chore: merge orchestration into develop

crates/worker/src/controller.rs

@@ -21,7 +21,6 @@ use crate::shutdown_after_idle::{
     ShutdownAfterIdleRequest, TicketIntakeReadyShutdownHook, is_ticket_intake_role,
     take_shutdown_request_after_status,
 };
-use crate::spawn::comm_tools::{sub_worker_list_tool, sub_worker_send_tool, sub_worker_stop_tool};
 use crate::spawn::registry::SpawnedWorkerRegistry;
 use crate::spawn::tool::sub_worker_spawn_tool;
 use crate::worker::{
@@ -802,6 +801,7 @@ where
         feature_registry.add_module(
             crate::feature::builtin::manage_worker::manage_worker_feature(
                 workspace_client,
+                Some(spawned_registry.clone()),
                 feature_config.worker.direct_spawn,
             ),
         );
@@ -920,9 +920,6 @@ where
                 scope_handle,
                 prompts,
             ));
-            engine.register_tool(sub_worker_list_tool(spawned_registry.clone()));
-            engine.register_tool(sub_worker_send_tool(spawned_registry.clone()));
-            engine.register_tool(sub_worker_stop_tool(spawned_registry.clone()));
             observation_providers.push(Arc::new(
                 crate::feature::builtin::worker_observation::SpawnedSubWorkerObservationProvider::new(
                     spawned_registry,

crates/worker/src/feature/builtin/worker_observation.rs

@@ -7,10 +7,11 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use session_store::collect_state;
 
+use super::manage_worker::{WORKER_CONTROL_SERVICE_ID, WorkerControlService};
 use crate::feature::{
     FeatureDescriptor, FeatureInstallContext, FeatureInstallError, FeatureInstructionContribution,
-    FeatureInstructionDeclaration, FeatureInstructionId, FeatureModule, ToolContribution,
+    FeatureInstructionDeclaration, FeatureInstructionId, FeatureModule, ServiceId,
-    ToolDeclaration,
+    ServiceRequirement, ToolContribution, ToolDeclaration,
 };
 use crate::session_capture::{
     ReadDetail, ReadOptions, ReadSelector, ReferenceKind, SearchOptions, SessionCapture,
@@ -111,11 +112,17 @@ impl WorkerObservationProvider for WorkspaceClientWorkerObservationProvider {
     async fn list_worker_sessions(
         &self,
     ) -> Result<Vec<WorkerObservationSubject>, WorkerObservationError> {
+        let workspace_id = self.client.workspace_id().ok_or_else(|| {
+            WorkerObservationError::Unavailable(
+                "Workspace observation requires a scoped Workspace client".to_string(),
+            )
+        })?;
         let response = self
             .client
-            .execute(crate::worker::WorkspaceRequest::get(
+            .execute(crate::worker::WorkspaceRequest::get(format!(
-                "/worker-observation/sessions",
+                "/api/w/{}/worker-observation/sessions",
-            ))
+                workspace_id
+            )))
             .map_err(workspace_client_error)?;
         let body = workspace_response_body(response)?;
         serde_json::from_str::<WorkspaceWorkerObservationListResponse>(&body)
@@ -129,11 +136,16 @@ impl WorkerObservationProvider for WorkspaceClientWorkerObservationProvider {
     ) -> Result<WorkerSessionCapture, WorkerObservationError> {
         let body = serde_json::to_string(subject)
             .map_err(|error| WorkerObservationError::Unavailable(error.to_string()))?;
+        let workspace_id = self.client.workspace_id().ok_or_else(|| {
+            WorkerObservationError::Unavailable(
+                "Workspace observation requires a scoped Workspace client".to_string(),
+            )
+        })?;
         let response = self
             .client
             .execute(crate::worker::WorkspaceRequest::json(
                 crate::worker::WorkspaceRequestMethod::Post,
-                "/worker-observation/session",
+                format!("/api/w/{}/worker-observation/session", workspace_id),
                 body,
             ))
             .map_err(workspace_client_error)?;
@@ -174,6 +186,43 @@ fn workspace_client_error(error: crate::worker::WorkspaceClientError) -> WorkerO
 }
 
 #[derive(Clone)]
+struct ControlAuthorizedObservationProvider {
+    control: Arc<dyn WorkerControlService>,
+    inner: Arc<dyn WorkerObservationProvider>,
+}
+
+#[async_trait]
+impl WorkerObservationProvider for ControlAuthorizedObservationProvider {
+    async fn list_worker_sessions(
+        &self,
+    ) -> Result<Vec<WorkerObservationSubject>, WorkerObservationError> {
+        let candidates = self.inner.list_worker_sessions().await?;
+        let mut granted = Vec::new();
+        for candidate in candidates {
+            if self
+                .control
+                .ensure_permission(&candidate.subject, "observe")
+                .await
+                .is_ok()
+            {
+                granted.push(candidate);
+            }
+        }
+        Ok(granted)
+    }
+
+    async fn capture_worker_session(
+        &self,
+        subject: &WorkerObservationSubjectRef,
+    ) -> Result<WorkerSessionCapture, WorkerObservationError> {
+        self.control
+            .ensure_permission(subject, "observe")
+            .await
+            .map_err(|_| WorkerObservationError::NotFound)?;
+        self.inner.capture_worker_session(subject).await
+    }
+}
+
 pub struct WorkerObservationFeature {
     provider: Arc<dyn WorkerObservationProvider>,
 }
@@ -190,11 +239,11 @@ impl FeatureModule for WorkerObservationFeature {
             .with_description(
                 "Read-only exploration of explicitly granted active Worker sessions.",
             )
-            .with_instruction(observation_instruction())
+            .with_service_requirement(ServiceRequirement::required(
-            .with_tool(ToolDeclaration::new(
+                ServiceId::builtin(WORKER_CONTROL_SERVICE_ID),
-                "ListWorkerSessions",
+                "Worker observation extends the known-Worker control authority",
-                "List bounded summaries of active Worker sessions granted to this Worker.",
             ))
+            .with_instruction(observation_instruction())
             .with_tool(ToolDeclaration::new(
                 "ViewSessionOverview",
                 "Show a sparse overview of the latest committed capture for one granted Worker session.",
@@ -215,21 +264,25 @@ impl FeatureModule for WorkerObservationFeature {
             .register(FeatureInstructionContribution::new(
                 observation_instruction(),
             ))?;
-        context.tools().register(ToolContribution::new(
+        let control = context
-            "ListWorkerSessions",
+            .services()
-            list_definition(self.provider.clone()),
+            .require::<dyn WorkerControlService>(&ServiceId::builtin(WORKER_CONTROL_SERVICE_ID))?;
-        ))?;
+        let provider: Arc<dyn WorkerObservationProvider> =
+            Arc::new(ControlAuthorizedObservationProvider {
+                control,
+                inner: self.provider.clone(),
+            });
         context.tools().register(ToolContribution::new(
             "ViewSessionOverview",
-            overview_definition(self.provider.clone()),
+            overview_definition(provider.clone()),
         ))?;
         context.tools().register(ToolContribution::new(
             "SearchSessionEntries",
-            search_definition(self.provider.clone()),
+            search_definition(provider.clone()),
         ))?;
         context.tools().register(ToolContribution::new(
             "ReadSessionEntry",
-            read_definition(self.provider.clone()),
+            read_definition(provider),
         ))?;
         Ok(())
     }
@@ -346,20 +399,6 @@ impl WorkerObservationProvider for SpawnedSubWorkerObservationProvider {
     }
 }
 
-fn list_definition(provider: Arc<dyn WorkerObservationProvider>) -> ToolDefinition {
-    Arc::new(move || {
-        let schema = serde_json::to_value(schemars::schema_for!(ListWorkerSessionsParams))
-            .unwrap_or_else(|_| serde_json::json!({}));
-        let meta = ToolMeta::new("ListWorkerSessions")
-            .description("List active Worker sessions explicitly granted to this Worker.")
-            .input_schema(schema);
-        let tool: Arc<dyn Tool> = Arc::new(ListWorkerSessionsTool {
-            provider: provider.clone(),
-        });
-        (meta, tool)
-    })
-}
-
 fn overview_definition(provider: Arc<dyn WorkerObservationProvider>) -> ToolDefinition {
     Arc::new(move || {
         let schema = serde_json::to_value(schemars::schema_for!(ViewSessionOverviewParams))
@@ -402,13 +441,6 @@ fn read_definition(provider: Arc<dyn WorkerObservationProvider>) -> ToolDefiniti
     })
 }
 
-#[derive(Debug, Deserialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-struct ListWorkerSessionsParams {
-    #[serde(default)]
-    limit: Option<usize>,
-}
-
 #[derive(Debug, Deserialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
 struct ViewSessionOverviewParams {
@@ -454,43 +486,6 @@ fn default_read_mode() -> String {
     "compact".to_string()
 }
 
-struct ListWorkerSessionsTool {
-    provider: Arc<dyn WorkerObservationProvider>,
-}
-
-#[async_trait]
-impl Tool for ListWorkerSessionsTool {
-    async fn execute(
-        &self,
-        input_json: &str,
-        _context: llm_engine::tool::ToolExecutionContext,
-    ) -> Result<ToolOutput, ToolError> {
-        let params: ListWorkerSessionsParams = parse_input("ListWorkerSessions", input_json)?;
-        let limit = bounded_limit(params.limit);
-        let mut subjects = self
-            .provider
-            .list_worker_sessions()
-            .await
-            .map_err(tool_error)?;
-        subjects.truncate(limit);
-        let sessions = subjects
-            .iter()
-            .map(|subject| {
-                serde_json::json!({
-                    "subject": bounded_subject(&subject.subject),
-                    "display_name": truncate_text(&subject.display_name, 200),
-                    "relation": truncate_text(&subject.relation, 64),
-                    "status": truncate_text(&subject.status, 64),
-                })
-            })
-            .collect::<Vec<_>>();
-        json_output(
-            format!("Listed {} Worker session(s).", sessions.len()),
-            serde_json::json!({ "sessions": sessions }),
-        )
-    }
-}
-
 struct ViewSessionOverviewTool {
     provider: Arc<dyn WorkerObservationProvider>,
 }
@@ -692,31 +687,6 @@ fn parse_tool_part(value: &str) -> Result<ToolPart, ToolError> {
         .ok_or_else(|| ToolError::InvalidArgument(format!("invalid tool_part {value:?}")))
 }
 
-fn bounded_subject(subject: &WorkerObservationSubjectRef) -> WorkerObservationSubjectRef {
-    match subject {
-        WorkerObservationSubjectRef::RuntimeWorker {
-            runtime_id,
-            worker_id,
-        } => WorkerObservationSubjectRef::RuntimeWorker {
-            runtime_id: truncate_text(runtime_id, 200),
-            worker_id: truncate_text(worker_id, 200),
-        },
-        WorkerObservationSubjectRef::SubWorker { name } => WorkerObservationSubjectRef::SubWorker {
-            name: truncate_text(name, 200),
-        },
-    }
-}
-
-fn truncate_text(value: &str, max_chars: usize) -> String {
-    if value.chars().count() <= max_chars {
-        value.to_string()
-    } else {
-        let mut truncated = value.chars().take(max_chars).collect::<String>();
-        truncated.push('…');
-        truncated
-    }
-}
-
 fn bounded_limit(limit: Option<usize>) -> usize {
     limit.unwrap_or(DEFAULT_PAGE_LIMIT).clamp(1, MAX_PAGE_LIMIT)
 }
@@ -801,7 +771,7 @@ mod tests {
         let catalog = crate::PromptCatalog::builtins_only().unwrap();
         let source = &catalog.projection().templates["common.worker_observation"];
         for token in [
-            "ListWorkerSessions",
+            "WorkerList",
             "ViewSessionOverview",
             "SearchSessionEntries",
             "ReadSessionEntry",
@@ -812,7 +782,7 @@ mod tests {
     }
 
     #[test]
-    fn worker_observation_installs_without_session_explore_or_memory_extract() {
+    fn worker_observation_requires_worker_control_service() {
         let provider = Arc::new(FakeProvider {
             captures: Mutex::new(Vec::new()),
         });
@@ -821,15 +791,15 @@ mod tests {
         let report = FeatureRegistryBuilder::new()
             .with_module(WorkerObservationFeature::new(provider))
             .install_into_pending(&mut pending_tools, &mut hook_builder);
-        assert!(report.reports[0].installed);
+        assert!(!report.reports[0].installed);
+        assert!(report.installed_tool_names().is_empty());
+        let descriptor = WorkerObservationFeature::new(Arc::new(FakeProvider {
+            captures: Mutex::new(Vec::new()),
+        }))
+        .descriptor();
         assert_eq!(
-            report.installed_tool_names(),
+            descriptor.requires_services[0].id,
-            [
+            ServiceId::builtin(WORKER_CONTROL_SERVICE_ID)
-                "ListWorkerSessions",
-                "ViewSessionOverview",
-                "SearchSessionEntries",
-                "ReadSessionEntry",
-            ]
         );
     }
 
@@ -838,13 +808,6 @@ mod tests {
         let provider = Arc::new(FakeProvider {
             captures: Mutex::new(vec![message("u1", Role::User, "first")]),
         });
-        let list = list_definition(provider.clone())().1;
-        let listed = list
-            .execute("{}", llm_engine::tool::ToolExecutionContext::direct())
-            .await
-            .unwrap();
-        assert!(listed.content.unwrap().contains("granted"));
-
         let read = read_definition(provider.clone())().1;
         let hidden = read
             .execute(

crates/worker/src/spawn/comm_tools.rs

@@ -1,6 +1,9 @@
+#![cfg_attr(not(test), allow(dead_code, unused_imports))]
+
 //! Parent-facing tools for in-process Internal SubWorker sessions.
 //!
-//! All four tools share the same parent-owned `SpawnedWorkerRegistry` of typed session handles.
+//! Legacy direct-child tool constructors are test-only; production exposes the
+//! registry through the unified `worker.control` service and Worker tools.
 //! There is no Runtime catalog lookup or child socket transport, so a Worker can operate only on
 //! its direct Internal children. The socket helper at the bottom remains solely for the legacy
 //! top-level Worker callback protocol and is not part of SubWorker communication.
@@ -74,6 +77,7 @@ impl Tool for SubWorkerListTool {
     }
 }
 
+#[cfg(test)]
 pub fn sub_worker_list_tool(registry: Arc<SpawnedWorkerRegistry>) -> ToolDefinition {
     Arc::new(move || {
         let schema = schemars::schema_for!(SubWorkerListInput);
@@ -132,6 +136,7 @@ impl Tool for SubWorkerSendTool {
     }
 }
 
+#[cfg(test)]
 pub fn sub_worker_send_tool(registry: Arc<SpawnedWorkerRegistry>) -> ToolDefinition {
     Arc::new(move || {
         let schema = schemars::schema_for!(SubWorkerSendInput);
@@ -186,6 +191,7 @@ impl Tool for SubWorkerStopTool {
     }
 }
 
+#[cfg(test)]
 pub fn sub_worker_stop_tool(registry: Arc<SpawnedWorkerRegistry>) -> ToolDefinition {
     Arc::new(move || {
         let schema = schemars::schema_for!(NameInput);

crates/workspace-server/src/hosts.rs

@@ -342,6 +342,12 @@ pub struct WorkerTicketAssignmentRequest {
 pub(crate) fn worker_spawn_idempotency(
     request: &WorkerSpawnRequest,
 ) -> Result<Option<(String, String)>, String> {
+    if let Some(operation) = request.resolved_control_operation.as_ref() {
+        return Ok(Some((
+            operation.operation_id.clone(),
+            operation.input_fingerprint.clone(),
+        )));
+    }
     let Some(assignment) = request.ticket_assignment.as_ref() else {
         return Ok(None);
     };
@@ -353,6 +359,12 @@ pub(crate) fn worker_spawn_idempotency(
     )))
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct WorkerControlOperation {
+    pub operation_id: String,
+    pub input_fingerprint: String,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(deny_unknown_fields)]
 pub struct WorkerSpawnRequest {
@@ -384,6 +396,9 @@ pub struct WorkerSpawnRequest {
     /// Backend-authored peer-session grants. Browser/model input cannot set this field.
     #[serde(skip, default)]
     pub resolved_worker_observation_grants: Vec<worker_runtime::identity::RuntimeWorkerRef>,
+    /// Trusted Backend operation identity used to make Worker-owned spawns replay-safe.
+    #[serde(skip, default)]
+    pub resolved_control_operation: Option<WorkerControlOperation>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -4801,10 +4816,28 @@ mod tests {
             resolved_config_bundle: None,
             resolved_worker_observation_enabled: false,
             resolved_worker_observation_grants: Vec::new(),
+            resolved_control_operation: None,
             resolved_workspace_api: Some(test_workspace_api()),
         }
     }
 
+    #[test]
+    fn trusted_control_operation_is_runtime_spawn_idempotency_authority() {
+        let mut request = embedded_spawn_request();
+        request.resolved_control_operation = Some(WorkerControlOperation {
+            operation_id: "control-op-1".to_string(),
+            input_fingerprint: "sha256:control-input".to_string(),
+        });
+
+        assert_eq!(
+            worker_spawn_idempotency(&request).unwrap(),
+            Some((
+                "control-op-1".to_string(),
+                "sha256:control-input".to_string(),
+            ))
+        );
+    }
+
     #[test]
     fn spawn_config_bundle_ref_preserves_bundle_identity() {
         let mut request = embedded_spawn_request();
@@ -5016,6 +5049,7 @@ mod tests {
                     resolved_config_bundle: None,
                     resolved_worker_observation_enabled: false,
                     resolved_worker_observation_grants: Vec::new(),
+                    resolved_control_operation: None,
                     resolved_workspace_api: Some(test_workspace_api()),
                 },
             )
@@ -5113,6 +5147,7 @@ mod tests {
                     resolved_config_bundle: None,
                     resolved_worker_observation_enabled: false,
                     resolved_worker_observation_grants: Vec::new(),
+                    resolved_control_operation: None,
                     resolved_workspace_api: Some(test_workspace_api()),
                 },
             )
@@ -5149,6 +5184,7 @@ mod tests {
                     resolved_config_bundle: None,
                     resolved_worker_observation_enabled: false,
                     resolved_worker_observation_grants: Vec::new(),
+                    resolved_control_operation: None,
                     resolved_workspace_api: Some(test_workspace_api()),
                 },
             )

crates/workspace-server/src/store.rs

@@ -181,6 +181,16 @@ const MIGRATIONS: &[Migration] = &[
         name: "persist Workspace config schema contribution bundles",
         apply: persist_workspace_config_schema_bundles,
     },
+    Migration {
+        version: 33,
+        name: "create durable Runtime Worker control grants",
+        apply: create_worker_control_grant_authority,
+    },
+    Migration {
+        version: 34,
+        name: "create Worker control delegation operation authority",
+        apply: create_worker_control_delegation_operation_authority,
+    },
 ];
 
 struct Migration {
@@ -325,6 +335,35 @@ pub struct WorkerRegistryRecord {
     pub updated_at: String,
 }
 
+/// Durable authority describing which Runtime Worker another Runtime Worker may
+/// discover and control. Revoked grants remain as audit evidence but are never
+/// returned by active-grant queries.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct WorkerControlGrantRecord {
+    pub workspace_id: String,
+    pub grant_id: String,
+    pub controller: RuntimeWorkerRef,
+    pub subject: RuntimeWorkerRef,
+    pub relation: String,
+    pub origin: String,
+    pub permissions: Vec<String>,
+    pub operation_id: String,
+    pub created_at: String,
+    pub revoked_at: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct WorkerControlDelegationOperationRecord {
+    pub workspace_id: String,
+    pub source_controller: RuntimeWorkerRef,
+    pub source_grant_id: String,
+    pub operation_id: String,
+    pub input_fingerprint: String,
+    pub delegated_grant_id: Option<String>,
+    pub created_at: String,
+    pub completed_at: Option<String>,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct TicketWorkerAssignmentRecord {
     pub workspace_id: String,
@@ -732,6 +771,52 @@ pub trait ControlPlaneStore: Send + Sync {
     fn delete_worker_registry(&self, workspace_id: &str, worker: &RuntimeWorkerRef)
     -> Result<bool>;
 
+    fn create_worker_control_grant(
+        &self,
+        record: &WorkerControlGrantRecord,
+    ) -> Result<WorkerControlGrantRecord>;
+    fn get_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        grant_id: &str,
+    ) -> Result<Option<WorkerControlGrantRecord>>;
+    fn get_worker_control_grant_by_operation(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        operation_id: &str,
+    ) -> Result<Option<WorkerControlGrantRecord>>;
+    fn get_active_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        subject: &RuntimeWorkerRef,
+    ) -> Result<Option<WorkerControlGrantRecord>>;
+    fn list_active_worker_control_grants(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        limit: usize,
+    ) -> Result<Vec<WorkerControlGrantRecord>>;
+    fn revoke_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        grant_id: &str,
+        revoked_at: &str,
+    ) -> Result<bool>;
+    fn reserve_worker_control_delegation_operation(
+        &self,
+        record: &WorkerControlDelegationOperationRecord,
+    ) -> Result<WorkerControlDelegationOperationRecord>;
+    fn complete_worker_control_delegation_operation(
+        &self,
+        workspace_id: &str,
+        source_controller: &RuntimeWorkerRef,
+        operation_id: &str,
+        delegated_grant_id: &str,
+        completed_at: &str,
+    ) -> Result<WorkerControlDelegationOperationRecord>;
+
     fn get_ticket_assignment_operation(
         &self,
         workspace_id: &str,
@@ -2321,6 +2406,267 @@ impl ControlPlaneStore for SqliteWorkspaceStore {
         })
     }
 
+    fn create_worker_control_grant(
+        &self,
+        record: &WorkerControlGrantRecord,
+    ) -> Result<WorkerControlGrantRecord> {
+        self.with_conn(|conn| {
+            let permissions_json = serde_json::to_string(&record.permissions)
+                .map_err(|error| Error::Store(error.to_string()))?;
+            conn.execute(
+                r#"INSERT INTO worker_control_grants (
+                    workspace_id, grant_id,
+                    controller_runtime_id, controller_worker_id,
+                    subject_runtime_id, subject_worker_id,
+                    relation, origin, permissions_json, operation_id, created_at, revoked_at
+                ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)
+                ON CONFLICT (
+                    workspace_id,
+                    controller_runtime_id,
+                    controller_worker_id,
+                    operation_id
+                ) DO NOTHING"#,
+                params![
+                    record.workspace_id,
+                    record.grant_id,
+                    record.controller.runtime_id,
+                    record.controller.worker_id,
+                    record.subject.runtime_id,
+                    record.subject.worker_id,
+                    record.relation,
+                    record.origin,
+                    permissions_json,
+                    record.operation_id,
+                    record.created_at,
+                    record.revoked_at,
+                ],
+            )?;
+
+            let persisted = read_worker_control_grant_by_operation(
+                conn,
+                record.workspace_id.as_str(),
+                &record.controller,
+                record.operation_id.as_str(),
+            )?
+            .ok_or_else(|| Error::Store("worker control grant was not persisted".to_string()))?;
+            if persisted.subject != record.subject
+                || persisted.relation != record.relation
+                || persisted.origin != record.origin
+                || persisted.permissions != record.permissions
+            {
+                return Err(Error::InvalidInput(format!(
+                    "worker control operation `{}` was already used with different input",
+                    record.operation_id
+                )));
+            }
+            Ok(persisted)
+        })
+    }
+
+    fn get_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        grant_id: &str,
+    ) -> Result<Option<WorkerControlGrantRecord>> {
+        self.with_conn(|conn| {
+            conn.query_row(
+                r#"SELECT workspace_id, grant_id,
+                          controller_runtime_id, controller_worker_id,
+                          subject_runtime_id, subject_worker_id,
+                          relation, origin, permissions_json, operation_id, created_at, revoked_at
+                   FROM worker_control_grants
+                   WHERE workspace_id = ?1 AND grant_id = ?2"#,
+                params![workspace_id, grant_id],
+                read_worker_control_grant_record,
+            )
+            .optional()
+            .map_err(Error::from)
+        })
+    }
+
+    fn get_worker_control_grant_by_operation(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        operation_id: &str,
+    ) -> Result<Option<WorkerControlGrantRecord>> {
+        self.with_conn(|conn| {
+            read_worker_control_grant_by_operation(conn, workspace_id, controller, operation_id)
+        })
+    }
+
+    fn get_active_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        subject: &RuntimeWorkerRef,
+    ) -> Result<Option<WorkerControlGrantRecord>> {
+        self.with_conn(|conn| {
+            conn.query_row(
+                r#"SELECT workspace_id, grant_id,
+                          controller_runtime_id, controller_worker_id,
+                          subject_runtime_id, subject_worker_id,
+                          relation, origin, permissions_json, operation_id, created_at, revoked_at
+                   FROM worker_control_grants
+                   WHERE workspace_id = ?1
+                     AND controller_runtime_id = ?2 AND controller_worker_id = ?3
+                     AND subject_runtime_id = ?4 AND subject_worker_id = ?5
+                     AND revoked_at IS NULL
+                   ORDER BY created_at DESC
+                   LIMIT 1"#,
+                params![
+                    workspace_id,
+                    controller.runtime_id,
+                    controller.worker_id,
+                    subject.runtime_id,
+                    subject.worker_id,
+                ],
+                read_worker_control_grant_record,
+            )
+            .optional()
+            .map_err(Error::from)
+        })
+    }
+
+    fn list_active_worker_control_grants(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        limit: usize,
+    ) -> Result<Vec<WorkerControlGrantRecord>> {
+        self.with_conn(|conn| {
+            let mut stmt = conn.prepare(
+                r#"SELECT workspace_id, grant_id,
+                          controller_runtime_id, controller_worker_id,
+                          subject_runtime_id, subject_worker_id,
+                          relation, origin, permissions_json, operation_id, created_at, revoked_at
+                   FROM worker_control_grants
+                   WHERE workspace_id = ?1
+                     AND controller_runtime_id = ?2 AND controller_worker_id = ?3
+                     AND revoked_at IS NULL
+                   ORDER BY created_at ASC, grant_id ASC
+                   LIMIT ?4"#,
+            )?;
+            let rows = stmt.query_map(
+                params![
+                    workspace_id,
+                    controller.runtime_id,
+                    controller.worker_id,
+                    limit as i64,
+                ],
+                read_worker_control_grant_record,
+            )?;
+            rows.collect::<std::result::Result<Vec<_>, _>>()
+                .map_err(Error::from)
+        })
+    }
+
+    fn revoke_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        grant_id: &str,
+        revoked_at: &str,
+    ) -> Result<bool> {
+        self.with_conn(|conn| {
+            let changed = conn.execute(
+                r#"UPDATE worker_control_grants
+                   SET revoked_at = ?3
+                   WHERE workspace_id = ?1 AND grant_id = ?2 AND revoked_at IS NULL"#,
+                params![workspace_id, grant_id, revoked_at],
+            )?;
+            Ok(changed > 0)
+        })
+    }
+
+    fn reserve_worker_control_delegation_operation(
+        &self,
+        record: &WorkerControlDelegationOperationRecord,
+    ) -> Result<WorkerControlDelegationOperationRecord> {
+        self.with_conn(|conn| {
+            conn.execute(
+                r#"INSERT INTO worker_control_delegation_operations (
+                    workspace_id, source_controller_runtime_id, source_controller_worker_id,
+                    source_grant_id, operation_id, input_fingerprint,
+                    delegated_grant_id, created_at, completed_at
+                ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+                ON CONFLICT (
+                    workspace_id, source_controller_runtime_id,
+                    source_controller_worker_id, operation_id
+                ) DO NOTHING"#,
+                params![
+                    record.workspace_id,
+                    record.source_controller.runtime_id,
+                    record.source_controller.worker_id,
+                    record.source_grant_id,
+                    record.operation_id,
+                    record.input_fingerprint,
+                    record.delegated_grant_id,
+                    record.created_at,
+                    record.completed_at,
+                ],
+            )?;
+            let persisted = read_worker_control_delegation_operation_by_key(
+                conn,
+                &record.workspace_id,
+                &record.source_controller,
+                &record.operation_id,
+            )?
+            .ok_or_else(|| {
+                Error::Store("worker control delegation operation was not persisted".to_string())
+            })?;
+            if persisted.source_grant_id != record.source_grant_id
+                || persisted.input_fingerprint != record.input_fingerprint
+            {
+                return Err(Error::InvalidInput(format!(
+                    "worker control delegation operation `{}` was already used with different input",
+                    record.operation_id
+                )));
+            }
+            Ok(persisted)
+        })
+    }
+
+    fn complete_worker_control_delegation_operation(
+        &self,
+        workspace_id: &str,
+        source_controller: &RuntimeWorkerRef,
+        operation_id: &str,
+        delegated_grant_id: &str,
+        completed_at: &str,
+    ) -> Result<WorkerControlDelegationOperationRecord> {
+        self.with_conn(|conn| {
+            conn.execute(
+                r#"UPDATE worker_control_delegation_operations
+                   SET delegated_grant_id = ?5, completed_at = ?6
+                   WHERE workspace_id = ?1
+                     AND source_controller_runtime_id = ?2
+                     AND source_controller_worker_id = ?3
+                     AND operation_id = ?4
+                     AND (delegated_grant_id IS NULL OR delegated_grant_id = ?5)"#,
+                params![
+                    workspace_id,
+                    source_controller.runtime_id,
+                    source_controller.worker_id,
+                    operation_id,
+                    delegated_grant_id,
+                    completed_at,
+                ],
+            )?;
+            read_worker_control_delegation_operation_by_key(
+                conn,
+                workspace_id,
+                source_controller,
+                operation_id,
+            )?
+            .filter(|record| record.delegated_grant_id.as_deref() == Some(delegated_grant_id))
+            .ok_or_else(|| {
+                Error::InvalidInput(format!(
+                    "worker control delegation operation `{operation_id}` completed with a different grant"
+                ))
+            })
+        })
+    }
+
     fn get_ticket_assignment_operation(
         &self,
         workspace_id: &str,
@@ -3627,6 +3973,103 @@ fn read_worker_registry_record(row: &rusqlite::Row<'_>) -> rusqlite::Result<Work
     })
 }
 
+fn read_worker_control_grant_record(
+    row: &rusqlite::Row<'_>,
+) -> rusqlite::Result<WorkerControlGrantRecord> {
+    let permissions_json: String = row.get(8)?;
+    let permissions = serde_json::from_str(&permissions_json).map_err(|error| {
+        rusqlite::Error::FromSqlConversionFailure(8, rusqlite::types::Type::Text, Box::new(error))
+    })?;
+    Ok(WorkerControlGrantRecord {
+        workspace_id: row.get(0)?,
+        grant_id: row.get(1)?,
+        controller: RuntimeWorkerRef::new(
+            row.get::<_, String>(2)?,
+            row.get::<_, u64>(3)?.to_string(),
+        ),
+        subject: RuntimeWorkerRef::new(row.get::<_, String>(4)?, row.get::<_, u64>(5)?.to_string()),
+        relation: row.get(6)?,
+        origin: row.get(7)?,
+        permissions,
+        operation_id: row.get(9)?,
+        created_at: row.get(10)?,
+        revoked_at: row.get(11)?,
+    })
+}
+
+fn read_worker_control_grant_by_operation(
+    conn: &Connection,
+    workspace_id: &str,
+    controller: &RuntimeWorkerRef,
+    operation_id: &str,
+) -> Result<Option<WorkerControlGrantRecord>> {
+    conn.query_row(
+        r#"SELECT workspace_id, grant_id,
+                  controller_runtime_id, controller_worker_id,
+                  subject_runtime_id, subject_worker_id,
+                  relation, origin, permissions_json, operation_id, created_at, revoked_at
+           FROM worker_control_grants
+           WHERE workspace_id = ?1
+             AND controller_runtime_id = ?2 AND controller_worker_id = ?3
+             AND operation_id = ?4"#,
+        params![
+            workspace_id,
+            controller.runtime_id,
+            controller.worker_id,
+            operation_id,
+        ],
+        read_worker_control_grant_record,
+    )
+    .optional()
+    .map_err(Error::from)
+}
+
+fn read_worker_control_delegation_operation_record(
+    row: &rusqlite::Row<'_>,
+) -> rusqlite::Result<WorkerControlDelegationOperationRecord> {
+    Ok(WorkerControlDelegationOperationRecord {
+        workspace_id: row.get(0)?,
+        source_controller: RuntimeWorkerRef::new(
+            row.get::<_, String>(1)?,
+            row.get::<_, u64>(2)?.to_string(),
+        ),
+        source_grant_id: row.get(3)?,
+        operation_id: row.get(4)?,
+        input_fingerprint: row.get(5)?,
+        delegated_grant_id: row.get(6)?,
+        created_at: row.get(7)?,
+        completed_at: row.get(8)?,
+    })
+}
+
+fn read_worker_control_delegation_operation_by_key(
+    conn: &Connection,
+    workspace_id: &str,
+    source_controller: &RuntimeWorkerRef,
+    operation_id: &str,
+) -> Result<Option<WorkerControlDelegationOperationRecord>> {
+    conn.query_row(
+        r#"SELECT workspace_id,
+                  source_controller_runtime_id, source_controller_worker_id,
+                  source_grant_id, operation_id, input_fingerprint,
+                  delegated_grant_id, created_at, completed_at
+           FROM worker_control_delegation_operations
+           WHERE workspace_id = ?1
+             AND source_controller_runtime_id = ?2
+             AND source_controller_worker_id = ?3
+             AND operation_id = ?4"#,
+        params![
+            workspace_id,
+            source_controller.runtime_id,
+            source_controller.worker_id,
+            operation_id,
+        ],
+        read_worker_control_delegation_operation_record,
+    )
+    .optional()
+    .map_err(Error::from)
+}
+
 fn current_ticket_worker_assignment_select_sql() -> String {
     "SELECT a.workspace_id, a.ticket_id, a.assignment_id, a.runtime_id, a.worker_id, \
             a.assigned_by, a.assigned_at \
@@ -4639,6 +5082,92 @@ pub(crate) fn persist_workspace_config_schema_bundles(conn: &Connection) -> Resu
     Ok(())
 }
 
+fn create_worker_control_grant_authority(conn: &Connection) -> Result<()> {
+    conn.execute_batch(
+        r#"
+        CREATE TABLE worker_control_grants (
+            workspace_id TEXT NOT NULL,
+            grant_id TEXT NOT NULL,
+            controller_runtime_id TEXT NOT NULL,
+            controller_worker_id INTEGER NOT NULL,
+            subject_runtime_id TEXT NOT NULL,
+            subject_worker_id INTEGER NOT NULL,
+            relation TEXT NOT NULL,
+            origin TEXT NOT NULL,
+            permissions_json TEXT NOT NULL,
+            operation_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            revoked_at TEXT,
+            PRIMARY KEY (workspace_id, grant_id),
+            UNIQUE (
+                workspace_id,
+                controller_runtime_id,
+                controller_worker_id,
+                operation_id
+            ),
+            FOREIGN KEY (workspace_id, controller_runtime_id, controller_worker_id)
+                REFERENCES worker_registry (workspace_id, runtime_id, runtime_worker_id)
+                ON DELETE CASCADE,
+            FOREIGN KEY (workspace_id, subject_runtime_id, subject_worker_id)
+                REFERENCES worker_registry (workspace_id, runtime_id, runtime_worker_id)
+                ON DELETE CASCADE
+        );
+
+        CREATE INDEX idx_worker_control_grants_controller_active
+            ON worker_control_grants (
+                workspace_id,
+                controller_runtime_id,
+                controller_worker_id,
+                revoked_at,
+                created_at
+            );
+
+        CREATE INDEX idx_worker_control_grants_subject_active
+            ON worker_control_grants (
+                workspace_id,
+                subject_runtime_id,
+                subject_worker_id,
+                revoked_at
+            );
+        "#,
+    )?;
+    Ok(())
+}
+
+fn create_worker_control_delegation_operation_authority(conn: &Connection) -> Result<()> {
+    conn.execute_batch(
+        r#"
+        CREATE TABLE worker_control_delegation_operations (
+            workspace_id TEXT NOT NULL,
+            source_controller_runtime_id TEXT NOT NULL,
+            source_controller_worker_id INTEGER NOT NULL,
+            source_grant_id TEXT NOT NULL,
+            operation_id TEXT NOT NULL,
+            input_fingerprint TEXT NOT NULL,
+            delegated_grant_id TEXT,
+            created_at TEXT NOT NULL,
+            completed_at TEXT,
+            PRIMARY KEY (
+                workspace_id,
+                source_controller_runtime_id,
+                source_controller_worker_id,
+                operation_id
+            ),
+            FOREIGN KEY (workspace_id, source_controller_runtime_id, source_controller_worker_id)
+                REFERENCES worker_registry (workspace_id, runtime_id, runtime_worker_id)
+                ON DELETE CASCADE,
+            FOREIGN KEY (workspace_id, source_grant_id)
+                REFERENCES worker_control_grants (workspace_id, grant_id)
+                ON DELETE CASCADE,
+            FOREIGN KEY (workspace_id, delegated_grant_id)
+                REFERENCES worker_control_grants (workspace_id, grant_id)
+                ON DELETE SET NULL
+        );
+        "#,
+    )?;
+    Ok(())
+}
+
 fn create_worker_mutation_source_proof_replay_guard(conn: &Connection) -> Result<()> {
     conn.execute_batch(
         r#"
@@ -5312,7 +5841,7 @@ CREATE TABLE ticket_worker_links (ticket_id TEXT, worker_ref_key TEXT);
 
         apply_migrations(&conn).unwrap();
 
-        assert_eq!(current_schema_version(&conn).unwrap(), 32);
+        assert_eq!(current_schema_version(&conn).unwrap(), 34);
         assert!(table_exists(&conn, "worker_workdir_attachment_reservations").unwrap());
     }
 
@@ -5345,7 +5874,7 @@ CREATE TABLE flow_events (event_id TEXT PRIMARY KEY);
 
         apply_migrations(&conn).unwrap();
 
-        assert_eq!(current_schema_version(&conn).unwrap(), 32);
+        assert_eq!(current_schema_version(&conn).unwrap(), 34);
         assert!(table_exists(&conn, "flow_sources").unwrap());
         assert!(table_exists(&conn, "flow_source_revisions").unwrap());
         assert!(!table_exists(&conn, "flow_instances").unwrap());
@@ -5412,7 +5941,7 @@ INSERT INTO worker_workdir_attachment_reservations (
 
         apply_migrations(&conn).unwrap();
 
-        assert_eq!(current_schema_version(&conn).unwrap(), 32);
+        assert_eq!(current_schema_version(&conn).unwrap(), 34);
         let repositories_sql: String = conn
             .query_row(
                 "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'repositories'",
@@ -5592,7 +6121,7 @@ INSERT INTO workdir_registry (
         let db = dir.path().join("control-plane.sqlite");
         let store = SqliteWorkspaceStore::open(&db).unwrap();
 
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 34);
         assert!(
             !store
                 .with_conn(|conn| table_exists(conn, "worker_workspace_credentials"))
@@ -5609,7 +6138,7 @@ INSERT INTO workdir_registry (
         store.upsert_workspace(&record).await.unwrap();
 
         let reopened = SqliteWorkspaceStore::open(&db).unwrap();
-        assert_eq!(reopened.schema_version().await.unwrap(), 32);
+        assert_eq!(reopened.schema_version().await.unwrap(), 34);
         assert_eq!(
             reopened.get_workspace("local-dev").await.unwrap(),
             Some(record)
@@ -6156,7 +6685,7 @@ INSERT INTO workdir_registry (
         .unwrap();
 
         let store = SqliteWorkspaceStore::from_connection(conn).unwrap();
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 34);
 
         store
             .with_conn(|conn| {
@@ -6345,7 +6874,7 @@ CREATE TABLE ticket_assignment_operations (
     #[tokio::test]
     async fn repository_records_round_trip() {
         let store = SqliteWorkspaceStore::in_memory().unwrap();
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 34);
         let workspace = WorkspaceRecord {
             workspace_id: "local-dev".to_string(),
             owner_account_id: None,
@@ -6411,7 +6940,7 @@ CREATE TABLE ticket_assignment_operations (
     #[tokio::test]
     async fn memory_authority_records_round_trip_and_close_staging() {
         let store = SqliteWorkspaceStore::in_memory().unwrap();
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 34);
         let workspace = WorkspaceRecord {
             workspace_id: "local-dev".to_string(),
             owner_account_id: None,
@@ -6671,10 +7200,138 @@ CREATE TABLE ticket_assignment_operations (
         );
     }
 
+    #[tokio::test]
+    async fn worker_control_grants_are_idempotent_scoped_and_revocable() {
+        let dir = tempfile::tempdir().unwrap();
+        let database = dir.path().join("control-grants.db");
+        let store = SqliteWorkspaceStore::open(&database).unwrap();
+        store
+            .upsert_workspace(&WorkspaceRecord {
+                workspace_id: "workspace-control".to_string(),
+                owner_account_id: None,
+                display_name: "Control grants".to_string(),
+                state: "active".to_string(),
+                created_at: "2026-07-27T00:00:00Z".to_string(),
+                updated_at: "2026-07-27T00:00:00Z".to_string(),
+            })
+            .await
+            .unwrap();
+        let worker_record = |worker_id: &str, display_name: &str| WorkerRegistryRecord {
+            workspace_id: "workspace-control".to_string(),
+            worker: RuntimeWorkerRef::new("runtime-a", worker_id),
+            display_name: display_name.to_string(),
+            profile: None,
+            retention_state: "normal".to_string(),
+            transcript_ref: None,
+            session_ref: None,
+            summary_ref: None,
+            diagnostics_ref: None,
+            created_at: "2026-07-27T00:00:00Z".to_string(),
+            updated_at: "2026-07-27T00:00:00Z".to_string(),
+        };
+        let controller_record = worker_record("1", "Controller");
+        let subject_record = worker_record("2", "Subject");
+        store.upsert_worker_registry(&controller_record).unwrap();
+        store.upsert_worker_registry(&subject_record).unwrap();
+
+        let grant = WorkerControlGrantRecord {
+            workspace_id: "workspace-control".to_string(),
+            grant_id: "grant-1".to_string(),
+            controller: controller_record.worker.clone(),
+            subject: subject_record.worker.clone(),
+            relation: "spawned".to_string(),
+            origin: "worker_spawn".to_string(),
+            permissions: vec![
+                "observe".to_string(),
+                "send_input".to_string(),
+                "stop".to_string(),
+            ],
+            operation_id: "spawn-op-1".to_string(),
+            created_at: "2026-07-27T00:00:01Z".to_string(),
+            revoked_at: None,
+        };
+        assert_eq!(store.create_worker_control_grant(&grant).unwrap(), grant);
+        assert_eq!(store.create_worker_control_grant(&grant).unwrap(), grant);
+        assert_eq!(
+            store
+                .list_active_worker_control_grants(
+                    "workspace-control",
+                    &controller_record.worker,
+                    10,
+                )
+                .unwrap(),
+            vec![grant.clone()]
+        );
+        assert_eq!(
+            store
+                .get_active_worker_control_grant(
+                    "workspace-control",
+                    &controller_record.worker,
+                    &subject_record.worker,
+                )
+                .unwrap(),
+            Some(grant.clone())
+        );
+
+        drop(store);
+        let store = SqliteWorkspaceStore::open(&database).unwrap();
+        assert_eq!(
+            store
+                .list_active_worker_control_grants(
+                    "workspace-control",
+                    &controller_record.worker,
+                    10,
+                )
+                .unwrap(),
+            vec![grant.clone()],
+            "known Runtime Worker grants survive Backend restart"
+        );
+
+        let conflicting_replay = WorkerControlGrantRecord {
+            subject: controller_record.worker.clone(),
+            ..grant.clone()
+        };
+        assert!(matches!(
+            store.create_worker_control_grant(&conflicting_replay),
+            Err(Error::InvalidInput(_))
+        ));
+        assert!(
+            store
+                .revoke_worker_control_grant(
+                    "workspace-control",
+                    &grant.grant_id,
+                    "2026-07-27T00:00:02Z",
+                )
+                .unwrap()
+        );
+        assert!(
+            store
+                .list_active_worker_control_grants(
+                    "workspace-control",
+                    &controller_record.worker,
+                    10,
+                )
+                .unwrap()
+                .is_empty()
+        );
+        assert!(
+            store
+                .delete_worker_registry("workspace-control", &subject_record.worker)
+                .unwrap()
+        );
+        assert!(
+            store
+                .get_worker_control_grant("workspace-control", &grant.grant_id)
+                .unwrap()
+                .is_none(),
+            "deleting a subject Worker cascades its durable control grants"
+        );
+    }
+
     #[tokio::test]
     async fn account_and_login_records_round_trip() {
         let store = SqliteWorkspaceStore::in_memory().unwrap();
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 34);
         let now = "2026-07-22T00:00:00Z".to_string();
         let account = AccountRecord {
             account_id: "acct-user-alice".to_string(),

resources/profiles/base.dcdl

@@ -26,7 +26,7 @@ feature = {
     memory = { enabled = true; };
     web = { enabled = true; };
     image = { enabled = true; };
-    sub_worker = { enabled = true; };
+    sub_worker = { enabled = false; };
     worker = { enabled = false; };
     objective = { enabled = true; };
     ticket = { enabled = true; authoring = true; thread = true; };

resources/profiles/coder.dcdl

@@ -10,7 +10,7 @@ import "./base.dcdl" // {
         web = { enabled = true; };
         sub_worker = { enabled = true; };
         flow = { enabled = true; };
-        worker = { enabled = false; };
+        worker = { enabled = true; };
         ticket = { enabled = true; thread = true; };
     };
 }

resources/prompts/common/worker-observation.md

@@ -2,7 +2,7 @@
 
 Worker-session tools are a read-only exploration surface over host-granted active Worker sessions.
 
-- Use `ListWorkerSessions` to discover only the sessions already granted to you. Reuse the returned structured `subject` exactly: Runtime peers use `{ kind: "runtime_worker", runtime_id, worker_id }`, while parent-owned children use `{ kind: "sub_worker", name }`. Do not guess subject identifiers.
+- Use `WorkerList` to discover known Workers and reuse its returned structured `subject` exactly. Runtime Workers use `{ kind: "runtime_worker", runtime_id, worker_id }`, while parent-owned children use `{ kind: "sub_worker", name }`. Do not guess subject identifiers.
 - Use `ViewSessionOverview` for sparse orientation, `SearchSessionEntries` for bounded range/filter queries, and `ReadSessionEntry` for one bounded entry.
 - `SessionEntryRef` is the common entry identity across overview, search, reads, and evidence conversion. Reuse returned `E...` values; never invent them.
 - Every operation rereads the latest committed capture. Existing references remain stable when entries append.