worker: persist known-worker control grants

crates/worker/src/controller.rs

@@ -21,7 +21,7 @@ use crate::shutdown_after_idle::{
     ShutdownAfterIdleRequest, TicketIntakeReadyShutdownHook, is_ticket_intake_role,
     take_shutdown_request_after_status,
 };
-use crate::spawn::comm_tools::{sub_worker_list_tool, sub_worker_send_tool, sub_worker_stop_tool};
+use crate::spawn::comm_tools::{sub_worker_send_tool, sub_worker_stop_tool};
 use crate::spawn::registry::SpawnedWorkerRegistry;
 use crate::spawn::tool::sub_worker_spawn_tool;
 use crate::worker::{
@@ -802,6 +802,7 @@ where
         feature_registry.add_module(
             crate::feature::builtin::manage_worker::manage_worker_feature(
                 workspace_client,
+                Some(spawned_registry.clone()),
                 feature_config.worker.direct_spawn,
             ),
         );
@@ -920,7 +921,6 @@ where
                 scope_handle,
                 prompts,
             ));
-            engine.register_tool(sub_worker_list_tool(spawned_registry.clone()));
             engine.register_tool(sub_worker_send_tool(spawned_registry.clone()));
             engine.register_tool(sub_worker_stop_tool(spawned_registry.clone()));
             observation_providers.push(Arc::new(

crates/worker/src/feature/builtin/manage_worker.rs

@@ -8,6 +8,7 @@ use llm_engine::tool::{
 };
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
+use uuid::Uuid;
 
 use protocol::Segment;
 
@@ -15,6 +16,7 @@ use crate::feature::{
     FeatureDescriptor, FeatureInstallContext, FeatureInstallError, FeatureModule,
     ServiceDeclaration, ServiceId, ToolContribution, ToolDeclaration,
 };
+use crate::spawn::registry::SpawnedWorkerRegistry;
 use crate::worker::{
     WorkspaceClient, WorkspaceClientError, WorkspaceRequest, WorkspaceRequestMethod,
     WorkspaceResponse,
@@ -25,8 +27,16 @@ const FEATURE_NAME: &str = "Worker";
 const FEATURE_DESCRIPTION: &str =
     "Workspace-authority tools for managing Workdir-bound Backend/Runtime Worker sessions.";
 pub const WORKER_LIFECYCLE_SERVICE_ID: &str = "worker.lifecycle";
+pub const WORKER_CONTROL_SERVICE_ID: &str = "worker.control";
 const WORKER_LIFECYCLE_SERVICE_VERSION: &str = "1";
 
+pub trait WorkerControlService: Send + Sync {}
+
+#[derive(Debug)]
+struct WorkspaceWorkerControlService;
+
+impl WorkerControlService for WorkspaceWorkerControlService {}
+
 #[async_trait]
 pub trait WorkerLifecycleService: Send + Sync {
     async fn spawn(
@@ -70,10 +80,15 @@ impl WorkerLifecycleService for WorkspaceWorkerLifecycleService {
                 ));
             }
         };
+        let control_operation_id = ticket_assignment
+            .as_ref()
+            .map(|assignment| assignment.operation_id.clone())
+            .unwrap_or_else(|| format!("worker-spawn-{}", Uuid::now_v7()));
         let body = WorkerSpawnRequest {
             runtime_id: request.runtime_id,
             display_name: request.display_name,
             profile: request.profile,
+            control_operation_id,
             ticket_assignment,
             initial_submit: request.initial_submit,
             working_directory: WorkerWorkingDirectorySelection {
@@ -83,25 +98,38 @@ impl WorkerLifecycleService for WorkspaceWorkerLifecycleService {
         };
         self.client.execute(WorkspaceRequest::json(
             WorkspaceRequestMethod::Post,
-            format!("/api/w/{}/workers", self.workspace_id),
+            format!("/api/w/{}/worker-control/workers", self.workspace_id),
             serde_json::to_string(&body)
                 .map_err(|error| WorkspaceClientError::Request(error.to_string()))?,
         ))
     }
 }
 
-#[derive(Clone, Debug)]
+#[derive(Clone)]
 pub struct ManageWorkerFeature {
     client: Arc<dyn WorkspaceClient>,
+    registry: Option<Arc<SpawnedWorkerRegistry>>,
     direct_spawn: bool,
 }
 
+impl std::fmt::Debug for ManageWorkerFeature {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ManageWorkerFeature")
+            .field("has_registry", &self.registry.is_some())
+            .field("direct_spawn", &self.direct_spawn)
+            .finish_non_exhaustive()
+    }
+}
+
 pub fn manage_worker_feature(
     client: Arc<dyn WorkspaceClient>,
+    registry: Option<Arc<SpawnedWorkerRegistry>>,
     direct_spawn: bool,
 ) -> ManageWorkerFeature {
     ManageWorkerFeature {
         client,
+        registry,
         direct_spawn,
     }
 }
@@ -114,6 +142,11 @@ impl FeatureModule for ManageWorkerFeature {
                 ServiceId::builtin(WORKER_LIFECYCLE_SERVICE_ID),
                 WORKER_LIFECYCLE_SERVICE_VERSION,
                 "Workspace-authoritative Worker lifecycle operations",
+            ))
+            .with_provided_service(ServiceDeclaration::new(
+                ServiceId::builtin(WORKER_CONTROL_SERVICE_ID),
+                WORKER_LIFECYCLE_SERVICE_VERSION,
+                "Known-Worker discovery and permission-fenced control operations",
             ));
         for operation in WorkerOperation::ALL {
             if operation != WorkerOperation::Spawn || self.direct_spawn {
@@ -150,6 +183,14 @@ impl FeatureModule for ManageWorkerFeature {
             ),
             lifecycle,
         )?;
+        context.services().provide(
+            ServiceDeclaration::new(
+                ServiceId::builtin(WORKER_CONTROL_SERVICE_ID),
+                WORKER_LIFECYCLE_SERVICE_VERSION,
+                "Known-Worker discovery and permission-fenced control operations",
+            ),
+            Arc::new(WorkspaceWorkerControlService) as Arc<dyn WorkerControlService>,
+        )?;
         for operation in WorkerOperation::ALL {
             if operation == WorkerOperation::Spawn && !self.direct_spawn {
                 continue;
@@ -159,26 +200,45 @@ impl FeatureModule for ManageWorkerFeature {
                     operation,
                     self.client.clone(),
                     workspace_id.clone(),
+                    self.registry.clone(),
                 ),
                 WorkerOperation::Spawn => definition::<WorkerSpawnInput>(
                     operation,
                     self.client.clone(),
                     workspace_id.clone(),
+                    self.registry.clone(),
+                ),
+                WorkerOperation::SendInput | WorkerOperation::Notify => {
+                    definition::<WorkerMessageInput>(
+                        operation,
+                        self.client.clone(),
+                        workspace_id.clone(),
+                        self.registry.clone(),
+                    )
+                }
+                WorkerOperation::Cancel => definition::<WorkerStopInput>(
+                    operation,
+                    self.client.clone(),
+                    workspace_id.clone(),
+                    self.registry.clone(),
                 ),
                 WorkerOperation::Stop => definition::<WorkerStopInput>(
                     operation,
                     self.client.clone(),
                     workspace_id.clone(),
+                    self.registry.clone(),
                 ),
                 WorkerOperation::Restore => definition::<WorkerTargetInput>(
                     operation,
                     self.client.clone(),
                     workspace_id.clone(),
+                    self.registry.clone(),
                 ),
                 WorkerOperation::Remove => definition::<WorkerRemoveInput>(
                     operation,
                     self.client.clone(),
                     workspace_id.clone(),
+                    self.registry.clone(),
                 ),
             };
             context
@@ -224,6 +284,7 @@ struct WorkerSpawnRequest {
     runtime_id: String,
     display_name: String,
     profile: String,
+    control_operation_id: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     ticket_assignment: Option<WorkerSpawnTicketAssignmentRequest>,
     initial_submit: Vec<Segment>,
@@ -244,6 +305,14 @@ struct WorkerTargetInput {
     worker_id: String,
 }
 
+#[derive(Debug, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+struct WorkerMessageInput {
+    runtime_id: String,
+    worker_id: String,
+    content: String,
+}
+
 #[derive(Debug, Deserialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
 struct WorkerStopInput {
@@ -266,21 +335,28 @@ struct WorkspaceWorkerTool {
     operation: WorkerOperation,
     client: Arc<dyn WorkspaceClient>,
     workspace_id: String,
+    registry: Option<Arc<SpawnedWorkerRegistry>>,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum WorkerOperation {
     List,
     Spawn,
+    SendInput,
+    Notify,
+    Cancel,
     Stop,
     Restore,
     Remove,
 }
 
 impl WorkerOperation {
-    const ALL: [Self; 5] = [
+    const ALL: [Self; 8] = [
         Self::List,
         Self::Spawn,
+        Self::SendInput,
+        Self::Notify,
+        Self::Cancel,
         Self::Stop,
         Self::Restore,
         Self::Remove,
@@ -290,6 +366,9 @@ impl WorkerOperation {
         match self {
             Self::List => "WorkerList",
             Self::Spawn => "WorkerSpawn",
+            Self::SendInput => "WorkerSendInput",
+            Self::Notify => "WorkerNotify",
+            Self::Cancel => "WorkerCancel",
             Self::Stop => "WorkerStop",
             Self::Restore => "WorkerRestore",
             Self::Remove => "WorkerRemove",
@@ -299,12 +378,15 @@ impl WorkerOperation {
     fn description(self) -> &'static str {
         match self {
             Self::List => {
-                "List Backend/Runtime Worker sessions in the current Workspace. SubWorkers are excluded."
+                "List only known Runtime Workers and direct SubWorkers granted to the current Worker."
             }
             Self::Spawn => {
                 "Spawn a Backend/Runtime Worker session in an existing Workspace Workdir. The Workdir id is authority; filesystem paths and Runtime URLs are not accepted. `initial_submit` carries the normal typed user submission. After the Orchestrator has committed a Ticket to `inprogress`, set `ticket_id` with a Flow segment in `initial_submit` to atomically assign the new Coder Worker; the operation id is derived from the durable tool call rather than model input."
             }
-            Self::Stop => "Stop a Backend/Runtime Worker session in the current Workspace.",
+            Self::SendInput => "Send user input to a known Runtime Worker when allowed.",
+            Self::Notify => "Send an advisory notification to a known Runtime Worker when allowed.",
+            Self::Cancel => "Cancel the current turn of a known Runtime Worker when allowed.",
+            Self::Stop => "Stop a known Runtime Worker when allowed.",
             Self::Restore => {
                 "Restore a stopped Backend/Runtime Worker session in the current Workspace."
             }
@@ -348,7 +430,48 @@ impl Tool for WorkspaceWorkerTool {
                 let request = match operation {
                     WorkerOperation::List => {
                         parse::<WorkerListInput>(input_json, "WorkerList")?;
-                        WorkspaceRequest::get(format!("/api/w/{}/workers", self.workspace_id))
+                        WorkspaceRequest::get(format!(
+                            "/api/w/{}/worker-control/workers",
+                            self.workspace_id
+                        ))
+                    }
+                    WorkerOperation::SendInput | WorkerOperation::Notify => {
+                        let tool_name = operation.tool_name();
+                        let input = parse::<WorkerMessageInput>(input_json, tool_name)?;
+                        let runtime_id = authority_id(&input.runtime_id, "runtime_id")?;
+                        let worker_id = authority_id(&input.worker_id, "worker_id")?;
+                        let content = non_empty(input.content, "content")?;
+                        if content.len() > 16 * 1024 {
+                            return Err(ToolError::ExecutionFailed(
+                                "content must contain at most 16384 bytes".to_string(),
+                            ));
+                        }
+                        WorkspaceRequest::json(
+                            WorkspaceRequestMethod::Post,
+                            format!(
+                                "/api/w/{}/worker-control/workers/{runtime_id}/{worker_id}/input",
+                                self.workspace_id
+                            ),
+                            serde_json::json!({
+                                "kind": if operation == WorkerOperation::Notify { "notify" } else { "user" },
+                                "content": content,
+                            })
+                            .to_string(),
+                        )
+                    }
+                    WorkerOperation::Cancel => {
+                        let input = parse::<WorkerStopInput>(input_json, "WorkerCancel")?;
+                        let runtime_id = authority_id(&input.runtime_id, "runtime_id")?;
+                        let worker_id = authority_id(&input.worker_id, "worker_id")?;
+                        let reason = input.reason.unwrap_or_default();
+                        WorkspaceRequest::json(
+                            WorkspaceRequestMethod::Post,
+                            format!(
+                                "/api/w/{}/worker-control/workers/{runtime_id}/{worker_id}/cancel",
+                                self.workspace_id
+                            ),
+                            serde_json::json!({ "reason": reason }).to_string(),
+                        )
                     }
                     WorkerOperation::Spawn => {
                         let input = parse::<WorkerSpawnInput>(input_json, "WorkerSpawn")?;
@@ -398,7 +521,7 @@ impl Tool for WorkspaceWorkerTool {
                         WorkspaceRequest::json(
                             WorkspaceRequestMethod::Post,
                             format!(
-                                "/api/w/{}/runtimes/{runtime_id}/workers/{worker_id}/stop",
+                                "/api/w/{}/worker-control/workers/{runtime_id}/{worker_id}/stop",
                                 self.workspace_id
                             ),
                             serde_json::json!({ "reason": input.reason }).to_string(),
@@ -411,7 +534,7 @@ impl Tool for WorkspaceWorkerTool {
                         WorkspaceRequest::json(
                             WorkspaceRequestMethod::Post,
                             format!(
-                                "/api/w/{}/runtimes/{runtime_id}/workers/{worker_id}/restore",
+                                "/api/w/{}/worker-control/workers/{runtime_id}/{worker_id}/restore",
                                 self.workspace_id
                             ),
                             "{}",
@@ -424,10 +547,58 @@ impl Tool for WorkspaceWorkerTool {
                     .map_err(|error| ToolError::ExecutionFailed(error.to_string()))?
             }
         };
+        let response = if self.operation == WorkerOperation::List {
+            self.with_subworkers(response).await?
+        } else {
+            response
+        };
         tool_output(self.operation, response)
     }
 }
 
+impl WorkspaceWorkerTool {
+    async fn with_subworkers(
+        &self,
+        mut response: WorkspaceResponse,
+    ) -> Result<WorkspaceResponse, ToolError> {
+        let Some(registry) = &self.registry else {
+            return Ok(response);
+        };
+        if !response.is_success() {
+            return Ok(response);
+        }
+        let mut body: serde_json::Value =
+            serde_json::from_str(&response.body).map_err(|error| {
+                ToolError::ExecutionFailed(format!("WorkerList returned invalid JSON: {error}"))
+            })?;
+        let items = body
+            .get_mut("items")
+            .and_then(serde_json::Value::as_array_mut)
+            .ok_or_else(|| {
+                ToolError::ExecutionFailed(
+                    "WorkerList response did not contain an items array".to_string(),
+                )
+            })?;
+        for internal in registry.list_internal() {
+            let child_name = internal.worker_name.clone();
+            items.push(serde_json::json!({
+                "subject": { "kind": "sub_worker", "name": child_name },
+                "relation": "direct_child",
+                "origin": "sub_worker_spawn",
+                "permissions": ["send_input", "stop", "observe"],
+                "summary": {
+                    "display_name": internal.worker_name,
+                    "status": format!("{:?}", internal.session.status()).to_lowercase(),
+                }
+            }));
+        }
+        response.body = serde_json::to_string(&body).map_err(|error| {
+            ToolError::ExecutionFailed(format!("WorkerList could not encode its response: {error}"))
+        })?;
+        Ok(response)
+    }
+}
+
 fn tool_output(
     operation: WorkerOperation,
     response: WorkspaceResponse,
@@ -449,6 +620,7 @@ fn definition<I: JsonSchema + 'static>(
     operation: WorkerOperation,
     client: Arc<dyn WorkspaceClient>,
     workspace_id: String,
+    registry: Option<Arc<SpawnedWorkerRegistry>>,
 ) -> ToolDefinition {
     Arc::new(move || {
         let schema = schemars::schema_for!(I);
@@ -460,6 +632,7 @@ fn definition<I: JsonSchema + 'static>(
             operation,
             client: client.clone(),
             workspace_id: workspace_id.clone(),
+            registry: registry.clone(),
         });
         (meta, tool)
     })
@@ -567,6 +740,7 @@ mod tests {
             operation: WorkerOperation::Spawn,
             client: client.clone(),
             workspace_id: "workspace%2Ftest".to_string(),
+            registry: None,
         };
         tool.execute(
             &serde_json::json!({
@@ -587,7 +761,10 @@ mod tests {
 
         let requests = client.requests.lock().unwrap();
         assert_eq!(requests.len(), 1);
-        assert_eq!(requests[0].path, "/api/w/workspace%2Ftest/workers");
+        assert_eq!(
+            requests[0].path,
+            "/api/w/workspace%2Ftest/worker-control/workers"
+        );
         let body: serde_json::Value =
             serde_json::from_str(requests[0].body.as_deref().unwrap()).unwrap();
         assert_eq!(body["initial_submit"][0]["kind"], "flow");
@@ -609,7 +786,7 @@ mod tests {
     #[test]
     fn worker_service_can_remain_enabled_without_direct_spawn_surface() {
         let client = Arc::new(RecordingWorkspaceClient::default());
-        let descriptor = manage_worker_feature(client, false).descriptor();
+        let descriptor = manage_worker_feature(client, None, false).descriptor();
         let tools: Vec<_> = descriptor
             .tools
             .iter()
@@ -618,8 +795,8 @@ mod tests {
         assert!(!tools.contains(&"WorkerSpawn"));
         assert!(tools.contains(&"WorkerList"));
         assert_eq!(
-            descriptor.provides_services[0].id,
+            descriptor.provides_services[1].id,
-            ServiceId::builtin(WORKER_LIFECYCLE_SERVICE_ID)
+            ServiceId::builtin(WORKER_CONTROL_SERVICE_ID)
         );
     }
 
@@ -630,6 +807,9 @@ mod tests {
             [
                 "WorkerList",
                 "WorkerSpawn",
+                "WorkerSendInput",
+                "WorkerNotify",
+                "WorkerCancel",
                 "WorkerStop",
                 "WorkerRestore",
                 "WorkerRemove",
@@ -654,6 +834,7 @@ mod tests {
             runtime_id: "runtime-1".to_string(),
             display_name: "Coder".to_string(),
             profile: "builtin:coder".to_string(),
+            control_operation_id: "spawn-operation-1".to_string(),
             ticket_assignment: None,
             initial_submit: vec![
                 Segment::Flow {
@@ -681,6 +862,64 @@ mod tests {
         assert!(value.get("initial_text").is_none());
     }
 
+    #[tokio::test]
+    async fn worker_message_and_cancel_use_permission_fenced_control_routes() {
+        let client = Arc::new(RecordingWorkspaceClient::default());
+        for (operation, args, expected_suffix, expected_kind) in [
+            (
+                WorkerOperation::SendInput,
+                serde_json::json!({
+                    "runtime_id": "runtime-1",
+                    "worker_id": "worker-7",
+                    "content": "continue",
+                }),
+                "/input",
+                Some("user"),
+            ),
+            (
+                WorkerOperation::Notify,
+                serde_json::json!({
+                    "runtime_id": "runtime-1",
+                    "worker_id": "worker-7",
+                    "content": "review ready",
+                }),
+                "/input",
+                Some("notify"),
+            ),
+            (
+                WorkerOperation::Cancel,
+                serde_json::json!({
+                    "runtime_id": "runtime-1",
+                    "worker_id": "worker-7",
+                    "reason": "superseded",
+                }),
+                "/cancel",
+                None,
+            ),
+        ] {
+            WorkspaceWorkerTool {
+                operation,
+                client: client.clone(),
+                workspace_id: "workspace%2Ftest".to_string(),
+                registry: None,
+            }
+            .execute(
+                &args.to_string(),
+                ToolExecutionContext::new("call-control", "batch-control", 0),
+            )
+            .await
+            .unwrap();
+            let request = client.requests.lock().unwrap().last().cloned().unwrap();
+            assert!(request.path.ends_with(expected_suffix));
+            assert!(request.path.contains("/worker-control/workers/"));
+            if let Some(expected_kind) = expected_kind {
+                let body: serde_json::Value =
+                    serde_json::from_str(request.body.as_deref().unwrap()).unwrap();
+                assert_eq!(body["kind"], expected_kind);
+            }
+        }
+    }
+
     #[tokio::test]
     async fn worker_remove_forwards_only_target_revision_and_bounded_reason() {
         let client = Arc::new(RecordingWorkspaceClient::default());
@@ -688,6 +927,7 @@ mod tests {
             operation: WorkerOperation::Remove,
             client: client.clone(),
             workspace_id: "workspace%2Ftest".to_string(),
+            registry: None,
         };
         tool.execute(
             &serde_json::json!({
@@ -734,6 +974,7 @@ mod tests {
             operation: WorkerOperation::Remove,
             client: client.clone(),
             workspace_id: "workspace%2Ftest".to_string(),
+            registry: None,
         };
         for reason in ["   ".to_string(), "x".repeat(513)] {
             let _error = tool

crates/worker/src/feature/builtin/worker_observation.rs

@@ -7,10 +7,11 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use session_store::collect_state;
 
+use super::manage_worker::WORKER_CONTROL_SERVICE_ID;
 use crate::feature::{
     FeatureDescriptor, FeatureInstallContext, FeatureInstallError, FeatureInstructionContribution,
-    FeatureInstructionDeclaration, FeatureInstructionId, FeatureModule, ToolContribution,
+    FeatureInstructionDeclaration, FeatureInstructionId, FeatureModule, ServiceId,
-    ToolDeclaration,
+    ServiceRequirement, ToolContribution, ToolDeclaration,
 };
 use crate::session_capture::{
     ReadDetail, ReadOptions, ReadSelector, ReferenceKind, SearchOptions, SessionCapture,
@@ -111,11 +112,17 @@ impl WorkerObservationProvider for WorkspaceClientWorkerObservationProvider {
     async fn list_worker_sessions(
         &self,
     ) -> Result<Vec<WorkerObservationSubject>, WorkerObservationError> {
+        let workspace_id = self.client.workspace_id().ok_or_else(|| {
+            WorkerObservationError::Unavailable(
+                "Workspace observation requires a scoped Workspace client".to_string(),
+            )
+        })?;
         let response = self
             .client
-            .execute(crate::worker::WorkspaceRequest::get(
+            .execute(crate::worker::WorkspaceRequest::get(format!(
-                "/worker-observation/sessions",
+                "/api/w/{}/worker-observation/sessions",
-            ))
+                workspace_id
+            )))
             .map_err(workspace_client_error)?;
         let body = workspace_response_body(response)?;
         serde_json::from_str::<WorkspaceWorkerObservationListResponse>(&body)
@@ -129,11 +136,16 @@ impl WorkerObservationProvider for WorkspaceClientWorkerObservationProvider {
     ) -> Result<WorkerSessionCapture, WorkerObservationError> {
         let body = serde_json::to_string(subject)
             .map_err(|error| WorkerObservationError::Unavailable(error.to_string()))?;
+        let workspace_id = self.client.workspace_id().ok_or_else(|| {
+            WorkerObservationError::Unavailable(
+                "Workspace observation requires a scoped Workspace client".to_string(),
+            )
+        })?;
         let response = self
             .client
             .execute(crate::worker::WorkspaceRequest::json(
                 crate::worker::WorkspaceRequestMethod::Post,
-                "/worker-observation/session",
+                format!("/api/w/{}/worker-observation/session", workspace_id),
                 body,
             ))
             .map_err(workspace_client_error)?;
@@ -190,11 +202,11 @@ impl FeatureModule for WorkerObservationFeature {
             .with_description(
                 "Read-only exploration of explicitly granted active Worker sessions.",
             )
-            .with_instruction(observation_instruction())
+            .with_service_requirement(ServiceRequirement::required(
-            .with_tool(ToolDeclaration::new(
+                ServiceId::builtin(WORKER_CONTROL_SERVICE_ID),
-                "ListWorkerSessions",
+                "Worker observation extends the known-Worker control authority",
-                "List bounded summaries of active Worker sessions granted to this Worker.",
             ))
+            .with_instruction(observation_instruction())
             .with_tool(ToolDeclaration::new(
                 "ViewSessionOverview",
                 "Show a sparse overview of the latest committed capture for one granted Worker session.",
@@ -215,10 +227,6 @@ impl FeatureModule for WorkerObservationFeature {
             .register(FeatureInstructionContribution::new(
                 observation_instruction(),
             ))?;
-        context.tools().register(ToolContribution::new(
-            "ListWorkerSessions",
-            list_definition(self.provider.clone()),
-        ))?;
         context.tools().register(ToolContribution::new(
             "ViewSessionOverview",
             overview_definition(self.provider.clone()),
@@ -346,20 +354,6 @@ impl WorkerObservationProvider for SpawnedSubWorkerObservationProvider {
     }
 }
 
-fn list_definition(provider: Arc<dyn WorkerObservationProvider>) -> ToolDefinition {
-    Arc::new(move || {
-        let schema = serde_json::to_value(schemars::schema_for!(ListWorkerSessionsParams))
-            .unwrap_or_else(|_| serde_json::json!({}));
-        let meta = ToolMeta::new("ListWorkerSessions")
-            .description("List active Worker sessions explicitly granted to this Worker.")
-            .input_schema(schema);
-        let tool: Arc<dyn Tool> = Arc::new(ListWorkerSessionsTool {
-            provider: provider.clone(),
-        });
-        (meta, tool)
-    })
-}
-
 fn overview_definition(provider: Arc<dyn WorkerObservationProvider>) -> ToolDefinition {
     Arc::new(move || {
         let schema = serde_json::to_value(schemars::schema_for!(ViewSessionOverviewParams))
@@ -402,13 +396,6 @@ fn read_definition(provider: Arc<dyn WorkerObservationProvider>) -> ToolDefiniti
     })
 }
 
-#[derive(Debug, Deserialize, JsonSchema)]
-#[serde(deny_unknown_fields)]
-struct ListWorkerSessionsParams {
-    #[serde(default)]
-    limit: Option<usize>,
-}
-
 #[derive(Debug, Deserialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
 struct ViewSessionOverviewParams {
@@ -454,43 +441,6 @@ fn default_read_mode() -> String {
     "compact".to_string()
 }
 
-struct ListWorkerSessionsTool {
-    provider: Arc<dyn WorkerObservationProvider>,
-}
-
-#[async_trait]
-impl Tool for ListWorkerSessionsTool {
-    async fn execute(
-        &self,
-        input_json: &str,
-        _context: llm_engine::tool::ToolExecutionContext,
-    ) -> Result<ToolOutput, ToolError> {
-        let params: ListWorkerSessionsParams = parse_input("ListWorkerSessions", input_json)?;
-        let limit = bounded_limit(params.limit);
-        let mut subjects = self
-            .provider
-            .list_worker_sessions()
-            .await
-            .map_err(tool_error)?;
-        subjects.truncate(limit);
-        let sessions = subjects
-            .iter()
-            .map(|subject| {
-                serde_json::json!({
-                    "subject": bounded_subject(&subject.subject),
-                    "display_name": truncate_text(&subject.display_name, 200),
-                    "relation": truncate_text(&subject.relation, 64),
-                    "status": truncate_text(&subject.status, 64),
-                })
-            })
-            .collect::<Vec<_>>();
-        json_output(
-            format!("Listed {} Worker session(s).", sessions.len()),
-            serde_json::json!({ "sessions": sessions }),
-        )
-    }
-}
-
 struct ViewSessionOverviewTool {
     provider: Arc<dyn WorkerObservationProvider>,
 }
@@ -692,31 +642,6 @@ fn parse_tool_part(value: &str) -> Result<ToolPart, ToolError> {
         .ok_or_else(|| ToolError::InvalidArgument(format!("invalid tool_part {value:?}")))
 }
 
-fn bounded_subject(subject: &WorkerObservationSubjectRef) -> WorkerObservationSubjectRef {
-    match subject {
-        WorkerObservationSubjectRef::RuntimeWorker {
-            runtime_id,
-            worker_id,
-        } => WorkerObservationSubjectRef::RuntimeWorker {
-            runtime_id: truncate_text(runtime_id, 200),
-            worker_id: truncate_text(worker_id, 200),
-        },
-        WorkerObservationSubjectRef::SubWorker { name } => WorkerObservationSubjectRef::SubWorker {
-            name: truncate_text(name, 200),
-        },
-    }
-}
-
-fn truncate_text(value: &str, max_chars: usize) -> String {
-    if value.chars().count() <= max_chars {
-        value.to_string()
-    } else {
-        let mut truncated = value.chars().take(max_chars).collect::<String>();
-        truncated.push('…');
-        truncated
-    }
-}
-
 fn bounded_limit(limit: Option<usize>) -> usize {
     limit.unwrap_or(DEFAULT_PAGE_LIMIT).clamp(1, MAX_PAGE_LIMIT)
 }
@@ -801,7 +726,7 @@ mod tests {
         let catalog = crate::PromptCatalog::builtins_only().unwrap();
         let source = &catalog.projection().templates["common.worker_observation"];
         for token in [
-            "ListWorkerSessions",
+            "WorkerList",
             "ViewSessionOverview",
             "SearchSessionEntries",
             "ReadSessionEntry",
@@ -812,7 +737,7 @@ mod tests {
     }
 
     #[test]
-    fn worker_observation_installs_without_session_explore_or_memory_extract() {
+    fn worker_observation_requires_worker_control_service() {
         let provider = Arc::new(FakeProvider {
             captures: Mutex::new(Vec::new()),
         });
@@ -821,15 +746,15 @@ mod tests {
         let report = FeatureRegistryBuilder::new()
             .with_module(WorkerObservationFeature::new(provider))
             .install_into_pending(&mut pending_tools, &mut hook_builder);
-        assert!(report.reports[0].installed);
+        assert!(!report.reports[0].installed);
+        assert!(report.installed_tool_names().is_empty());
+        let descriptor = WorkerObservationFeature::new(Arc::new(FakeProvider {
+            captures: Mutex::new(Vec::new()),
+        }))
+        .descriptor();
         assert_eq!(
-            report.installed_tool_names(),
+            descriptor.requires_services[0].id,
-            [
+            ServiceId::builtin(WORKER_CONTROL_SERVICE_ID)
-                "ListWorkerSessions",
-                "ViewSessionOverview",
-                "SearchSessionEntries",
-                "ReadSessionEntry",
-            ]
         );
     }
 
@@ -838,13 +763,6 @@ mod tests {
         let provider = Arc::new(FakeProvider {
             captures: Mutex::new(vec![message("u1", Role::User, "first")]),
         });
-        let list = list_definition(provider.clone())().1;
-        let listed = list
-            .execute("{}", llm_engine::tool::ToolExecutionContext::direct())
-            .await
-            .unwrap();
-        assert!(listed.content.unwrap().contains("granted"));
-
         let read = read_definition(provider.clone())().1;
         let hidden = read
             .execute(

crates/workspace-server/src/server.rs

@@ -103,8 +103,8 @@ use crate::skills;
 use crate::store::{
     AccountRecord, ApiTokenRecord, AuthChallengeRecord, BrowserSessionRecord, ControlPlaneStore,
     DeviceLoginFlowRecord, FlowSourceRecord, PasskeyCredentialRecord, RepositoryRecord,
-    TicketWorkerAssignmentRecord, UserRecord, WorkdirRegistryRecord, WorkerRegistryRecord,
+    TicketWorkerAssignmentRecord, UserRecord, WorkdirRegistryRecord, WorkerControlGrantRecord,
-    WorkerWorkdirLinkRecord, WorkspaceRecord,
+    WorkerRegistryRecord, WorkerWorkdirLinkRecord, WorkspaceRecord,
 };
 use crate::{Error, Result};
 use worker_runtime::catalog::{
@@ -335,20 +335,10 @@ impl WorkspaceWorkerRemoveExecutor {
         let runtime = self.runtime.upgrade().ok_or_else(|| {
             "Workspace Runtime registry is unavailable during WorkerRemove".to_string()
         })?;
-        let source_is_current_orchestrator =
+        let target = RuntimeWorkerRef {
-            runtime.list_workers(1_000).items.into_iter().any(|worker| {
+            runtime_id: target_runtime_id.to_string(),
-                worker.worker.runtime_id == source.runtime_id
+            worker_id: target_worker_id.to_string(),
-                    && worker.worker.worker_id == source.worker_id
+        };
-                    && worker.singleton_key.as_deref()
-                        == Some(crate::hosts::WORKSPACE_ORCHESTRATOR_SINGLETON_KEY)
-            });
-        if !source_is_current_orchestrator {
-            return Ok(worker_remove_error_response(
-                StatusCode::FORBIDDEN,
-                "orchestrator_required",
-                "WorkerRemove is restricted to the current Workspace Orchestrator",
-            ));
-        }
         if source.runtime_id == target_runtime_id && source.worker_id == target_worker_id {
             return Ok(worker_remove_error_response(
                 StatusCode::CONFLICT,
@@ -356,11 +346,25 @@ impl WorkspaceWorkerRemoveExecutor {
                 "The current Orchestrator cannot remove itself",
             ));
         }
+        let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
+        let granted = self
+            .store
+            .get_active_worker_control_grant(&self.workspace_id, &controller, &target)
+            .map_err(|_| "Worker control grant authority is unavailable".to_string())?
+            .is_some_and(|grant| {
+                grant
+                    .permissions
+                    .iter()
+                    .any(|permission| permission == "remove")
+            });
+        if !granted {
+            return Ok(worker_remove_error_response(
+                StatusCode::NOT_FOUND,
+                "unknown_worker",
+                "The target Worker is not known to the current Worker",
+            ));
+        }
 
-        let target = RuntimeWorkerRef {
-            runtime_id: target_runtime_id.to_string(),
-            worker_id: target_worker_id.to_string(),
-        };
         let remove_lock = {
             let mut locks = self
                 .worker_remove_locks
@@ -1435,6 +1439,26 @@ pub fn build_router(api: WorkspaceApi) -> Router {
             get(scoped_workspace_orchestrator_status)
                 .post(scoped_start_workspace_orchestrator),
         )
+        .route(
+            "/api/w/{workspace_id}/worker-control/workers",
+            get(list_known_workers).post(spawn_known_worker),
+        )
+        .route(
+            "/api/w/{workspace_id}/worker-control/workers/{runtime_id}/{worker_id}/input",
+            post(send_known_worker_input),
+        )
+        .route(
+            "/api/w/{workspace_id}/worker-control/workers/{runtime_id}/{worker_id}/cancel",
+            post(cancel_known_worker),
+        )
+        .route(
+            "/api/w/{workspace_id}/worker-control/workers/{runtime_id}/{worker_id}/stop",
+            post(stop_known_worker),
+        )
+        .route(
+            "/api/w/{workspace_id}/worker-control/workers/{runtime_id}/{worker_id}/restore",
+            post(restore_known_worker),
+        )
         .route(
             "/api/w/{workspace_id}/worker-observation/sessions",
             get(scoped_list_worker_observation_sessions),
@@ -2066,6 +2090,9 @@ pub struct CreateWorkspaceWorkerRequest {
     pub initial_submit: Vec<Segment>,
     #[serde(default)]
     pub working_directory: Option<BrowserWorkerWorkingDirectorySelection>,
+    /// Backend idempotency key used only for authenticated Worker-owned spawn/control.
+    #[serde(default)]
+    pub control_operation_id: Option<String>,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -5832,6 +5859,229 @@ async fn scoped_workspace_orchestrator_status(
     Ok(Json(workspace_orchestrator_response(&api, "observed")))
 }
 
+#[derive(Debug, Serialize, Deserialize)]
+struct KnownWorkerRecord {
+    subject: RuntimeWorkerRef,
+    relation: String,
+    origin: String,
+    permissions: Vec<String>,
+    summary: WorkerSummary,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct KnownWorkersResponse {
+    workspace_id: String,
+    items: Vec<KnownWorkerRecord>,
+    truncated: bool,
+}
+
+async fn list_known_workers(
+    State(api): State<WorkspaceApi>,
+    AxumPath(path): AxumPath<ScopedWorkspacePath>,
+    headers: HeaderMap,
+) -> ApiResult<Json<KnownWorkersResponse>> {
+    validate_workspace_scope(&api, &path.workspace_id)?;
+    let source = authenticate_worker_mutation_source(&api, &path.workspace_id, &headers)?;
+    let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
+    let limit = api.config.max_records.clamp(1, 500);
+    let grants =
+        api.store
+            .list_active_worker_control_grants(&path.workspace_id, &controller, limit + 1)?;
+    let truncated = grants.len() > limit;
+    let mut items = Vec::with_capacity(grants.len().min(limit));
+    for grant in grants.into_iter().take(limit) {
+        let summary = api
+            .runtime
+            .worker(&grant.subject)
+            .map_err(|error| error.into_error())?;
+        items.push(KnownWorkerRecord {
+            subject: grant.subject,
+            relation: grant.relation,
+            origin: grant.origin,
+            permissions: grant.permissions,
+            summary,
+        });
+    }
+    Ok(Json(KnownWorkersResponse {
+        workspace_id: path.workspace_id,
+        items,
+        truncated,
+    }))
+}
+
+async fn spawn_known_worker(
+    State(api): State<WorkspaceApi>,
+    AxumPath(path): AxumPath<ScopedWorkspacePath>,
+    headers: HeaderMap,
+    Json(request): Json<CreateWorkspaceWorkerRequest>,
+) -> ApiResult<Json<BrowserCreateWorkerResponse>> {
+    validate_workspace_scope(&api, &path.workspace_id)?;
+    let source = authenticate_worker_mutation_source(&api, &path.workspace_id, &headers)?;
+    let relation = if request.ticket_assignment.is_some() {
+        "assigned"
+    } else {
+        "spawned"
+    };
+    let operation_id = request
+        .control_operation_id
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| Error::InvalidInput("control_operation_id is required".to_string()))?
+        .to_string();
+    let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
+    if request.ticket_assignment.is_none()
+        && let Some(existing) = api.store.get_worker_control_grant_by_operation(
+            &path.workspace_id,
+            &controller,
+            &operation_id,
+        )?
+    {
+        let worker = api
+            .runtime
+            .worker(&existing.subject)
+            .map_err(|error| error.into_error())?;
+        return Ok(Json(BrowserCreateWorkerResponse {
+            workspace_id: path.workspace_id,
+            console_href: format!(
+                "/w/{}/runtimes/{}/workers/{}/console",
+                encode_path_segment(&existing.workspace_id),
+                encode_path_segment(&existing.subject.runtime_id),
+                encode_path_segment(&existing.subject.worker_id),
+            ),
+            worker_ref: existing.subject,
+            worker,
+            diagnostics: Vec::new(),
+        }));
+    }
+    let response = create_workspace_worker(State(api.clone()), headers, Json(request)).await?;
+    if let Err(error) = api
+        .store
+        .create_worker_control_grant(&WorkerControlGrantRecord {
+            workspace_id: path.workspace_id.clone(),
+            grant_id: new_id("wcg"),
+            controller,
+            subject: response.0.worker_ref.clone(),
+            relation: relation.to_string(),
+            origin: "worker_spawn".to_string(),
+            permissions: vec![
+                "send_input".to_string(),
+                "notify".to_string(),
+                "cancel".to_string(),
+                "stop".to_string(),
+                "restore".to_string(),
+                "remove".to_string(),
+                "observe".to_string(),
+            ],
+            operation_id,
+            created_at: Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true),
+            revoked_at: None,
+        })
+    {
+        let subject = response.0.worker_ref.clone();
+        let _ = api.runtime.delete_worker(&subject);
+        let _ = api
+            .store
+            .delete_worker_registry(&path.workspace_id, &subject);
+        return Err(ApiError::from(error));
+    }
+    Ok(response)
+}
+
+fn authorize_known_worker_permission(
+    api: &WorkspaceApi,
+    workspace_id: &str,
+    controller: &RuntimeWorkerRef,
+    subject: &RuntimeWorkerRef,
+    permission: &str,
+) -> Result<()> {
+    let grant = api
+        .store
+        .get_active_worker_control_grant(workspace_id, controller, subject)?
+        .ok_or_else(|| Error::UnknownWorker {
+            worker: subject.clone(),
+        })?;
+    if !grant
+        .permissions
+        .iter()
+        .any(|candidate| candidate == permission)
+    {
+        return Err(Error::InvalidInput(format!(
+            "worker control permission `{permission}` was not granted"
+        )));
+    }
+    Ok(())
+}
+
+async fn send_known_worker_input(
+    State(api): State<WorkspaceApi>,
+    AxumPath(path): AxumPath<ScopedRuntimeWorkerPath>,
+    headers: HeaderMap,
+    Json(request): Json<WorkerInputRequest>,
+) -> ApiResult<Json<WorkerInputResult>> {
+    validate_workspace_scope(&api, &path.workspace_id)?;
+    let source = authenticate_worker_mutation_source(&api, &path.workspace_id, &headers)?;
+    let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
+    let permission = match request.kind {
+        WorkerInputKind::Notify => "notify",
+        _ => "send_input",
+    };
+    authorize_known_worker_permission(
+        &api,
+        &path.workspace_id,
+        &controller,
+        &path.worker,
+        permission,
+    )?;
+    scoped_send_runtime_worker_input(State(api), AxumPath(path), Json(request)).await
+}
+
+async fn cancel_known_worker(
+    State(api): State<WorkspaceApi>,
+    AxumPath(path): AxumPath<ScopedRuntimeWorkerPath>,
+    headers: HeaderMap,
+    Json(request): Json<WorkerLifecycleRequest>,
+) -> ApiResult<Json<WorkerLifecycleResult>> {
+    validate_workspace_scope(&api, &path.workspace_id)?;
+    let source = authenticate_worker_mutation_source(&api, &path.workspace_id, &headers)?;
+    let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
+    authorize_known_worker_permission(
+        &api,
+        &path.workspace_id,
+        &controller,
+        &path.worker,
+        "cancel",
+    )?;
+    scoped_cancel_runtime_worker(State(api), AxumPath(path), Json(request)).await
+}
+
+async fn stop_known_worker(
+    State(api): State<WorkspaceApi>,
+    AxumPath(path): AxumPath<ScopedRuntimeWorkerPath>,
+    headers: HeaderMap,
+    Json(request): Json<WorkerLifecycleRequest>,
+) -> ApiResult<Json<WorkerLifecycleResult>> {
+    validate_workspace_scope(&api, &path.workspace_id)?;
+    let source = authenticate_worker_mutation_source(&api, &path.workspace_id, &headers)?;
+    let subject = path.worker.clone();
+    let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
+    authorize_known_worker_permission(&api, &path.workspace_id, &controller, &subject, "stop")?;
+    scoped_stop_runtime_worker(State(api), AxumPath(path), Json(request)).await
+}
+
+async fn restore_known_worker(
+    State(api): State<WorkspaceApi>,
+    AxumPath(path): AxumPath<ScopedRuntimeWorkerPath>,
+    headers: HeaderMap,
+) -> ApiResult<Json<WorkerRestoreResponse>> {
+    validate_workspace_scope(&api, &path.workspace_id)?;
+    let source = authenticate_worker_mutation_source(&api, &path.workspace_id, &headers)?;
+    let subject = path.worker.clone();
+    let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
+    authorize_known_worker_permission(&api, &path.workspace_id, &controller, &subject, "restore")?;
+    scoped_restore_runtime_worker(State(api), AxumPath(path), Query(Default::default())).await
+}
+
 async fn scoped_list_worker_observation_sessions(
     State(api): State<WorkspaceApi>,
     AxumPath(path): AxumPath<ScopedWorkspacePath>,
@@ -5839,27 +6089,35 @@ async fn scoped_list_worker_observation_sessions(
 ) -> ApiResult<Json<serde_json::Value>> {
     validate_workspace_scope(&api, &path.workspace_id)?;
     let source = authenticate_worker_mutation_source(&api, &path.workspace_id, &headers)?;
-    authorize_workspace_orchestrator_observation(&api, &source)?;
+    let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
-    let sessions = workers_response(api.clone())?
+    let sessions = api
-        .items
+        .store
+        .list_active_worker_control_grants(&path.workspace_id, &controller, 100)?
         .into_iter()
-        .filter(|worker| {
+        .filter(|grant| {
-            !matches!(
+            grant
+                .permissions
+                .iter()
+                .any(|permission| permission == "observe")
+        })
+        .filter_map(|grant| {
+            let worker = api.runtime.worker(&grant.subject).ok()?;
+            if matches!(
                 worker.state.as_str(),
                 "stopped" | "failed" | "rejected" | "disconnected"
-            ) && (worker.worker.runtime_id != source.runtime_id
+            ) {
-                || worker.worker.worker_id != source.worker_id)
+                return None;
-        })
+            }
-        .take(100)
+            Some(WorkerObservationSubject {
-        .map(|worker| WorkerObservationSubject {
                 subject: WorkerObservationSubjectRef::RuntimeWorker {
-                runtime_id: worker.worker.runtime_id,
+                    runtime_id: grant.subject.runtime_id,
-                worker_id: worker.worker.worker_id,
+                    worker_id: grant.subject.worker_id,
                 },
                 display_name: worker.display_name,
-            relation: "workspace_orchestrator_grant".to_string(),
+                relation: grant.relation,
                 status: worker.state,
             })
+        })
         .collect::<Vec<_>>();
     Ok(Json(serde_json::json!({ "sessions": sessions })))
 }
@@ -5872,7 +6130,6 @@ async fn scoped_capture_worker_observation_session(
 ) -> ApiResult<Json<serde_json::Value>> {
     validate_workspace_scope(&api, &path.workspace_id)?;
     let source = authenticate_worker_mutation_source(&api, &path.workspace_id, &headers)?;
-    authorize_workspace_orchestrator_observation(&api, &source)?;
     let WorkerObservationSubjectRef::RuntimeWorker {
         runtime_id,
         worker_id,
@@ -5883,17 +6140,16 @@ async fn scoped_capture_worker_observation_session(
         }));
     };
     let target = RuntimeWorkerRef::new(runtime_id, worker_id);
-    let granted = workers_response(api.clone())?
+    let controller = RuntimeWorkerRef::new(&source.runtime_id, &source.worker_id);
-        .items
+    authorize_known_worker_permission(&api, &path.workspace_id, &controller, &target, "observe")?;
-        .into_iter()
+    let target_summary = api
-        .any(|worker| {
+        .runtime
-            worker.worker == target
+        .worker(&target)
-                && !matches!(
+        .map_err(|error| error.into_error())?;
-                    worker.state.as_str(),
+    if matches!(
+        target_summary.state.as_str(),
         "stopped" | "failed" | "rejected" | "disconnected"
-                )
+    ) {
-        });
-    if !granted {
         return Err(ApiError::from(Error::UnknownWorker { worker: target }));
     }
 
@@ -5927,25 +6183,6 @@ async fn scoped_capture_worker_observation_session(
     })))
 }
 
-fn authorize_workspace_orchestrator_observation(
-    api: &WorkspaceApi,
-    source: &WorkerMutationSource,
-) -> ApiResult<()> {
-    let Some(orchestrator) = find_workspace_orchestrator(api) else {
-        return Err(ApiError::from(Error::UnknownWorker {
-            worker: RuntimeWorkerRef::new(source.runtime_id.clone(), source.worker_id.clone()),
-        }));
-    };
-    if orchestrator.worker.runtime_id != source.runtime_id
-        || orchestrator.worker.worker_id != source.worker_id
-    {
-        return Err(ApiError::from(Error::UnknownWorker {
-            worker: RuntimeWorkerRef::new(source.runtime_id.clone(), source.worker_id.clone()),
-        }));
-    }
-    Ok(())
-}
-
 async fn scoped_start_workspace_orchestrator(
     State(api): State<WorkspaceApi>,
     AxumPath(path): AxumPath<ScopedWorkspacePath>,
@@ -6028,6 +6265,14 @@ async fn scoped_start_workspace_orchestrator(
             result.diagnostics,
         ));
     }
+    let worker = result.worker.as_ref().expect("accepted Worker was checked");
+    record_worker_summary(
+        &api,
+        worker,
+        &worker.display_name,
+        Some("builtin:orchestrator".to_string()),
+        WorkerRegistryDisplayNamePolicy::UseProvided,
+    )?;
     *api.orchestrator_attention_fingerprint
         .lock()
         .unwrap_or_else(|poisoned| poisoned.into_inner()) = None;
@@ -8446,6 +8691,7 @@ async fn create_workspace_worker(
         ticket_assignment,
         initial_submit,
         working_directory,
+        control_operation_id: _,
     } = request;
     let config_state = api
         .config_store
@@ -12273,6 +12519,7 @@ mod tests {
                     selector: "builtin:coder-review".to_string(),
                 }],
                 working_directory: None,
+                control_operation_id: None,
             }),
         )
         .await
@@ -12312,6 +12559,7 @@ mod tests {
                 ticket_assignment: None,
                 initial_submit: Vec::new(),
                 working_directory: None,
+                control_operation_id: None,
             }),
         )
         .await
@@ -12346,6 +12594,7 @@ mod tests {
                 ticket_assignment: None,
                 initial_submit: Vec::new(),
                 working_directory: None,
+                control_operation_id: None,
             }),
         )
         .await
@@ -12447,6 +12696,7 @@ mod tests {
                     selector: "builtin:coder-review".to_string(),
                 }],
                 working_directory: None,
+                control_operation_id: None,
             }),
         )
         .await
@@ -12745,6 +12995,7 @@ mod tests {
                 ticket_assignment: None,
                 initial_submit: Vec::new(),
                 working_directory: None,
+                control_operation_id: None,
             }),
         )
         .await
@@ -12761,6 +13012,7 @@ mod tests {
                 ticket_assignment: None,
                 initial_submit: Vec::new(),
                 working_directory: None,
+                control_operation_id: None,
             }),
         )
         .await
@@ -12783,6 +13035,21 @@ mod tests {
         );
         assert_ne!(dedicated.worker.worker_id, generic.worker_ref.worker_id);
 
+        api.store
+            .create_worker_control_grant(&WorkerControlGrantRecord {
+                workspace_id: workspace_id.clone(),
+                grant_id: "orchestrator-controls-generic".to_string(),
+                controller: dedicated.worker.clone(),
+                subject: generic.worker_ref.clone(),
+                relation: "spawned".to_string(),
+                origin: "test".to_string(),
+                permissions: vec!["observe".to_string()],
+                operation_id: "observe-generic".to_string(),
+                created_at: "2026-07-27T00:00:00Z".to_string(),
+                revoked_at: None,
+            })
+            .unwrap();
+
         let mut observation_headers = HeaderMap::new();
         observation_headers.insert(
             "x-yoi-runtime-id",
@@ -12792,6 +13059,19 @@ mod tests {
             "x-yoi-worker-id",
             axum::http::HeaderValue::from_str(&dedicated.worker.worker_id).unwrap(),
         );
+        let Json(known) = list_known_workers(
+            State(api.clone()),
+            AxumPath(ScopedWorkspacePath {
+                workspace_id: workspace_id.clone(),
+            }),
+            observation_headers.clone(),
+        )
+        .await
+        .unwrap();
+        assert_eq!(known.items.len(), 1);
+        assert_eq!(known.items[0].subject, generic.worker_ref);
+        assert_eq!(known.items[0].permissions, ["observe"]);
+
         let Json(sessions) = scoped_list_worker_observation_sessions(
             State(api.clone()),
             AxumPath(ScopedWorkspacePath {
@@ -12836,7 +13116,7 @@ mod tests {
             "x-yoi-worker-id",
             axum::http::HeaderValue::from_str(&generic.worker_ref.worker_id).unwrap(),
         );
-        let error = scoped_list_worker_observation_sessions(
+        let Json(unauthorized) = scoped_list_worker_observation_sessions(
             State(api.clone()),
             AxumPath(ScopedWorkspacePath {
                 workspace_id: workspace_id.clone(),
@@ -12844,8 +13124,8 @@ mod tests {
             unauthorized_headers,
         )
         .await
-        .unwrap_err();
+        .unwrap();
-        assert_eq!(error.into_response().status(), StatusCode::NOT_FOUND);
+        assert!(unauthorized["sessions"].as_array().unwrap().is_empty());
 
         let Json(existing) = scoped_start_workspace_orchestrator(
             State(api.clone()),
@@ -14883,6 +15163,9 @@ mod tests {
             )
             .unwrap();
         let target = spawned.worker.unwrap().worker;
+        let target_summary = api.runtime.worker(&target).unwrap();
+        sync_worker_observation(&api, &target_summary).unwrap();
+        seed_worker_control_grant(&api, &source, &target, "caller-guard-target");
         let running_response = executor
             .execute_async(
                 verified_source(),
@@ -14992,6 +15275,7 @@ mod tests {
         .unwrap();
         let summary = api.runtime.worker(&target).unwrap();
         let record = sync_worker_observation(&api, &summary).unwrap();
+        seed_worker_control_grant(&api, &source, &target, "embedded-valid-proof");
 
         let response = WorkspaceWorkerRemoveExecutor::new(&api)
             .execute_async(
@@ -15208,12 +15492,12 @@ mod tests {
             )
             .await
             .unwrap();
-        assert_eq!(route_response.status(), StatusCode::FORBIDDEN);
+        assert_eq!(route_response.status(), StatusCode::NOT_FOUND);
         let route_body = axum::body::to_bytes(route_response.into_body(), usize::MAX)
             .await
             .unwrap();
         let route_body = String::from_utf8(route_body.to_vec()).unwrap();
-        assert!(route_body.contains("orchestrator_required"));
+        assert!(route_body.contains("unknown_worker"));
         assert!(!route_body.contains("source"));
         assert!(!route_body.contains("proof"));
 
@@ -15262,6 +15546,28 @@ mod tests {
             .unwrap();
     }
 
+    fn seed_worker_control_grant(
+        api: &WorkspaceApi,
+        controller: &RuntimeWorkerRef,
+        subject: &RuntimeWorkerRef,
+        operation_id: &str,
+    ) {
+        api.store
+            .create_worker_control_grant(&WorkerControlGrantRecord {
+                workspace_id: api.config.workspace_id.clone(),
+                grant_id: format!("grant-{operation_id}"),
+                controller: controller.clone(),
+                subject: subject.clone(),
+                relation: "spawned".to_string(),
+                origin: "test".to_string(),
+                permissions: vec!["remove".to_string()],
+                operation_id: operation_id.to_string(),
+                created_at: now_registry_timestamp(),
+                revoked_at: None,
+            })
+            .unwrap();
+    }
+
     fn seed_cleanup_worker(
         api: &WorkspaceApi,
         runtime_worker_id: u64,

crates/workspace-server/src/store.rs

@@ -181,6 +181,11 @@ const MIGRATIONS: &[Migration] = &[
         name: "persist Workspace config schema contribution bundles",
         apply: persist_workspace_config_schema_bundles,
     },
+    Migration {
+        version: 33,
+        name: "create durable Runtime Worker control grants",
+        apply: create_worker_control_grant_authority,
+    },
 ];
 
 struct Migration {
@@ -325,6 +330,23 @@ pub struct WorkerRegistryRecord {
     pub updated_at: String,
 }
 
+/// Durable authority describing which Runtime Worker another Runtime Worker may
+/// discover and control. Revoked grants remain as audit evidence but are never
+/// returned by active-grant queries.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct WorkerControlGrantRecord {
+    pub workspace_id: String,
+    pub grant_id: String,
+    pub controller: RuntimeWorkerRef,
+    pub subject: RuntimeWorkerRef,
+    pub relation: String,
+    pub origin: String,
+    pub permissions: Vec<String>,
+    pub operation_id: String,
+    pub created_at: String,
+    pub revoked_at: Option<String>,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct TicketWorkerAssignmentRecord {
     pub workspace_id: String,
@@ -732,6 +754,35 @@ pub trait ControlPlaneStore: Send + Sync {
     fn delete_worker_registry(&self, workspace_id: &str, worker: &RuntimeWorkerRef)
     -> Result<bool>;
 
+    fn create_worker_control_grant(
+        &self,
+        record: &WorkerControlGrantRecord,
+    ) -> Result<WorkerControlGrantRecord>;
+    fn get_worker_control_grant_by_operation(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        operation_id: &str,
+    ) -> Result<Option<WorkerControlGrantRecord>>;
+    fn get_active_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        subject: &RuntimeWorkerRef,
+    ) -> Result<Option<WorkerControlGrantRecord>>;
+    fn list_active_worker_control_grants(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        limit: usize,
+    ) -> Result<Vec<WorkerControlGrantRecord>>;
+    fn revoke_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        grant_id: &str,
+        revoked_at: &str,
+    ) -> Result<bool>;
+
     fn get_ticket_assignment_operation(
         &self,
         workspace_id: &str,
@@ -2321,6 +2372,157 @@ impl ControlPlaneStore for SqliteWorkspaceStore {
         })
     }
 
+    fn create_worker_control_grant(
+        &self,
+        record: &WorkerControlGrantRecord,
+    ) -> Result<WorkerControlGrantRecord> {
+        self.with_conn(|conn| {
+            let permissions_json = serde_json::to_string(&record.permissions)
+                .map_err(|error| Error::Store(error.to_string()))?;
+            conn.execute(
+                r#"INSERT INTO worker_control_grants (
+                    workspace_id, grant_id,
+                    controller_runtime_id, controller_worker_id,
+                    subject_runtime_id, subject_worker_id,
+                    relation, origin, permissions_json, operation_id, created_at, revoked_at
+                ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)
+                ON CONFLICT (
+                    workspace_id,
+                    controller_runtime_id,
+                    controller_worker_id,
+                    operation_id
+                ) DO NOTHING"#,
+                params![
+                    record.workspace_id,
+                    record.grant_id,
+                    record.controller.runtime_id,
+                    record.controller.worker_id,
+                    record.subject.runtime_id,
+                    record.subject.worker_id,
+                    record.relation,
+                    record.origin,
+                    permissions_json,
+                    record.operation_id,
+                    record.created_at,
+                    record.revoked_at,
+                ],
+            )?;
+
+            let persisted = read_worker_control_grant_by_operation(
+                conn,
+                record.workspace_id.as_str(),
+                &record.controller,
+                record.operation_id.as_str(),
+            )?
+            .ok_or_else(|| Error::Store("worker control grant was not persisted".to_string()))?;
+            if persisted.subject != record.subject
+                || persisted.relation != record.relation
+                || persisted.origin != record.origin
+                || persisted.permissions != record.permissions
+            {
+                return Err(Error::InvalidInput(format!(
+                    "worker control operation `{}` was already used with different input",
+                    record.operation_id
+                )));
+            }
+            Ok(persisted)
+        })
+    }
+
+    fn get_worker_control_grant_by_operation(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        operation_id: &str,
+    ) -> Result<Option<WorkerControlGrantRecord>> {
+        self.with_conn(|conn| {
+            read_worker_control_grant_by_operation(conn, workspace_id, controller, operation_id)
+        })
+    }
+
+    fn get_active_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        subject: &RuntimeWorkerRef,
+    ) -> Result<Option<WorkerControlGrantRecord>> {
+        self.with_conn(|conn| {
+            conn.query_row(
+                r#"SELECT workspace_id, grant_id,
+                          controller_runtime_id, controller_worker_id,
+                          subject_runtime_id, subject_worker_id,
+                          relation, origin, permissions_json, operation_id, created_at, revoked_at
+                   FROM worker_control_grants
+                   WHERE workspace_id = ?1
+                     AND controller_runtime_id = ?2 AND controller_worker_id = ?3
+                     AND subject_runtime_id = ?4 AND subject_worker_id = ?5
+                     AND revoked_at IS NULL
+                   ORDER BY created_at DESC
+                   LIMIT 1"#,
+                params![
+                    workspace_id,
+                    controller.runtime_id,
+                    controller.worker_id,
+                    subject.runtime_id,
+                    subject.worker_id,
+                ],
+                read_worker_control_grant_record,
+            )
+            .optional()
+            .map_err(Error::from)
+        })
+    }
+
+    fn list_active_worker_control_grants(
+        &self,
+        workspace_id: &str,
+        controller: &RuntimeWorkerRef,
+        limit: usize,
+    ) -> Result<Vec<WorkerControlGrantRecord>> {
+        self.with_conn(|conn| {
+            let mut stmt = conn.prepare(
+                r#"SELECT workspace_id, grant_id,
+                          controller_runtime_id, controller_worker_id,
+                          subject_runtime_id, subject_worker_id,
+                          relation, origin, permissions_json, operation_id, created_at, revoked_at
+                   FROM worker_control_grants
+                   WHERE workspace_id = ?1
+                     AND controller_runtime_id = ?2 AND controller_worker_id = ?3
+                     AND revoked_at IS NULL
+                   ORDER BY created_at ASC, grant_id ASC
+                   LIMIT ?4"#,
+            )?;
+            let rows = stmt.query_map(
+                params![
+                    workspace_id,
+                    controller.runtime_id,
+                    controller.worker_id,
+                    limit as i64,
+                ],
+                read_worker_control_grant_record,
+            )?;
+            rows.collect::<std::result::Result<Vec<_>, _>>()
+                .map_err(Error::from)
+        })
+    }
+
+    fn revoke_worker_control_grant(
+        &self,
+        workspace_id: &str,
+        grant_id: &str,
+        revoked_at: &str,
+    ) -> Result<bool> {
+        self.with_conn(|conn| {
+            let changed = conn.execute(
+                r#"UPDATE worker_control_grants
+                   SET revoked_at = ?3
+                   WHERE workspace_id = ?1 AND grant_id = ?2 AND revoked_at IS NULL"#,
+                params![workspace_id, grant_id, revoked_at],
+            )?;
+            Ok(changed > 0)
+        })
+    }
+
     fn get_ticket_assignment_operation(
         &self,
         workspace_id: &str,
@@ -3627,6 +3829,57 @@ fn read_worker_registry_record(row: &rusqlite::Row<'_>) -> rusqlite::Result<Work
     })
 }
 
+fn read_worker_control_grant_record(
+    row: &rusqlite::Row<'_>,
+) -> rusqlite::Result<WorkerControlGrantRecord> {
+    let permissions_json: String = row.get(8)?;
+    let permissions = serde_json::from_str(&permissions_json).map_err(|error| {
+        rusqlite::Error::FromSqlConversionFailure(8, rusqlite::types::Type::Text, Box::new(error))
+    })?;
+    Ok(WorkerControlGrantRecord {
+        workspace_id: row.get(0)?,
+        grant_id: row.get(1)?,
+        controller: RuntimeWorkerRef::new(
+            row.get::<_, String>(2)?,
+            row.get::<_, u64>(3)?.to_string(),
+        ),
+        subject: RuntimeWorkerRef::new(row.get::<_, String>(4)?, row.get::<_, u64>(5)?.to_string()),
+        relation: row.get(6)?,
+        origin: row.get(7)?,
+        permissions,
+        operation_id: row.get(9)?,
+        created_at: row.get(10)?,
+        revoked_at: row.get(11)?,
+    })
+}
+
+fn read_worker_control_grant_by_operation(
+    conn: &Connection,
+    workspace_id: &str,
+    controller: &RuntimeWorkerRef,
+    operation_id: &str,
+) -> Result<Option<WorkerControlGrantRecord>> {
+    conn.query_row(
+        r#"SELECT workspace_id, grant_id,
+                  controller_runtime_id, controller_worker_id,
+                  subject_runtime_id, subject_worker_id,
+                  relation, origin, permissions_json, operation_id, created_at, revoked_at
+           FROM worker_control_grants
+           WHERE workspace_id = ?1
+             AND controller_runtime_id = ?2 AND controller_worker_id = ?3
+             AND operation_id = ?4"#,
+        params![
+            workspace_id,
+            controller.runtime_id,
+            controller.worker_id,
+            operation_id,
+        ],
+        read_worker_control_grant_record,
+    )
+    .optional()
+    .map_err(Error::from)
+}
+
 fn current_ticket_worker_assignment_select_sql() -> String {
     "SELECT a.workspace_id, a.ticket_id, a.assignment_id, a.runtime_id, a.worker_id, \
             a.assigned_by, a.assigned_at \
@@ -4639,6 +4892,58 @@ pub(crate) fn persist_workspace_config_schema_bundles(conn: &Connection) -> Resu
     Ok(())
 }
 
+fn create_worker_control_grant_authority(conn: &Connection) -> Result<()> {
+    conn.execute_batch(
+        r#"
+        CREATE TABLE worker_control_grants (
+            workspace_id TEXT NOT NULL,
+            grant_id TEXT NOT NULL,
+            controller_runtime_id TEXT NOT NULL,
+            controller_worker_id INTEGER NOT NULL,
+            subject_runtime_id TEXT NOT NULL,
+            subject_worker_id INTEGER NOT NULL,
+            relation TEXT NOT NULL,
+            origin TEXT NOT NULL,
+            permissions_json TEXT NOT NULL,
+            operation_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            revoked_at TEXT,
+            PRIMARY KEY (workspace_id, grant_id),
+            UNIQUE (
+                workspace_id,
+                controller_runtime_id,
+                controller_worker_id,
+                operation_id
+            ),
+            FOREIGN KEY (workspace_id, controller_runtime_id, controller_worker_id)
+                REFERENCES worker_registry (workspace_id, runtime_id, runtime_worker_id)
+                ON DELETE CASCADE,
+            FOREIGN KEY (workspace_id, subject_runtime_id, subject_worker_id)
+                REFERENCES worker_registry (workspace_id, runtime_id, runtime_worker_id)
+                ON DELETE CASCADE
+        );
+
+        CREATE INDEX idx_worker_control_grants_controller_active
+            ON worker_control_grants (
+                workspace_id,
+                controller_runtime_id,
+                controller_worker_id,
+                revoked_at,
+                created_at
+            );
+
+        CREATE INDEX idx_worker_control_grants_subject_active
+            ON worker_control_grants (
+                workspace_id,
+                subject_runtime_id,
+                subject_worker_id,
+                revoked_at
+            );
+        "#,
+    )?;
+    Ok(())
+}
+
 fn create_worker_mutation_source_proof_replay_guard(conn: &Connection) -> Result<()> {
     conn.execute_batch(
         r#"
@@ -5312,7 +5617,7 @@ CREATE TABLE ticket_worker_links (ticket_id TEXT, worker_ref_key TEXT);
 
         apply_migrations(&conn).unwrap();
 
-        assert_eq!(current_schema_version(&conn).unwrap(), 32);
+        assert_eq!(current_schema_version(&conn).unwrap(), 33);
         assert!(table_exists(&conn, "worker_workdir_attachment_reservations").unwrap());
     }
 
@@ -5345,7 +5650,7 @@ CREATE TABLE flow_events (event_id TEXT PRIMARY KEY);
 
         apply_migrations(&conn).unwrap();
 
-        assert_eq!(current_schema_version(&conn).unwrap(), 32);
+        assert_eq!(current_schema_version(&conn).unwrap(), 33);
         assert!(table_exists(&conn, "flow_sources").unwrap());
         assert!(table_exists(&conn, "flow_source_revisions").unwrap());
         assert!(!table_exists(&conn, "flow_instances").unwrap());
@@ -5412,7 +5717,7 @@ INSERT INTO worker_workdir_attachment_reservations (
 
         apply_migrations(&conn).unwrap();
 
-        assert_eq!(current_schema_version(&conn).unwrap(), 32);
+        assert_eq!(current_schema_version(&conn).unwrap(), 33);
         let repositories_sql: String = conn
             .query_row(
                 "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'repositories'",
@@ -5592,7 +5897,7 @@ INSERT INTO workdir_registry (
         let db = dir.path().join("control-plane.sqlite");
         let store = SqliteWorkspaceStore::open(&db).unwrap();
 
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 33);
         assert!(
             !store
                 .with_conn(|conn| table_exists(conn, "worker_workspace_credentials"))
@@ -5609,7 +5914,7 @@ INSERT INTO workdir_registry (
         store.upsert_workspace(&record).await.unwrap();
 
         let reopened = SqliteWorkspaceStore::open(&db).unwrap();
-        assert_eq!(reopened.schema_version().await.unwrap(), 32);
+        assert_eq!(reopened.schema_version().await.unwrap(), 33);
         assert_eq!(
             reopened.get_workspace("local-dev").await.unwrap(),
             Some(record)
@@ -6156,7 +6461,7 @@ INSERT INTO workdir_registry (
         .unwrap();
 
         let store = SqliteWorkspaceStore::from_connection(conn).unwrap();
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 33);
 
         store
             .with_conn(|conn| {
@@ -6345,7 +6650,7 @@ CREATE TABLE ticket_assignment_operations (
     #[tokio::test]
     async fn repository_records_round_trip() {
         let store = SqliteWorkspaceStore::in_memory().unwrap();
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 33);
         let workspace = WorkspaceRecord {
             workspace_id: "local-dev".to_string(),
             owner_account_id: None,
@@ -6411,7 +6716,7 @@ CREATE TABLE ticket_assignment_operations (
     #[tokio::test]
     async fn memory_authority_records_round_trip_and_close_staging() {
         let store = SqliteWorkspaceStore::in_memory().unwrap();
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 33);
         let workspace = WorkspaceRecord {
             workspace_id: "local-dev".to_string(),
             owner_account_id: None,
@@ -6671,10 +6976,110 @@ CREATE TABLE ticket_assignment_operations (
         );
     }
 
+    #[tokio::test]
+    async fn worker_control_grants_are_idempotent_scoped_and_revocable() {
+        let store = SqliteWorkspaceStore::in_memory().unwrap();
+        store
+            .upsert_workspace(&WorkspaceRecord {
+                workspace_id: "workspace-control".to_string(),
+                owner_account_id: None,
+                display_name: "Control grants".to_string(),
+                state: "active".to_string(),
+                created_at: "2026-07-27T00:00:00Z".to_string(),
+                updated_at: "2026-07-27T00:00:00Z".to_string(),
+            })
+            .await
+            .unwrap();
+        let worker_record = |worker_id: &str, display_name: &str| WorkerRegistryRecord {
+            workspace_id: "workspace-control".to_string(),
+            worker: RuntimeWorkerRef::new("runtime-a", worker_id),
+            display_name: display_name.to_string(),
+            profile: None,
+            retention_state: "normal".to_string(),
+            transcript_ref: None,
+            session_ref: None,
+            summary_ref: None,
+            diagnostics_ref: None,
+            created_at: "2026-07-27T00:00:00Z".to_string(),
+            updated_at: "2026-07-27T00:00:00Z".to_string(),
+        };
+        let controller_record = worker_record("1", "Controller");
+        let subject_record = worker_record("2", "Subject");
+        store.upsert_worker_registry(&controller_record).unwrap();
+        store.upsert_worker_registry(&subject_record).unwrap();
+
+        let grant = WorkerControlGrantRecord {
+            workspace_id: "workspace-control".to_string(),
+            grant_id: "grant-1".to_string(),
+            controller: controller_record.worker.clone(),
+            subject: subject_record.worker.clone(),
+            relation: "spawned".to_string(),
+            origin: "worker_spawn".to_string(),
+            permissions: vec![
+                "observe".to_string(),
+                "send_input".to_string(),
+                "stop".to_string(),
+            ],
+            operation_id: "spawn-op-1".to_string(),
+            created_at: "2026-07-27T00:00:01Z".to_string(),
+            revoked_at: None,
+        };
+        assert_eq!(store.create_worker_control_grant(&grant).unwrap(), grant);
+        assert_eq!(store.create_worker_control_grant(&grant).unwrap(), grant);
+        assert_eq!(
+            store
+                .list_active_worker_control_grants(
+                    "workspace-control",
+                    &controller_record.worker,
+                    10,
+                )
+                .unwrap(),
+            vec![grant.clone()]
+        );
+        assert_eq!(
+            store
+                .get_active_worker_control_grant(
+                    "workspace-control",
+                    &controller_record.worker,
+                    &subject_record.worker,
+                )
+                .unwrap(),
+            Some(grant.clone())
+        );
+
+        let conflicting_replay = WorkerControlGrantRecord {
+            subject: controller_record.worker.clone(),
+            ..grant.clone()
+        };
+        assert!(matches!(
+            store.create_worker_control_grant(&conflicting_replay),
+            Err(Error::InvalidInput(_))
+        ));
+        assert!(
+            store
+                .revoke_worker_control_grant(
+                    "workspace-control",
+                    &grant.grant_id,
+                    "2026-07-27T00:00:02Z",
+                )
+                .unwrap()
+        );
+        assert!(
+            store
+                .list_active_worker_control_grants(
+                    "workspace-control",
+                    &controller_record.worker,
+                    10,
+                )
+                .unwrap()
+                .is_empty()
+        );
+    }
+
     #[tokio::test]
     async fn account_and_login_records_round_trip() {
         let store = SqliteWorkspaceStore::in_memory().unwrap();
-        assert_eq!(store.schema_version().await.unwrap(), 32);
+        assert_eq!(store.schema_version().await.unwrap(), 33);
         let now = "2026-07-22T00:00:00Z".to_string();
         let account = AccountRecord {
             account_id: "acct-user-alice".to_string(),

resources/profiles/base.dcdl

@@ -27,7 +27,7 @@ feature = {
     web = { enabled = true; };
     image = { enabled = true; };
     sub_worker = { enabled = true; };
-    worker = { enabled = false; };
+    worker = { enabled = true; };
     objective = { enabled = true; };
     ticket = { enabled = true; authoring = true; thread = true; };
 };

resources/prompts/common/worker-observation.md

@@ -2,7 +2,7 @@
 
 Worker-session tools are a read-only exploration surface over host-granted active Worker sessions.
 
-- Use `ListWorkerSessions` to discover only the sessions already granted to you. Reuse the returned structured `subject` exactly: Runtime peers use `{ kind: "runtime_worker", runtime_id, worker_id }`, while parent-owned children use `{ kind: "sub_worker", name }`. Do not guess subject identifiers.
+- Use `WorkerList` to discover known Workers and reuse its returned structured `subject` exactly. Runtime Workers use `{ kind: "runtime_worker", runtime_id, worker_id }`, while parent-owned children use `{ kind: "sub_worker", name }`. Do not guess subject identifiers.
 - Use `ViewSessionOverview` for sparse orientation, `SearchSessionEntries` for bounded range/filter queries, and `ReadSessionEntry` for one bounded entry.
 - `SessionEntryRef` is the common entry identity across overview, search, reads, and evidence conversion. Reuse returned `E...` values; never invent them.
 - Every operation rereads the latest committed capture. Existing references remain stable when entries append.