fix: reuse scoped validation evidence without reusing approval

T-847: separate complete-candidate review responsibility from rerunning unchanged checks, retain source/environment provenance and unverified outcomes, and align coder-review handoff retry identity with the Host-owned tool contract. Verify fresh Profile, Ticket/MR guidance, and actual builtin Flow input composition. Also covers T-850 instruction wiring; real-model operational comparisons remain outstanding.

crates/flow/src/builtin.rs

@@ -72,6 +72,41 @@ mod tests {
         }
     }
 
+    #[test]
+    fn compiled_handoff_uses_host_owned_retry_identity() {
+        let flow = builtin_flow_source(CODER_REVIEW_FLOW_SLUG)
+            .unwrap()
+            .compile()
+            .unwrap();
+        let complete = flow
+            .state(&crate::StateId::new("complete").unwrap())
+            .unwrap();
+        assert!(
+            complete
+                .instructions
+                .contains("The Host owns transport retry identity")
+        );
+        assert!(
+            complete
+                .instructions
+                .contains("do not supply operation_key")
+        );
+        assert!(!complete.instructions.contains("same key and full input"));
+        let fix = flow.state(&crate::StateId::new("fix").unwrap()).unwrap();
+        assert!(
+            fix.instructions
+                .contains("rerun validation affected by the fixes")
+        );
+        assert!(
+            fix.instructions
+                .contains("Cite reusable evidence for unaffected scope")
+        );
+        assert!(
+            fix.instructions
+                .contains("Source movement invalidates the prior verdict")
+        );
+    }
+
     #[test]
     fn every_builtin_flow_compiles_and_matches_catalog_identity() {
         assert!(!builtin_flow_sources().is_empty());

crates/worker/src/prompt/catalog.rs

@@ -823,6 +823,20 @@ mod tests {
         assert!(prompt.contains("SubmitBackendJobResult"));
     }
 
+    #[test]
+    fn flow_verifier_reuses_inspected_evidence_without_claiming_live_read_authority() {
+        let prompt = PromptCatalog::builtins_only()
+            .unwrap()
+            .flow_verifier_system()
+            .unwrap();
+        assert!(prompt.contains("stable entry references"));
+        assert!(prompt.contains("unchanged tree under equivalent conditions"));
+        assert!(prompt.contains("never transfers an old approval or authority"));
+        assert!(prompt.contains("cannot perform live MR or other-session reads"));
+        assert!(prompt.contains("return `indeterminate`"));
+        assert!(prompt.contains("FinishFlowVerification"));
+    }
+
     #[test]
     fn merge_request_prompts_keep_recording_and_reviewer_contracts() {
         let catalog = PromptCatalog::builtins_only().unwrap();

crates/worker/src/worker.rs

@@ -16148,6 +16148,10 @@ mod build_summary_prompt_tests {
         assert!(worker.history().is_empty());
     }
 
+    mod prompt_wiring_tests {
+        include!("worker/prompt_wiring_tests.rs");
+    }
+
     #[tokio::test]
     async fn worker_without_initial_system_prompt_does_not_load_feature_contribution() {
         let dir = tempfile::tempdir().unwrap();

crates/worker/src/worker/prompt_wiring_tests.rs

@@ -0,0 +1,180 @@
+// Construction coverage only, not model-behavior measurement or a restored prompt update.
+use super::*;
+use crate::feature::builtin::ticket::{TicketFeature, TicketFeatureAccess};
+
+#[derive(Debug)]
+struct GuidanceHost;
+impl WorkspaceClient for GuidanceHost {
+    fn workspace_id(&self) -> Option<&str> {
+        Some("workspace-test")
+    }
+    fn kind(&self) -> &str {
+        "guidance-fixture"
+    }
+    fn is_available(&self) -> bool {
+        true
+    }
+    fn authorize_feature_activation(&self, _feature: &str) -> Result<(), WorkspaceClientError> {
+        // This fixture tests construction, not Backend authorization policy.
+        Ok(())
+    }
+    fn execute(
+        &self,
+        request: WorkspaceRequest,
+    ) -> Result<WorkspaceResponse, WorkspaceClientError> {
+        if request.path.ends_with("/authorization/check") {
+            return Ok(WorkspaceResponse {
+                status: 200,
+                body: "{}".into(),
+            });
+        }
+        assert_eq!(request.path, "/api/w/workspace-test/flows/resolve");
+        let definition = flow::builtin_flow_source("coder-review")
+            .unwrap()
+            .compile()
+            .unwrap();
+        let source = flow::ResolvedFlowSource {
+            selector: "builtin:coder-review".parse().unwrap(),
+            workspace_id: "workspace-test".into(),
+            flow_id: "guidance-fixture".into(),
+            content_digest: definition.content_digest.clone(),
+            definition,
+        };
+        Ok(WorkspaceResponse {
+            status: 200,
+            body: serde_json::to_string(&source).unwrap(),
+        })
+    }
+}
+
+#[tokio::test]
+async fn fresh_builtin_profiles_materialize_validation_guidance() {
+    for (profile, guidance) in [
+        ("coder", "own diagnosis, test selection, and fix iterations"),
+        ("orchestrator", "Same-named files on separate branches"),
+        ("reviewer", "Responsibility for the complete snapshot"),
+    ] {
+        let dir = tempfile::tempdir().unwrap();
+        let manifest = manifest::ProfileResolver::new()
+            .with_workspace_base(dir.path())
+            .resolve(
+                &manifest::ProfileSelector::parse_cli(&format!("builtin:{profile}")),
+                manifest::ProfileResolveOptions::with_worker_name("prompt-wiring"),
+            )
+            .unwrap()
+            .manifest;
+        let instruction = manifest.engine.instruction.clone();
+        let config = manifest.feature.merge_request;
+        let ticket = &manifest.feature.ticket;
+        let access = TicketFeatureAccess {
+            authoring: ticket.authoring,
+            thread: ticket.thread,
+            intake: ticket.intake,
+            workflow: ticket.workflow,
+        };
+        let orchestration = manifest.feature.sub_worker.enabled || manifest.feature.worker.enabled;
+        assert!(config.any() && ticket.enabled);
+        let cwd = dir.path().join("workspace");
+        std::fs::create_dir_all(&cwd).unwrap();
+        let mut worker = Worker::new(
+            manifest,
+            Engine::<_, Mutable, SessionHistoryMetadata>::new_annotated(NoopClient),
+            session_store::FsStore::new(dir.path().join("sessions")).unwrap(),
+            WorkerWorkspaceContext::with_client(
+                Some(WorkspaceId::new("workspace-test").unwrap()),
+                Arc::new(GuidanceHost),
+            ),
+            WorkerFilesystemAuthority::local(cwd.clone(), cwd.clone()),
+            Scope::writable(&cwd).unwrap(),
+        )
+        .await
+        .unwrap();
+        let feature = crate::feature::builtin::merge_request::MergeRequestFeature::new(
+            worker.workspace_client_handle(),
+            config,
+        );
+        let report = worker.install_features(
+            FeatureRegistryBuilder::new()
+                .with_module(feature)
+                .with_module(TicketFeature::new(worker.workspace_client_handle(), access)),
+        );
+        assert!(
+            !report.has_errors(),
+            "{profile}: {}",
+            report.error_message()
+        );
+        if orchestration {
+            worker.register_worker_orchestration_instruction();
+        }
+        worker.set_system_prompt_template(
+            SystemPromptTemplate::parse(
+                &instruction,
+                crate::prompt::source::PromptCatalogSource::builtins_only(),
+            )
+            .unwrap(),
+        );
+        worker.ensure_system_prompt_materialized().await.unwrap();
+        let prompt = worker.engine().get_system_prompt().unwrap();
+        assert!(prompt.contains(guidance), "{profile}");
+        assert_eq!(
+            prompt.matches("Record validation evidence once").count(),
+            1,
+            "{profile}"
+        );
+        assert_eq!(
+            prompt.matches("Record a Ticket dependency when").count(),
+            1,
+            "{profile}"
+        );
+        assert!(prompt.contains("rerun affected or uncertain checks"));
+        assert!(prompt.contains("Changed source or requirements need fresh attestation"));
+        if orchestration {
+            assert!(prompt.contains("SubWorkerSpawn"));
+            assert!(prompt.contains("delegated authority"));
+        }
+        if profile == "coder" {
+            worker.ensure_segment_head().await.unwrap();
+            let report = worker.install_runtime_flow_transition_feature().unwrap();
+            assert!(!report.has_errors(), "{}", report.error_message());
+            let (segments, state, projection) = worker
+                .prepare_flow_input(vec![Segment::Flow {
+                    selector: "builtin:coder-review".into(),
+                }])
+                .unwrap();
+            let state = state.expect("new Flow");
+            let builtin = flow::builtin_flow_source("coder-review")
+                .unwrap()
+                .compile()
+                .unwrap();
+            let entry = worker.projected_input_history(
+                &segments,
+                projection.as_ref(),
+                &[SessionHistoryEntryId::new()],
+                &WorkerHistoryProvenance::HumanInput {
+                    account_id: "fixture".into(),
+                },
+            );
+            assert_eq!(entry.len(), 1);
+            assert!(matches!(
+                entry[0].annotation.origin,
+                WorkerHistoryProvenance::FlowInstruction { .. }
+            ));
+            assert_eq!(
+                entry[0].item.as_text().as_deref(),
+                Some(
+                    builtin
+                        .state(&builtin.initial)
+                        .unwrap()
+                        .instructions
+                        .as_str()
+                )
+            );
+            // The resolved immutable Flow, rather than a hard-coded test recipe, was installed.
+            assert!(
+                serde_json::to_string(&state)
+                    .unwrap()
+                    .contains(&builtin.content_digest)
+            );
+        }
+    }
+}

docs/development/work-items.md

@@ -34,4 +34,8 @@ Assignは担当への委譲であり、readyやQueueの操作を前提にしな
 
 source変更後は変更後のsourceを再レビューする。targetだけの変化では、未変更sourceへの承認と統合可否の再確認を区別する。通常の修正・再レビュー証拠はMerge Requestに置き、Ticketには調整が必要な阻害要因、決定、最終引継ぎを残す。
 
+再レビューの判断対象は現在の候補全体だが、全試験の再実行とは区別する。同一tree・同等条件の証拠は再利用し、新しい差分では依存・lockfile・feature・生成物・共有初期化・migration・環境への影響から必要な試験を選ぶ。元のsource／dirty snapshot、command、条件、exit／timeoutと到達範囲、ログ参照、未解決事項を一度記録し、後続報告では参照する。再利用した証拠を新sourceでの実行成功と呼ばず、旧承認を新候補へ移さない。
+
+組込みPrompt／Flowの変更は、保存済みWorker指示や既存Flow定義を自動更新しない。新規Profileからの指示構成・Flowコンパイルの試験と、実モデルでの待機・再試験・出力量の測定を区別する。前者だけで運用改善を実証済みとしない。
+
 統合、Ticketの結論、Worker停止、接続解除、資源削除は別の判断である。対応終了後の担当表示の保持と、未完作業による資源拘束も区別する。終了通知や最終回答だけから後続操作を開始せず、依頼範囲と現在の正本を確認する。未反映の変更を統合済みと報告しない。

resources/flows/coder-review.dcdl

@@ -33,7 +33,7 @@
         };
 
         fix = {
-            instructions = "Resolve every open Reviewer finding on the same Ticket work branch and existing Merge Request source selector, rerun validation affected by the fixes, and commit the corrected implementation. Publish only that updated source ref with a normal non-force push and verify that the provider resolves it to exact new HEAD. Source movement invalidates the prior verdict, so request a fresh Reviewer child after publication. Do not open a replacement Merge Request, invent an operation to append another source candidate, create a fresh integration branch, rewrite previously reviewed commits, reuse the prior request_changes result as approval, push the target branch, push tags or unrelated refs, force-push, merge, delete branches, or discard pre-existing changes. Request a Flow transition only after the corrected source ref is published and ready for fresh independent review.";
+            instructions = "Resolve every open Reviewer finding on the same Ticket work branch and existing Merge Request source selector, rerun validation affected by the fixes, and commit the corrected implementation. Cite reusable evidence for unaffected scope under equivalent conditions, including its original source and execution conditions; do not claim those checks were rerun on the new source. Assess dependencies, features, generated code, shared initialization, migrations, and environment when choosing the affected checks. Fresh independent judgment covers the complete current candidate without automatically rerunning every prior suite. Publish only that updated source ref with a normal non-force push and verify that the provider resolves it to exact new HEAD. Source movement invalidates the prior verdict, so request a fresh Reviewer child after publication. Do not open a replacement Merge Request, invent an operation to append another source candidate, create a fresh integration branch, rewrite previously reviewed commits, reuse the prior request_changes result as approval, push the target branch, push tags or unrelated refs, force-push, merge, delete branches, or discard pre-existing changes. Request a Flow transition only after the corrected source ref is published and ready for fresh independent review.";
             transitions = {
                 review = {
                     target = "review";
@@ -43,7 +43,7 @@
         };
 
         complete = {
-            instructions = "Call `ShowMergeRequest` and verify that authoritative approval still matches the exact current source ref, Ticket content digest, and complete linked result snapshot, keep that reviewed source ref immutable, save concise implementation and validation evidence with `TicketImplementationResult` using the Ticket, stable operation_key, kind, bounded body and optional retained MR/source evidence. Backend authenticates an active Workspace Worker; no current or pinned implementation assignment or Orchestrator delegation is required. Other or previously assigned Workers may report facts without fulfilling an assignment or gaining authority. Do not supply assignment identities or model actor claims. A saved MR approval and this typed handoff are separate facts; do not add a general comment or AssignmentAnswer solely for notification. Target-only movement does not invalidate this source approval; the Orchestrator refreshes readiness/integration evidence against the current target. Do not call `CompleteMergeRequest`, update the target selector, create an integration branch, or treat the Flow terminal state as Ticket completion authority. After the typed result receipt exists, request a Flow transition. Retry unknown outcomes only with the same key and full input.";
+            instructions = "Call `ShowMergeRequest` and verify that authoritative approval still matches the exact current source ref, Ticket content digest, and complete linked result snapshot, keep that reviewed source ref immutable, save concise implementation and validation evidence with `TicketImplementationResult` using the Ticket, kind, bounded body and optional retained MR/source evidence. The Host owns transport retry identity; do not supply operation_key. Backend authenticates an active Workspace Worker; no current or pinned implementation assignment or Orchestrator delegation is required. Other or previously assigned Workers may report facts without fulfilling an assignment or gaining authority. Do not supply assignment identities or model actor claims. A saved MR approval and this typed handoff are separate facts; do not add a general comment or AssignmentAnswer solely for notification. Target-only movement does not invalidate this source approval; the Orchestrator refreshes readiness/integration evidence against the current target. Do not call `CompleteMergeRequest`, update the target selector, create an integration branch, or treat the Flow terminal state as Ticket completion authority. After the typed result receipt exists, request a Flow transition. If the report outcome is uncertain, reconcile saved evidence before a new invocation; a new invocation is a new report, not a transport retry.";
             transitions = {
                 completed = {
                     target = "done";

resources/prompts/common/merge-request.md

@@ -6,4 +6,6 @@ MR bookkeeping is separate from selecting and adopting changes. `CompleteMergeRe
 
 When using MRs, address each by `merge_request_id`. Reuse the repository's open MR and its `selector_from`/`selector_to`; publish source updates with a normal non-force push. Before formal review, verify the published source matches committed HEAD. Keep review/fix evidence on the MR, not repeated Ticket comments.
 
+Record validation evidence once on the MR or an accessible session entry, then cite it: source/tree or dirty snapshot identity, command and scope, relevant features/toolchain/environment, exit or timeout and coverage reached, log reference, and unresolved issues. Reuse evidence for unchanged code under equivalent conditions. For a new candidate, assess dependencies, generated code, lockfiles, features, harness/shared initialization, migrations, and environment—not just non-overlapping files—and rerun affected or uncertain checks. Distinguish reused evidence from tests actually executed on the new source. Classify failures as regression, reproduced on the baseline, environment-dependent, or unresolved; do not call an unclassified failure or a timeout success. Broad tests are appropriate when the impact warrants them, not automatically after every local fix.
+
 Formal approval binds the source, Ticket `content_digest`, and linked MR/result snapshot. Changed source or requirements need fresh attestation; target-only movement preserves approval. `CheckMergeRequestReadiness` checks this recording workflow. Ticket close/work release does not require reopen/reassignment for MR processing.

resources/prompts/common/worker-observation.md

@@ -5,6 +5,7 @@ Worker-session tools are a read-only exploration surface over host-granted activ
 - Use `WorkerList` to discover known Workers and reuse its returned structured `subject` exactly. Runtime Workers use `{ kind: "runtime_worker", runtime_id, worker_id }`, while parent-owned children use `{ kind: "sub_worker", name }`. Do not guess subject identifiers.
 - Use `ViewSessionOverview` for sparse orientation, `SearchSessionEntries` for bounded range/filter queries, and `ReadSessionEntry` for one bounded entry.
 - `SessionEntryRef` is the common entry identity across overview, search, reads, and evidence conversion. Reuse returned `E...` values; never invent them.
+- For routine progress, read new results, failures, and blockers with their stable evidence references rather than reopening and transcribing all earlier logs. Before adoption or completion, inspect the concrete evidence relevant to that decision; an inaccessible reference remains unverified. Keep handling updates focused on current status, next action, and material result references.
 - Every operation rereads the latest committed capture. Existing references remain stable when entries append.
 - A missing subject and an unauthorized subject intentionally produce the same result. Treat either as inaccessible.
 - Observation is not mutation authority and does not prove approval, completion, or Ticket state. Reread the relevant domain authority before acting.

resources/prompts/internal/flow_verifier_system.md

@@ -4,6 +4,10 @@ The host gives you one immutable attempt snapshot containing the current state,
 
 Use ShowOverview, SearchEntries, and ReadEntry to inspect bounded committed parent-session evidence. When read-only Workdir tools are available, use Read, Glob, and Grep only as needed to check current repository evidence. You have no authority to mutate files, Tickets, Memory, Workers, Workdirs, Flow state, or any other domain.
 
+Use stable entry references in the capture to inspect already-recorded validation rather than requiring the parent to repeat the same logs or commands. Evidence from an unchanged tree under equivalent conditions can remain applicable; for a changed candidate, inspect the impact on dependencies, generated code, features, shared initialization, migrations, and environment before reusing unaffected evidence. Reuse is not a claim that checks ran on the new source, and never transfers an old approval or authority.
+
+A reference alone is not verification: inaccessible evidence, timeouts, and checks that did not reach their target remain unverified. You cannot perform live MR or other-session reads with tools that are not provided. If a condition requires a current authoritative observation that the captured evidence cannot establish, return `indeterminate`; do not invent freshness or demand copied prose as a substitute.
+
 For every supplied transition, decide exactly one verdict:
 
 - `met`: the available evidence establishes the condition.

resources/prompts/role/reviewer.md

@@ -2,4 +2,6 @@ You are the independent MR Reviewer, a direct SubWorker of the review requester.
 
 Evaluate the captured MR subject, Ticket `content_digest`, and complete linked MR/result snapshot against the Ticket requirements. Approval attests that snapshot, not just the selected diff. You may use Bash for Git and other commands.
 
+Independently inspect the current candidate and its impact boundary. Responsibility for the complete snapshot does not require rerunning every unchanged test: verify and cite applicable prior evidence, execute affected or uncertain checks, and make a fresh judgment for the current snapshot. Inaccessible evidence remains unverified, and an old approval is never transferable to a changed source or requirements.
+
 Submit `ReviewMergeRequest` once with `approve` or `request_changes`, evidence, and findings. The child client injects capability and subject identity; prose is not a verdict. Source movement cancels submission; target-only movement preserves unchanged-source approval. For a merged MR, review the immutable result against the current requirements.