert result["recovered"] is True
+    assert result["runtime_rehydrated"] is False
+    assert result["durable_branch_lease_present"] is True
+    assert revision == 1
+    assert datetime.fromisoformat(expires_at) > datetime.now(timezone.utc)
+
+
+def test_authority_recovers_only_clean_detached_single_attempt_worktree(tmp_path: Path) -> None:
+    import subprocess
+    from aios_authority_git_executor import AuthorityGitExecutor
+
+    bare = tmp_path / "authority.git"
+    seed = tmp_path / "seed"
+    subprocess.run(["git", "init", "--bare", str(bare)], check=True, capture_output=True)
+    subprocess.run(["git", "init", str(seed)], check=True, capture_output=True)
+    (seed / "base.txt").write_text("base\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(seed), "add", "base.txt"], check=True)
+    subprocess.run(
+        ["git", "-C", str(seed), "-c", "user.name=test", "-c", "user.email=test@example.invalid",
+         "commit", "-m", "base"], check=True, capture_output=True,
+    )
+    base = subprocess.check_output(["git", "-C", str(seed), "rev-parse", "HEAD"], text=True).strip()
+    subprocess.run(["git", "-C", str(seed), "push", str(bare), "HEAD:refs/heads/main"], check=True, capture_output=True)
+    root = tmp_path / "worktrees"
+    authority = AuthorityGitExecutor(bare, root)
+    worktree = authority.create_detached_worktree(base, "task")
+    (worktree / "attempt.txt").write_text("attempt\n", encoding="utf-8")
+    subprocess.run(["git", "-C", str(worktree), "add", "attempt.txt"], check=True)
+    subprocess.run(
+        ["git", "-C", str(worktree), "-c", "user.name=test", "-c", "user.email=test@example.invalid",
+         "commit", "-m", "failed attempt"], check=True, capture_output=True,
+    )
+    stale = subprocess.check_output(["git", "-C", str(worktree), "rev-parse", "HEAD"], text=True).strip()
+
+    recovered = authority.recover_failed_detached_worktree_exact(
+        path=worktree,
+        expected_oid=base,
+        stale_oid=stale,
+        target_ref="refs/heads/agent/recovery-test",
+    )
+
+    assert recovered == stale
+    assert subprocess.check_output(["git", "-C", str(worktree), "rev-parse", "HEAD"], text=True).strip() == base
+    assert subprocess.run(["git", "-C", str(worktree), "symbolic-ref", "-q", "HEAD"]).returncode == 1
+    assert subprocess.check_output(["git", "-C", str(worktree), "status", "--porcelain"], text=True) == ""