[ITSGJY]

Scope

Addresses yyjeqhc/webcodex#1362 in this Fork Draft PR. A retained Workflow Session may be inspected or closed by its authorized owner after its original Runner Project has been unregistered, but must not regain execution rights when the Project selector is reused.

Implementation

• Persist a unique registration_incarnation UUID for each new Project registration (explicit register/create, path registration, and managed worktrees). Ordinary Runner reconnects and restarts reuse the value stored in the TOML record.
• Upgrade valid legacy Project TOML records once through a synchronized, atomic write before advertising them in the Runner inventory. Preserve the existing TOML content and table scopes. If the upgrade cannot be persisted, the Project is not granted a temporary execution identity.
• Carry the registration ID in the Runner Project summary, validate its syntax at the registry boundary, and bind the Server's Session identity to both the registration ID and its registered root witness.
• Keep owner-authorized historical read/close gated on proof of unregistration from a complete current Runner inventory. An active replacement registration cannot inherit the original Session's authority.
• Retain the existing permission checks and close/SQLite durability semantics; the new identity is also checked at generic Session-bound execution admission.

Latest verification (head b3c712487a78bd8dfda4b0b300afa941b8514203)

• Fail-first reproduction: lifecycle enable/disable and idempotent Runner receipts dropped registration_incarnation, while the Server projection accepted a missing identity. Both tests failed before the fix and passed after.
• Corrected the Runner lifecycle receipts to retain the persisted registration incarnation. The Server now rejects absent or malformed incarnation values before its Registry upsert.
• Added a Server integration test traversing a real unregister request and Runner receipt, subsequent Registry removal, authorized historical Session read/close, and denial of live mutation.
• Server full suite: 3,903 passed, 0 failed, 14 ignored. Runner plus Registry full suites: 1,623 passed, 0 failed, 12 ignored. Total 5,526 passed, 0 failed, 26 ignored.
• Rust formatting and diff whitespace checks: passed.
• Independent Codex read-only review of the final incremental changes: no confirmed new issues. This is code review, not an execution test.
• GitHub cross-platform CI for the exact head b3c712487a78bd8dfda4b0b300afa941b8514203: 18/18 checks successful (Actions run 42355340300); Linux, Windows, macOS, Docker, MCP conformance and contract checks passed. The run was triggered as push from a temporary release/ci-validation-1362-b3c71248 branch pointing to the exact PR head, not from the PR event. GitHub associated all 18 checks with PR fix(workflow-session): fence Sessions by persisted Project registration (#1362) #33. The temporary branch was removed after completion and all 18 checks remain successful.

Remaining gates

• Reassess distributed request-lifetime/inventory-propagation timing as a separate security review concern; local Session authorization tests alone do not prove every Runner-side dispatch-time race is excluded.
• Owner review remains required. This PR remains Draft; no upstream PR, merge, production deployment, or service restart was performed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.