feat: connect Subject Ticket assignments across public execution paths

crates/server-api/src/lib.rs

@@ -8092,6 +8092,9 @@ pub struct TicketAssignmentSummary {
 #[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
 #[cfg_attr(feature = "typescript", ts(tag = "kind", rename_all = "snake_case"))]
 pub enum TicketAssignmentPrincipal {
+    Subject {
+        subject_id: String,
+    },
     User {
         account_id: String,
     },

crates/server-api/tests/ticket_subject_contract.rs

@@ -0,0 +1,45 @@
+use server_api::{SetTicketRoleAssignmentRequest, TicketAssignmentPrincipal, TicketQueryRequest};
+
+#[test]
+fn subject_assignment_and_query_use_the_same_exact_principal_identity() {
+    for subject_id in ["subject-a", "subject-b"] {
+        let principal = serde_json::json!({ "kind": "subject", "subject_id": subject_id });
+        let assign: SetTicketRoleAssignmentRequest = serde_json::from_value(serde_json::json!({
+            "operation_id": "assign-subject", "expected_assignment_id": null, "principal": principal
+        }))
+        .unwrap();
+        assert!(
+            matches!(assign.principal, TicketAssignmentPrincipal::Subject { subject_id: ref id } if id == subject_id)
+        );
+        let query: TicketQueryRequest = serde_json::from_value(serde_json::json!({
+            "assigned_principal": principal
+        }))
+        .unwrap();
+        assert_eq!(
+            serde_json::to_value(query.assigned_principal).unwrap(),
+            principal
+        );
+        assert_eq!(serde_json::to_value(assign.principal).unwrap(), principal);
+    }
+}
+
+#[test]
+fn assignment_principal_keeps_legacy_audit_and_rejects_subject_identity_spoofing() {
+    for principal in [
+        serde_json::json!({ "kind": "user", "account_id": "alice" }),
+        serde_json::json!({ "kind": "worker", "runtime_id": "runtime", "worker_id": "worker" }),
+        serde_json::json!({ "kind": "workspace_agent", "agent_key": "workspace-orchestrator" }),
+    ] {
+        let retained: TicketAssignmentPrincipal =
+            serde_json::from_value(principal.clone()).unwrap();
+        assert_eq!(serde_json::to_value(retained).unwrap(), principal);
+    }
+    for malformed in [
+        serde_json::json!({ "kind": "subject" }),
+        serde_json::json!({ "kind": "subject", "subject_id": 1 }),
+        serde_json::json!({ "kind": "subject", "subject_id": "a", "worker_id": "old-body" }),
+        serde_json::json!({ "kind": "subject", "subject_id": "a", "agent_key": "workspace-orchestrator" }),
+    ] {
+        assert!(serde_json::from_value::<TicketAssignmentPrincipal>(malformed).is_err());
+    }
+}