merge: orchestration

.yoi/tickets/00001KX6WVNPD/artifacts/orchestration-plan.jsonl

@@ -1,2 +1,3 @@
 {"id":"orch-plan-20260710-220020-1","ticket_id":"00001KX6WVNPD","kind":"after","related_ticket":"00001KX6Y2A9Q","note":"Ticket has explicit typed `depends_on` relation to `00001KX6Y2A9Q`. That prerequisite is currently `inprogress` implementing the WorkerFilesystemAuthority boundary this Ticket relies on. Start only after `00001KX6Y2A9Q` is approved, merged, and closed or an explicit combined-work decision is made.","author":"orchestrator","at":"2026-07-10T22:00:20Z"}
 {"id":"orch-plan-20260710-220024-2","ticket_id":"00001KX6WVNPD","kind":"waiting_capacity_note","note":"Dashboard queue routing inspected. This Ticket is otherwise concrete, but typed relation metadata reports blocker `00001KX6Y2A9Q` in state `inprogress`. That prerequisite introduces/removes the Worker filesystem-authority/cwd boundary used by this Ticket. Starting now would duplicate or conflict with that refactor. Leave queued and re-route after prerequisite merge/close.","author":"orchestrator","at":"2026-07-10T22:00:24Z"}
+{"id":"orch-plan-20260710-233758-3","ticket_id":"00001KX6WVNPD","kind":"accepted_plan","accepted_plan":{"summary":"Implement embedded Runtime no-workdir Worker creation policy using the merged `WorkerFilesystemAuthority` boundary: embedded Runtime may create Workers without selected workdir using `WorkerFilesystemAuthority::None`, non-embedded/local-authority paths preserve workdir requirements, no-workdir Workers expose no filesystem/Bash tool surface, and UI/API make workdir optional only for embedded Runtime.","branch":"work/00001KX6WVNPD-embedded-no-workdir-policy","worktree":"/home/hare/Projects/yoi/.worktree/00001KX6WVNPD-embedded-no-workdir-policy","role_plan":"Orchestrator accepts queued Ticket after prerequisite `00001KX6Y2A9Q` was approved, merged, validated, and closed. Use sibling Coder for implementation in a dedicated worktree, then sibling Reviewer for read-only review. Orchestrator retains merge/final-validation/close/worktree cleanup authority. Per current user instruction, do not call StopPod during cleanup."},"author":"orchestrator","at":"2026-07-10T23:37:58Z"}

.yoi/tickets/00001KX6WVNPD/item.md

@@ -1,9 +1,9 @@
 ---
 title: 'Embedded no-workdir Worker authority policy'
-state: 'queued'
+state: 'closed'
 priority: 'P1'
 created_at: '2026-07-10T20:52:43Z'
-updated_at: '2026-07-10T22:00:33Z'
+updated_at: '2026-07-11T00:13:51Z'
 assignee: null
 queued_by: 'workspace-panel'
 queued_at: '2026-07-10T22:00:07Z'

.yoi/tickets/00001KX6WVNPD/resolution.md

@@ -0,0 +1,28 @@
+Embedded no-workdir Worker authority policy を実装・レビュー・merge・検証した。
+
+実装内容:
+- Runtime launch metadata に `working_directory_required` を追加し、embedded Runtime のみ workdir optional として扱うようにした。
+- Workspace/API Worker create path で、embedded Runtime では no-workdir Worker creation を許可し、non-embedded Runtime では no-workdir creation を typed diagnostic で拒否するようにした。
+- Embedded no-workdir launch は Runtime へ working directory なしで渡され、merged `WorkerFilesystemAuthority` 境界により `WorkerFilesystemAuthority::None` になる。
+- Workdir-present embedded Worker は materialized binding を `WorkerFilesystemAuthority::Local` として保持する既存 behavior を維持。
+- Browser Worker creation UI で embedded Runtime の場合だけ “No working directory — guidance-only Worker; filesystem tools are disabled” を選べるようにした。
+- No-workdir launch では relative cwd input を隠し、filesystem tools / Bash が disabled であることを明示。
+- Tests で launch metadata、non-embedded no-workdir rejection、embedded no-workdir request construction、および existing runtime tests による no-workdir tool omission/no cwd fallback を確認。
+
+Review:
+- Reviewer approved with no blockers。
+- Evidence included API optionality bounds, non-embedded rejection, authority construction path, no filesystem/Bash tool surface coverage, workdir-present behavior, and Browser labeling。
+
+Merge / validation:
+- Merge commit: `2f7b8094 merge: embedded no-workdir worker policy`。
+- Final validation passed:
+  - `rg 'worker\\.cwd\\(' . || true`
+  - `git diff --check`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/embedded-no-workdir-final-validation-1783728763.txt`

.yoi/tickets/00001KX6WVNPD/thread.md

@@ -88,3 +88,223 @@ Next action:
 - Escalate only if a human explicitly requests combined implementation in the same branch/worktree。
 
 ---
+
+<!-- event: decision author: orchestrator at: 2026-07-10T23:38:28Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- 前提 Ticket `00001KX6Y2A9Q` は approved / merged / final-validated / closed 済みで、`WorkerFilesystemAuthority::{None, Local}` と no-workdir core filesystem/Bash tool omission boundary が利用可能になった。
+- この Ticket は embedded Runtime の workdir 未指定 Worker 作成 policy と UI/API 制約に集中しており、目的・binding decision・受け入れ条件が具体的である。
+- `TicketRelationQuery(00001KX6WVNPD)` の blocker view は空で、残る outgoing `depends_on 00001KX6Y2A9Q` は closed prerequisite になっている。
+- `TicketOrchestrationPlanQuery(00001KX6WVNPD)` の既存 waiting note は prerequisite inprogress を理由にしたものだったため、現在は解消済み。
+- Orchestrator worktree は clean。既存 child implementation branch/worktree は見当たらない。
+
+Evidence checked:
+- Ticket body / thread / relations / orchestration plan。
+- Related closed Ticket `00001KX6Y2A9Q` resolution/review/validation evidence。
+- `TicketList(inprogress)`: 0 件。
+- `git status --short --branch` and `git worktree list` in `/home/hare/Projects/yoi/.worktree/orchestration`。
+- Current queue also contains related `00001KX6Y6ZEA`, but its Worker workspace-backend refactor touches overlapping Worker context/constructor surfaces; it will be held separately with a conflict/migration-boundary reason rather than started in parallel。
+
+IntentPacket:
+
+Intent:
+- Embedded Runtime 選択時に、workdir 未指定の guidance/conversation-oriented Worker を作成できるようにする。
+- Embedded no-workdir Worker は `WorkerFilesystemAuthority::None` として作られ、repository filesystem authority / cwd fallback / filesystem tools / Bash を持たない。
+
+Binding decisions / invariants:
+- no-workdir authority は merged `WorkerFilesystemAuthority::None` を使う。
+- workspace root / process cwd / runtime cwd / manifest override / default scope を filesystem authority fallback にしない。
+- filesystem tools (`Read`, `Write`, `Edit`, `Glob`, `Grep`) と `Bash` は no-workdir embedded Worker では construct/register/model-visible にしない。
+- Bash は filesystem sandbox ではないため、no-workdir embedded では登録しない。
+- non-embedded または local/filesystem-authority-required launch path では、既存の workdir 必須制約または明示 authority requirement を維持する。
+- Worker 直下の `cwd` property / `worker.cwd()` 前提に戻さない。
+
+Requirements / acceptance criteria:
+- UI/API 経由で embedded Runtime の workdir 未指定 Worker create ができる。
+- embedded + workdir ありは materialized binding を `WorkerFilesystemAuthority::Local` と Worker summary/detail に反映する。
+- embedded + workdir なしは `WorkerFilesystemAuthority::None` になり、model-visible tool surface に fs tools / Bash が出ないことをテストで確認できる。
+- `Glob` / `Grep` path 省略や `Bash` initial directory が no-workdir embedded の権限漏れにならない。
+- Browser/UI では workdir optional が embedded Runtime に限られ、non-embedded/local authority path の制約を緩めない。
+
+Implementation latitude:
+- API DTO / UI form model / runtime spawn request shape の具体的な整理は coder が既存 pattern に沿って選んでよい。
+- workdir 未指定状態の UI 表示文言・validation placement は、binding invariant を満たす範囲で local tactic としてよい。
+- tests の配置は worker-runtime / workspace-server / web の既存近接 test pattern に合わせてよい。
+
+Escalate if:
+- embedded no-workdir Worker に workspace API access を付けるために `WorkspaceBackend` / `WorkspaceClient` の先行導入が必須になる場合。
+- no-workdir Worker へ fs/Bash tool の error-only stub や empty-scope fallback を登録したくなる場合。
+- non-embedded Worker の workdir requirement を緩める必要が出る場合。
+- `WorkerFilesystemAuthority` の既存 invariant を変更する必要が出る場合。
+
+Validation:
+- `git diff --check`
+- focused grep/check that no no-workdir path reintroduces `worker.cwd()` or local cwd fallback。
+- `cargo test -p worker --lib --tests` if worker crate is touched。
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check && deno task test` if web/API/types are touched。
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Current code map / likely touch points:
+- `crates/worker/src/worker.rs`, `crates/worker/src/controller.rs` for existing authority boundary verification only if needed。
+- `crates/worker-runtime/src/worker_backend.rs` / working-directory binding and embedded spawn paths。
+- `crates/workspace-server/src/server.rs` / API DTOs for Worker create/runtime options。
+- `web/workspace` worker creation UI/types if workdir optionality is exposed there。
+
+Critical risks / reviewer focus:
+- Hidden filesystem authority through workspace root / process cwd / runtime cwd fallback。
+- no-workdir Worker showing fs tools/Bash in model-visible schema。
+- empty-scope/error-only fs tool registration rather than no registration。
+- UI/API accidentally allowing non-embedded no-workdir Worker where local filesystem authority is still required。
+- regression of embedded workdir-present Worker status/tool cwd behavior。
+
+---
+
+<!-- event: state_changed author: orchestrator at: 2026-07-10T23:38:34Z from: queued to: inprogress reason: accepted_for_implementation field: state -->
+
+## State changed
+
+Prerequisite `00001KX6Y2A9Q` is now closed and merged. This Ticket is accepted for implementation before creating a worktree or spawning role Pods.
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-11T00:00:55Z -->
+
+## Implementation report
+
+Implementation progress report:
+
+- Coder Pod `yoi-coder-00001KX6WVNPD-no-workdir-policy` completed an implementation pass in `/home/hare/Projects/yoi/.worktree/00001KX6WVNPD-embedded-no-workdir-policy` on branch `work/00001KX6WVNPD-embedded-no-workdir-policy`。
+- Implementation commit: `10267869ae0dfe02e186dc69fec14151926f5009 feat: enforce embedded no-workdir worker policy`。
+- Files touched:
+  - `crates/workspace-server/src/server.rs`
+  - `web/workspace/src/lib/workspace-sidebar/types.ts`
+  - `web/workspace/src/lib/workspace-sidebar/worker-launch.test.ts`
+  - `web/workspace/src/routes/w/[workspaceId]/workers/new/+page.svelte`
+- Orchestrator inspected worktree status, branch log, commit stats, `git diff --check 83c9d884..HEAD`, and `rg 'worker\\.cwd\\(\\)' .`; worktree was clean, diff check passed, and no `worker.cwd()` matches were found。
+
+Implementation summary:
+- Added Browser/API launch metadata for whether a runtime requires working directory selection。
+- Embedded Runtime can be marked as workdir-optional; non-embedded Runtime remains workdir-required。
+- Server-side creation path rejects no-workdir Worker creation unless the target runtime is embedded, using a typed diagnostic。
+- Browser Worker creation UI offers “no workdir / embedded conversation only” only when the selected runtime allows it。
+- Relative cwd input is hidden for no-workdir launch and UI text explains no filesystem tools or Bash are available without workdir。
+- Tests were added/updated for launch metadata, non-embedded no-workdir rejection, and web request construction for embedded no-workdir launch。
+
+Next action:
+- Route to external Reviewer Pod before merge/close decisions。
+
+---
+
+<!-- event: review author: reviewer at: 2026-07-11T00:12:24Z status: approve -->
+
+## Review: approve
+
+External review result: approve
+
+Evidence:
+- UI/API optionality is correctly bounded: launch options expose `working_directory_required` and set it false only for embedded runtime (`crates/workspace-server/src/server.rs:749`, `:3823`), while browser request construction omits `working_directory` for embedded no-workdir mode and tests cover that (`web/workspace/src/lib/workspace-sidebar/worker-launch.test.ts:80`)。
+- Non-embedded no-workdir is rejected in workspace/API launch paths (`server.rs:2639`, `:2839`) with tests covering the 400 behavior (`server.rs:6383`, `:6554`)。
+- Authority boundary is preserved: absent materialized workdir reaches runtime as no working directory (`server.rs:2652`) and worker-runtime maps that to `WorkerFilesystemAuthority::None`; workdir-present maps to `Local(root, cwd)` (`crates/worker-runtime/src/worker_backend.rs:301`)。
+- Tool surface/no fallback is covered by existing runtime tests asserting no cwd observation and omission of `Read`/`Write`/`Edit`/`Glob`/`Grep`/`Bash` for no-workdir workers (`worker_backend.rs:1151`, `:1216`)。
+- Workdir-present behavior remains covered by materialized binding assertions (`worker_backend.rs:1151`) and server worker creation still links/summarizes workdir-present workers。
+- Browser labeling is explicit: embedded mode offers “No working directory — guidance-only Worker; filesystem tools are disabled” and non-embedded paths require selection (`+page.svelte:153`, `:289`)。
+
+Validation performed by reviewer:
+- `cargo test -p yoi-workspace-server no_workdir -- --nocapture`
+- `cargo test -p worker-runtime --features ws-server --lib -- --nocapture`
+- `cd web/workspace && deno task test`
+- Final `git status --short` was clean。
+
+Blockers: none。
+Non-blocking notes: none。
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-11T00:13:31Z -->
+
+## Implementation report
+
+Merge / final validation report:
+
+- Reviewer approved the implementation with no blockers。
+- Merged branch `work/00001KX6WVNPD-embedded-no-workdir-policy` into orchestration branch with merge commit `2f7b8094 merge: embedded no-workdir worker policy`。
+- Final validation was rerun in `/home/hare/Projects/yoi/.worktree/orchestration` after merge。
+
+Validation passed:
+- `rg 'worker\\.cwd\\(' . || true`: no matches。
+- `git diff --check`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check`
+- `cd web/workspace && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/embedded-no-workdir-final-validation-1783728763.txt`
+
+Reviewed/merged implementation commit:
+- `10267869 feat: enforce embedded no-workdir worker policy`
+
+---
+
+<!-- event: state_changed author: orchestrator at: 2026-07-11T00:13:37Z from: inprogress to: done reason: implementation_validated field: state -->
+
+## State changed
+
+Implementation was reviewed, merged into orchestration branch, and final validation passed. Moving to done before closure.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-07-11T00:13:51Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-07-11T00:13:51Z status: closed -->
+
+## 完了
+
+Embedded no-workdir Worker authority policy を実装・レビュー・merge・検証した。
+
+実装内容:
+- Runtime launch metadata に `working_directory_required` を追加し、embedded Runtime のみ workdir optional として扱うようにした。
+- Workspace/API Worker create path で、embedded Runtime では no-workdir Worker creation を許可し、non-embedded Runtime では no-workdir creation を typed diagnostic で拒否するようにした。
+- Embedded no-workdir launch は Runtime へ working directory なしで渡され、merged `WorkerFilesystemAuthority` 境界により `WorkerFilesystemAuthority::None` になる。
+- Workdir-present embedded Worker は materialized binding を `WorkerFilesystemAuthority::Local` として保持する既存 behavior を維持。
+- Browser Worker creation UI で embedded Runtime の場合だけ “No working directory — guidance-only Worker; filesystem tools are disabled” を選べるようにした。
+- No-workdir launch では relative cwd input を隠し、filesystem tools / Bash が disabled であることを明示。
+- Tests で launch metadata、non-embedded no-workdir rejection、embedded no-workdir request construction、および existing runtime tests による no-workdir tool omission/no cwd fallback を確認。
+
+Review:
+- Reviewer approved with no blockers。
+- Evidence included API optionality bounds, non-embedded rejection, authority construction path, no filesystem/Bash tool surface coverage, workdir-present behavior, and Browser labeling。
+
+Merge / validation:
+- Merge commit: `2f7b8094 merge: embedded no-workdir worker policy`。
+- Final validation passed:
+  - `rg 'worker\\.cwd\\(' . || true`
+  - `git diff --check`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/embedded-no-workdir-final-validation-1783728763.txt`
+
+---

.yoi/tickets/00001KX6Y2A9Q/item.md

@@ -1,9 +1,9 @@
 ---
 title: 'Implement WorkerFilesystemAuthority for no-workdir Workers'
-state: 'inprogress'
+state: 'closed'
 priority: 'P1'
 created_at: '2026-07-10T21:13:49Z'
-updated_at: '2026-07-10T21:51:33Z'
+updated_at: '2026-07-10T22:45:01Z'
 assignee: null
 queued_by: 'workspace-panel'
 queued_at: '2026-07-10T21:51:00Z'

.yoi/tickets/00001KX6Y2A9Q/resolution.md

@@ -0,0 +1,32 @@
+Worker filesystem authority の明示境界を実装・レビュー・merge・検証した。
+
+実装内容:
+- `WorkerFilesystemAuthority::{None, Local(LocalWorkingDirectory)}` を追加。
+- `LocalWorkingDirectory` は filesystem authority `root` と default `cwd` を分離して保持する。
+- Worker-level `cwd: PathBuf` field と `worker.cwd()` accessor を削除。
+- core filesystem/Bash tool registration は local filesystem authority がある場合だけ行うようにした。
+- No-workdir Worker では `Read` / `Write` / `Edit` / `Glob` / `Grep` / `Bash` を construct/register/model-visible にしない。
+- Embedded no-workdir Worker spawn は Runtime/process cwd fallback ではなく `WorkerFilesystemAuthority::None` を明示的に渡す。
+- Ticket / worker-spawn / peer-discovery など cwd 依存箇所は local filesystem authority 必須に整理し、workspace root fallback を authority として使わないようにした。
+- tests で no-workdir tool omission、no cwd fallback、local/materialized Worker の filesystem/Bash behavior を確認。
+
+Review:
+- Reviewer approved with no blockers。
+- Evidence included explicit authority type, no Worker cwd field/accessor, filesystem/Bash registration gate, embedded Runtime authority construction, and tests。
+- Non-blocking note: workspace-context surfaces such as memory/MCP/resident prompt loading can still be backed by `workspace_root` when enabled; this is outside the focused core filesystem/Bash authority gate and may become follow-up if the invariant expands to “no local file reads of any kind”。
+
+Merge / validation:
+- Merge commit: `c29e9135 merge: worker filesystem authority`。
+- Final validation passed:
+  - `rg "worker\\.cwd\\(" crates || true`
+  - `rg "pub fn cwd\\(" crates/worker/src/worker.rs || true`
+  - `git diff --check`
+  - `cargo test -p worker --lib --tests`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/worker-fs-authority-final-validation-1783723253.txt`

.yoi/tickets/00001KX6Y2A9Q/thread.md

@@ -101,3 +101,158 @@ Implementation focus:
 Dashboard queue authorization was inspected, no blockers were found, and an accepted plan was recorded. Moving queued Ticket to inprogress before creating implementation worktree or spawning Pods.
 
 ---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-10T22:31:16Z -->
+
+## Implementation report
+
+Implementation progress report:
+
+- Coder Pod `yoi-coder-00001KX6Y2A9Q-worker-fs-authority` completed implementation in `/home/hare/Projects/yoi/.worktree/00001KX6Y2A9Q-worker-filesystem-authority` on branch `work/00001KX6Y2A9Q-worker-filesystem-authority`。
+- Implementation commit: `b50b94612a1185dc5bdc935d83d63f9d6ace826b feat: add explicit worker filesystem authority`。
+- Orchestrator inspected the worktree status, branch log, commit stats, `git diff --check db3a7165..HEAD`, and grep checks for `worker.cwd()` / Worker `fn cwd`; worktree was clean, diff check passed, and no matches were found。
+
+Coder-reported implementation summary:
+- Added explicit `WorkerFilesystemAuthority::{None, Local(LocalWorkingDirectory)}` boundary。
+- Removed Worker-level `cwd: PathBuf` and `worker.cwd()` accessor。
+- Local Workers carry authority `root` and `cwd` separately。
+- No-workdir embedded Worker spawn passes `WorkerFilesystemAuthority::None` explicitly instead of falling back to runtime/process cwd。
+- Controller tool registration branches on local filesystem authority:
+  - Local Workers register `Read`, `Write`, `Edit`, `Glob`, `Grep`, `Bash` and get fs view/completions。
+  - No-workdir Workers do not construct/register filesystem or Bash tools。
+- Ticket / worker-spawn / peer-discovery cwd-dependent paths now require local filesystem authority instead of using workspace root as fallback。
+- Tests added/updated for no-workdir tool omission, no cwd fallback, and local/materialized Worker filesystem/Bash behavior。
+
+Coder-reported validation passed:
+- `cargo test -p worker --lib --tests`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo check -p yoi`
+- `git diff --check`
+- `cargo run -p yoi -- ticket doctor`
+- `nix build .#yoi --no-link`
+- `rg "worker\\.cwd\\(" crates || true`: no matches。
+- `rg "pub fn cwd\\(" crates/worker/src/worker.rs || true`: no Worker cwd accessor remains。
+
+Not run by Coder:
+- `cd web/workspace && deno task check && deno task test` because web/API/types were not touched。
+
+Next action:
+- Route to external Reviewer Pod before merge/close decisions。
+
+---
+
+<!-- event: review author: reviewer at: 2026-07-10T22:40:35Z status: approve -->
+
+## Review: approve
+
+External review result: approve
+
+Evidence:
+- `WorkerFilesystemAuthority::{None, Local(LocalWorkingDirectory)}` and separate `root`/`cwd` are present in `crates/worker/src/worker.rs`; `Worker` now stores `filesystem_authority` plus separate `workspace_root`, with no `cwd: PathBuf` Worker field。
+- Core filesystem/Bash registration is gated on `worker.local_working_directory()` in `crates/worker/src/controller.rs:619-636`; no-local Workers return `(None, None)` and do not construct/register `Read`/`Write`/`Edit`/`Glob`/`Grep`/`Bash`。
+- Ticket and worker-spawn surfaces require local authority rather than falling back to `workspace_root` (`controller.rs:647-667`, `719-733`)。
+- Embedded runtime creates `WorkerFilesystemAuthority::Local(binding.root, binding.cwd)` only when a working directory binding exists, otherwise `WorkerFilesystemAuthority::None` (`crates/worker-runtime/src/worker_backend.rs:297-310`)。
+- Tests cover no-workdir omission and no cwd fallback via empty observed materialized cwds plus forbidden core tool names (`worker_backend.rs:1133-1201`), and materialized local Workers exposing core tools with materialized cwd (`worker_backend.rs:1203-1260`)。
+- Grep check found no `worker.cwd()` / Worker `fn cwd`; the only remaining `pub fn cwd` hit is `WorkingDirectory` binding API, not `Worker`。
+
+Blockers: none。
+
+Validation performed by reviewer:
+- Read-only ticket/diff/source/test inspection and grep checks。
+- Reviewer did not rerun cargo/nix tests; coder-reported validation covers the requested test/build set。
+
+Non-blocking note:
+- Workspace-context surfaces such as memory/MCP/resident prompt loading can still be backed by `workspace_root` when enabled; this was treated as outside this Ticket’s focused core filesystem/Bash authority gate, but may need follow-up if the intended invariant becomes “no local file reads of any kind” for no-workdir Workers。
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-10T22:44:39Z -->
+
+## Implementation report
+
+Merge / final validation report:
+
+- Reviewer approved the implementation with no blockers。
+- Merged branch `work/00001KX6Y2A9Q-worker-filesystem-authority` into orchestration branch with merge commit `c29e9135 merge: worker filesystem authority`。
+- Final validation was rerun in `/home/hare/Projects/yoi/.worktree/orchestration` after merge。
+
+Validation passed:
+- `rg "worker\\.cwd\\(" crates || true`: no matches。
+- `rg "pub fn cwd\\(" crates/worker/src/worker.rs || true`: no Worker cwd accessor matches。
+- `git diff --check`
+- `cargo test -p worker --lib --tests`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check`
+- `cd web/workspace && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/worker-fs-authority-final-validation-1783723253.txt`
+
+Reviewed/merged implementation commit:
+- `b50b9461 feat: add explicit worker filesystem authority`
+
+Non-blocking reviewer note:
+- Workspace-context surfaces such as memory/MCP/resident prompt loading can still be backed by `workspace_root` when enabled; this was treated as outside this Ticket’s focused core filesystem/Bash authority gate, but may be follow-up material if the intended invariant becomes “no local file reads of any kind” for no-workdir Workers。
+
+---
+
+<!-- event: state_changed author: orchestrator at: 2026-07-10T22:44:45Z from: inprogress to: done reason: implementation_validated field: state -->
+
+## State changed
+
+Implementation was reviewed, merged into orchestration branch, and final validation passed. Moving to done before closure.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-07-10T22:45:01Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-07-10T22:45:01Z status: closed -->
+
+## 完了
+
+Worker filesystem authority の明示境界を実装・レビュー・merge・検証した。
+
+実装内容:
+- `WorkerFilesystemAuthority::{None, Local(LocalWorkingDirectory)}` を追加。
+- `LocalWorkingDirectory` は filesystem authority `root` と default `cwd` を分離して保持する。
+- Worker-level `cwd: PathBuf` field と `worker.cwd()` accessor を削除。
+- core filesystem/Bash tool registration は local filesystem authority がある場合だけ行うようにした。
+- No-workdir Worker では `Read` / `Write` / `Edit` / `Glob` / `Grep` / `Bash` を construct/register/model-visible にしない。
+- Embedded no-workdir Worker spawn は Runtime/process cwd fallback ではなく `WorkerFilesystemAuthority::None` を明示的に渡す。
+- Ticket / worker-spawn / peer-discovery など cwd 依存箇所は local filesystem authority 必須に整理し、workspace root fallback を authority として使わないようにした。
+- tests で no-workdir tool omission、no cwd fallback、local/materialized Worker の filesystem/Bash behavior を確認。
+
+Review:
+- Reviewer approved with no blockers。
+- Evidence included explicit authority type, no Worker cwd field/accessor, filesystem/Bash registration gate, embedded Runtime authority construction, and tests。
+- Non-blocking note: workspace-context surfaces such as memory/MCP/resident prompt loading can still be backed by `workspace_root` when enabled; this is outside the focused core filesystem/Bash authority gate and may become follow-up if the invariant expands to “no local file reads of any kind”。
+
+Merge / validation:
+- Merge commit: `c29e9135 merge: worker filesystem authority`。
+- Final validation passed:
+  - `rg "worker\\.cwd\\(" crates || true`
+  - `rg "pub fn cwd\\(" crates/worker/src/worker.rs || true`
+  - `git diff --check`
+  - `cargo test -p worker --lib --tests`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/worker-fs-authority-final-validation-1783723253.txt`
+
+---

.yoi/tickets/00001KX6Y6ZEA/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,4 @@
+{"id":"orch-plan-20260710-220343-1","ticket_id":"00001KX6Y6ZEA","kind":"after","related_ticket":"00001KX6Y2A9Q","note":"Ticket has explicit typed `depends_on` relation to `00001KX6Y2A9Q`. The prerequisite WorkerFilesystemAuthority refactor is currently `inprogress` and establishes the filesystem-authority/workspace-boundary this Ticket builds on. Start only after the prerequisite is approved, merged, and closed or an explicit combined-work decision is made.","author":"orchestrator","at":"2026-07-10T22:03:43Z"}
+{"id":"orch-plan-20260710-220349-2","ticket_id":"00001KX6Y6ZEA","kind":"waiting_capacity_note","note":"Dashboard queue routing inspected. This Ticket is concrete but blocked by typed `depends_on` relation to `00001KX6Y2A9Q`, which is currently inprogress. Starting now would conflict with the Worker struct/context/constructor refactor and filesystem-authority boundary. Leave queued and re-route after prerequisite merge/close.","author":"orchestrator","at":"2026-07-10T22:03:49Z"}
+{"id":"orch-plan-20260710-233841-3","ticket_id":"00001KX6Y6ZEA","kind":"waiting_capacity_note","note":"Queue review resumed after prerequisite `00001KX6Y2A9Q` closed. `00001KX6WVNPD` was accepted first because it is the smaller embedded no-workdir policy MVP and explicitly does not require WorkspaceBackend migration. This Ticket remains queued due migration-boundary/conflict risk: it removes Worker `workspace_root` and introduces WorkspaceBackend/WorkspaceClient surfaces in the same Worker context/constructor/runtime code that `00001KX6WVNPD` is now changing. Re-route after `00001KX6WVNPD` is reviewed/merged/closed, unless a human explicitly requests a combined branch.","author":"orchestrator","at":"2026-07-10T23:38:41Z"}
+{"id":"orch-plan-20260711-001433-4","ticket_id":"00001KX6Y6ZEA","kind":"accepted_plan","accepted_plan":{"summary":"Replace Worker `workspace_root: PathBuf` identity with path-free workspace identity and Runtime/host-owned WorkspaceBackend/WorkspaceClient boundary. Preserve filesystem authority exclusively under `WorkerFilesystemAuthority::Local`, allow workspace_id/client without local filesystem authority, and migrate workspace-aware Worker references away from local workspace paths where in scope.","branch":"work/00001KX6Y6ZEA-workspace-backend","worktree":"/home/hare/Projects/yoi/.worktree/00001KX6Y6ZEA-workspace-backend","role_plan":"Orchestrator accepts queued Ticket after prerequisites `00001KX6Y2A9Q` and related `00001KX6WVNPD` were approved, merged, validated, and closed. Use sibling Coder for implementation in a dedicated worktree, then sibling Reviewer for read-only review. Orchestrator retains merge/final-validation/close/worktree cleanup authority. Per user instruction, do not call StopPod during cleanup."},"author":"orchestrator","at":"2026-07-11T00:14:33Z"}

.yoi/tickets/00001KX6Y6ZEA/item.md

@@ -1,9 +1,9 @@
 ---
 title: 'Replace Worker workspace_root path with WorkspaceBackend'
-state: 'queued'
+state: 'closed'
 priority: 'P1'
 created_at: '2026-07-10T21:16:22Z'
-updated_at: '2026-07-10T22:03:27Z'
+updated_at: '2026-07-11T01:09:59Z'
 assignee: null
 queued_by: 'workspace-panel'
 queued_at: '2026-07-10T22:03:27Z'

.yoi/tickets/00001KX6Y6ZEA/resolution.md

@@ -0,0 +1,32 @@
+Worker workspace identity / WorkspaceBackend boundary を実装・レビュー・merge・検証した。
+
+実装内容:
+- Worker-held `workspace_root: PathBuf` identity を削除し、path-free `WorkerWorkspaceContext`, `WorkspaceId`, `WorkspaceClient` に置き換えた。
+- Worker は `workspace_context` と `filesystem_authority` を分離して保持し、local filesystem authority は `WorkerFilesystemAuthority::{None, Local(LocalWorkingDirectory)}` に閉じ込めた。
+- Worker constructors / restore / spawn paths を workspace context と filesystem authority の分離形に更新した。
+- Runtime 側に `RuntimeWorkspaceBackendRef` を追加し、host-owned local backend binding から narrow Worker workspace context を注入するようにした。
+- `workspace_id/client` が存在しても local filesystem authority を意味しないようにした。
+- no-filesystem Workers では memory/workflow local layouts を workspace path fallback せず unavailable/fail-closed にした。
+- legacy metadata `workspace_root` は compatibility/local filesystem hint として、`WorkerFilesystemAuthority::Local` 由来の場合だけ扱うようにした。
+- tests で path-free workspace identity/client と local cwd/root の分離、filesystem authority なしの workspace client、local path-returning Worker workspace accessor 不在、constructor/restore/spawn behavior を確認した。
+
+Review:
+- Reviewer approved with no blockers。
+- Evidence included path-free Worker context, no Worker `workspace_root()` accessor, Runtime/host backend materialization boundary, workspace-client-without-filesystem tests, fail-closed local workspace features, and legacy metadata confinement。
+- Non-blocking note: `set_active_with_workspace_context` preserves existing metadata fields when passed `None`; future no-workspace reuse of an existing Pod name may want explicit clearing semantics to avoid stale UI hints。
+
+Merge / validation:
+- Merge commit: `391f11fc merge: workspace backend worker context`。
+- Final validation passed:
+  - `rg -n 'workspace_root' crates/worker crates/worker-runtime crates/client crates/workspace-server || true`
+  - `rg -n 'worker\\.workspace_root|pub fn workspace_root|fn workspace_root' crates/worker crates/worker-runtime crates/client crates/workspace-server || true`
+  - `git diff --check`
+  - `cargo test -p worker --lib --tests`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/workspace-backend-final-validation-1783732052.txt`

.yoi/tickets/00001KX6Y6ZEA/thread.md

@@ -72,4 +72,324 @@ Marked ready by `yoi ticket state`.
 Ticket を `workspace-panel` が queued にしました。
 
 
+---
+
+<!-- event: decision author: orchestrator at: 2026-07-10T22:03:57Z -->
+
+## Decision
+
+Routing decision: blocked_by_dependency
+
+Reason:
+- Dashboard queue authorization was inspected, but this Ticket has an explicit typed `depends_on` relation to `00001KX6Y2A9Q`。
+- `00001KX6Y2A9Q` is currently `inprogress` and is refactoring Worker filesystem authority / cwd removal / no-workdir boundaries。
+- This Ticket replaces Worker `workspace_root` path usage with `WorkspaceBackend`, which builds on the same Worker struct/context/constructor boundary。
+- Starting now would likely conflict with the active filesystem-authority refactor and obscure review boundaries。
+- Therefore this routing pass leaves the Ticket `queued` and does not record `queued -> inprogress`, create a worktree, or spawn role Pods。
+
+Evidence checked:
+- Ticket body / recent thread / artifacts。
+- `TicketRelationQuery(00001KX6Y6ZEA)`: includes dependency on `00001KX6Y2A9Q`。
+- `TicketList(inprogress)`: `00001KX6Y2A9Q` is the active inprogress Ticket。
+- Orchestrator worktree status: clean。
+
+Next action:
+- Re-route this Ticket after `00001KX6Y2A9Q` is approved, merged, validated, and closed。
+- Escalate only if a human explicitly requests combined implementation in the same branch/worktree。
+
+---
+
+<!-- event: decision author: orchestrator at: 2026-07-10T23:38:54Z -->
+
+## Decision
+
+Routing decision: hold_queued_due_migration_boundary_conflict
+
+Reason:
+- 前提 `00001KX6Y2A9Q` は closed になったため dependency 自体は解消済み。
+- ただし、この routing pass では `00001KX6WVNPD` を先に受理した。
+- `00001KX6WVNPD` は embedded no-workdir policy MVP であり、WorkspaceBackend migration を必要としない小さい境界変更である。
+- この Ticket は Worker `workspace_root` path を `WorkspaceBackend` に置き換える refactor で、Worker struct/context/constructor/runtime spawn/UI API 周辺に触れる。
+- `00001KX6WVNPD` も同じ Worker create / embedded runtime / no-workdir authority surface に触るため、並行 branch で進めると conflict と review boundary 混濁の可能性が高い。
+- よって、この Ticket は `queued` のまま保持し、`00001KX6WVNPD` が reviewed/merged/closed になってから再 routing する。
+
+Evidence checked:
+- Ticket body / thread / relations / orchestration plan。
+- `TicketRelationQuery(00001KX6Y6ZEA)`: prerequisite `00001KX6Y2A9Q` は closed。
+- `TicketList(inprogress)`: routing pass 中に `00001KX6WVNPD` を accepted for implementation。
+- Orchestrator worktree status: clean。
+
+Next action:
+- `00001KX6WVNPD` の implementation/review/merge/close を完了後、この Ticket を再 routing する。
+- 人間が combined branch を明示希望する場合のみ、この待機判断を再検討する。
+
+---
+
+<!-- event: decision author: orchestrator at: 2026-07-11T00:15:05Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- 前提 `00001KX6Y2A9Q` は closed 済みで、`WorkerFilesystemAuthority::{None, Local}` と cwd 除去境界が merge 済み。
+- 関連 `00001KX6WVNPD` も closed 済みで、embedded no-workdir Worker policy / UI/API optionality が merge 済み。
+- この Ticket の typed `depends_on 00001KX6Y2A9Q` は解消済み。`00001KX6WVNPD` は `related` であり blocker ではなく、直前の conflict/migration-boundary waiting note もその Ticket の merge/close により解消済み。
+- `TicketList(inprogress)` は 0 件で、Orchestrator worktree は clean。
+- Ticket body/thread に Worker-level local path identity をなくし、Runtime/host-owned backend/client 境界へ移す binding decision が記録されている。
+
+Evidence checked:
+- Ticket body / thread / relations / orchestration plan。
+- Closed prerequisite `00001KX6Y2A9Q` and closed related policy Ticket `00001KX6WVNPD`。
+- `TicketRelationQuery(00001KX6Y6ZEA)`: outgoing `depends_on 00001KX6Y2A9Q` is closed; other relations are `related` only。
+- `TicketOrchestrationPlanQuery(00001KX6Y6ZEA)`: prior waiting notes were dependency/conflict notes now resolved by prerequisite and related Ticket closure。
+- `TicketList(inprogress)`: 0 件。
+- Orchestrator worktree status: clean。
+
+IntentPacket:
+
+Intent:
+- Worker の workspace identity/context を local path (`workspace_root: PathBuf`) から path-free identity (`Option<WorkspaceId>`) と Runtime/host injected workspace client/handle 境界へ移行する。
+- Filesystem authority は `WorkerFilesystemAuthority` に閉じ込め、workspace identity/client が local filesystem authority を意味しないようにする。
+
+Binding decisions / invariants:
+- Worker struct は durable/context identity として local workspace path を保持しない。
+- Worker-level `workspace_root: PathBuf` field と local path-returning workspace identity accessor を削除する。
+- Worker が `WorkspaceBackendRef` / endpoint / auth / SecretRef / adapter を直接解決しない。
+- Runtime/host 側が backend binding source を保持・解決し、Worker には narrow `WorkspaceClient` / handle を注入する。
+- `workspace_id = Some(...)` かつ `filesystem = None` を表現できること。
+- `workspace_id = None` かつ `filesystem = None` の会話専用 Worker も表現できること。
+- local path が必要な処理は Runtime/host backend adapter または `WorkerFilesystemAuthority::Local` の内側に閉じ込める。
+- capability を導入する場合でも authority source にせず、tool registration / UX / discovery hint として扱い、enforcement は backend 側に置く。
+- `WorkerFilesystemAuthority` / embedded no-workdir policy を崩さない。workspace root fallback や process cwd fallback を filesystem authority として復活させない。
+
+Requirements / acceptance criteria:
+- Worker context に `workspace_id: Option<WorkspaceId>` equivalent と injected workspace client/handle equivalent を持てる。
+- Worker struct に `workspace_root: PathBuf` が存在しない。
+- workspace-aware features（Ticket / memory / workflow / project records / workspace metadata）は local workspace path authority ではなく injected workspace client/handle 経由へ移行する、または移行が必要な箇所を fail-closed / unavailable diagnostic にする。
+- Runtime/host が `WorkspaceBackendRef` equivalent を保持・解決し、Worker launch/restore/embedded/spawn path へ安全に materialize できる。
+- No-workdir Worker は workspace API access と local filesystem authority の有無を独立に表現できる。
+- Existing local/workdir Workers still work with `WorkerFilesystemAuthority::Local` and local-path-only operations confined there。
+- Tests cover no local workspace path identity on Worker, workspace_id/client injection shape, no filesystem authority mixing, and representative workspace-aware API/tool behavior。
+
+Implementation latitude:
+- `WorkspaceId`, `WorkspaceBackendRef`, `WorkspaceClient` / handle の exact placement/name/API surface は existing crate boundaries に合わせてよい。
+- Minimal client/handle can support only currently needed workspace-aware operations if broad API migration would exceed Ticket scope, but it must not leave Worker-local path authority as the active path。
+- If a currently path-backed feature cannot be migrated safely in this Ticket, prefer explicit unavailable/fail-closed diagnostic with follow-up note rather than hidden path fallback。
+- Capability discovery is optional unless needed for safe tool registration/UX。
+
+Escalate if:
+- Removing `workspace_root` from Worker requires changing product semantics for memory/Ticket/workflow availability beyond local refactor。
+- A workspace-aware feature cannot be migrated without introducing a broad external backend/protocol design not captured by this Ticket。
+- You need to reintroduce Worker-held local workspace path as identity/authority。
+- You need to weaken no-workdir fs/Bash tool omission or `WorkerFilesystemAuthority` invariants。
+- Public API/serialization migration requires incompatible durable-state handling beyond existing restore/test coverage。
+
+Validation:
+- `rg "workspace_root" crates/worker crates/worker-runtime crates/yoi-pod-client crates/yoi-workspace-server` with expected remaining hits only outside Worker identity/authority or documented adapter boundaries。
+- `rg "worker\.workspace_root|workspace_root\(\)" crates` or equivalent showing Worker local path accessor removed。
+- `git diff --check`
+- `cargo test -p worker --lib --tests`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check && deno task test` if API/types/UI are touched。
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Current code map / likely touch points:
+- `crates/worker/src/worker.rs` for Worker context fields and accessors。
+- `crates/worker/src/controller.rs` for workspace-aware tool/resource setup currently tied to workspace path。
+- `crates/worker-runtime/src/worker_backend.rs` for Runtime/embedded/restore construction and backend binding materialization。
+- workspace-server/client crates if backend/client DTOs or Worker launch summaries expose workspace identity。
+- tests around no-workdir Workers, restore, child spawn, Ticket/memory/workflow availability。
+
+Critical risks / reviewer focus:
+- Hidden local path authority retained in Worker under a renamed field/accessor。
+- Workspace identity/client being treated as filesystem authority。
+- WorkspaceBackendRef/endpoint/secret leaking into Worker-owned state。
+- Breaking local/workdir Workers or child spawn/restore while removing path identity。
+- Regressing embedded no-workdir policy or filesystem/Bash tool omission。
+- Over-broad migration that invents a large remote-workspace protocol instead of the minimal safe boundary needed here。
+
+---
+
+<!-- event: state_changed author: orchestrator at: 2026-07-11T00:15:11Z from: queued to: inprogress reason: accepted_for_implementation field: state -->
+
+## State changed
+
+Prerequisite and prior conflict/migration-boundary Ticket are now closed. This Ticket is accepted for implementation before creating a worktree or spawning role Pods.
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-11T00:59:55Z -->
+
+## Implementation report
+
+Implementation progress report:
+
+- Coder Pod `yoi-coder-00001KX6Y6ZEA-workspace-backend` completed implementation in `/home/hare/Projects/yoi/.worktree/00001KX6Y6ZEA-workspace-backend` on branch `work/00001KX6Y6ZEA-workspace-backend`。
+- Implementation commit: `142b60e1b3ca refactor: separate worker workspace identity`。
+- Orchestrator inspected worktree status, branch log, commit stats, `git diff --check 74b07bd7..HEAD`, and workspace-root accessor grep. Worktree was clean and diff check passed。
+
+Implementation summary:
+- Replaced Worker-held `workspace_root: PathBuf` identity with path-free `WorkerWorkspaceContext`, `WorkspaceId`, and `WorkspaceClient`。
+- Kept local filesystem authority under `WorkerFilesystemAuthority::{None, Local(LocalWorkingDirectory)}`。
+- Updated Worker constructors / restore / spawn paths to receive workspace context separately from filesystem authority。
+- Added runtime-side `RuntimeWorkspaceBackendRef` as host-owned local backend binding that injects narrow Worker workspace context。
+- No-filesystem Workers keep memory/workflow local layouts unavailable/fail-closed rather than falling back to workspace paths。
+- Preserved legacy metadata `workspace_root` only as a local filesystem hint derived from `WorkerFilesystemAuthority::Local`, not as Worker identity。
+- Updated tests for path-free workspace identity/client separation from local tool cwd/root, workspace client without filesystem authority, no local path-returning Worker workspace accessor, and constructor usage。
+
+Files touched:
+- `crates/worker/src/worker.rs`
+- `crates/worker/src/controller.rs`
+- `crates/worker/src/entrypoint.rs`
+- `crates/worker/src/lib.rs`
+- `crates/worker/src/discovery.rs`
+- `crates/worker/src/ticket_event_notify.rs`
+- `crates/worker/tests/*`
+- `crates/worker-runtime/src/worker_backend.rs`
+- `crates/worker-runtime/Cargo.toml`
+- `crates/session-store/src/worker_metadata.rs`
+- `Cargo.lock`
+- `package.nix`
+
+Coder-reported validation passed:
+- `rg -n "workspace_root" crates/worker crates/worker-runtime crates/client crates/workspace-server` with remaining hits as legacy metadata/local filesystem adapter or host/runtime local backend boundaries plus tests。
+- `rg -n "worker\\.workspace_root|pub fn workspace_root|fn workspace_root" crates/worker crates/worker-runtime crates/client crates/workspace-server || true`; no Worker `workspace_root()` accessor hits. Orchestrator grep observed an unrelated `crates/workspace-server/src/records.rs` project-record accessor hit outside Worker identity。
+- `git diff --check`
+- `cargo test -p worker --lib --tests`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo check -p yoi`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Not run by Coder:
+- `cd web/workspace && deno task check && deno task test` because web/API/types were not touched。
+
+Next action:
+- Route to external Reviewer Pod before merge/close decisions。
+
+---
+
+<!-- event: review author: reviewer at: 2026-07-11T01:07:06Z status: approve -->
+
+## Review: approve
+
+External review result: approve
+
+Evidence:
+- Worker identity is path-free: `WorkerWorkspaceContext` carries `Option<WorkspaceId>` plus narrow `WorkspaceClient`/unavailable state, while `Worker` stores `workspace_context` and `filesystem_authority` instead of a `workspace_root: PathBuf` (`crates/worker/src/worker.rs:61-109`, `384-405`)。
+- No `worker.workspace_root()` / local path-returning workspace accessor remains; local paths are exposed only through `WorkerFilesystemAuthority::Local` helpers such as `local_working_directory()` (`worker.rs:741-840`)。
+- Runtime/host boundary now resolves local workspace backend context before constructing Workers (`crates/worker-runtime/src/worker_backend.rs:321-390`), and Worker construction accepts injected workspace context + filesystem authority (`worker.rs:4219-4260`)。
+- Workspace/client without filesystem and no-workspace/no-filesystem Workers are represented and covered by tests (`worker.rs:5441-5530`; worker-runtime tests around `901+`)。
+- Workspace-aware local features fail closed when no local filesystem authority is available; Ticket/memory/workflow/spawn-dependent surfaces require `filesystem_authority.local()` and otherwise return unavailable errors rather than cwd/root fallback (`crates/worker/src/controller.rs:630-672`, `709-779`)。
+- Legacy `workspace_root` metadata is written only as a compatibility/local hint from local filesystem authority, not as Worker identity (`worker.rs:4604-4621`; `session-store/src/worker_metadata.rs`)。
+
+Validation performed:
+- `git diff --check 142b60e1^ 142b60e1`
+- Focused grep for forbidden `workspace_root()` accessor: no matches。
+- Focused tests:
+  - `cargo test -p worker spawned_context_tests --lib`
+  - `cargo test -p worker-runtime worker_spawn_receives_materialized_workspace_cwd_instead_of_source_repo --features ws-server,fs-store`
+  - `cargo test -p worker-runtime adapter_dispatches_user_input_through_worker_run_lifecycle --features ws-server,fs-store`
+
+Blockers: none。
+
+Non-blocking notes:
+- Remaining `workspace_root` hits are local runtime/entrypoint/spawn-tool adapter, legacy metadata, or test contexts; reviewer did not find Worker identity/accessor use。
+- `set_active_with_workspace_context` preserves existing metadata fields when passed `None`; acceptable for this Ticket as compatibility metadata, but future no-workspace reuse of an existing Pod name may want explicit clearing semantics to avoid stale UI hints。
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-11T01:09:39Z -->
+
+## Implementation report
+
+Merge / final validation report:
+
+- Reviewer approved the implementation with no blockers。
+- Merged branch `work/00001KX6Y6ZEA-workspace-backend` into orchestration branch with merge commit `391f11fc merge: workspace backend worker context`。
+- Final validation was rerun in `/home/hare/Projects/yoi/.worktree/orchestration` after merge。
+
+Validation passed:
+- `rg -n 'workspace_root' crates/worker crates/worker-runtime crates/client crates/workspace-server || true` with remaining hits limited to legacy metadata/local adapter/test contexts。
+- `rg -n 'worker\\.workspace_root|pub fn workspace_root|fn workspace_root' crates/worker crates/worker-runtime crates/client crates/workspace-server || true`; no Worker identity/accessor hits were found. The expected unrelated workspace-server project-record accessor remains outside Worker identity。
+- `git diff --check`
+- `cargo test -p worker --lib --tests`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check`
+- `cd web/workspace && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/workspace-backend-final-validation-1783732052.txt`
+
+Reviewed/merged implementation commit:
+- `142b60e1 refactor: separate worker workspace identity`
+
+Non-blocking reviewer note:
+- `set_active_with_workspace_context` preserves existing metadata fields when passed `None`; acceptable for this Ticket as compatibility metadata, but future no-workspace reuse of an existing Pod name may want explicit clearing semantics to avoid stale UI hints。
+
+---
+
+<!-- event: state_changed author: orchestrator at: 2026-07-11T01:09:43Z from: inprogress to: done reason: implementation_validated field: state -->
+
+## State changed
+
+Implementation was reviewed, merged into orchestration branch, and final validation passed. Moving to done before closure.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-07-11T01:09:59Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-07-11T01:09:59Z status: closed -->
+
+## 完了
+
+Worker workspace identity / WorkspaceBackend boundary を実装・レビュー・merge・検証した。
+
+実装内容:
+- Worker-held `workspace_root: PathBuf` identity を削除し、path-free `WorkerWorkspaceContext`, `WorkspaceId`, `WorkspaceClient` に置き換えた。
+- Worker は `workspace_context` と `filesystem_authority` を分離して保持し、local filesystem authority は `WorkerFilesystemAuthority::{None, Local(LocalWorkingDirectory)}` に閉じ込めた。
+- Worker constructors / restore / spawn paths を workspace context と filesystem authority の分離形に更新した。
+- Runtime 側に `RuntimeWorkspaceBackendRef` を追加し、host-owned local backend binding から narrow Worker workspace context を注入するようにした。
+- `workspace_id/client` が存在しても local filesystem authority を意味しないようにした。
+- no-filesystem Workers では memory/workflow local layouts を workspace path fallback せず unavailable/fail-closed にした。
+- legacy metadata `workspace_root` は compatibility/local filesystem hint として、`WorkerFilesystemAuthority::Local` 由来の場合だけ扱うようにした。
+- tests で path-free workspace identity/client と local cwd/root の分離、filesystem authority なしの workspace client、local path-returning Worker workspace accessor 不在、constructor/restore/spawn behavior を確認した。
+
+Review:
+- Reviewer approved with no blockers。
+- Evidence included path-free Worker context, no Worker `workspace_root()` accessor, Runtime/host backend materialization boundary, workspace-client-without-filesystem tests, fail-closed local workspace features, and legacy metadata confinement。
+- Non-blocking note: `set_active_with_workspace_context` preserves existing metadata fields when passed `None`; future no-workspace reuse of an existing Pod name may want explicit clearing semantics to avoid stale UI hints。
+
+Merge / validation:
+- Merge commit: `391f11fc merge: workspace backend worker context`。
+- Final validation passed:
+  - `rg -n 'workspace_root' crates/worker crates/worker-runtime crates/client crates/workspace-server || true`
+  - `rg -n 'worker\\.workspace_root|pub fn workspace_root|fn workspace_root' crates/worker crates/worker-runtime crates/client crates/workspace-server || true`
+  - `git diff --check`
+  - `cargo test -p worker --lib --tests`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/workspace-backend-final-validation-1783732052.txt`
+
 ---