feat: add typed engine run exits

# Conflicts:
#	crates/workspace-server/src/store.rs

Cargo.lock

@@ -26,6 +26,16 @@ dependencies = [
  "pom",
 ]
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common 0.1.7",
+ "generic-array",
+]
+
 [[package]]
 name = "aes"
 version = "0.8.4"
@@ -37,6 +47,20 @@ dependencies = [
  "cpufeatures 0.2.17",
 ]
 
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
 [[package]]
 name = "agen"
 version = "0.2.1"
@@ -326,6 +350,12 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -338,6 +368,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "base64urlsafedata"
 version = "0.5.5"
@@ -349,6 +385,17 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bcrypt-pbkdf"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6aeac2e1fe888769f34f05ac343bbef98b14d1ffb292ab69d4608b3abc86f2a2"
+dependencies = [
+ "blowfish",
+ "pbkdf2",
+ "sha2 0.10.9",
+]
+
 [[package]]
 name = "bit-set"
 version = "0.5.3"
@@ -403,6 +450,16 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher",
+]
+
 [[package]]
 name = "bstr"
 version = "1.12.1"
@@ -435,6 +492,12 @@ version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "bytes"
 version = "1.11.1"
@@ -495,6 +558,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -654,6 +728,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -937,6 +1017,18 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -966,6 +1058,41 @@ dependencies = [
  "phf 0.11.3",
 ]
 
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "digest 0.10.7",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "darling"
 version = "0.23.0"
@@ -1056,6 +1183,16 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4"
 
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid 0.9.6",
+ "zeroize",
+]
+
 [[package]]
 name = "der-parser"
 version = "9.0.0"
@@ -1114,7 +1251,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
+ "const-oid 0.9.6",
  "crypto-common 0.1.7",
+ "subtle",
 ]
 
 [[package]]
@@ -1124,7 +1263,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
 dependencies = [
  "block-buffer 0.12.0",
- "const-oid",
+ "const-oid 0.10.2",
  "crypto-common 0.2.1",
 ]
 
@@ -1175,12 +1314,66 @@ dependencies = [
  "cipher",
 ]
 
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest 0.10.7",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "sha2 0.10.9",
+ "subtle",
+]
+
 [[package]]
 name = "either"
 version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest 0.10.7",
+ "ff",
+ "generic-array",
+ "group",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "embedded-io"
 version = "0.4.0"
@@ -1284,6 +1477,22 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
+[[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "filedescriptor"
 version = "0.8.3"
@@ -1526,6 +1735,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
@@ -1568,6 +1778,16 @@ dependencies = [
  "wasip3",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
 [[package]]
 name = "gimli"
 version = "0.33.0"
@@ -1636,6 +1856,17 @@ dependencies = [
  "memmap2",
 ]
 
+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "h2"
 version = "0.4.13"
@@ -1724,6 +1955,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "html5ever"
 version = "0.26.0"
@@ -2212,6 +2452,9 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
 
 [[package]]
 name = "leb128fmt"
@@ -2672,6 +2915,22 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-conv"
 version = "0.2.1"
@@ -2698,6 +2957,16 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-iter"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2705,6 +2974,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
+ "libm",
 ]
 
 [[package]]
@@ -2765,6 +3035,12 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "openssl"
 version = "0.10.76"
@@ -2818,6 +3094,44 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "p521"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
+dependencies = [
+ "base16ct",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+]
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -2847,6 +3161,15 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"
 
+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "pdf-extract"
 version = "0.10.0"
@@ -2864,6 +3187,15 @@ dependencies = [
  "unicode-normalization",
 ]
 
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -3009,6 +3341,27 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.32"
@@ -3021,6 +3374,29 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "pom"
 version = "1.1.0"
@@ -3101,6 +3477,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -3525,6 +3910,16 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -3539,6 +3934,27 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid 0.9.6",
+ "digest 0.10.7",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rusqlite"
 version = "0.37.0"
@@ -3745,6 +4161,20 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "secrets"
 version = "0.1.0"
@@ -4060,6 +4490,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest 0.10.7",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
@@ -4103,6 +4543,72 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "ssh-cipher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caac132742f0d33c3af65bfcde7f6aa8f62f0e991d80db99149eb9d44708784f"
+dependencies = [
+ "aes",
+ "aes-gcm",
+ "cbc",
+ "chacha20",
+ "cipher",
+ "ctr",
+ "poly1305",
+ "ssh-encoding",
+ "subtle",
+]
+
+[[package]]
+name = "ssh-encoding"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb9242b9ef4108a78e8cd1a2c98e193ef372437f8c22be363075233321dd4a15"
+dependencies = [
+ "base64ct",
+ "pem-rfc7468",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "ssh-key"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b86f5297f0f04d08cabaa0f6bff7cb6aec4d9c3b49d87990d63da9d9156a8c3"
+dependencies = [
+ "bcrypt-pbkdf",
+ "ed25519-dalek",
+ "p256",
+ "p384",
+ "p521",
+ "rand_core 0.6.4",
+ "rsa",
+ "sec1",
+ "sha2 0.10.9",
+ "signature",
+ "ssh-cipher",
+ "ssh-encoding",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -4934,6 +5440,16 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
 [[package]]
 name = "unsafe-libyaml"
 version = "0.2.11"
@@ -6131,9 +6647,12 @@ dependencies = [
  "tokio-tungstenite 0.29.0",
  "toml",
  "tower",
+ "url",
  "uuid",
  "workdir",
  "worker",
+ "workspace-api",
+ "zeroize",
 ]
 
 [[package]]
@@ -6257,11 +6776,13 @@ dependencies = [
  "project-record",
  "protocol",
  "reqwest",
+ "ring",
  "rusqlite",
  "serde",
  "serde_json",
  "serde_yaml",
  "sha2 0.11.0",
+ "ssh-key",
  "tempfile",
  "thiserror 2.0.18",
  "ticket",
@@ -6278,6 +6799,7 @@ dependencies = [
  "worker",
  "worker-runtime",
  "workspace-api",
+ "zeroize",
 ]
 
 [[package]]

Cargo.toml

@@ -115,6 +115,7 @@ tar = "0.4"
 rusqlite = { version = "0.37", features = ["backup", "bundled"] }
 ring = "0.17.14"
 sha2 = "0.11"
+ssh-key = { version = "0.6.7", features = ["ed25519", "encryption"] }
 tempfile = "3.27"
 thiserror = "2.0"
 tokio = "1.52"
@@ -124,4 +125,5 @@ toml = "1.1"
 tracing = "0.1"
 url = "2.5"
 uuid = "1.23"
+zeroize = "1"
 webauthn-rs = { version = "0.5.2", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }

compose.yaml

@@ -21,7 +21,7 @@ services:
       - "8787"
     volumes:
       - server-data:/server-data
-      - ./docker/workspace:/workspace:ro
+      - /etc/yoi/server.toml:/server-config/server.toml:ro
 
   webui:
     image: yoi-webui:latest

crates/agen/README.md

@@ -24,18 +24,17 @@ agen = { version = "0.2.1", features = ["codex"] }
 Supply an implementation of [`LlmClient`](https://docs.rs/agen/latest/agen/llm_client/trait.LlmClient.html), then run a turn. The first call consumes the mutable engine and returns a cache-locked engine for later turns.
 
 ```no_run
-use agen::{Engine, EngineError};
+use agen::Engine;
 use agen::llm_client::LlmClient;
 
-async fn conversation<C: LlmClient>(client: C) -> Result<(), EngineError> {
+async fn conversation<C: LlmClient>(client: C) {
     let output = Engine::new(client)
         .system_prompt("You are a concise assistant.")
         .run("Explain typed state in one sentence.")
-        .await?;
+        .await;
 
     let mut engine = output.engine;
-    let _result = engine.run("Give a Rust example.").await?;
-    Ok(())
+    let _exit = engine.run("Give a Rust example.").await;
 }
 ```
 

crates/agen/examples/engine_cancel_demo.rs

@@ -4,7 +4,7 @@
 
 use agen::llm_client::scheme::{Scheme, anthropic::AnthropicScheme};
 use agen::llm_client::transport::{HttpTransport, ResolvedAuth};
-use agen::{Engine, EngineResult};
+use agen::{Engine, EngineRunExit, StopReason};
 use std::time::Duration;
 
 #[tokio::main]
@@ -45,16 +45,15 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     println!("📡 Sending request to LLM...");
 
-    match engine.run("Tell me a very long story about a brave knight. Make it as detailed as possible with many paragraphs.").await {
-        Ok(out) => match out.result {
-            EngineResult::Finished => println!("✅ Task completed normally"),
-            EngineResult::Paused => println!("⏸️  Task paused"),
-            EngineResult::LimitReached => println!("🔒 Turn limit reached"),
-            EngineResult::Yielded => println!("↩️  Task yielded"),
-        },
-        Err(e) => {
-            println!("❌ Task error: {}", e);
+    let output = engine.run("Tell me a very long story about a brave knight. Make it as detailed as possible with many paragraphs.").await;
+    match output.result {
+        EngineRunExit::Finished => println!("✅ Task completed normally"),
+        EngineRunExit::Paused => println!("⏸️  Task paused"),
+        EngineRunExit::Yielded => println!("↩️  Task yielded"),
+        EngineRunExit::Interrupted(StopReason::LimitReached) => {
+            println!("🔒 Turn limit reached")
         }
+        EngineRunExit::Interrupted(reason) => println!("❌ Task interrupted: {reason:?}"),
     }
 
     println!("\n✨ Demo complete!");

crates/agen/examples/engine_cli.rs

@@ -39,7 +39,7 @@ use tracing::info;
 use tracing_subscriber::EnvFilter;
 
 use agen::{
-    Engine,
+    Engine, EngineRunExit, StopReason,
     interceptor::{Interceptor, PostToolAction, ToolResultInfo},
     llm_client::{
         LlmClient,
@@ -476,12 +476,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // One-shot mode
     if let Some(prompt) = args.prompt {
-        match engine.run(&prompt).await {
-            Ok(_) => {}
-            Err(e) => {
-                eprintln!("\n❌ Error: {}", e);
-                std::process::exit(1);
-            }
+        let output = engine.run(&prompt).await;
+        if let EngineRunExit::Interrupted(StopReason::Unexpected(error)) = output.result {
+            eprintln!("\n❌ Error: {error}");
         }
 
         return Ok(());
@@ -500,13 +497,8 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         return Ok(());
     }
 
-    let mut locked = match engine.run(first_input).await {
-        Ok(out) => out.engine,
-        Err(e) => {
-            eprintln!("\n❌ Error: {}", e);
-            return Ok(());
-        }
-    };
+    let output = engine.run(first_input).await;
+    let mut locked = output.engine;
 
     loop {
         print!("\n👤 You: ");
@@ -525,11 +517,8 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             break;
         }
 
-        match locked.run(input).await {
-            Ok(_) => {}
-            Err(e) => {
-                eprintln!("\n❌ Error: {}", e);
-            }
+        if let EngineRunExit::Interrupted(StopReason::Unexpected(error)) = locked.run(input).await {
+            eprintln!("\n❌ Error: {error}");
         }
     }
 

crates/agen/src/engine.rs

@@ -70,24 +70,50 @@ pub struct EngineConfig {
     _private: (),
 }
 
-/// Engine execution result (status)
+/// Legacy serializable outcome used by the Worker session-log compatibility boundary.
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum EngineResult {
-    /// Completed (waiting for user input)
     Finished,
-    /// Paused (can be resumed)
     Paused,
-    /// Turn limit reached (max_turns exceeded)
     LimitReached,
-    /// Yielded to caller for external processing (e.g. context compaction).
-    ///
-    /// Distinct from `Paused`: internal machinery, not user-facing. The
-    /// caller is expected to perform some side work and then call `resume()`
-    /// to continue the turn loop.
     Yielded,
 }
 
+/// The public termination boundary for one logical engine run.
+#[derive(Debug)]
+pub enum EngineRunExit {
+    Finished,
+    Paused,
+    Yielded,
+    Interrupted(StopReason),
+}
+
+/// A typed reason why an engine run could not finish normally.
+#[derive(Debug)]
+pub enum StopReason {
+    LimitReached,
+    ContextWindowExceeded,
+    Cancelled,
+    Unexpected(EngineError),
+}
+
+impl From<Result<EngineResult, EngineError>> for EngineRunExit {
+    fn from(result: Result<EngineResult, EngineError>) -> Self {
+        match result {
+            Ok(EngineResult::Finished) => Self::Finished,
+            Ok(EngineResult::Paused) => Self::Paused,
+            Ok(EngineResult::Yielded) => Self::Yielded,
+            Ok(EngineResult::LimitReached) => Self::Interrupted(StopReason::LimitReached),
+            Err(EngineError::Client(ClientError::ContextWindowExceeded)) => {
+                Self::Interrupted(StopReason::ContextWindowExceeded)
+            }
+            Err(EngineError::Cancelled) => Self::Interrupted(StopReason::Cancelled),
+            Err(error) => Self::Interrupted(StopReason::Unexpected(error)),
+        }
+    }
+}
+
 /// Result of [`Engine::run`] or [`Engine::resume`].
 ///
 /// Contains the `Locked` Engine (ready for subsequent runs) and the outcome.
@@ -95,7 +121,7 @@ pub struct EngineRunOutput<C: LlmClient> {
     /// The Engine, now in Locked state.
     pub engine: Engine<C, Locked>,
     /// Outcome of the turn.
-    pub result: EngineResult,
+    pub result: EngineRunExit,
 }
 
 /// Internal: tool execution result
@@ -126,16 +152,16 @@ const MAX_STREAM_CONTINUATIONS: u32 = 3;
 /// engine.register_tool(my_tool);
 ///
 /// // Mutable::run() consumes self → EngineRunOutput { engine: Locked, result }
-/// let out = engine.run("Hello").await?;
+/// let out = engine.run("Hello").await;
 /// let mut engine = out.engine;
 ///
 /// // Locked::run() borrows &mut self
-/// engine.run("Follow-up").await?;
+/// let _exit = engine.run("Follow-up").await;
 ///
 /// // To edit between turns, unlock back to Mutable
 /// let mut engine = engine.unlock();
 /// engine.truncate_history(5);
-/// let out = engine.run("Continue").await?;
+/// let out = engine.run("Continue").await;
 /// let mut engine = out.engine;
 /// ```
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -179,14 +205,20 @@ pub struct Engine<C: LlmClient, S: EngineState = Mutable> {
     history: Vec<Item>,
     /// History length at lock time (only meaningful in Locked state)
     locked_prefix_len: usize,
-    /// AgentTurn count.
+    /// AgentTurn count across the lifetime of this Engine.
     ///
     /// Once retry (`agen-stream-continuation`) is implemented, an
     /// AgentTurn collapses N retried `LlmCall`s with identical input;
     /// today retry is not implemented so AgentTurn and LlmCall fire 1:1
     /// and the increment site (the LLM-call loop) is shared.
-    /// `max_turns` is interpreted as a per-`run()` AgentTurn cap.
     turn_count: usize,
+    /// AgentTurns consumed by the currently active logical run.
+    ///
+    /// A fresh [`run`](Self::run) starts at zero. Pause and Yield retain the
+    /// count for [`resume`](Self::resume), while terminal outcomes clear it.
+    /// `max_turns` is enforced against this run-scoped count rather than the
+    /// cumulative `turn_count` above.
+    active_run_turn_count: Option<usize>,
     /// LlmCall count (per-Engine running counter, monotonic). Unlike
     /// `turn_count` this never collapses retries.
     llm_call_count: usize,
@@ -231,8 +263,6 @@ pub struct Engine<C: LlmClient, S: EngineState = Mutable> {
     history_append_cbs: Vec<Box<dyn Fn(&Item) -> Result<(), String> + Send + Sync>>,
     /// Request configuration (max_tokens, temperature, etc.)
     request_config: RequestConfig,
-    /// Whether the previous run was interrupted
-    last_run_interrupted: bool,
     /// Cancel notification channel (for interrupting execution)
     cancel_tx: mpsc::Sender<()>,
     cancel_rx: mpsc::Receiver<()>,
@@ -264,8 +294,18 @@ pub struct Engine<C: LlmClient, S: EngineState = Mutable> {
 }
 
 impl<C: LlmClient, S: EngineState> Engine<C, S> {
-    fn reset_interruption_state(&mut self) {
-        self.last_run_interrupted = false;
+    fn start_logical_run(&mut self) {
+        self.active_run_turn_count = Some(0);
+    }
+
+    fn ensure_logical_run(&mut self) {
+        self.active_run_turn_count.get_or_insert(0);
+    }
+
+    fn finish_logical_run(&mut self, result: &Result<EngineResult, EngineError>) {
+        if !matches!(result, Ok(EngineResult::Paused) | Ok(EngineResult::Yielded)) {
+            self.active_run_turn_count = None;
+        }
     }
 
     fn drain_cancel_queue(&mut self) {
@@ -650,6 +690,23 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
         self.turn_count
     }
 
+    /// Get the AgentTurns consumed by an interrupted logical run.
+    ///
+    /// `Some` is retained only while Pause or Yield permits a later
+    /// [`resume`](Self::resume). Terminal outcomes return this to `None`.
+    pub fn active_run_turn_count(&self) -> Option<usize> {
+        self.active_run_turn_count
+    }
+
+    /// Restore the persisted turn budget of an interrupted logical run.
+    ///
+    /// Session owners restore this together with the cumulative turn count and
+    /// history. `None` means there is no resumable logical run and the next
+    /// [`resume`](Self::resume) starts a fresh budget.
+    pub fn set_active_run_turn_count(&mut self, turn_count: Option<usize>) {
+        self.active_run_turn_count = turn_count;
+    }
+
     /// Get the current LlmCall count (per-Engine running counter, never
     /// collapsed by retry).
     pub fn llm_call_count(&self) -> usize {
@@ -768,11 +825,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
         self.try_cancelled()
     }
 
-    /// Whether the previous run was interrupted
-    pub fn last_run_interrupted(&self) -> bool {
-        self.last_run_interrupted
-    }
-
     /// Generate list of ToolDefinitions for LLM from registered tools
     fn build_tool_definitions(&self) -> Vec<ToolDefinition> {
         self.tool_server.tool_definitions_sorted()
@@ -865,7 +917,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
         match result {
             Ok(value) => Ok(value),
             Err(err) => {
-                self.last_run_interrupted = true;
                 let reason = match &err {
                     EngineError::Aborted(reason) => reason.clone(),
                     EngineError::Cancelled => "Cancelled".to_string(),
@@ -963,11 +1014,9 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                         continue;
                     }
                     PreToolAction::Abort(reason) => {
-                        self.last_run_interrupted = true;
                         return Err(EngineError::Aborted(reason));
                     }
                     PreToolAction::Pause => {
-                        self.last_run_interrupted = true;
                         return Ok(ToolExecutionResult::Paused);
                     }
                 }
@@ -1020,7 +1069,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                     info!("Tool execution cancelled");
                 }
                 self.timeline.abort_current_block();
-                self.last_run_interrupted = true;
                 return Err(EngineError::Cancelled);
             }
         };
@@ -1042,7 +1090,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                 match self.interceptor.post_tool_call(&mut info).await {
                     PostToolAction::Continue => {}
                     PostToolAction::Abort(reason) => {
-                        self.last_run_interrupted = true;
                         return Err(EngineError::Aborted(reason));
                     }
                 }
@@ -1096,7 +1143,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
 
     /// Internal turn execution logic
     async fn run_turn_loop(&mut self) -> Result<EngineResult, EngineError> {
-        self.reset_interruption_state();
         let tool_definitions = self.build_tool_definitions();
 
         info!(
@@ -1119,10 +1165,21 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
             if self.try_cancelled() {
                 info!("Execution cancelled");
                 self.timeline.abort_current_block();
-                self.last_run_interrupted = true;
                 return Err(EngineError::Cancelled);
             }
 
+            if let Some(max) = self.max_turns
+                && self.active_run_turn_count.unwrap_or(0) >= max as usize
+            {
+                info!(
+                    active_run_turn_count = self.active_run_turn_count.unwrap_or(0),
+                    total_turn_count = self.turn_count,
+                    max_turns = max,
+                    "Logical run turn limit reached"
+                );
+                return Ok(EngineResult::LimitReached);
+            }
+
             let current_turn = self.turn_count;
             if !continuing_stream {
                 debug!(turn = current_turn, "Turn start");
@@ -1213,7 +1270,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                     for cb in &self.turn_end_cbs {
                         cb(current_turn);
                     }
-                    self.last_run_interrupted = true;
                     return Err(EngineError::Aborted(reason));
                 }
                 PreRequestAction::YieldWith(items) => {
@@ -1223,7 +1279,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                     for cb in &self.turn_end_cbs {
                         cb(current_turn);
                     }
-                    self.last_run_interrupted = true;
                     return Ok(EngineResult::Yielded);
                 }
                 PreRequestAction::Yield => {
@@ -1231,7 +1286,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                     for cb in &self.turn_end_cbs {
                         cb(current_turn);
                     }
-                    self.last_run_interrupted = true;
                     return Ok(EngineResult::Yielded);
                 }
                 PreRequestAction::ContinueWith(items) => {
@@ -1276,7 +1330,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
             if let StreamCompletion::Interrupted { reason } = stream_outcome {
                 stream_continuations += 1;
                 if stream_continuations > MAX_STREAM_CONTINUATIONS {
-                    self.last_run_interrupted = true;
                     return Err(EngineError::Client(ClientError::Api {
                         status: None,
                         code: None,
@@ -1314,6 +1367,7 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                 cb(current_turn);
             }
             self.turn_count += 1;
+            *self.active_run_turn_count.get_or_insert(0) += 1;
 
             // Collect and commit assistant items. Routed through
             // `append_history_items` so observers see each item as it lands.
@@ -1327,7 +1381,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
             if tool_calls.is_empty() {
                 match self.interceptor.on_turn_end(&self.history).await {
                     TurnEndAction::Finish => {
-                        self.last_run_interrupted = false;
                         return Ok(EngineResult::Finished);
                     }
                     TurnEndAction::ContinueWithMessages(additional) => {
@@ -1335,7 +1388,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                         continue;
                     }
                     TurnEndAction::Pause => {
-                        self.last_run_interrupted = true;
                         return Ok(EngineResult::Paused);
                     }
                 }
@@ -1344,18 +1396,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
             if let Some(result) = self.execute_and_commit_tools(tool_calls).await? {
                 return Ok(result);
             }
-
-            if let Some(max) = self.max_turns {
-                if self.turn_count >= max as usize {
-                    info!(
-                        turn_count = self.turn_count,
-                        max_turns = max,
-                        "Turn limit reached"
-                    );
-                    self.last_run_interrupted = false;
-                    return Ok(EngineResult::LimitReached);
-                }
-            }
         }
     }
 
@@ -1397,7 +1437,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                         }),
                     );
                     self.timeline.abort_current_block();
-                    self.last_run_interrupted = true;
                     return Err(EngineError::Cancelled);
                 }
             };
@@ -1429,7 +1468,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                                 }),
                             );
                             self.timeline.abort_current_block();
-                            self.last_run_interrupted = true;
                             return Err(EngineError::Cancelled);
                         }
                     };
@@ -1471,7 +1509,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
 
             let next_failed_attempt = failed_attempt + 1;
             if next_failed_attempt >= policy.max_attempts || !is_retryable(&err) {
-                self.last_run_interrupted = true;
                 return Err(EngineError::Client(err));
             }
 
@@ -1480,7 +1517,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                 .unwrap_or_else(|| policy.backoff(failed_attempt));
             let elapsed = started.elapsed();
             if elapsed + wait > policy.total_timeout {
-                self.last_run_interrupted = true;
                 return Err(EngineError::Client(err));
             }
 
@@ -1509,7 +1545,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                         info!("Cancelled during LLM retry backoff");
                     }
                     self.timeline.abort_current_block();
-                    self.last_run_interrupted = true;
                     return Err(EngineError::Cancelled);
                 }
             }
@@ -1552,7 +1587,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                             let event = match result {
                                 Ok(event) => event,
                                 Err(err) => {
-                                    self.last_run_interrupted = true;
                                     // 部分情報でも発火しておく（料金会計用）
                                     self.timeline.flush_usage();
                                     return Ok(StreamCompletion::Interrupted {
@@ -1573,7 +1607,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                             if let Event::Error(err) = &event {
                                 self.timeline.abort_current_block();
                                 self.timeline.flush_usage();
-                                self.last_run_interrupted = true;
                                 return Err(EngineError::Client(ClientError::Api {
                                     status: None,
                                     code: err.code.clone(),
@@ -1591,7 +1624,6 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                     }
                     self.timeline.abort_current_block();
                     self.timeline.flush_usage();
-                    self.last_run_interrupted = true;
                     return Err(EngineError::Cancelled);
                 }
             }
@@ -1610,10 +1642,7 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
         tool_calls: Vec<ToolCall>,
     ) -> Result<Option<EngineResult>, EngineError> {
         match self.execute_tools(tool_calls).await {
-            Ok(ToolExecutionResult::Paused) => {
-                self.last_run_interrupted = true;
-                Ok(Some(EngineResult::Paused))
-            }
+            Ok(ToolExecutionResult::Paused) => Ok(Some(EngineResult::Paused)),
             Ok(ToolExecutionResult::Completed(results)) => {
                 // Route per-result pushes through the callback path so
                 // observers see each tool result as it lands.
@@ -1629,10 +1658,7 @@ impl<C: LlmClient, S: EngineState> Engine<C, S> {
                 self.append_history_items(items)?;
                 Ok(None)
             }
-            Err(err) => {
-                self.last_run_interrupted = true;
-                Err(err)
-            }
+            Err(err) => Err(err),
         }
     }
 }
@@ -1664,6 +1690,7 @@ impl<C: LlmClient> Engine<C, Mutable> {
             history: Vec::new(),
             locked_prefix_len: 0,
             turn_count: 0,
+            active_run_turn_count: None,
             llm_call_count: 0,
             tool_execution_batch_count: 0,
             max_turns: None,
@@ -1679,7 +1706,6 @@ impl<C: LlmClient> Engine<C, Mutable> {
             tool_result_cbs: Vec::new(),
             history_append_cbs: Vec::new(),
             request_config: RequestConfig::default(),
-            last_run_interrupted: false,
             cancel_tx,
             cancel_rx,
             tool_output_limits: None,
@@ -1863,11 +1889,6 @@ impl<C: LlmClient> Engine<C, Mutable> {
         self.max_turns = max_turns;
     }
 
-    /// Set the last_run_interrupted flag (for session restoration)
-    pub fn set_last_run_interrupted(&mut self, interrupted: bool) {
-        self.last_run_interrupted = interrupted;
-    }
-
     /// Apply configuration (reserved for future extensions)
     #[allow(dead_code)]
     pub fn config(self, _config: EngineConfig) -> Self {
@@ -1881,28 +1902,25 @@ impl<C: LlmClient> Engine<C, Mutable> {
     ///
     /// Subsequent runs can call [`Engine::run`] directly.
     /// To edit state between turns, call [`unlock()`](Engine::unlock) first.
-    pub async fn run(
-        self,
-        user_input: impl Into<String>,
-    ) -> Result<EngineRunOutput<C>, EngineError> {
+    pub async fn run(self, user_input: impl Into<String>) -> EngineRunOutput<C> {
         let mut locked = self.lock();
-        let result = locked.run(user_input).await?;
-        Ok(EngineRunOutput {
+        let result = locked.run(user_input).await;
+        EngineRunOutput {
             engine: locked,
             result,
-        })
+        }
     }
 
     /// Resume from Paused, consuming self and transitioning to Locked.
     ///
     /// Used after `unlock()` → edit → resume.
-    pub async fn resume(self) -> Result<EngineRunOutput<C>, EngineError> {
+    pub async fn resume(self) -> EngineRunOutput<C> {
         let mut locked = self.lock();
-        let result = locked.resume().await?;
-        Ok(EngineRunOutput {
+        let result = locked.resume().await;
+        EngineRunOutput {
             engine: locked,
             result,
-        })
+        }
     }
 
     /// Lock and transition to Locked state
@@ -1934,6 +1952,7 @@ impl<C: LlmClient> Engine<C, Mutable> {
             history: self.history,
             locked_prefix_len,
             turn_count: self.turn_count,
+            active_run_turn_count: self.active_run_turn_count,
             llm_call_count: self.llm_call_count,
             tool_execution_batch_count: self.tool_execution_batch_count,
             max_turns: self.max_turns,
@@ -1949,7 +1968,6 @@ impl<C: LlmClient> Engine<C, Mutable> {
             tool_result_cbs: self.tool_result_cbs,
             history_append_cbs: self.history_append_cbs,
             request_config: self.request_config,
-            last_run_interrupted: self.last_run_interrupted,
 
             cancel_tx: self.cancel_tx,
             cancel_rx: self.cancel_rx,
@@ -1970,16 +1988,17 @@ impl<C: LlmClient> Engine<C, Locked> {
     ///
     /// Adds a new user message to history and sends a request to the LLM.
     /// Automatically loops if there are tool calls.
-    pub async fn run(
-        &mut self,
-        user_input: impl Into<String>,
-    ) -> Result<EngineResult, EngineError> {
-        self.reset_interruption_state();
+    pub async fn run(&mut self, user_input: impl Into<String>) -> EngineRunExit {
+        self.run_result(user_input.into()).await.into()
+    }
+
+    async fn run_result(&mut self, user_input: String) -> Result<EngineResult, EngineError> {
+        // Supplying new user input abandons any paused/yielded logical run.
+        self.active_run_turn_count = None;
         // Interceptor: on_prompt_submit
         let mut user_item = Item::user_message(user_input);
         let extras = match self.interceptor.on_prompt_submit(&mut user_item).await {
             PromptAction::Cancel(reason) => {
-                self.last_run_interrupted = true;
                 return self
                     .finalize_interruption(Err(EngineError::Aborted(reason)))
                     .await;
@@ -1991,17 +2010,26 @@ impl<C: LlmClient> Engine<C, Locked> {
         if !extras.is_empty() {
             self.append_history_items(extras)?;
         }
+        self.start_logical_run();
         let result = self.run_turn_loop().await;
-        self.finalize_interruption(result).await
+        let result = self.finalize_interruption(result).await;
+        self.finish_logical_run(&result);
+        result
     }
 
     /// Resume execution (from Paused state)
     ///
     /// Resumes turn processing from current state without adding a new user message.
-    pub async fn resume(&mut self) -> Result<EngineResult, EngineError> {
-        self.reset_interruption_state();
+    pub async fn resume(&mut self) -> EngineRunExit {
+        self.resume_result().await.into()
+    }
+
+    async fn resume_result(&mut self) -> Result<EngineResult, EngineError> {
+        self.ensure_logical_run();
         let result = self.run_turn_loop().await;
-        self.finalize_interruption(result).await
+        let result = self.finalize_interruption(result).await;
+        self.finish_logical_run(&result);
+        result
     }
 
     /// Get the prefix length at lock time
@@ -2027,6 +2055,7 @@ impl<C: LlmClient> Engine<C, Locked> {
             history: self.history,
             locked_prefix_len: 0,
             turn_count: self.turn_count,
+            active_run_turn_count: self.active_run_turn_count,
             llm_call_count: self.llm_call_count,
             tool_execution_batch_count: self.tool_execution_batch_count,
             max_turns: self.max_turns,
@@ -2042,7 +2071,6 @@ impl<C: LlmClient> Engine<C, Locked> {
             tool_result_cbs: self.tool_result_cbs,
             history_append_cbs: self.history_append_cbs,
             request_config: self.request_config,
-            last_run_interrupted: self.last_run_interrupted,
 
             cancel_tx: self.cancel_tx,
             cancel_rx: self.cancel_rx,

crates/agen/src/lib.rs

@@ -20,8 +20,8 @@ pub mod usage_record;
 pub use agen_macros::{description, tool, tool_registry};
 pub use callback::{TextBlockScope, ThinkingBlockScope, ToolUseBlockScope};
 pub use engine::{
-    Engine, EngineConfig, EngineError, EngineResult, EngineRunOutput, LlmRetryNotice,
-    ToolRegistryError,
+    Engine, EngineConfig, EngineError, EngineResult, EngineRunExit, EngineRunOutput,
+    LlmRetryNotice, StopReason, ToolRegistryError,
 };
 pub use handler::ToolUseBlockStart;
 pub use interceptor::Interceptor;

crates/agen/src/llm_client/error.rs

@@ -18,6 +18,9 @@ pub enum ClientError {
         message: String,
         retry_after: Option<Duration>,
     },
+    /// The provider rejected the request because it exceeded the model context window.
+    /// Classified only from a structured provider error code, never message text.
+    ContextWindowExceeded,
     /// A request lifecycle phase exceeded its hard timeout.
     Timeout {
         phase: &'static str,
@@ -48,6 +51,7 @@ impl fmt::Display for ClientError {
                 }
                 write!(f, ": {}", message)
             }
+            ClientError::ContextWindowExceeded => write!(f, "Model context window reached"),
             ClientError::Timeout { phase, timeout } => {
                 write!(f, "{phase} timed out after {}s", timeout.as_secs())
             }
@@ -112,7 +116,10 @@ pub fn is_retryable(error: &ClientError) -> bool {
         ClientError::Api { status: None, .. } => false,
         ClientError::Timeout { .. } => true,
         ClientError::Http(e) => e.is_connect() || e.is_timeout(),
-        ClientError::Json(_) | ClientError::Sse(_) | ClientError::Config(_) => false,
+        ClientError::ContextWindowExceeded
+        | ClientError::Json(_)
+        | ClientError::Sse(_)
+        | ClientError::Config(_) => false,
     }
 }
 

crates/agen/src/llm_client/transport.rs

@@ -431,13 +431,7 @@ fn api_error_code(error: &ClientError) -> Option<&str> {
 }
 
 fn is_context_length_exceeded(error: &ClientError) -> bool {
-    match error {
-        ClientError::Api { code, message, .. } => {
-            code.as_deref() == Some("context_length_exceeded")
-                || message.contains("context_length_exceeded")
-        }
-        _ => false,
-    }
+    matches!(error, ClientError::ContextWindowExceeded)
 }
 
 async fn response_with_timeout(
@@ -487,6 +481,9 @@ async fn classify_error_response(resp: reqwest::Response) -> ClientError {
             .and_then(|v| v.as_str())
             .unwrap_or(&text)
             .to_string();
+        if code.as_deref() == Some("context_length_exceeded") {
+            return ClientError::ContextWindowExceeded;
+        }
         ClientError::Api {
             status: Some(status),
             code,

crates/agen/tests/callback_test.rs

@@ -66,7 +66,10 @@ async fn test_callback_llm_retry_event() {
     });
 
     let result = engine.run("retry once").await;
-    assert!(result.is_ok(), "engine should succeed after one retry");
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "engine should succeed after one retry"
+    );
 
     let notices = notices.lock().unwrap();
     assert_eq!(notices.len(), 1);
@@ -108,9 +111,12 @@ async fn test_callback_text_block_events() {
         });
     });
 
-    // Mutable::run consumes self, returns (Locked, EngineResult)
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
     let result = engine.run("Greet me").await;
-    assert!(result.is_ok(), "Engine should complete");
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "Engine should complete"
+    );
 
     let deltas = text_deltas.lock().unwrap();
     assert_eq!(deltas.len(), 2);
@@ -154,7 +160,7 @@ async fn test_callback_tool_call_complete() {
         });
     });
 
-    // Mutable::run consumes self, returns (Locked, EngineResult)
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
     let _ = engine.run("Weather please").await;
 
     let starts = tool_starts.lock().unwrap();
@@ -197,9 +203,9 @@ async fn test_callback_turn_events() {
         ends.lock().unwrap().push(turn);
     });
 
-    // Mutable::run consumes self, returns (Locked, EngineResult)
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
     let result = engine.run("Do something").await;
-    assert!(result.is_ok());
+    assert!(matches!(result.result, agen::EngineRunExit::Finished));
 
     let starts = turn_starts.lock().unwrap();
     let ends = turn_ends.lock().unwrap();
@@ -382,7 +388,7 @@ async fn test_callback_usage_events() {
         usages.lock().unwrap().push(event.clone());
     });
 
-    // Mutable::run consumes self, returns (Locked, EngineResult)
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
     let _ = engine.run("Hello").await;
 
     let usages = usage_events.lock().unwrap();

crates/agen/tests/engine_fixtures.rs

@@ -138,7 +138,10 @@ async fn test_engine_simple_text_response() {
     // Send a simple message (Mutable::run consumes self, returns tuple)
     let result = engine.run("Hello").await;
 
-    assert!(result.is_ok(), "Engine should complete successfully");
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "Engine should complete successfully"
+    );
 }
 
 /// Verify that Engine can correctly process responses containing tool calls
@@ -199,7 +202,10 @@ async fn test_engine_with_programmatic_events() {
     // Mutable::run consumes self, returns tuple
     let result = engine.run("Greet me").await;
 
-    assert!(result.is_ok(), "Engine should complete successfully");
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "Engine should complete successfully"
+    );
 }
 
 /// Verify that ToolCallCollector correctly collects ToolCall from ToolUse block events

crates/agen/tests/engine_state_test.rs

@@ -9,12 +9,48 @@ use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 
 use agen::Item;
+use agen::interceptor::{
+    Interceptor, PreRequestAction, PreToolAction, ToolCallInfo, TurnEndAction,
+};
+use agen::llm_client::ClientError;
 use agen::llm_client::event::{Event, ResponseStatus, StatusEvent};
 use agen::tool::{Tool, ToolDefinition, ToolError, ToolMeta, ToolOutput};
-use agen::{Engine, EngineError};
+use agen::{Engine, EngineError, EngineRunExit, StopReason};
 use async_trait::async_trait;
 use common::MockLlmClient;
 
+#[test]
+fn engine_source_has_no_worker_owned_interruption_marker() {
+    let source = include_str!("../src/engine.rs");
+    assert!(!source.contains("last_run_interrupted"));
+    assert!(!source.contains("set_last_run_interrupted"));
+}
+
+#[test]
+fn run_exit_classifies_known_and_unexpected_stops_without_message_parsing() {
+    assert!(matches!(
+        EngineRunExit::from(Err(EngineError::Cancelled)),
+        EngineRunExit::Interrupted(StopReason::Cancelled)
+    ));
+    assert!(matches!(
+        EngineRunExit::from(Err(EngineError::Client(ClientError::ContextWindowExceeded))),
+        EngineRunExit::Interrupted(StopReason::ContextWindowExceeded)
+    ));
+
+    let message_only = EngineError::Client(ClientError::Api {
+        status: Some(400),
+        code: None,
+        message: "context_length_exceeded".to_string(),
+        retry_after: None,
+    });
+    assert!(matches!(
+        EngineRunExit::from(Err(message_only)),
+        EngineRunExit::Interrupted(StopReason::Unexpected(EngineError::Client(
+            ClientError::Api { .. }
+        )))
+    ));
+}
+
 // =============================================================================
 // Mutable State Tests
 // =============================================================================
@@ -192,11 +228,13 @@ async fn history_append_failure_stops_before_tool_execution() {
     });
 
     let mut engine = engine.lock();
-    let error = engine.run("use the tool").await.unwrap_err();
+    let exit = engine.run("use the tool").await;
 
-    assert!(
-        matches!(error, EngineError::HistoryAppend(ref message) if message == "simulated ENOSPC")
-    );
+    assert!(matches!(
+        exit,
+        EngineRunExit::Interrupted(StopReason::Unexpected(EngineError::HistoryAppend(ref message)))
+            if message == "simulated ENOSPC"
+    ));
     assert_eq!(tool.call_count(), 0);
     assert_eq!(engine.history().len(), 1);
     assert_eq!(engine.history()[0].as_text(), Some("use the tool"));
@@ -271,7 +309,7 @@ async fn test_mutable_run_updates_history() -> Result<(), EngineError> {
     let engine = Engine::new(client);
 
     // Execute (Mutable::run consumes self, returns EngineRunOutput)
-    let out = engine.run("Hi there").await?;
+    let out = engine.run("Hi there").await;
     let engine = out.engine;
 
     // History is updated
@@ -320,12 +358,12 @@ async fn test_locked_multi_turn_history_accumulation() {
 
     // Turn 1
     let result1 = locked_engine.run("Hello!").await;
-    assert!(result1.is_ok());
+    assert!(matches!(result1, EngineRunExit::Finished));
     assert_eq!(locked_engine.history().len(), 2); // user + assistant
 
     // Turn 2
     let result2 = locked_engine.run("Can you help me?").await;
-    assert!(result2.is_ok());
+    assert!(matches!(result2, EngineRunExit::Finished));
     assert_eq!(locked_engine.history().len(), 4); // 2 * (user + assistant)
 
     // Verify history contents
@@ -383,7 +421,7 @@ async fn test_locked_prefix_len_tracking() {
     assert_eq!(locked_engine.locked_prefix_len(), 2); // 2 items at lock time
 
     // Execute turn
-    locked_engine.run("New message").await.unwrap();
+    locked_engine.run("New message").await;
 
     // History grows but locked_prefix_len remains unchanged
     assert_eq!(locked_engine.history().len(), 4); // 2 + 2
@@ -418,13 +456,13 @@ async fn test_turn_count_increment() -> Result<(), EngineError> {
     assert_eq!(engine.llm_call_count(), 0);
 
     // First run consumes Mutable, returns EngineRunOutput
-    let mut engine = engine.run("First").await?.engine;
+    let mut engine = engine.run("First").await.engine;
     assert_eq!(engine.turn_count(), 1);
     // Retry not yet implemented → AgentTurn:LlmCall is 1:1.
     assert_eq!(engine.llm_call_count(), 1);
 
     // Subsequent runs on Locked take &mut self
-    engine.run("Second").await?;
+    engine.run("Second").await;
     assert_eq!(engine.turn_count(), 2);
     assert_eq!(engine.llm_call_count(), 2);
 
@@ -512,7 +550,7 @@ async fn test_lock_unlock_relock_tools_remain_effective() {
     engine.register_tool(tool_a.definition());
 
     let mut locked = engine.lock();
-    locked.run("first").await.expect("first run");
+    locked.run("first").await;
     assert_eq!(tool_a.call_count(), 1, "tool_a should be called once");
 
     let mut unlocked = locked.unlock();
@@ -520,7 +558,7 @@ async fn test_lock_unlock_relock_tools_remain_effective() {
     unlocked.register_tool(tool_b.definition());
 
     let mut relocked = unlocked.lock();
-    relocked.run("second").await.expect("second run");
+    relocked.run("second").await;
 
     assert_eq!(tool_a.call_count(), 1, "tool_a should not be called again");
     assert_eq!(tool_b.call_count(), 1, "tool_b should be called once");
@@ -561,3 +599,196 @@ fn test_system_prompt_change_after_unlock() {
     let relocked = unlocked.lock();
     assert_eq!(relocked.get_system_prompt(), Some("New prompt"));
 }
+
+fn completed_text_events() -> Vec<Event> {
+    vec![
+        Event::text_block_start(0),
+        Event::text_delta(0, "done"),
+        Event::text_block_stop(0, None),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ]
+}
+
+struct YieldOnce {
+    calls: AtomicUsize,
+}
+
+#[async_trait]
+impl Interceptor for YieldOnce {
+    async fn pre_llm_request(&self, _context: &mut Vec<Item>) -> PreRequestAction {
+        if self.calls.fetch_add(1, Ordering::SeqCst) == 0 {
+            PreRequestAction::Yield
+        } else {
+            PreRequestAction::Continue
+        }
+    }
+}
+
+struct PauseToolOnce {
+    calls: AtomicUsize,
+}
+
+#[async_trait]
+impl Interceptor for PauseToolOnce {
+    async fn pre_tool_call(&self, _info: &mut ToolCallInfo) -> PreToolAction {
+        if self.calls.fetch_add(1, Ordering::SeqCst) == 0 {
+            PreToolAction::Pause
+        } else {
+            PreToolAction::Continue
+        }
+    }
+}
+
+struct ContinueTurnOnce {
+    calls: AtomicUsize,
+}
+
+#[async_trait]
+impl Interceptor for ContinueTurnOnce {
+    async fn on_turn_end(&self, _history: &[Item]) -> TurnEndAction {
+        if self.calls.fetch_add(1, Ordering::SeqCst) == 0 {
+            TurnEndAction::ContinueWithMessages(vec![Item::system_message("continue")])
+        } else {
+            TurnEndAction::Finish
+        }
+    }
+}
+
+#[tokio::test]
+async fn max_turns_is_scoped_to_each_fresh_run() {
+    let responses = vec![completed_text_events(), completed_text_events()];
+    let mut engine = Engine::new(MockLlmClient::with_responses(responses));
+    engine.set_max_turns(Some(1));
+    let mut engine = engine.lock();
+
+    assert!(matches!(engine.run("first").await, EngineRunExit::Finished));
+    assert_eq!(engine.turn_count(), 1);
+    assert_eq!(engine.active_run_turn_count(), None);
+
+    assert!(matches!(
+        engine.run("second").await,
+        EngineRunExit::Finished
+    ));
+    assert_eq!(engine.turn_count(), 2);
+    assert_eq!(engine.active_run_turn_count(), None);
+}
+
+#[tokio::test]
+async fn yielded_resume_keeps_the_same_unspent_turn_budget() {
+    let mut engine = Engine::new(MockLlmClient::new(completed_text_events()));
+    engine.set_max_turns(Some(1));
+    engine.set_interceptor(YieldOnce {
+        calls: AtomicUsize::new(0),
+    });
+    let mut engine = engine.lock();
+
+    assert!(matches!(engine.run("start").await, EngineRunExit::Yielded));
+    assert_eq!(engine.turn_count(), 0);
+    assert_eq!(engine.active_run_turn_count(), Some(0));
+
+    assert!(matches!(engine.resume().await, EngineRunExit::Finished));
+    assert_eq!(engine.turn_count(), 1);
+    assert_eq!(engine.active_run_turn_count(), None);
+}
+
+#[tokio::test]
+async fn paused_tool_resume_does_not_reset_the_consumed_turn_budget() {
+    let events = vec![
+        Event::tool_use_start(0, "call_1", "count_tool"),
+        Event::tool_input_delta(0, "{}"),
+        Event::tool_use_stop(0),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ];
+    let tool = CountingTool::new("count_tool");
+    let mut engine = Engine::new(MockLlmClient::new(events));
+    engine.set_max_turns(Some(1));
+    engine.register_tool(tool.definition());
+    engine.set_interceptor(PauseToolOnce {
+        calls: AtomicUsize::new(0),
+    });
+    let mut engine = engine.lock();
+
+    assert!(matches!(engine.run("call it").await, EngineRunExit::Paused));
+    assert_eq!(engine.turn_count(), 1);
+    assert_eq!(engine.active_run_turn_count(), Some(1));
+    assert_eq!(tool.call_count(), 0);
+
+    assert!(matches!(
+        engine.resume().await,
+        EngineRunExit::Interrupted(StopReason::LimitReached)
+    ));
+    assert_eq!(engine.turn_count(), 1);
+    assert_eq!(engine.active_run_turn_count(), None);
+    assert_eq!(tool.call_count(), 1, "the consumed turn's tool still runs");
+}
+
+#[tokio::test]
+async fn fresh_input_abandons_a_paused_run_and_starts_a_new_budget() {
+    let tool_events = vec![
+        Event::tool_use_start(0, "call_1", "count_tool"),
+        Event::tool_input_delta(0, "{}"),
+        Event::tool_use_stop(0),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ];
+    let client = MockLlmClient::with_responses(vec![tool_events, completed_text_events()]);
+    let tool = CountingTool::new("count_tool");
+    let mut engine = Engine::new(client);
+    engine.set_max_turns(Some(1));
+    engine.register_tool(tool.definition());
+    engine.set_interceptor(PauseToolOnce {
+        calls: AtomicUsize::new(0),
+    });
+    let mut engine = engine.lock();
+
+    assert!(matches!(engine.run("pause").await, EngineRunExit::Paused));
+    assert_eq!(engine.active_run_turn_count(), Some(1));
+
+    assert!(matches!(
+        engine.run("replace").await,
+        EngineRunExit::Finished
+    ));
+    assert_eq!(engine.turn_count(), 2);
+    assert_eq!(engine.active_run_turn_count(), None);
+    assert_eq!(tool.call_count(), 1, "pending-tool semantics are unchanged");
+}
+
+#[tokio::test]
+async fn interceptor_continuation_consumes_the_logical_run_budget() {
+    let mut engine = Engine::new(MockLlmClient::new(completed_text_events()));
+    engine.set_max_turns(Some(1));
+    engine.set_interceptor(ContinueTurnOnce {
+        calls: AtomicUsize::new(0),
+    });
+    let mut engine = engine.lock();
+
+    assert!(matches!(
+        engine.run("start").await,
+        EngineRunExit::Interrupted(StopReason::LimitReached)
+    ));
+    assert_eq!(engine.turn_count(), 1);
+    assert_eq!(engine.llm_call_count(), 1);
+    assert_eq!(engine.active_run_turn_count(), None);
+}
+
+#[tokio::test]
+async fn restored_active_run_budget_is_enforced_before_another_llm_call() {
+    let mut engine = Engine::new(MockLlmClient::new(completed_text_events()));
+    engine.set_max_turns(Some(1));
+    engine.set_turn_count(7);
+    engine.set_active_run_turn_count(Some(1));
+    let mut engine = engine.lock();
+
+    assert!(matches!(
+        engine.resume().await,
+        EngineRunExit::Interrupted(StopReason::LimitReached)
+    ));
+    assert_eq!(engine.turn_count(), 7);
+    assert_eq!(engine.llm_call_count(), 0);
+    assert_eq!(engine.active_run_turn_count(), None);
+}

crates/agen/tests/parallel_execution_test.rs

@@ -158,7 +158,7 @@ async fn test_parallel_tool_execution() {
     engine.register_tool(tool3.definition());
 
     let start = Instant::now();
-    // Mutable::run consumes self, returns (Locked, EngineResult)
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
     let _result = engine.run("Run all tools").await;
     let elapsed = start.elapsed();
 
@@ -415,7 +415,7 @@ async fn test_before_tool_call_skip() {
 
     engine.set_interceptor(BlockingPolicy);
 
-    // Mutable::run consumes self, returns (Locked, EngineResult)
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
     let _result = engine.run("Test hook").await;
 
     // allowed_tool is called, but blocked_tool is not
@@ -502,10 +502,13 @@ async fn test_post_tool_call_modification() {
         modified_content: modified_content.clone(),
     });
 
-    // Mutable::run consumes self, returns (Locked, EngineResult)
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
     let result = engine.run("Test modification").await;
 
-    assert!(result.is_ok(), "Engine should complete");
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "Engine should complete"
+    );
 
     // Verify hook was called and content was modified
     let content = modified_content.lock().unwrap().clone();
@@ -558,7 +561,7 @@ async fn test_before_tool_call_synthetic_result_committed() {
 
     engine.set_interceptor(SyntheticPolicy);
 
-    let result = engine.run("Test synthetic result").await.unwrap();
+    let result = engine.run("Test synthetic result").await;
 
     assert_eq!(blocked_clone.call_count(), 0, "Blocked tool should not run");
     assert!(result.engine.history().iter().any(|item| matches!(

crates/agen/tests/reasoning_round_trip_test.rs

@@ -65,7 +65,7 @@ async fn anthropic_thinking_round_trips_signature_into_history() {
     ]);
     let client = MockLlmClient::new(events);
     let engine = Engine::new(client);
-    let out = engine.run("question?").await.expect("run ok");
+    let out = engine.run("question?").await;
     let engine = out.engine;
 
     let history = engine.history();
@@ -109,7 +109,7 @@ async fn openai_reasoning_round_trips_encrypted_and_summary() {
     ]);
     let client = MockLlmClient::new(events);
     let engine = Engine::new(client);
-    let out = engine.run("q").await.expect("run ok");
+    let out = engine.run("q").await;
     let engine = out.engine;
 
     let history = engine.history();
@@ -155,7 +155,7 @@ async fn reasoning_precedes_text_in_assistant_burst() {
     }));
     let client = MockLlmClient::new(events);
     let engine = Engine::new(client);
-    let out = engine.run("q").await.expect("run ok");
+    let out = engine.run("q").await;
     let engine = out.engine;
 
     let history = engine.history();
@@ -214,7 +214,7 @@ async fn injected_reasoning_survives_into_outgoing_request() {
         Item::assistant_message("prior answer"),
     ]);
 
-    let _ = engine.run("follow up").await.expect("run ok");
+    let _ = engine.run("follow up").await;
 
     let req = captured
         .lock()

crates/client/src/backend_workspace.rs

@@ -1,5 +1,6 @@
 use serde::{Deserialize, Serialize};
 use std::fmt;
+use workspace_api::{RepositoryObservedStatus, RepositorySource};
 
 const DEFAULT_WORKSPACE_LIMIT: usize = 200;
 
@@ -44,8 +45,13 @@ pub struct CreateBackendWorkspaceRepositoryRecord {
     pub repository_id: String,
     pub name: String,
     pub kind: String,
-    pub uri: String,
+    pub provider: Option<String>,
+    pub source: RepositorySource,
     pub default_ref: Option<String>,
+    pub source_revision: u64,
+    pub source_fingerprint: String,
+    pub observed_status: RepositoryObservedStatus,
+    pub observed_at: Option<String>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]

crates/client/src/workspace_product.rs

@@ -26,7 +26,7 @@ struct BackendWorkerLaunchOptions {
 #[derive(Debug, Deserialize)]
 struct BackendWorkerLaunchRuntime {
     runtime_id: String,
-    can_spawn_worker: bool,
+    worker_creation_available: bool,
     working_directory_required: bool,
 }
 
@@ -261,7 +261,7 @@ impl BackendWorkspaceProductClient {
         let runtime = options
             .runtimes
             .iter()
-            .find(|runtime| runtime.can_spawn_worker && !runtime.working_directory_required)
+            .find(|runtime| runtime.worker_creation_available && !runtime.working_directory_required)
             .ok_or_else(|| {
                 BackendWorkspaceClientError::InvalidTarget(
                     "Backend has no spawn-capable Runtime that supports a Workdir-less Intake Worker"
@@ -473,8 +473,12 @@ impl TicketBackend for BackendWorkspaceProductClient {
         .map_err(ticket_client_error)
     }
 
-    fn queue_ready(&self, id: TicketIdOrSlug, _queued_by: &str) -> ticket::Result<()> {
-        self.send_unit::<()>(
+    fn queue_ready(
+        &self,
+        id: TicketIdOrSlug,
+        _queued_by: &str,
+    ) -> ticket::Result<ticket::TicketQueueOutcome> {
+        self.send_json::<(), _>(
             Method::POST,
             &format!(
                 "/tickets/{}/workflow/queue",
@@ -773,7 +777,7 @@ mod tests {
         let (base_url, requests, handle) = response_sequence_server(vec![
             (
                 "200 OK",
-                r#"{"runtimes":[{"runtime_id":"embedded","can_spawn_worker":true,"working_directory_required":false}]}"#,
+                r#"{"runtimes":[{"runtime_id":"embedded","worker_creation_available":true,"working_directory_required":false}]}"#,
             ),
             (
                 "200 OK",

crates/flow/src/builtin.rs

@@ -24,7 +24,7 @@ pub fn builtin_flow_source(slug: &str) -> Option<BuiltinFlowSource> {
     match slug {
         CODER_REVIEW_FLOW_SLUG => Some(BuiltinFlowSource {
             slug: CODER_REVIEW_FLOW_SLUG,
-            revision: 3,
+            revision: 4,
             path: "builtin/flows/coder-review.dcdl",
             content: CODER_REVIEW_FLOW_SOURCE,
         }),
@@ -35,7 +35,7 @@ pub fn builtin_flow_source(slug: &str) -> Option<BuiltinFlowSource> {
 pub fn builtin_flow_sources() -> &'static [BuiltinFlowSource] {
     const SOURCES: &[BuiltinFlowSource] = &[BuiltinFlowSource {
         slug: CODER_REVIEW_FLOW_SLUG,
-        revision: 3,
+        revision: 4,
         path: "builtin/flows/coder-review.dcdl",
         content: CODER_REVIEW_FLOW_SOURCE,
     }];
@@ -46,6 +46,30 @@ pub fn builtin_flow_sources() -> &'static [BuiltinFlowSource] {
 mod tests {
     use super::*;
 
+    #[test]
+    fn coder_review_flow_uses_current_selector_ref_review_contract() {
+        let source = builtin_flow_source(CODER_REVIEW_FLOW_SLUG).expect("coder review Flow");
+        for required in [
+            "OpenMergeRequest",
+            "ShowMergeRequest",
+            "ReviewMergeRequest",
+            "CompleteMergeRequest",
+            "existing Merge Request `selector_from`",
+            "Target-only movement does not invalidate",
+        ] {
+            assert!(source.content.contains(required), "missing {required}");
+        }
+        for stale in [
+            "MergeRequestOpen",
+            "MergeRequestShow",
+            "MergeRequestReview",
+            "MergeRequestComplete",
+            "new immutable revision",
+        ] {
+            assert!(!source.content.contains(stale), "stale contract {stale}");
+        }
+    }
+
     #[test]
     fn every_builtin_flow_compiles_and_matches_catalog_identity() {
         assert!(!builtin_flow_sources().is_empty());

crates/merge-request/src/lib.rs

@@ -416,7 +416,7 @@ impl MergeRequestStore {
         let conflict:bool=t.query_row("SELECT EXISTS(SELECT 1 FROM merge_request_ticket_relations rel JOIN merge_requests mr ON mr.workspace_id=rel.workspace_id AND mr.merge_request_id=rel.merge_request_id WHERE rel.workspace_id=?1 AND rel.ticket_id=?2 AND mr.state='open')",params![i.auth.workspace_id,i.ticket_id],|r|r.get(0))?;
         if conflict {
             return Err(MergeRequestError::Conflict(
-                "Ticket already has an open Merge Request".into(),
+                "Ticket already has an open Merge Request; use ShowMergeRequest and advance the existing selector_from with a normal non-force push instead of opening a replacement Merge Request or adding a revision".into(),
             ));
         }
         let now = i.now.to_rfc3339();
@@ -575,12 +575,16 @@ impl MergeRequestStore {
             ));
         };
         if subject != i.current_subject_ref {
+            let reason = format!(
+                "selector_from moved from requested subject {subject} to current subject {}; fresh review of the exact current source ref is required",
+                i.current_subject_ref
+            );
             let e = ReviewCancelledEvent {
                 event_id: Uuid::now_v7().to_string(),
                 sequence: next_seq(&t, &ws, &mr)?,
                 request_event_id: req,
                 subject_ref: subject,
-                reason: "selector_from moved before submission".into(),
+                reason,
                 created_at: i.now,
             };
             insert_event(&t, &ws, &mr, "review_cancelled", &e, i.now, None)?;
@@ -667,9 +671,27 @@ impl MergeRequestStore {
         }
         match (&i.current_subject_ref, &review) {
             (None, _) => b.push("selector_from could not be resolved".into()),
-            (Some(_), None) => b.push("current source ref has no valid review".into()),
-            (_, Some(r)) if r.decision == ReviewDecision::RequestChanges => {
-                b.push("current source ref requests changes".into())
+            (Some(subject_ref), None) => {
+                let previous_review_subject = mr.thread.iter().rev().find_map(|event| match event {
+                    MergeRequestThreadEvent::ReviewRequested(value) => {
+                        Some(value.subject_ref.as_str())
+                    }
+                    MergeRequestThreadEvent::Review(value) => Some(value.subject_ref.as_str()),
+                    _ => None,
+                });
+                match previous_review_subject.filter(|previous| *previous != subject_ref) {
+                    Some(previous) => b.push(format!(
+                        "selector_from moved from reviewed/requested subject {previous} to current subject {subject_ref}; request a fresh review for this exact source ref (selector_to movement alone does not invalidate source approval)"
+                    )),
+                    None => b.push(format!(
+                        "current source ref {subject_ref} has no valid review; request a fresh review for this exact source ref"
+                    )),
+                }
+            }
+            (Some(subject_ref), Some(r)) if r.decision == ReviewDecision::RequestChanges => {
+                b.push(format!(
+                    "current source ref {subject_ref} requests changes; advance the existing selector_from with a normal non-force push, then request a fresh review for the exact new source ref"
+                ))
             }
             _ => {}
         }

crates/merge-request/tests/store.rs

@@ -181,16 +181,85 @@ fn source_move_cancels_submission_and_old_approval_is_reusable_when_source_retur
         .is_err()
     );
     let mr = s.get("W", "T").unwrap();
+    let cancellation = mr.thread.iter().find_map(|event| match event {
+        MergeRequestThreadEvent::ReviewCancelled(value) => Some(value),
+        _ => None,
+    });
     assert!(
-        mr.thread
-            .iter()
-            .any(|e| matches!(e, MergeRequestThreadEvent::ReviewCancelled(_)))
+        cancellation
+            .as_ref()
+            .is_some_and(|value| value.reason.contains("selector_from moved")
+                && value.reason.contains("fresh review"))
     );
     assert_eq!(
         mr.effective_review("source-a").map(|r| &r.event_id),
         Some(&approved.event_id)
     );
 }
+#[test]
+fn same_selector_source_advancement_requires_fresh_review_and_preserves_target_only_approval() {
+    let (_d, s) = fixture();
+    open(&s);
+    let first = approve(&s, "source-1", "one");
+
+    let stale = s
+        .readiness(ReadinessCheck {
+            ticket_id: "T".into(),
+            current_subject_ref: Some("source-2".into()),
+            auth: auth(),
+        })
+        .unwrap();
+    assert!(!stale.ready);
+    assert!(stale.review.is_none());
+    assert!(stale.blockers.iter().any(|blocker| {
+        blocker.contains("selector_from moved from reviewed/requested subject source-1")
+            && blocker.contains("current subject source-2")
+            && blocker.contains("fresh review")
+    }));
+    assert_eq!(
+        s.get("W", "T")
+            .unwrap()
+            .effective_review("source-1")
+            .map(|review| &review.event_id),
+        Some(&first.event_id)
+    );
+
+    let second = approve(&s, "source-2", "two");
+    let ready = s
+        .readiness(ReadinessCheck {
+            ticket_id: "T".into(),
+            current_subject_ref: Some("source-2".into()),
+            auth: auth(),
+        })
+        .unwrap();
+    assert!(ready.ready);
+    assert_eq!(
+        ready.review.as_ref().map(|review| &review.event_id),
+        Some(&second.event_id)
+    );
+
+    // The target can move from target-1 to target-2 without changing selector_from
+    // or invalidating the exact-source approval. Completion consumes refreshed
+    // integration evidence for the current target pair.
+    let merged = s
+        .complete(CompleteMergeRequest {
+            operation_id: "target-moved".into(),
+            ticket_id: "T".into(),
+            current_subject_ref: "source-2".into(),
+            target_ref_before: "target-2".into(),
+            target_ref_after: "integrated-target-2".into(),
+            approval_event_id: second.event_id,
+            strategy: MergeStrategy::FastForward,
+            resolution: ConflictResolution::None,
+            auth: auth(),
+            now: at(5),
+        })
+        .unwrap();
+    assert_eq!(merged.approved_source_ref, "source-2");
+    assert_eq!(merged.target_ref_before, "target-2");
+    assert_eq!(merged.target_ref_after, "integrated-target-2");
+}
+
 #[test]
 fn review_revocation_invalidates_readiness() {
     let (_d, s) = fixture();

crates/protocol/src/lib.rs

@@ -281,11 +281,44 @@ impl Method {
 /// Presentation category for an Internal Worker exposed through its parent's
 /// protocol stream. Internal Workers never become independently addressable
 /// protocol subjects.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
 #[serde(rename_all = "snake_case")]
 pub enum InternalWorkerKind {
     SubWorker,
+    Service { kind: String },
+}
+
+/// Stable parent-owned lifecycle for one compaction run.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
+pub struct CompactionLifecycle {
+    pub schema_version: u32,
+    pub compaction_id: String,
+    pub revision: u64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub internal_worker: Option<InternalWorkerRef>,
+    pub state: CompactionLifecycleState,
+    /// Milliseconds since the Unix epoch.
+    pub started_at_ms: u64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ended_at_ms: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub summary: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub new_segment_id: Option<String>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
+#[serde(rename_all = "snake_case")]
+pub enum CompactionLifecycleState {
+    Running,
+    Done,
+    Failed,
+    Interrupted,
 }
 
 /// Stable presentation identity for one parent-owned Internal Worker session.
@@ -607,23 +640,18 @@ pub enum Event {
     /// This is not part of LLM history or prompt context; clients may display it
     /// briefly as operational status.
     MemoryWorker(MemoryWorkerEvent),
-    /// Worker has started compacting the current session.
-    ///
-    /// Fired immediately before a compaction run. Success is signalled by
-    /// `CompactDone` (with the new `SegmentId`); failure by `CompactFailed`.
-    /// Broadcast to all clients; not replayed to late subscribers.
-    CompactStart,
-    /// Compaction completed and the session was rotated.
-    ///
-    /// `new_segment_id` is the UUID of the freshly created session that
-    /// replaced the old history.
-    CompactDone {
-        #[cfg_attr(feature = "typescript", ts(type = "string"))]
-        new_segment_id: uuid::Uuid,
+    /// Worker has started compacting the current session, or bound the run to its
+    /// observable Internal Worker. Revisions upsert one stable lifecycle item.
+    CompactStart {
+        lifecycle: CompactionLifecycle,
     },
-    /// Compaction failed. The session is unchanged.
+    /// Compaction completed and the session was rotated.
+    CompactDone {
+        lifecycle: CompactionLifecycle,
+    },
+    /// Compaction failed or was cancelled. The session is unchanged.
     CompactFailed {
-        error: String,
+        lifecycle: CompactionLifecycle,
     },
     Shutdown,
 }
@@ -895,6 +923,7 @@ pub enum WorkerStatus {
     Idle,
     Running,
     Paused,
+    Stopped,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -1377,7 +1406,7 @@ mod tests {
         let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
         assert_eq!(parsed["event"], "completions");
         assert_eq!(parsed["data"]["kind"], "file");
-        assert_eq!(parsed["data"]["entries"][0]["value"], "clear");
+        assert_eq!(parsed["data"]["entries"][0]["value"], "src/main.rs");
 
         // is_dir defaults to false on inbound payloads that omit it.
         let inbound =
@@ -1732,45 +1761,74 @@ mod tests {
         assert_eq!(parsed["data"]["timestamp_ms"], 1_700_000_000_000i64);
     }
 
+    fn test_compaction_lifecycle(state: CompactionLifecycleState) -> CompactionLifecycle {
+        CompactionLifecycle {
+            schema_version: 2,
+            compaction_id: "0192f0e8-4d84-7d6e-a000-000000000000".into(),
+            revision: 1,
+            internal_worker: None,
+            state,
+            started_at_ms: 1_700_000_000_000,
+            ended_at_ms: None,
+            summary: None,
+            error: None,
+            new_segment_id: None,
+        }
+    }
+
     #[test]
     fn event_compact_start_roundtrip() {
-        let event = Event::CompactStart;
+        let event = Event::CompactStart {
+            lifecycle: test_compaction_lifecycle(CompactionLifecycleState::Running),
+        };
         let json = serde_json::to_string(&event).unwrap();
-        assert_eq!(json, r#"{"event":"compact_start"}"#);
+        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
+        assert_eq!(parsed["event"], "compact_start");
+        assert_eq!(parsed["data"]["lifecycle"]["state"], "running");
         let decoded: Event = serde_json::from_str(&json).unwrap();
-        assert!(matches!(decoded, Event::CompactStart));
+        assert!(matches!(decoded, Event::CompactStart { lifecycle } if lifecycle.revision == 1));
     }
 
     #[test]
     fn event_compact_done_roundtrip() {
         let id = uuid::Uuid::parse_str("0192f0e8-4d84-7d6e-a000-000000000001").unwrap();
-        let event = Event::CompactDone { new_segment_id: id };
+        let mut lifecycle = test_compaction_lifecycle(CompactionLifecycleState::Done);
+        lifecycle.new_segment_id = Some(id.to_string());
+        lifecycle.summary = Some("accepted summary".into());
+        let event = Event::CompactDone { lifecycle };
         let json = serde_json::to_string(&event).unwrap();
         let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
         assert_eq!(parsed["event"], "compact_done");
         assert_eq!(
-            parsed["data"]["new_segment_id"],
+            parsed["data"]["lifecycle"]["new_segment_id"],
             "0192f0e8-4d84-7d6e-a000-000000000001"
         );
         let decoded: Event = serde_json::from_str(&json).unwrap();
         match decoded {
-            Event::CompactDone { new_segment_id } => assert_eq!(new_segment_id, id),
+            Event::CompactDone { lifecycle } => {
+                assert_eq!(
+                    lifecycle.new_segment_id.as_deref(),
+                    Some(id.to_string().as_str())
+                )
+            }
             other => panic!("expected CompactDone, got {other:?}"),
         }
     }
 
     #[test]
     fn event_compact_failed_roundtrip() {
-        let event = Event::CompactFailed {
-            error: "provider 429".into(),
-        };
+        let mut lifecycle = test_compaction_lifecycle(CompactionLifecycleState::Failed);
+        lifecycle.error = Some("provider 429".into());
+        let event = Event::CompactFailed { lifecycle };
         let json = serde_json::to_string(&event).unwrap();
         let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
         assert_eq!(parsed["event"], "compact_failed");
-        assert_eq!(parsed["data"]["error"], "provider 429");
+        assert_eq!(parsed["data"]["lifecycle"]["error"], "provider 429");
         let decoded: Event = serde_json::from_str(&json).unwrap();
         match decoded {
-            Event::CompactFailed { error } => assert_eq!(error, "provider 429"),
+            Event::CompactFailed { lifecycle } => {
+                assert_eq!(lifecycle.error.as_deref(), Some("provider 429"))
+            }
             other => panic!("expected CompactFailed, got {other:?}"),
         }
     }

crates/protocol/src/typescript.rs

@@ -4,11 +4,11 @@ use ts_rs::{Config, TS};
 
 use crate::{
     Alert, AlertLevel, AlertSource, CommandEvent, CommandSnapshot, CommandStatus, CommandStream,
-    CommandStreamSlice, CompletionEntry, CompletionKind, ErrorCode, Event, Greeting, InFlightBlock,
-    InFlightSnapshot, InFlightToolCallState, InternalWorkerKind, InternalWorkerRef,
-    InternalWorkerSnapshot, InvokeKind, MemoryWorkerEvent, Method, Permission, RewindSummary,
-    RewindTarget, RewindTargetId, RunResult, ScopeRule, Segment, TurnResult, WorkerEvent,
-    WorkerStatus,
+    CommandStreamSlice, CompactionLifecycle, CompactionLifecycleState, CompletionEntry,
+    CompletionKind, ErrorCode, Event, Greeting, InFlightBlock, InFlightSnapshot,
+    InFlightToolCallState, InternalWorkerKind, InternalWorkerRef, InternalWorkerSnapshot,
+    InvokeKind, MemoryWorkerEvent, Method, Permission, RewindSummary, RewindTarget, RewindTargetId,
+    RunResult, ScopeRule, Segment, TurnResult, WorkerEvent, WorkerStatus,
     subscription::{
         EventSubscriptionSelector, SubscriptionEvent, SubscriptionEventPayload, SubscriptionFrame,
         SubscriptionFramePayload, SubscriptionId, SubscriptionRejectionCode, SubscriptionRequest,
@@ -53,6 +53,8 @@ pub fn generated_protocol_types() -> String {
     push_decl::<CommandStreamSlice>(&cfg, &mut output);
     push_decl::<CommandSnapshot>(&cfg, &mut output);
     push_decl::<CommandEvent>(&cfg, &mut output);
+    push_decl::<CompactionLifecycleState>(&cfg, &mut output);
+    push_decl::<CompactionLifecycle>(&cfg, &mut output);
     push_decl::<ScopeRule>(&cfg, &mut output);
     push_decl::<CompletionEntry>(&cfg, &mut output);
     push_decl::<RewindTargetId>(&cfg, &mut output);

crates/session-store/src/segment.rs

@@ -307,6 +307,7 @@ pub fn save_run_completed(
     segment_id: SegmentId,
     result: EngineResult,
     interrupted: bool,
+    active_run_turn_count: Option<usize>,
 ) -> Result<(), StoreError> {
     append_entry(
         store,
@@ -316,6 +317,7 @@ pub fn save_run_completed(
             ts: segment_log::now_millis(),
             interrupted,
             result,
+            active_run_turn_count,
         },
     )
 }

crates/session-store/src/segment_log.rs

@@ -125,11 +125,16 @@ pub enum LogEntry {
     TurnEnd { ts: u64, turn_count: usize },
 
     /// `run()` / `resume()` が `EngineResult` で正常終了した。
-    /// Audit-only metadata: replay は `interrupted` のみ反映する。
+    /// Replay restores both interruption state and any resumable logical-run
+    /// turn budget.
     RunCompleted {
         ts: u64,
         interrupted: bool,
         result: EngineResult,
+        /// AgentTurns consumed by a paused/yielded logical run. Terminal
+        /// outcomes persist `None`.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        active_run_turn_count: Option<usize>,
     },
 
     /// `run()` / `resume()` が `EngineError` で終了した。
@@ -141,6 +146,15 @@ pub enum LogEntry {
         message: String,
     },
 
+    /// Restores an active logical-run budget at a segment boundary, notably
+    /// after compaction replaced the segment that held the original Invoke and
+    /// RunCompleted entries.
+    ActiveRunCheckpoint {
+        ts: u64,
+        active_turn_count: usize,
+        total_turn_count: usize,
+    },
+
     /// A paused interrupted turn was explicitly abandoned without calling
     /// `run()` or `resume()` again. Replay clears the interrupted marker so
     /// the restored Worker is idle and future user input starts a normal new turn.
@@ -209,6 +223,8 @@ pub struct RestoredState {
     pub config: RequestConfig,
     pub history: Vec<Item>,
     pub turn_count: usize,
+    /// AgentTurns consumed by the active paused/yielded logical run.
+    pub active_run_turn_count: Option<usize>,
     pub last_run_interrupted: bool,
     /// Number of entries replayed. `0` means the segment log was empty.
     /// Writers track their own append count via the same counter so
@@ -238,6 +254,7 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
         config: RequestConfig::default(),
         history: Vec::new(),
         turn_count: 0,
+        active_run_turn_count: None,
         last_run_interrupted: false,
         entries_count: 0,
         usage_history: Vec::new(),
@@ -265,6 +282,7 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
                 // A terminal run record below clears or refines this. If the
                 // log ends first, restore must treat the turn as interrupted.
                 state.last_run_interrupted = true;
+                state.active_run_turn_count = Some(0);
             }
             LogEntry::UserInput {
                 segments,
@@ -290,16 +308,44 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
                 state.history.push(item.to_history_item());
             }
             LogEntry::TurnEnd { turn_count, .. } => {
+                if let Some(active_turn_count) = &mut state.active_run_turn_count {
+                    *active_turn_count += turn_count.saturating_sub(state.turn_count);
+                }
                 state.turn_count = *turn_count;
             }
-            LogEntry::RunCompleted { interrupted, .. } => {
+            LogEntry::RunCompleted {
+                interrupted,
+                result,
+                active_run_turn_count,
+                ..
+            } => {
                 state.last_run_interrupted = *interrupted;
+                if *interrupted && matches!(result, EngineResult::Paused | EngineResult::Yielded) {
+                    // Legacy entries omit the explicit field; retain the
+                    // Invoke/TurnEnd-derived count in that case.
+                    if let Some(turn_count) = active_run_turn_count {
+                        state.active_run_turn_count = Some(*turn_count);
+                    }
+                } else {
+                    state.active_run_turn_count = None;
+                }
             }
             LogEntry::RunErrored { interrupted, .. } => {
                 state.last_run_interrupted = *interrupted;
+                state.active_run_turn_count = None;
+            }
+            LogEntry::ActiveRunCheckpoint {
+                active_turn_count,
+                total_turn_count,
+                ..
+            } => {
+                state.active_run_turn_count = Some(*active_turn_count);
+                state.turn_count = *total_turn_count;
+                state.last_run_interrupted = true;
             }
             LogEntry::PausedTurnAbandoned { .. } => {
                 state.last_run_interrupted = false;
+                state.active_run_turn_count = None;
             }
             LogEntry::ConfigChanged { config, .. } => {
                 state.config = config.clone();
@@ -397,6 +443,7 @@ mod tests {
                 ts: 3200,
                 interrupted: false,
                 result: EngineResult::Finished,
+                active_run_turn_count: None,
             },
         ]);
         assert_eq!(state.history.len(), 2);
@@ -695,10 +742,93 @@ mod tests {
                 ts: 100,
                 interrupted: true,
                 result: EngineResult::Paused,
+                active_run_turn_count: Some(1),
             },
             LogEntry::PausedTurnAbandoned { ts: 200 },
         ]);
         assert!(!state.last_run_interrupted);
+        assert_eq!(state.active_run_turn_count, None);
+    }
+
+    #[test]
+    fn replay_restores_active_run_budget_across_compaction_checkpoint() {
+        let state = collect_state(&[
+            LogEntry::SegmentStart {
+                ts: 0,
+                session_id: uuid::Uuid::nil(),
+                system_prompt: None,
+                config: RequestConfig::default(),
+                history: vec![],
+                forked_from: None,
+                compacted_from: None,
+            },
+            LogEntry::ActiveRunCheckpoint {
+                ts: 100,
+                active_turn_count: 3,
+                total_turn_count: 9,
+            },
+        ]);
+
+        assert_eq!(state.turn_count, 9);
+        assert_eq!(state.active_run_turn_count, Some(3));
+        assert!(state.last_run_interrupted);
+    }
+
+    #[test]
+    fn legacy_interrupted_run_derives_budget_from_invoke_and_turn_end() {
+        let entry: LogEntry = serde_json::from_value(serde_json::json!({
+            "kind": "run_completed",
+            "ts": 300,
+            "interrupted": true,
+            "result": "paused"
+        }))
+        .expect("legacy run-completed entry");
+        let state = collect_state(&[
+            LogEntry::SegmentStart {
+                ts: 0,
+                session_id: uuid::Uuid::nil(),
+                system_prompt: None,
+                config: RequestConfig::default(),
+                history: vec![],
+                forked_from: None,
+                compacted_from: None,
+            },
+            LogEntry::Invoke {
+                ts: 100,
+                trigger: InvokeKind::UserSend,
+            },
+            LogEntry::TurnEnd {
+                ts: 200,
+                turn_count: 2,
+            },
+            entry,
+        ]);
+
+        assert_eq!(state.active_run_turn_count, Some(2));
+        assert!(state.last_run_interrupted);
+    }
+
+    #[test]
+    fn non_resumable_interruption_clears_the_active_run_budget() {
+        let state = collect_state(&[
+            LogEntry::Invoke {
+                ts: 100,
+                trigger: InvokeKind::UserSend,
+            },
+            LogEntry::TurnEnd {
+                ts: 200,
+                turn_count: 2,
+            },
+            LogEntry::RunCompleted {
+                ts: 300,
+                interrupted: true,
+                result: EngineResult::LimitReached,
+                active_run_turn_count: None,
+            },
+        ]);
+
+        assert!(state.last_run_interrupted);
+        assert_eq!(state.active_run_turn_count, None);
     }
 
     #[test]

crates/session-store/tests/fs_store_test.rs

@@ -51,6 +51,7 @@ fn round_trip_write_and_read() {
             ts: 3200,
             interrupted: false,
             result: EngineResult::Finished,
+            active_run_turn_count: None,
         },
     ];
 

crates/session-store/tests/session_test.rs

@@ -132,6 +132,7 @@ async fn run_and_persist(
                 segment_id,
                 r.clone(),
                 worker.last_run_interrupted(),
+                worker.active_run_turn_count(),
             )
             .unwrap();
         }
@@ -309,6 +310,7 @@ async fn session_resume_after_pause() {
     // Restore state and verify
     let state = session_store::restore(&store, sid, segid).unwrap();
     assert!(state.last_run_interrupted);
+    assert_eq!(state.active_run_turn_count, Some(2));
 }
 
 #[tokio::test]

crates/ticket/src/tool.rs

@@ -142,8 +142,8 @@ const INTAKE_READY_DESCRIPTION: &str = "Record a bounded intake summary and mark
 The backend applies the same target validation and lock as TicketMarkReady and commits the summary, \
 state_changed event, effective target, and planning -> ready transition atomically.";
 const QUEUE_DESCRIPTION: &str = "Queue a ready Ticket for Orchestrator routing through the typed \
-Ticket backend. The backend performs the gated ready -> queued transition, records queued_by/queued_at, \
-and rejects unresolved blocking relations.";
+Ticket backend. The backend rejects transitive planning dependencies and cycles, atomically queues the \
+requested Ticket plus every transitive ready dependency, and leaves queued or in-progress dependencies unchanged.";
 const WORKFLOW_STATE_DESCRIPTION: &str = "Transition Ticket `state` through the typed \
 Ticket backend with a bounded `state_changed` event. Treat `queued -> inprogress` \
 as the implementation acceptance step: implementation side effects should happen only after that \
@@ -316,7 +316,11 @@ impl TicketBackend for TicketToolBackend {
         self.backend.mark_ready(id, request)
     }
 
-    fn queue_ready(&self, id: TicketIdOrSlug, queued_by: &str) -> TicketResult<()> {
+    fn queue_ready(
+        &self,
+        id: TicketIdOrSlug,
+        queued_by: &str,
+    ) -> TicketResult<crate::TicketQueueOutcome> {
         self.backend.queue_ready(id, queued_by)
     }
 
@@ -1219,12 +1223,22 @@ impl Tool for TicketQueueTool {
     ) -> Result<ToolOutput, ToolError> {
         let params: TicketQueueParams = parse_input("TicketQueue", input_json)?;
         let queued_by = default_author();
-        self.backend
+        let outcome = self
+            .backend
             .queue_ready(TicketIdOrSlug::Query(params.ticket.clone()), &queued_by)
             .map_err(|error| backend_error("TicketQueue", error))?;
         Ok(json_output(
-            format!("Queued ticket {} for Orchestrator", params.ticket),
-            json!({ "ticket": params.ticket, "state": "queued", "queued_by": queued_by, "ok": true }),
+            format!(
+                "Queued {} ticket(s) for Orchestrator",
+                outcome.queued_tickets.len()
+            ),
+            json!({
+                "ticket": outcome.requested_ticket,
+                "queued_tickets": outcome.queued_tickets,
+                "state": "queued",
+                "queued_by": queued_by,
+                "ok": true
+            }),
         ))
     }
 }

crates/tools/tests/edge_cases.rs

@@ -131,10 +131,11 @@ async fn symlink_to_outside_scope_is_rejected_for_write() {
     assert!(
         msg.contains("outside allowed read scope")
             || msg.contains("outside allowed write scope")
+            || msg.contains("outside allowed scope")
             || msg.contains("has not been read"),
         "symlink escape not rejected: {msg}"
     );
-    if !msg.contains("has not been read") {
+    if msg.contains("outside allowed read scope") || msg.contains("outside allowed write scope") {
         assert!(
             msg.contains("add the symlink target"),
             "symlink escape diagnostic should include remediation: {msg}"
@@ -233,12 +234,16 @@ async fn absolute_path_is_rejected() {
         )
         .await
         .unwrap_err();
-    assert!(format!("{err}").contains("invalid Workdir path"));
+    let msg = format!("{err}");
+    assert!(
+        msg.contains("invalid logical filesystem path"),
+        "absolute path was not rejected as invalid: {msg}"
+    );
 }
 
 #[tokio::test]
 async fn directory_target_is_rejected_for_read() {
-    let (dir, _spill, reg) = setup();
+    let (_dir, _spill, reg) = setup();
     let read = reg.get("Read");
     let err = read
         .execute(&json!({ "file_path": "." }).to_string(), Default::default())

crates/tools/tests/integration.rs

@@ -191,7 +191,7 @@ async fn write_then_grep_finds_content() {
 
 #[tokio::test]
 async fn glob_finds_written_files() {
-    let (dir, _spill, reg) = setup();
+    let (_dir, _spill, reg) = setup();
     let write = reg.get("Write");
     let glob = reg.get("Glob");
 
@@ -229,7 +229,10 @@ async fn absolute_path_is_rejected() {
     .await;
     // Absolute paths are rejected at the logical WorkdirSession boundary.
     let msg = format!("{err}");
-    assert!(msg.contains("invalid Workdir path"), "unexpected: {msg}");
+    assert!(
+        msg.contains("invalid logical filesystem path"),
+        "unexpected: {msg}"
+    );
 }
 
 #[tokio::test]
@@ -340,7 +343,7 @@ async fn tracker_recent_files_tracks_read_write_edit() {
     ));
 
     let a = dir.path().join("a.txt");
-    let b = dir.path().join("b.txt");
+    let _b = dir.path().join("b.txt");
     std::fs::write(&a, "one\n").unwrap();
 
     // Read `a` — should appear in recency.

crates/tui/src/app.rs

@@ -1342,13 +1342,20 @@ impl App {
                     }
                 }
             }
-            Event::CompactStart => {
-                self.blocks.push(Block::Compact(CompactEvent::Streaming {
-                    started_at: Instant::now(),
-                }));
+            Event::CompactStart { .. } => {
+                if self.last_streaming_compact_mut().is_none() {
+                    self.blocks.push(Block::Compact(CompactEvent::Streaming {
+                        started_at: Instant::now(),
+                    }));
+                }
             }
-            Event::CompactDone { new_segment_id } => {
+            Event::CompactDone { lifecycle } => {
                 self.session_context_tokens = 0;
+                let new_segment_id = lifecycle
+                    .new_segment_id
+                    .as_deref()
+                    .and_then(|value| uuid::Uuid::parse_str(value).ok())
+                    .unwrap_or_default();
                 if let Some(evt) = self.last_streaming_compact_mut() {
                     let elapsed_secs = match evt {
                         CompactEvent::Streaming { started_at } => {
@@ -1367,7 +1374,10 @@ impl App {
                     }));
                 }
             }
-            Event::CompactFailed { error } => {
+            Event::CompactFailed { lifecycle } => {
+                let error = lifecycle
+                    .error
+                    .unwrap_or_else(|| "compaction failed".to_string());
                 if let Some(evt) = self.last_streaming_compact_mut() {
                     let elapsed_secs = match evt {
                         CompactEvent::Streaming { started_at } => {
@@ -2486,7 +2496,7 @@ fn event_is_stale_after_rewind(event: &Event) -> bool {
         event,
         Event::Alert(_)
             | Event::MemoryWorker(_)
-            | Event::CompactStart
+            | Event::CompactStart { .. }
             | Event::CompactDone { .. }
             | Event::CompactFailed { .. }
             | Event::SegmentRotated { .. }
@@ -4076,13 +4086,34 @@ mod completion_flow_tests {
         }
     }
 
+    fn test_compaction_lifecycle(
+        state: protocol::CompactionLifecycleState,
+    ) -> protocol::CompactionLifecycle {
+        protocol::CompactionLifecycle {
+            schema_version: 2,
+            compaction_id: "compaction-test".into(),
+            revision: 1,
+            internal_worker: None,
+            state,
+            started_at_ms: 1,
+            ended_at_ms: None,
+            summary: None,
+            error: None,
+            new_segment_id: None,
+        }
+    }
+
     #[test]
     fn compact_done_replaces_live_block() {
         let mut app = App::new("test".into());
         let id = uuid::Uuid::parse_str("12345678-1234-5678-1234-567812345678").unwrap();
 
-        app.handle_worker_event(Event::CompactStart);
-        app.handle_worker_event(Event::CompactDone { new_segment_id: id });
+        app.handle_worker_event(Event::CompactStart {
+            lifecycle: test_compaction_lifecycle(protocol::CompactionLifecycleState::Running),
+        });
+        let mut lifecycle = test_compaction_lifecycle(protocol::CompactionLifecycleState::Done);
+        lifecycle.new_segment_id = Some(id.to_string());
+        app.handle_worker_event(Event::CompactDone { lifecycle });
 
         assert_eq!(compact_block_count(&app), 1);
         assert!(matches!(
@@ -4098,10 +4129,12 @@ mod completion_flow_tests {
     fn compact_failed_replaces_live_block() {
         let mut app = App::new("test".into());
 
-        app.handle_worker_event(Event::CompactStart);
-        app.handle_worker_event(Event::CompactFailed {
-            error: "provider 429".into(),
+        app.handle_worker_event(Event::CompactStart {
+            lifecycle: test_compaction_lifecycle(protocol::CompactionLifecycleState::Running),
         });
+        let mut lifecycle = test_compaction_lifecycle(protocol::CompactionLifecycleState::Failed);
+        lifecycle.error = Some("provider 429".into());
+        app.handle_worker_event(Event::CompactFailed { lifecycle });
 
         assert_eq!(compact_block_count(&app), 1);
         assert!(matches!(
@@ -4117,7 +4150,9 @@ mod completion_flow_tests {
     fn shutdown_marks_live_compact_incomplete() {
         let mut app = App::new("test".into());
 
-        app.handle_worker_event(Event::CompactStart);
+        app.handle_worker_event(Event::CompactStart {
+            lifecycle: test_compaction_lifecycle(protocol::CompactionLifecycleState::Running),
+        });
         app.handle_worker_event(Event::Shutdown);
 
         assert!(app.quit);
@@ -4208,9 +4243,9 @@ mod completion_flow_tests {
         let mut app = App::new("test".into());
         app.session_context_tokens = 42_000;
 
-        app.handle_worker_event(Event::CompactDone {
-            new_segment_id: uuid::Uuid::nil(),
-        });
+        let mut lifecycle = test_compaction_lifecycle(protocol::CompactionLifecycleState::Done);
+        lifecycle.new_segment_id = Some(uuid::Uuid::nil().to_string());
+        app.handle_worker_event(Event::CompactDone { lifecycle });
 
         assert_eq!(app.session_context_tokens, 0);
     }

crates/tui/src/console/mod.rs

@@ -1016,7 +1016,7 @@ fn handle_key(app: &mut App, key: KeyEvent) -> Option<Method> {
                 app.clear_queued_inputs();
                 Some(Method::Cancel)
             }
-            WorkerStatus::Idle => Some(Method::Shutdown),
+            WorkerStatus::Idle | WorkerStatus::Stopped => Some(Method::Shutdown),
         }),
         KeyCode::Char('d') if ctrl => {
             app.quit = true;

crates/tui/src/dashboard/mod.rs

@@ -4,6 +4,7 @@ use std::fmt;
 use std::io;
 use std::path::{Path, PathBuf};
 use std::process::Command;
+use std::sync::Arc;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use client::ticket_role::{
@@ -4125,7 +4126,10 @@ async fn dispatch_ticket_action(
     let config = TicketConfig::load_workspace(&request.workspace_root)
         .map_err(|error| TicketActionError::BackendConfig(error.to_string()))?;
     let backend = LocalTicketBackend::new(config.backend_root())
-        .with_record_language(config.ticket_record_language());
+        .with_record_language(config.ticket_record_language())
+        .with_target_authority(Arc::new(DashboardTicketTargetAuthority {
+            workspace_root: request.workspace_root.clone(),
+        }));
     if request.action == NextUserAction::Close {
         return dispatch_panel_close(&backend, &request.ticket_id);
     }
@@ -4201,17 +4205,32 @@ async fn dispatch_panel_queue(
         "root-ticket-state-after-orchestration-merge",
         &preflight.root_top_level,
     )?;
-    backend
+    let queue_outcome = backend
         .queue_ready(TicketIdOrSlug::Id(ticket_id.to_owned()), "workspace-panel")
         .map_err(|error| TicketActionError::Ticket(error.to_string()))?;
+    let expected_queue_tickets = preflight
+        .queue_tickets
+        .iter()
+        .cloned()
+        .collect::<std::collections::BTreeSet<_>>();
+    let actual_queue_tickets = queue_outcome
+        .queued_tickets
+        .iter()
+        .cloned()
+        .collect::<std::collections::BTreeSet<_>>();
+    if actual_queue_tickets != expected_queue_tickets {
+        return Err(TicketActionError::Stale(format!(
+            "Queue dependency plan changed after confirmation for Ticket {ticket_id}; reload and retry"
+        )));
+    }
     let commit = commit_panel_queue_ticket_record(&preflight)?;
     let sync = sync_panel_queue_to_orchestration(&preflight, &commit)?;
     verify_panel_queue_synced(&preflight, &commit)?;
     let notification = notify_workspace_orchestrator(orchestrator, current_ticket).await;
     Ok(TicketActionOutcome {
         notice: format!(
-            "Queued Ticket {}; root Queue commit {}; {}; orchestration sync {}; {}. Orchestrator routing is authorized; implementation side effects still require queued -> inprogress acceptance.",
-            ticket_id,
+            "Queued Ticket closure [{}]; root Queue commit {}; {}; orchestration sync {}; {}. Orchestrator routing is authorized; implementation side effects still require queued -> inprogress acceptance.",
+            queue_outcome.queued_tickets.join(", "),
             commit.sha,
             root_merge.sentence(),
             sync.sentence(),
@@ -4220,12 +4239,52 @@ async fn dispatch_panel_queue(
     })
 }
 
+struct DashboardTicketTargetAuthority {
+    workspace_root: PathBuf,
+}
+
+impl ticket::TicketTargetAuthority for DashboardTicketTargetAuthority {
+    fn resolve_target(
+        &self,
+        _workspace_id: &str,
+        repository_id: Option<&str>,
+        ref_selector: Option<&str>,
+    ) -> ticket::Result<ticket::ResolvedTicketTarget> {
+        let repository_id = repository_id.unwrap_or("main");
+        if repository_id != "main" {
+            return Err(ticket::TicketError::UnknownTargetRepository(
+                repository_id.to_string(),
+            ));
+        }
+        let ref_selector = ref_selector.unwrap_or("HEAD");
+        git_capture(
+            &self.workspace_root,
+            &[
+                "rev-parse",
+                "--verify",
+                &format!("{ref_selector}^{{commit}}"),
+            ],
+            "resolve Queue Ticket target",
+        )
+        .map_err(|reason| ticket::TicketError::InvalidTargetSelector {
+            repository_id: repository_id.to_string(),
+            selector: ref_selector.to_string(),
+            reason,
+        })?;
+        Ok(ticket::ResolvedTicketTarget {
+            repository_id: repository_id.to_string(),
+            ref_selector: ref_selector.to_string(),
+        })
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct PanelQueueHandoffPreflight {
     ticket_id: String,
     root_top_level: PathBuf,
     orchestration: OrchestrationWorktreeLayout,
-    ticket_record_dir: PathBuf,
+    queue_tickets: Vec<String>,
+    ticket_record_dirs: Vec<PathBuf>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -4393,27 +4452,53 @@ fn prepare_panel_queue_handoff(
         &root_top_level,
     )?;
 
-    let ticket_record_dir = backend.root().join(ticket_id);
-    if !ticket_record_dir.join("item.md").is_file() {
+    let dependency_check = backend
+        .dependency_check(TicketIdOrSlug::Id(ticket_id.to_owned()))
+        .map_err(|error| TicketActionError::Ticket(error.to_string()))?;
+    if !dependency_check.queue_guard.can_queue_for_orchestrator {
         return Err(queue_check_failed(
-            "target-ticket-record",
+            "dependency-queue-plan",
             ticket_id,
-            &ticket_record_dir,
-            "target Ticket item.md is missing".to_string(),
+            &root_top_level,
+            dependency_check
+                .queue_guard
+                .blocked_reason
+                .or(dependency_check.queue_guard.reason)
+                .unwrap_or_else(|| "Queue dependency validation failed".to_string()),
         ));
     }
-    ensure_git_path_clean(
-        "root-ticket-clean",
-        ticket_id,
-        &root_top_level,
-        &ticket_record_dir,
-    )?;
+    let queue_tickets = dependency_check.queue_tickets;
+    let mut ticket_record_dirs = Vec::with_capacity(queue_tickets.len());
+    for queue_ticket in &queue_tickets {
+        let ticket_record_dir = backend.root().join(queue_ticket);
+        if !ticket_record_dir.join("item.md").is_file() {
+            return Err(queue_check_failed(
+                "target-ticket-record",
+                &queue_ticket,
+                &ticket_record_dir,
+                "Queue Ticket item.md is missing".to_string(),
+            ));
+        }
+        let clean_stage = if queue_ticket == ticket_id {
+            "root-ticket-clean"
+        } else {
+            "queue-dependency-clean"
+        };
+        ensure_git_path_clean(
+            clean_stage,
+            &queue_ticket,
+            &root_top_level,
+            &ticket_record_dir,
+        )?;
+        ticket_record_dirs.push(ticket_record_dir);
+    }
 
     Ok(PanelQueueHandoffPreflight {
         ticket_id: ticket_id.to_string(),
         root_top_level,
         orchestration,
-        ticket_record_dir,
+        queue_tickets,
+        ticket_record_dirs,
     })
 }
 
@@ -4504,37 +4589,36 @@ fn sync_orchestration_to_root_before_queue(
 fn commit_panel_queue_ticket_record(
     preflight: &PanelQueueHandoffPreflight,
 ) -> Result<PanelQueueCommit, TicketActionError> {
-    let ticket_rel = path_relative_to_root(
-        &preflight.root_top_level,
-        &preflight.ticket_record_dir,
-        "target-ticket-record",
-        &preflight.ticket_id,
-    )?;
+    let ticket_rels = preflight
+        .ticket_record_dirs
+        .iter()
+        .map(|ticket_record_dir| {
+            path_relative_to_root(
+                &preflight.root_top_level,
+                ticket_record_dir,
+                "target-ticket-record",
+                &preflight.ticket_id,
+            )
+        })
+        .collect::<Result<Vec<_>, _>>()?;
     let mut add = Command::new("git");
     add.arg("-C")
         .arg(&preflight.root_top_level)
         .arg("add")
         .arg("--")
-        .arg(&ticket_rel);
-    run_git_command(add, "stage Queue Ticket record").map_err(|message| {
+        .args(&ticket_rels);
+    run_git_command(add, "stage Queue Ticket records").map_err(|message| {
         queue_check_failed(
             "queue-commit-stage",
             &preflight.ticket_id,
-            &preflight.ticket_record_dir,
+            &preflight.root_top_level,
             message,
         )
     })?;
 
-    let ticket_rel_string = git_path_string(&ticket_rel);
     let staged = git_capture(
         &preflight.root_top_level,
-        &[
-            "diff",
-            "--cached",
-            "--name-only",
-            "--",
-            ticket_rel_string.as_str(),
-        ],
+        &["diff", "--cached", "--name-only"],
         "list staged Queue Ticket files",
     )
     .map_err(|message| {
@@ -4545,19 +4629,31 @@ fn commit_panel_queue_ticket_record(
             message,
         )
     })?;
+    let allowed = ticket_rels
+        .iter()
+        .map(|path| format!("{}/", git_path_string(path).trim_end_matches('/')))
+        .collect::<Vec<_>>();
     let staged_paths = staged
         .lines()
         .filter(|line| !line.trim().is_empty())
         .collect::<Vec<_>>();
-    if staged_paths.is_empty() {
+    if staged_paths.is_empty()
+        || staged_paths
+            .iter()
+            .any(|path| !allowed.iter().any(|root| path.starts_with(root)))
+    {
         return Err(queue_check_failed(
             "queue-commit-pathscope",
             &preflight.ticket_id,
-            &preflight.ticket_record_dir,
-            "Queue mutation produced no staged Ticket record changes".to_string(),
+            &preflight.root_top_level,
+            "Queue mutation staged no Ticket records or included files outside the confirmed dependency closure"
+                .to_string(),
         ));
     }
-    let message = format!("ticket: queue {}", preflight.ticket_id);
+    let message = format!(
+        "chore: queue Ticket dependency closure {}",
+        preflight.ticket_id
+    );
     let mut commit = Command::new("git");
     commit
         .arg("-C")
@@ -4567,8 +4663,8 @@ fn commit_panel_queue_ticket_record(
         .arg("-m")
         .arg(message)
         .arg("--")
-        .arg(&ticket_rel);
-    run_git_command(commit, "commit Queue Ticket record").map_err(|message| {
+        .args(&ticket_rels);
+    run_git_command(commit, "commit Queue Ticket records").map_err(|message| {
         queue_check_failed(
             "queue-commit-create",
             &preflight.ticket_id,
@@ -5108,6 +5204,7 @@ fn row_status_label(entry: &WorkerListEntry) -> (&'static str, Style) {
                     .fg(Color::Cyan)
                     .add_modifier(Modifier::BOLD),
             ),
+            Some(WorkerStatus::Stopped) => ("live stopped", Style::default().fg(Color::DarkGray)),
             None => ("live", Style::default().fg(Color::DarkGray)),
         };
     }

crates/tui/src/dashboard/render.rs

@@ -462,7 +462,7 @@ pub(super) fn panel_ticket_detail(row: &PanelRow) -> String {
         .as_ref()
         .and_then(|ticket| ticket.blocked_reason.as_deref())
     {
-        parts.push(format!("Gate: waiting for {blocked_reason}"));
+        parts.push(format!("Dependencies: {blocked_reason}"));
     } else {
         parts.push("Gate: clear".to_string());
     }

crates/tui/src/dashboard/tests.rs

@@ -1846,24 +1846,23 @@ fn panel_orchestration_overlay_uses_compact_status_column_and_detail_line() {
 }
 
 #[test]
-fn ready_ticket_with_waiting_gate_shows_queue_disabled_reason() {
+fn ready_ticket_with_dependency_context_keeps_queue_action_available() {
     let mut row = panel_test_ticket_row(
         "00001WAITING",
-        "Ready but gated",
-        ActionPriority::Background,
-        NextUserAction::Wait,
+        "Ready with dependency context",
+        ActionPriority::ReadyForQueue,
+        NextUserAction::Queue,
         "ready",
     );
-    row.disabled_reason = Some("Queue disabled: waiting for BLOCKER-1".to_string());
     row.ticket.as_mut().unwrap().blocked_reason = Some("BLOCKER-1 via depends_on".to_string());
 
     let lines = panel_row_lines(&row, true, 160);
     let detail = &lines[1];
     let detail_line = plain_line(&detail);
 
-    assert!(detail_line.contains("Gate: waiting for BLOCKER-1 via depends_on"));
-    assert!(detail_line.contains("Action: queue disabled"));
-    assert!(detail_line.contains("Reason: Queue disabled: waiting for BLOCKER-1"));
+    assert!(detail_line.contains("Dependencies: BLOCKER-1 via depends_on"));
+    assert!(detail_line.contains("Action: Queue"));
+    assert!(!detail_line.contains("Queue disabled"));
 }
 
 #[test]

crates/tui/src/workspace_panel.rs

@@ -1530,6 +1530,7 @@ fn worker_status_label(entry: &WorkerListEntry) -> &'static str {
             Some(WorkerStatus::Idle) => "live idle",
             Some(WorkerStatus::Running) => "live running",
             Some(WorkerStatus::Paused) => "live paused",
+            Some(WorkerStatus::Stopped) => "live stopped",
             None => "live",
         };
     }
@@ -2203,7 +2204,7 @@ mod tests {
     }
 
     #[test]
-    fn workspace_panel_marks_ready_ticket_with_unresolved_relation_waiting_gate() {
+    fn workspace_panel_blocks_ready_ticket_with_planning_relation() {
         let temp = TempDir::new().unwrap();
         write_ticket_config(temp.path());
         let backend = LocalTicketBackend::new(temp.path().join(".yoi/tickets"));
@@ -2235,12 +2236,7 @@ mod tests {
         assert_eq!(row.kind, PanelRowKind::Ticket);
         assert_eq!(row.next_action, Some(NextUserAction::Wait));
         assert_eq!(row.priority, ActionPriority::Background);
-        assert!(
-            row.disabled_reason
-                .as_deref()
-                .unwrap()
-                .contains("Queue disabled: waiting for")
-        );
+        assert!(row.disabled_reason.is_some());
         assert!(
             row.ticket
                 .as_ref()
@@ -2253,7 +2249,7 @@ mod tests {
     }
 
     #[test]
-    fn workspace_panel_allows_ready_ticket_when_relation_prerequisite_is_queued() {
+    fn workspace_panel_queues_ready_ticket_when_relation_prerequisite_is_queued() {
         let temp = TempDir::new().unwrap();
         write_ticket_config(temp.path());
         let backend = LocalTicketBackend::new(temp.path().join(".yoi/tickets"));
@@ -2286,13 +2282,16 @@ mod tests {
         assert_eq!(row.next_action, Some(NextUserAction::Queue));
         assert_eq!(row.priority, ActionPriority::ReadyForQueue);
         assert!(row.disabled_reason.is_none());
-        assert!(row.ticket.as_ref().unwrap().blocked_reason.is_none());
         assert!(
-            row.key_hint
-                .as_deref()
+            row.ticket
+                .as_ref()
                 .unwrap()
-                .contains("Queue allowed: prerequisites are already queued/in progress")
+                .blocked_reason
+                .as_deref()
+                .unwrap_or_default()
+                .contains(&dependency.id)
         );
+        assert!(row.key_hint.as_deref().unwrap().contains("Queue targets:"));
         assert!(row.key_hint.as_deref().unwrap().contains(&dependency.id));
     }
 

crates/workdir/src/delegation.rs

@@ -311,7 +311,10 @@ impl DelegatingWorkdirSession {
         if !self.capabilities.supports(WorkdirSessionCapability::Read)
             || (writable
                 && (!self.capabilities.supports(WorkdirSessionCapability::Write)
-                    || !self.capabilities.supports(WorkdirSessionCapability::Edit)))
+                    || !self.capabilities.supports(WorkdirSessionCapability::Edit)
+                    || !self
+                        .capabilities
+                        .supports(WorkdirSessionCapability::Command)))
         {
             return Err(WorkdirError::Denied(
                 "parent workdir session cannot delegate the requested capabilities".into(),
@@ -342,6 +345,7 @@ impl DelegatingWorkdirSession {
         if writable {
             delegated.push(WorkdirSessionCapability::Write);
             delegated.push(WorkdirSessionCapability::Edit);
+            delegated.push(WorkdirSessionCapability::Command);
         }
         Ok(WorkdirSessionCapabilities::from_capabilities(delegated))
     }
@@ -929,6 +933,43 @@ mod tests {
             .delegate(request("leased", WorkdirDelegationPermission::Write))
             .await
             .unwrap();
+        assert!(
+            child
+                .capabilities
+                .supports(WorkdirSessionCapability::Command)
+        );
+        let command = child
+            .scoped_session
+            .start_command(CommandRequest {
+                command: "printf child-command".into(),
+                timeout_secs: 5,
+                output_limit: 1024,
+                tool_call_id: Some("delegated-child-command".into()),
+            })
+            .await
+            .unwrap();
+        let command_output = child
+            .scoped_session
+            .command_output(CommandOutputRequest {
+                handle: command,
+                cursor: 0,
+                limit: 1024,
+                wait: true,
+            })
+            .await
+            .unwrap();
+        assert_eq!(command_output.content, "child-command");
+        assert!(
+            parent
+                .start_command(CommandRequest {
+                    command: "printf parent-command".into(),
+                    timeout_secs: 5,
+                    output_limit: 1024,
+                    tool_call_id: Some("blocked-parent-command".into()),
+                })
+                .await
+                .is_err()
+        );
 
         assert!(matches!(
             parent.write(write("leased/file", "parent")).await,

crates/workdir/src/lib.rs

@@ -28,7 +28,9 @@ pub use fs_operation::{
     GlobResult, GrepOutputMode, GrepRequest, GrepResult, ListEntry, ListRequest, ListResult,
     ReadRequest, ReadResult, StatRequest, StatResult, WriteRequest, WriteResult,
 };
-pub use local::{LocalWorkdirSession, SymlinkInfo, direct_symlink, first_symlink};
+pub use local::{
+    LocalWorkdirSession, SymlinkInfo, WorkdirSessionResource, direct_symlink, first_symlink,
+};
 pub use operation::*;
 
 /// Persistent, opaque identity of one materialized Workdir.

crates/workdir/src/local.rs

@@ -8,7 +8,8 @@
 //! `LocalWorkdirSession` is cheap to clone (`Arc` inside). Tool-specific session
 //! state, such as read-before-edit tracking, remains owned by the tool layer.
 
-use std::collections::HashMap;
+use std::collections::{BTreeMap, HashMap};
+use std::fmt::Debug;
 #[cfg(test)]
 use std::io::Write as _;
 use std::io::{Read as _, Seek as _, SeekFrom};
@@ -228,6 +229,8 @@ struct LocalWorkdirSessionInner {
     next_command_id: AtomicU64,
     commands: Mutex<HashMap<String, LocalCommand>>,
     command_telemetry: CommandTelemetry,
+    command_environment: BTreeMap<String, String>,
+    resources: StdMutex<Vec<Arc<dyn WorkdirSessionResource>>>,
 }
 
 impl Drop for LocalWorkdirSessionInner {
@@ -242,6 +245,9 @@ impl Drop for LocalWorkdirSessionInner {
     }
 }
 
+pub trait WorkdirSessionResource: Debug + Send + Sync {}
+impl<T> WorkdirSessionResource for T where T: Debug + Send + Sync {}
+
 /// Scope-aware filesystem handle. Clone-cheap (`Arc` inside).
 ///
 /// The wrapped [`SharedScope`] is shared with every clone of this
@@ -318,6 +324,26 @@ impl LocalWorkdirSession {
         cwd: PathBuf,
         scope: SharedScope,
         capabilities: WorkdirSessionCapabilities,
+    ) -> Self {
+        Self::materialized_bound_with_environment(
+            workdir,
+            root,
+            cwd,
+            scope,
+            capabilities,
+            BTreeMap::new(),
+            Vec::new(),
+        )
+    }
+
+    pub fn materialized_bound_with_environment(
+        workdir: Workdir,
+        root: PathBuf,
+        cwd: PathBuf,
+        scope: SharedScope,
+        capabilities: WorkdirSessionCapabilities,
+        command_environment: BTreeMap<String, String>,
+        resources: Vec<Arc<dyn WorkdirSessionResource>>,
     ) -> Self {
         Self {
             inner: Arc::new(LocalWorkdirSessionInner {
@@ -331,6 +357,8 @@ impl LocalWorkdirSession {
                 next_command_id: AtomicU64::new(1),
                 commands: Mutex::new(HashMap::new()),
                 command_telemetry: CommandTelemetry::new(),
+                command_environment,
+                resources: StdMutex::new(resources),
             }),
         }
     }
@@ -669,9 +697,18 @@ impl WorkdirSession for LocalWorkdirSession {
         let (completion_tx, completion) = watch::channel(false);
         let command_id = handle.0.clone();
         let telemetry = self.inner.command_telemetry.clone();
+        let command_environment = self.inner.command_environment.clone();
         let (cancel, cancel_rx) = watch::channel(false);
         let task = tokio::spawn(async move {
-            let output = run_command(cwd, request, command_id, telemetry, cancel_rx).await;
+            let output = run_command(
+                cwd,
+                request,
+                command_id,
+                telemetry,
+                command_environment,
+                cancel_rx,
+            )
+            .await;
             let _ = completion_tx.send(true);
             output
         });
@@ -840,6 +877,9 @@ impl WorkdirSession for LocalWorkdirSession {
                 LocalCommand::Completed(_) => {}
             }
         }
+        if let Ok(mut resources) = self.inner.resources.lock() {
+            resources.clear();
+        }
         Ok(())
     }
 }
@@ -909,6 +949,7 @@ async fn run_command(
     request: CommandRequest,
     command_id: String,
     telemetry: CommandTelemetry,
+    command_environment: BTreeMap<String, String>,
     mut cancel: watch::Receiver<bool>,
 ) -> Result<CommandOutput, WorkdirError> {
     let stdout = tempfile::NamedTempFile::new().map_err(|error| WorkdirError::io(&cwd, error))?;
@@ -925,6 +966,7 @@ async fn run_command(
         .arg("-c")
         .arg(&request.command)
         .current_dir(&cwd)
+        .envs(command_environment)
         .stdin(Stdio::null())
         .stdout(Stdio::from(stdout_file))
         .stderr(Stdio::from(stderr_file))
@@ -2319,6 +2361,31 @@ mod tests {
         assert_eq!(terminal, Some((handle.0, CommandStatus::TimedOut, None)));
     }
 
+    #[tokio::test]
+    async fn closing_session_releases_runtime_resources() {
+        #[derive(Debug)]
+        struct Resource(Arc<AtomicBool>);
+        impl Drop for Resource {
+            fn drop(&mut self) {
+                self.0.store(true, Ordering::Release);
+            }
+        }
+
+        let dir = TempDir::new().unwrap();
+        let released = Arc::new(AtomicBool::new(false));
+        let session = LocalWorkdirSession::materialized_bound_with_environment(
+            Workdir::new("resource-session"),
+            dir.path().to_path_buf(),
+            dir.path().to_path_buf(),
+            SharedScope::new(Scope::writable(dir.path()).unwrap()),
+            WorkdirSessionCapabilities::ALL,
+            BTreeMap::from([("SSH_AUTH_SOCK".to_string(), "test-socket".to_string())]),
+            vec![Arc::new(Resource(released.clone()))],
+        );
+        WorkdirSession::close(&session).await.unwrap();
+        assert!(released.load(Ordering::Acquire));
+    }
+
     #[tokio::test]
     async fn provider_cancels_active_command() {
         let dir = TempDir::new().unwrap();

crates/workdir/src/workspace.rs

@@ -30,6 +30,8 @@ impl RuntimeWorkerRef {
 #[serde(rename_all = "snake_case")]
 pub enum MaterializerKind {
     #[default]
+    RuntimeGitCache,
+    /// Legacy persisted value from the pre-cache local `git worktree` materializer.
     LocalGitWorktree,
 }
 
@@ -109,6 +111,8 @@ pub struct WorkingDirectoryProvenance {
     pub creation_selector: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub creation_ref: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub creation_tree: Option<String>,
     pub materializer_kind: MaterializerKind,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub cleanup_target: Option<WorkingDirectoryCleanupTarget>,
@@ -122,6 +126,10 @@ pub struct WorkingDirectoryCurrentObservation {
     pub current_selector: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub current_ref: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub current_tree: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub observed_at_epoch_seconds: Option<u64>,
     pub status: WorkingDirectoryStatusKind,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub cleanliness: Option<String>,
@@ -141,9 +149,15 @@ pub struct WorkingDirectorySummary {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub creation_ref: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub creation_tree: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub current_selector: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub current_ref: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub current_tree: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub observed_at_epoch_seconds: Option<u64>,
     pub materializer_kind: MaterializerKind,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub cleanup_target: Option<WorkingDirectoryCleanupTarget>,
@@ -166,6 +180,7 @@ impl WorkingDirectorySummary {
         WorkingDirectoryProvenance {
             creation_selector: self.creation_selector.clone(),
             creation_ref: self.creation_ref.clone(),
+            creation_tree: self.creation_tree.clone(),
             materializer_kind: self.materializer_kind.clone(),
             cleanup_target: self.cleanup_target.clone(),
         }
@@ -175,6 +190,8 @@ impl WorkingDirectorySummary {
         WorkingDirectoryCurrentObservation {
             current_selector: self.current_selector.clone(),
             current_ref: self.current_ref.clone(),
+            current_tree: self.current_tree.clone(),
+            observed_at_epoch_seconds: self.observed_at_epoch_seconds,
             status: self.status.clone(),
             cleanliness: self.cleanliness.clone(),
             primary_worker_id: self.primary_worker_id.clone(),
@@ -211,6 +228,7 @@ pub struct WorkingDirectoryListResponse {
 #[serde(deny_unknown_fields)]
 pub struct WorkingDirectoryDetailResponse {
     pub workspace_id: String,
+    pub runtime_id: String,
     pub item: WorkingDirectorySummary,
     pub diagnostics: Vec<WorkingDirectoryDiagnostic>,
 }
@@ -246,8 +264,11 @@ mod tests {
                     repository_id: "repo".to_string(),
                     creation_selector: Some("develop".to_string()),
                     creation_ref: Some("abc123".to_string()),
+                    creation_tree: Some("tree123".to_string()),
                     current_selector: Some("work/ticket".to_string()),
                     current_ref: Some("def456".to_string()),
+                    current_tree: Some("tree456".to_string()),
+                    observed_at_epoch_seconds: Some(1_777_777_777),
                     materializer_kind: MaterializerKind::LocalGitWorktree,
                     cleanup_target: Some(WorkingDirectoryCleanupTarget {
                         kind: "git_worktree".to_string(),
@@ -268,8 +289,11 @@ mod tests {
                     repository_id: "repo".to_string(),
                     creation_selector: None,
                     creation_ref: None,
+                    creation_tree: None,
                     current_selector: None,
                     current_ref: Some("987fed".to_string()),
+                    current_tree: None,
+                    observed_at_epoch_seconds: None,
                     materializer_kind: MaterializerKind::LocalGitWorktree,
                     cleanup_target: None,
                     status: WorkingDirectoryStatusKind::Active,
@@ -306,6 +330,7 @@ mod tests {
 
         let detail = WorkingDirectoryDetailResponse {
             workspace_id: decoded.workspace_id.clone(),
+            runtime_id: "arcadia".to_string(),
             item: decoded.items[0].clone(),
             diagnostics: decoded.diagnostics.clone(),
         };

crates/worker-runtime/Cargo.toml

@@ -41,9 +41,12 @@ tar.workspace = true
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["net", "rt", "sync", "time"] }
 toml.workspace = true
+url.workspace = true
 uuid = { workspace = true, features = ["v7"] }
+zeroize.workspace = true
 tower = { workspace = true, features = ["util"], optional = true }
 worker.workspace = true
+workspace-api = { path = "../workspace-api" }
 workdir.workspace = true
 
 [dev-dependencies]

crates/worker-runtime/src/auth.rs

@@ -3,6 +3,7 @@ use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use ring::rand::{SecureRandom, SystemRandom};
 use ring::signature::{ED25519, Ed25519KeyPair, KeyPair, UnparsedPublicKey};
 use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
 use std::fmt;
 use std::time::{SystemTime, UNIX_EPOCH};
 
@@ -14,6 +15,11 @@ pub const WORKER_MUTATION_SOURCE_PROOF_HEADER: &str = "x-yoi-worker-mutation-pro
 const WORKER_MUTATION_SOURCE_PROOF_PREFIX: &str = "yoi-worker-source-v1";
 const WORKER_MUTATION_SOURCE_SIGNING_INPUT_PREFIX: &str = "yoi-worker-source-v1.";
 pub const WORKER_REMOVE_PERMISSION: &str = "workspace:worker-remove";
+pub const RUNTIME_REQUEST_SOURCE_PROOF_HEADER: &str = "x-yoi-runtime-request-proof";
+pub const WORKSPACE_REQUEST_PERMISSION: &str = "workspace:request";
+pub const BACKEND_RESOURCE_FETCH_PERMISSION: &str = "workspace:resource-fetch";
+const RUNTIME_REQUEST_SOURCE_PROOF_PREFIX: &str = "yoi-runtime-request-v1";
+const RUNTIME_REQUEST_SOURCE_SIGNING_INPUT_PREFIX: &str = "yoi-runtime-request-v1.";
 
 #[derive(Debug, thiserror::Error)]
 pub enum RuntimeAuthError {
@@ -33,6 +39,10 @@ pub enum RuntimeAuthError {
     InvalidTokenFormat,
     #[error("malformed capability token claims: {0}")]
     MalformedClaims(#[from] serde_json::Error),
+    #[error("runtime request proof contains an invalid `{0}` claim")]
+    InvalidClaim(&'static str),
+    #[error("runtime request proof does not match the HTTP request")]
+    ClaimMismatch,
     #[error("unknown token issuer `{0}`")]
     UnknownIssuer(String),
     #[error("invalid token signature")]
@@ -224,6 +234,162 @@ pub fn verify_capability_token(
     })
 }
 
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RuntimeRequestSourceClaims {
+    pub iss: String,
+    pub aud: String,
+    pub workspace_id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub worker_id: Option<String>,
+    pub permission: String,
+    pub method: String,
+    pub path: String,
+    pub body_digest: String,
+    pub iat: i64,
+    pub exp: i64,
+    pub jti: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RuntimeRequestSourceSigner {
+    identity_id: String,
+    private_key: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RuntimeRequestSourceExpectation<'a> {
+    pub identity_id: &'a str,
+    pub audience: &'a str,
+    pub workspace_id: &'a str,
+    pub worker_id: Option<&'a str>,
+    pub permission: &'a str,
+    pub method: &'a str,
+    pub path: &'a str,
+    pub body_digest: &'a str,
+    pub now_unix: i64,
+}
+
+pub fn request_body_digest(body: &[u8]) -> String {
+    URL_SAFE_NO_PAD.encode(Sha256::digest(body))
+}
+
+impl RuntimeRequestSourceSigner {
+    pub fn from_identity(identity: &RuntimeIdentityMaterial) -> Self {
+        Self {
+            identity_id: identity.identity_id.clone(),
+            private_key: identity.private_key.clone(),
+        }
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    pub fn issue(
+        &self,
+        audience: &str,
+        workspace_id: &str,
+        worker_id: Option<&str>,
+        permission: &str,
+        method: &str,
+        path: &str,
+        body: &[u8],
+        now_unix: i64,
+        ttl_seconds: u64,
+    ) -> Result<String, RuntimeAuthError> {
+        for (name, value) in [
+            ("audience", audience),
+            ("workspace_id", workspace_id),
+            ("permission", permission),
+            ("method", method),
+            ("path", path),
+        ] {
+            if value.trim().is_empty() {
+                return Err(RuntimeAuthError::InvalidClaim(name));
+            }
+        }
+        if worker_id.is_some_and(str::is_empty) {
+            return Err(RuntimeAuthError::InvalidClaim("worker_id"));
+        }
+        let ttl_seconds = i64::try_from(ttl_seconds).unwrap_or(i64::MAX);
+        let claims = RuntimeRequestSourceClaims {
+            iss: self.identity_id.clone(),
+            aud: audience.to_owned(),
+            workspace_id: workspace_id.to_owned(),
+            worker_id: worker_id.map(str::to_owned),
+            permission: permission.to_owned(),
+            method: method.to_owned(),
+            path: path.to_owned(),
+            body_digest: request_body_digest(body),
+            iat: now_unix,
+            exp: now_unix.saturating_add(ttl_seconds),
+            jti: new_token_id()?,
+        };
+        let payload = serde_json::to_vec(&claims)?;
+        let payload = URL_SAFE_NO_PAD.encode(payload);
+        let signing_input = format!("{RUNTIME_REQUEST_SOURCE_SIGNING_INPUT_PREFIX}{payload}");
+        let private = decode_private_key(&self.private_key)?;
+        let key_pair = Ed25519KeyPair::from_pkcs8(&private)
+            .map_err(|_| RuntimeAuthError::InvalidPrivateKey)?;
+        let signature = URL_SAFE_NO_PAD.encode(key_pair.sign(signing_input.as_bytes()).as_ref());
+        Ok(format!(
+            "{RUNTIME_REQUEST_SOURCE_PROOF_PREFIX}.{payload}.{signature}"
+        ))
+    }
+}
+
+pub fn decode_runtime_request_source_claims(
+    proof: &str,
+) -> Result<RuntimeRequestSourceClaims, RuntimeAuthError> {
+    let (prefix, payload, _signature) = split_runtime_request_source_proof(proof)?;
+    if prefix != RUNTIME_REQUEST_SOURCE_PROOF_PREFIX {
+        return Err(RuntimeAuthError::InvalidTokenFormat);
+    }
+    let payload = URL_SAFE_NO_PAD.decode(payload)?;
+    serde_json::from_slice(&payload).map_err(RuntimeAuthError::from)
+}
+
+pub fn verify_runtime_request_source(
+    proof: &str,
+    public_key: &str,
+    expected: &RuntimeRequestSourceExpectation<'_>,
+) -> Result<RuntimeRequestSourceClaims, RuntimeAuthError> {
+    let (prefix, payload, signature) = split_runtime_request_source_proof(proof)?;
+    if prefix != RUNTIME_REQUEST_SOURCE_PROOF_PREFIX {
+        return Err(RuntimeAuthError::InvalidTokenFormat);
+    }
+    let signature = URL_SAFE_NO_PAD.decode(signature)?;
+    let signing_input = format!("{RUNTIME_REQUEST_SOURCE_SIGNING_INPUT_PREFIX}{payload}");
+    let public_key = decode_public_key(public_key)?;
+    UnparsedPublicKey::new(&ED25519, public_key)
+        .verify(signing_input.as_bytes(), &signature)
+        .map_err(|_| RuntimeAuthError::InvalidSignature)?;
+    let claims = decode_runtime_request_source_claims(proof)?;
+    if claims.iss != expected.identity_id
+        || claims.aud != expected.audience
+        || claims.workspace_id != expected.workspace_id
+        || claims.worker_id.as_deref() != expected.worker_id
+        || claims.permission != expected.permission
+        || claims.method != expected.method
+        || claims.path != expected.path
+        || claims.body_digest != expected.body_digest
+    {
+        return Err(RuntimeAuthError::ClaimMismatch);
+    }
+    if claims.iat > expected.now_unix || claims.exp < expected.now_unix {
+        return Err(RuntimeAuthError::Expired);
+    }
+    Ok(claims)
+}
+
+fn split_runtime_request_source_proof(proof: &str) -> Result<(&str, &str, &str), RuntimeAuthError> {
+    let mut parts = proof.split('.');
+    let prefix = parts.next().unwrap_or_default();
+    let payload = parts.next().unwrap_or_default();
+    let signature = parts.next().unwrap_or_default();
+    if prefix.is_empty() || payload.is_empty() || signature.is_empty() || parts.next().is_some() {
+        return Err(RuntimeAuthError::InvalidTokenFormat);
+    }
+    Ok((prefix, payload, signature))
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct WorkerMutationSourceClaims {
     pub iss: String,
@@ -592,6 +758,99 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn runtime_request_source_proof_binds_request_and_rejects_spoofed_signature() {
+        let trusted = RuntimeIdentityMaterial::generate("runtime-main").unwrap();
+        let signer = RuntimeRequestSourceSigner::from_identity(&trusted);
+        let body = br#"{"ticket":"T-1"}"#;
+        let proof = signer
+            .issue(
+                "server-main",
+                "workspace-a",
+                Some("worker-7"),
+                WORKSPACE_REQUEST_PERMISSION,
+                "POST",
+                "/api/w/workspace-a/tickets/comment",
+                body,
+                90,
+                10,
+            )
+            .unwrap();
+        let expected = RuntimeRequestSourceExpectation {
+            identity_id: "runtime-main",
+            audience: "server-main",
+            workspace_id: "workspace-a",
+            worker_id: Some("worker-7"),
+            permission: WORKSPACE_REQUEST_PERMISSION,
+            method: "POST",
+            path: "/api/w/workspace-a/tickets/comment",
+            body_digest: &request_body_digest(body),
+            now_unix: 99,
+        };
+        let claims = verify_runtime_request_source(&proof, &trusted.public_key, &expected).unwrap();
+        assert_eq!(claims.iss, "runtime-main");
+        let changed_body = RuntimeRequestSourceExpectation {
+            body_digest: &request_body_digest(br#"{"ticket":"T-2"}"#),
+            ..expected.clone()
+        };
+        assert!(matches!(
+            verify_runtime_request_source(&proof, &trusted.public_key, &changed_body),
+            Err(RuntimeAuthError::ClaimMismatch)
+        ));
+        let spoofed = RuntimeIdentityMaterial::generate("runtime-main").unwrap();
+        assert!(matches!(
+            verify_runtime_request_source(&proof, &spoofed.public_key, &expected),
+            Err(RuntimeAuthError::InvalidSignature)
+        ));
+    }
+
+    #[test]
+    fn runtime_request_source_proof_rejects_wrong_scope_and_expiry() {
+        let runtime = RuntimeIdentityMaterial::generate("runtime-main").unwrap();
+        let proof = RuntimeRequestSourceSigner::from_identity(&runtime)
+            .issue(
+                "server-main",
+                "workspace-a",
+                None,
+                BACKEND_RESOURCE_FETCH_PERMISSION,
+                "POST",
+                "/api/runtime/v1/workspaces/workspace-a/resources/fetch",
+                b"{}",
+                90,
+                10,
+            )
+            .unwrap();
+        let digest = request_body_digest(b"{}");
+        let expected = RuntimeRequestSourceExpectation {
+            identity_id: "runtime-main",
+            audience: "server-main",
+            workspace_id: "workspace-a",
+            worker_id: None,
+            permission: BACKEND_RESOURCE_FETCH_PERMISSION,
+            method: "POST",
+            path: "/api/runtime/v1/workspaces/workspace-a/resources/fetch",
+            body_digest: &digest,
+            now_unix: 99,
+        };
+        assert!(verify_runtime_request_source(&proof, &runtime.public_key, &expected).is_ok());
+        let wrong_workspace = RuntimeRequestSourceExpectation {
+            workspace_id: "workspace-b",
+            ..expected.clone()
+        };
+        assert!(matches!(
+            verify_runtime_request_source(&proof, &runtime.public_key, &wrong_workspace),
+            Err(RuntimeAuthError::ClaimMismatch)
+        ));
+        let expired = RuntimeRequestSourceExpectation {
+            now_unix: 101,
+            ..expected
+        };
+        assert!(matches!(
+            verify_runtime_request_source(&proof, &runtime.public_key, &expired),
+            Err(RuntimeAuthError::Expired)
+        ));
+    }
+
     #[test]
     fn capability_token_verifies_signature_audience_expiry_and_permission() {
         let server = RuntimeIdentityMaterial::generate("server-main").unwrap();

crates/worker-runtime/src/catalog.rs

@@ -2,7 +2,6 @@ use crate::identity::{RuntimeWorkerRef, WorkerId, WorkerRef};
 use crate::interaction::WorkerInput;
 use crate::profile_archive::{ProfileSourceArchive, ProfileSourceArchiveRef};
 use serde::{Deserialize, Serialize};
-use std::path::PathBuf;
 
 fn is_false(value: &bool) -> bool {
     !*value
@@ -85,9 +84,9 @@ impl std::ops::Deref for RepositorySelector {
 pub struct WorkingDirectoryRepository {
     pub id: String,
     pub provider: String,
-    pub uri: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub local_path: Option<PathBuf>,
+    pub source: workspace_api::RepositorySource,
+    pub source_revision: u64,
+    pub source_fingerprint: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub selector: Option<RepositorySelector>,
 }
@@ -98,6 +97,74 @@ pub use workdir::workspace::{
     WorkingDirectorySummary,
 };
 
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SensitiveString(String);
+
+impl SensitiveString {
+    pub fn new(value: impl Into<String>) -> Self {
+        Self(value.into())
+    }
+
+    pub fn expose(&self) -> &str {
+        &self.0
+    }
+}
+
+impl Drop for SensitiveString {
+    fn drop(&mut self) {
+        zeroize::Zeroize::zeroize(&mut self.0);
+    }
+}
+
+impl Default for SensitiveString {
+    fn default() -> Self {
+        Self(String::new())
+    }
+}
+
+impl std::fmt::Debug for SensitiveString {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("[REDACTED]")
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RepositorySshMaterializationAccess {
+    pub credential_id: String,
+    pub credential_revision: u64,
+    pub host_trust_id: String,
+    pub host_trust_revision: u64,
+    pub access: workspace_api::RepositoryAccessMode,
+    pub expires_at_epoch_seconds: u64,
+    pub repository_id: String,
+    pub repository_source_fingerprint: String,
+    pub repository_uri: String,
+    pub secret_resource: crate::resource::BackendResourceHandle,
+    #[serde(skip, default)]
+    pub private_key: SensitiveString,
+    #[serde(skip, default)]
+    pub known_hosts_entry: SensitiveString,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RepositoryMaterializationContext {
+    pub workspace_id: String,
+    pub runtime_id: String,
+    pub operation_id: String,
+    pub config_revision: u64,
+    pub config_projection_digest: String,
+    #[serde(default)]
+    pub cache_generation: u64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ssh: Option<RepositorySshMaterializationAccess>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct WorkingDirectoryRepositoryAccessRequest {
+    pub working_directory_id: String,
+    pub materialization: RepositoryMaterializationContext,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct WorkingDirectoryRequest {
     pub repository: WorkingDirectoryRepository,
@@ -107,6 +174,9 @@ pub struct WorkingDirectoryRequest {
     /// Backend can create canonical registry rows before materialization.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub backend_workdir_id: Option<String>,
+    /// Backend-authored, operation-scoped repository access and cache identity.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub materialization: Option<RepositoryMaterializationContext>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]

crates/worker-runtime/src/execution.rs

@@ -1,4 +1,6 @@
-use crate::catalog::{WorkingDirectoryRequest, WorkingDirectoryStatus};
+use crate::catalog::{
+    WorkingDirectoryRepositoryAccessRequest, WorkingDirectoryRequest, WorkingDirectoryStatus,
+};
 use crate::config_bundle::ConfigBundle;
 use crate::error::RuntimeError;
 use crate::identity::WorkerRef;
@@ -319,6 +321,16 @@ pub trait WorkerExecutionBackend: Send + Sync + 'static {
         ))
     }
 
+    fn authorize_working_directory_repository_access(
+        &self,
+        _request: &WorkingDirectoryRepositoryAccessRequest,
+    ) -> Result<(), WorkingDirectoryDiagnostic> {
+        Err(WorkingDirectoryDiagnostic::rejected(
+            "working_directory_repository_access_unsupported",
+            "Worker execution backend does not support Repository access authorization",
+        ))
+    }
+
     fn list_working_directories(&self) -> Vec<WorkingDirectoryStatus> {
         Vec::new()
     }
@@ -454,6 +466,14 @@ impl WorkerExecutionBackendRef {
         self.backend.create_working_directory(request)
     }
 
+    pub(crate) fn authorize_working_directory_repository_access(
+        &self,
+        request: &WorkingDirectoryRepositoryAccessRequest,
+    ) -> Result<(), WorkingDirectoryDiagnostic> {
+        self.backend
+            .authorize_working_directory_repository_access(request)
+    }
+
     pub(crate) fn list_working_directories(&self) -> Vec<WorkingDirectoryStatus> {
         self.backend.list_working_directories()
     }

crates/worker-runtime/src/http_server.rs

@@ -12,7 +12,8 @@ use crate::auth::{
 };
 use crate::catalog::{
     ConfigBundleRef, CreateWorkerRequest, WorkerDetail, WorkerLifecycleAck, WorkerSummary,
-    WorkingDirectoryRequest, WorkingDirectoryStatus, WorkspaceApiRef,
+    WorkingDirectoryRepositoryAccessRequest, WorkingDirectoryRequest, WorkingDirectoryStatus,
+    WorkspaceApiRef,
 };
 use crate::config_bundle::{ConfigBundle, ConfigBundleAvailability, ConfigBundleSummary};
 use crate::error::RuntimeError;
@@ -203,6 +204,10 @@ fn runtime_http_router_with_optional_auth(
             "/v1/working-directories",
             get(list_working_directories).post(create_working_directory),
         )
+        .route(
+            "/v1/working-directories/repository-access",
+            post(authorize_working_directory_repository_access),
+        )
         .route(
             "/v1/working-directories/{working_directory_id}/sessions",
             post(open_workdir_session),
@@ -335,6 +340,11 @@ pub struct RuntimeHttpWorkingDirectoriesResponse {
     pub working_directories: Vec<WorkingDirectoryStatus>,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RuntimeHttpRepositoryAccessResponse {
+    pub authorized: bool,
+}
+
 /// Working directory response used by create/detail/delete endpoints.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct RuntimeHttpWorkingDirectoryResponse {
@@ -513,6 +523,29 @@ async fn list_workers(
     Ok(Json(RuntimeHttpWorkersResponse { workers }))
 }
 
+async fn authorize_working_directory_repository_access(
+    State(state): State<RuntimeHttpState>,
+    Extension(auth): Extension<RuntimeAuthContext>,
+    body: Result<Json<WorkingDirectoryRepositoryAccessRequest>, JsonRejection>,
+) -> RestResult<RuntimeHttpRepositoryAccessResponse> {
+    let Json(request) = body.map_err(RuntimeHttpRestError::json_rejection)?;
+    if request.materialization.workspace_id != auth.workspace_id {
+        return Err(RuntimeHttpRestError::new(
+            StatusCode::FORBIDDEN,
+            "working_directory_materialization_workspace_mismatch",
+            "Repository access authority does not match the authenticated Workspace",
+        ));
+    }
+    state
+        .runtime
+        .authorize_working_directory_repository_access_from_resource(request)
+        .await
+        .map_err(RuntimeHttpRestError::runtime)?;
+    Ok(Json(RuntimeHttpRepositoryAccessResponse {
+        authorized: true,
+    }))
+}
+
 async fn list_working_directories(
     State(state): State<RuntimeHttpState>,
 ) -> RestResult<RuntimeHttpWorkingDirectoriesResponse> {
@@ -527,12 +560,23 @@ async fn list_working_directories(
 
 async fn create_working_directory(
     State(state): State<RuntimeHttpState>,
+    Extension(auth): Extension<RuntimeAuthContext>,
     body: Result<Json<WorkingDirectoryRequest>, JsonRejection>,
 ) -> RestResult<RuntimeHttpWorkingDirectoryResponse> {
     let Json(request) = body.map_err(RuntimeHttpRestError::json_rejection)?;
+    if let Some(materialization) = request.materialization.as_ref()
+        && materialization.workspace_id != auth.workspace_id
+    {
+        return Err(RuntimeHttpRestError::new(
+            StatusCode::FORBIDDEN,
+            "working_directory_materialization_workspace_mismatch",
+            "Repository materialization authority does not match the authenticated Workspace",
+        ));
+    }
     let working_directory = state
         .runtime
-        .create_working_directory(request)
+        .create_working_directory_from_resource(request)
+        .await
         .map_err(RuntimeHttpRestError::runtime)?;
     Ok(Json(RuntimeHttpWorkingDirectoryResponse {
         working_directory,
@@ -1559,6 +1603,9 @@ fn required_runtime_permission(method: &Method, path: &str) -> Option<&'static s
     if path == "/v1/workers" && *method == Method::POST {
         return Some("workers:create");
     }
+    if path == "/v1/working-directories/repository-access" && *method == Method::POST {
+        return Some("workdirs:operate");
+    }
     if path.starts_with("/v1/workdir-sessions")
         || (path.starts_with("/v1/working-directories/") && path.ends_with("/sessions"))
     {
@@ -2220,6 +2267,10 @@ mod tests {
 
     #[test]
     fn workdir_routes_require_dedicated_operation_permission() {
+        assert_eq!(
+            required_runtime_permission(&Method::POST, "/v1/working-directories/repository-access",),
+            Some("workdirs:operate")
+        );
         assert_eq!(
             required_runtime_permission(&Method::POST, "/v1/working-directories/wd-1/sessions"),
             Some("workdirs:operate")

crates/worker-runtime/src/main.rs

@@ -23,10 +23,21 @@ use worker_runtime::http_server::{
     RuntimeHttpServerConfig, RuntimeHttpServerError, RuntimeHttpStoreSelection,
 };
 use worker_runtime::worker_backend::{ProfileRuntimeWorkerFactory, WorkerRuntimeExecutionBackend};
-use worker_runtime::working_directory::LocalGitWorktreeMaterializer;
+use worker_runtime::working_directory::RuntimeGitCacheMaterializer;
 use worker_runtime::{Runtime, RuntimeOptions};
 
 fn main() -> ExitCode {
+    let mut arguments = std::env::args().skip(1).collect::<Vec<_>>();
+    if arguments.first().map(String::as_str) == Some("__repository-ssh") {
+        arguments.remove(0);
+        return match worker_runtime::working_directory::run_repository_ssh_client(&arguments) {
+            Ok(status) => ExitCode::from(u8::try_from(status).unwrap_or(1)),
+            Err(error) => {
+                eprintln!("{error}");
+                ExitCode::from(1)
+            }
+        };
+    }
     match run() {
         Ok(()) => ExitCode::SUCCESS,
         Err(error) => {
@@ -160,29 +171,52 @@ fn build_runtime(config: &ProcessConfig) -> Result<Runtime, ProcessError> {
     };
     let mut factory = ProfileRuntimeWorkerFactory::new(fs_paths.worker_dir.join("worker-root"))
         .with_runtime_store_dir(runtime_store_dir);
-    if let Some(identity) = read_runtime_auth_file(&runtime_auth_path(config))?.identity {
-        factory = factory.with_remote_worker_mutation_identity(identity);
+    let runtime_auth = read_runtime_auth_file(&runtime_auth_path(config))?;
+    if let Some(identity) = runtime_auth.identity.clone() {
+        if let [trusted_server] = runtime_auth.trusted_servers.as_slice() {
+            factory =
+                factory.with_runtime_request_identity(identity, trusted_server.server_id.clone());
+        } else {
+            factory = factory.with_remote_worker_mutation_identity(identity);
+        }
     }
+    let mut backend_resource_client: Option<
+        Arc<dyn worker_runtime::resource::BackendResourceClient>,
+    > = None;
     if let Some(endpoint) = config.backend_resource_endpoint.clone() {
-        factory = factory.with_resource_client(Arc::new(
+        let identity = runtime_auth.identity.as_ref().ok_or_else(|| {
+            ProcessError::Auth(
+                "--backend-resource-endpoint requires a configured Runtime identity".to_owned(),
+            )
+        })?;
+        let [trusted_server] = runtime_auth.trusted_servers.as_slice() else {
+            return Err(ProcessError::Auth(
+                "--backend-resource-endpoint requires exactly one trusted Server identity"
+                    .to_owned(),
+            ));
+        };
+        let client = Arc::new(
             worker_runtime::resource::HttpBackendResourceClient::new(
                 endpoint,
                 config.backend_resource_token.clone(),
-            ),
-        ));
+            )
+            .with_runtime_request_source(identity, trusted_server.server_id.clone()),
+        );
+        factory = factory.with_resource_client(client.clone());
+        backend_resource_client = Some(client);
     }
     let backend = Arc::new(
         WorkerRuntimeExecutionBackend::new(factory)
             .map_err(ProcessError::WorkerAdapter)?
-            .with_working_directory_materializer(LocalGitWorktreeMaterializer::new(
+            .with_working_directory_materializer(RuntimeGitCacheMaterializer::new(
                 fs_paths.workdir_target.clone(),
             )),
     );
 
-    match &config.http.store {
+    let runtime = match &config.http.store {
         RuntimeHttpStoreSelection::Memory => {
             Runtime::with_execution_backend(runtime_options_from_http(&config.http), backend)
-                .map_err(ProcessError::Runtime)
+                .map_err(ProcessError::Runtime)?
         }
         RuntimeHttpStoreSelection::Fs { root } => {
             let mut options = FsRuntimeStoreOptions::new(root.clone()).with_runtime_id(
@@ -195,12 +229,20 @@ fn build_runtime(config: &ProcessConfig) -> Result<Runtime, ProcessError> {
             );
             options.display_name = config.http.display_name.clone();
             Runtime::with_fs_store_and_execution_backend(options, backend)
-                .map_err(ProcessError::Runtime)
+                .map_err(ProcessError::Runtime)?
         }
-        _ => Err(ProcessError::usage(
-            "unsupported Runtime catalog store selection".to_string(),
-        )),
+        _ => {
+            return Err(ProcessError::usage(
+                "unsupported Runtime catalog store selection".to_string(),
+            ));
+        }
+    };
+    if let Some(client) = backend_resource_client {
+        runtime
+            .install_backend_resource_client(client)
+            .map_err(ProcessError::Runtime)?;
     }
+    Ok(runtime)
 }
 
 fn runtime_options_from_http(config: &RuntimeHttpServerConfig) -> RuntimeOptions {

crates/worker-runtime/src/resource.rs

@@ -1,3 +1,7 @@
+use crate::auth::{
+    BACKEND_RESOURCE_FETCH_PERMISSION, RUNTIME_REQUEST_SOURCE_PROOF_HEADER,
+    RuntimeIdentityMaterial, RuntimeRequestSourceSigner, unix_now_seconds,
+};
 use crate::identity::WorkerId;
 use crate::profile_archive::{ProfileSourceArchive, ProfileSourceArchiveRef, sha256_hex};
 use async_trait::async_trait;
@@ -7,18 +11,46 @@ use std::sync::Mutex;
 
 pub const PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE: &str =
     "application/vnd.yoi.profile-source-archive+tar";
+pub const REPOSITORY_SSH_ACCESS_CONTENT_TYPE: &str =
+    "application/vnd.yoi.repository-ssh-access+json";
 pub const DEFAULT_PROFILE_SOURCE_ARCHIVE_MAX_BYTES: u64 = 2 * 1024 * 1024;
+pub const DEFAULT_REPOSITORY_SSH_ACCESS_MAX_BYTES: u64 = 64 * 1024;
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct RepositorySshAccessSecret {
+    pub private_key: String,
+    pub known_hosts_entry: String,
+}
+
+impl Drop for RepositorySshAccessSecret {
+    fn drop(&mut self) {
+        zeroize::Zeroize::zeroize(&mut self.private_key);
+        zeroize::Zeroize::zeroize(&mut self.known_hosts_entry);
+    }
+}
+
+impl std::fmt::Debug for RepositorySshAccessSecret {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RepositorySshAccessSecret")
+            .field("private_key", &"[REDACTED]")
+            .field("known_hosts_entry", &"[REDACTED]")
+            .finish()
+    }
+}
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum BackendResourceKind {
     ProfileSourceArchive,
+    RepositorySshAccess,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum BackendResourceOperation {
     FetchArchive,
+    FetchOnce,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -62,7 +94,7 @@ pub struct BackendResourceFetchRequest {
     pub audit_correlation_id: String,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct BackendResourceFetchResponse {
     pub kind: BackendResourceKind,
     pub resource_id: String,
@@ -72,6 +104,29 @@ pub struct BackendResourceFetchResponse {
     pub audit_correlation_id: String,
 }
 
+impl std::fmt::Debug for BackendResourceFetchResponse {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("BackendResourceFetchResponse")
+            .field("kind", &self.kind)
+            .field("resource_id", &self.resource_id)
+            .field("digest", &self.digest)
+            .field("content_type", &self.content_type)
+            .field(
+                "bytes",
+                &format_args!("[REDACTED; {} bytes]", self.bytes.len()),
+            )
+            .field("audit_correlation_id", &self.audit_correlation_id)
+            .finish()
+    }
+}
+
+impl Drop for BackendResourceFetchResponse {
+    fn drop(&mut self) {
+        self.bytes.fill(0);
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, thiserror::Error)]
 #[serde(tag = "code", rename_all = "snake_case")]
 pub enum BackendResourceError {
@@ -108,6 +163,8 @@ pub trait BackendResourceClient: Send + Sync + 'static {
 pub struct HttpBackendResourceClient {
     endpoint: String,
     bearer_token: Option<String>,
+    request_source_signer: Option<RuntimeRequestSourceSigner>,
+    request_source_audience: Option<String>,
     client: reqwest::Client,
 }
 
@@ -117,9 +174,21 @@ impl HttpBackendResourceClient {
         Self {
             endpoint: endpoint.into(),
             bearer_token,
+            request_source_signer: None,
+            request_source_audience: None,
             client: reqwest::Client::new(),
         }
     }
+
+    pub fn with_runtime_request_source(
+        mut self,
+        identity: &RuntimeIdentityMaterial,
+        audience: impl Into<String>,
+    ) -> Self {
+        self.request_source_signer = Some(RuntimeRequestSourceSigner::from_identity(identity));
+        self.request_source_audience = Some(audience.into());
+        self
+    }
 }
 
 #[cfg(feature = "http-server")]
@@ -129,7 +198,44 @@ impl BackendResourceClient for HttpBackendResourceClient {
         &self,
         request: BackendResourceFetchRequest,
     ) -> Result<BackendResourceFetchResponse, BackendResourceError> {
-        let builder = self.client.post(&self.endpoint).json(&request);
+        let body = serde_json::to_vec(&request).map_err(|error| {
+            BackendResourceError::InvalidResponse {
+                message: error.to_string(),
+            }
+        })?;
+        let endpoint = reqwest::Url::parse(&self.endpoint).map_err(|error| {
+            BackendResourceError::Transport {
+                message: error.to_string(),
+            }
+        })?;
+        let mut builder = self
+            .client
+            .post(endpoint.clone())
+            .header(reqwest::header::CONTENT_TYPE, "application/json")
+            .body(body.clone());
+        if let Some(signer) = self.request_source_signer.as_ref() {
+            let audience = self.request_source_audience.as_deref().ok_or_else(|| {
+                BackendResourceError::Unauthorized {
+                    message: "Runtime request proof audience is unavailable".to_owned(),
+                }
+            })?;
+            let proof = signer
+                .issue(
+                    audience,
+                    &request.handle.workspace_id,
+                    None,
+                    BACKEND_RESOURCE_FETCH_PERMISSION,
+                    "POST",
+                    endpoint.path(),
+                    &body,
+                    i64::try_from(unix_now_seconds()).unwrap_or(i64::MAX),
+                    30,
+                )
+                .map_err(|error| BackendResourceError::Unauthorized {
+                    message: error.to_string(),
+                })?;
+            builder = builder.header(RUNTIME_REQUEST_SOURCE_PROOF_HEADER, proof);
+        }
         let builder = if let Some(token) = self.bearer_token.as_deref() {
             builder.bearer_auth(token)
         } else {
@@ -193,7 +299,7 @@ pub fn build_profile_source_archive_fetch_request(
 
 pub fn profile_source_archive_from_response(
     handle: &BackendResourceHandle,
-    response: BackendResourceFetchResponse,
+    mut response: BackendResourceFetchResponse,
 ) -> Result<ProfileSourceArchive, BackendResourceError> {
     if handle.kind != BackendResourceKind::ProfileSourceArchive
         || response.kind != BackendResourceKind::ProfileSourceArchive
@@ -208,7 +314,7 @@ pub fn profile_source_archive_from_response(
     if response.content_type != handle.content_type {
         return Err(BackendResourceError::ContentTypeMismatch {
             expected: handle.content_type.clone(),
-            actual: response.content_type,
+            actual: response.content_type.clone(),
         });
     }
     let actual_bytes = response.bytes.len() as u64;
@@ -223,7 +329,7 @@ pub fn profile_source_archive_from_response(
         return Err(BackendResourceError::DigestMismatch {
             expected: handle.digest.clone(),
             actual: if response.digest != handle.digest {
-                response.digest
+                response.digest.clone()
             } else {
                 actual_digest
             },
@@ -241,7 +347,7 @@ pub fn profile_source_archive_from_response(
                 }
             })?,
         },
-        content: response.bytes,
+        content: std::mem::take(&mut response.bytes),
     })
 }
 

crates/worker-runtime/src/runtime.rs

@@ -1,6 +1,6 @@
 use crate::catalog::{
     ConfigBundleRef, CreateWorkerRequest, ProfileSelector, WorkerDetail, WorkerLifecycleAck,
-    WorkerStatus, WorkerSummary, WorkingDirectoryRequest,
+    WorkerStatus, WorkerSummary, WorkingDirectoryRepositoryAccessRequest, WorkingDirectoryRequest,
     WorkingDirectoryStatus as CatalogWorkingDirectoryStatus, WorkspaceApiRef,
 };
 use crate::config_bundle::{
@@ -26,6 +26,10 @@ use crate::management::{
 };
 #[cfg(feature = "ws-server")]
 use crate::observation::{WorkerObservationCursor, WorkerObservationEvent};
+use crate::resource::{
+    BackendResourceClient, BackendResourceError, BackendResourceFetchRequest, BackendResourceKind,
+    REPOSITORY_SSH_ACCESS_CONTENT_TYPE, RepositorySshAccessSecret,
+};
 #[cfg(feature = "fs-store")]
 use crate::retention::{
     FsWorkerRetentionProvider, WorkerRetentionExecutionRequest, WorkerRetentionExecutionResult,
@@ -172,6 +176,14 @@ impl Runtime {
         Ok(runtime)
     }
 
+    pub fn install_backend_resource_client(
+        &self,
+        client: Arc<dyn BackendResourceClient>,
+    ) -> Result<(), RuntimeError> {
+        self.lock()?.backend_resource_client = Some(BackendResourceClientRef(client));
+        Ok(())
+    }
+
     /// Create or restore a filesystem-backed Runtime.
     ///
     /// The store is scoped by `options.root`; if the directory already exists,
@@ -366,6 +378,103 @@ impl Runtime {
             .map_err(RuntimeError::from)
     }
 
+    pub async fn create_working_directory_from_resource(
+        &self,
+        mut request: WorkingDirectoryRequest,
+    ) -> Result<CatalogWorkingDirectoryStatus, RuntimeError> {
+        if let Some(ssh) = request
+            .materialization
+            .as_mut()
+            .and_then(|materialization| materialization.ssh.as_mut())
+        {
+            self.resolve_repository_access_resource(ssh).await?;
+        }
+        self.create_working_directory(request)
+    }
+
+    pub fn authorize_working_directory_repository_access(
+        &self,
+        request: WorkingDirectoryRepositoryAccessRequest,
+    ) -> Result<(), RuntimeError> {
+        let backend = {
+            let state = self.lock()?;
+            state.ensure_running()?;
+            state.execution_backend.clone().ok_or_else(|| {
+                RuntimeError::ExecutionBackendUnavailable {
+                    message: "working directory Repository access requires an execution backend"
+                        .to_string(),
+                }
+            })?
+        };
+        backend
+            .authorize_working_directory_repository_access(&request)
+            .map_err(RuntimeError::from)
+    }
+
+    async fn resolve_repository_access_resource(
+        &self,
+        ssh: &mut crate::catalog::RepositorySshMaterializationAccess,
+    ) -> Result<(), RuntimeError> {
+        if !ssh.private_key.expose().is_empty() && !ssh.known_hosts_entry.expose().is_empty() {
+            return Ok(());
+        }
+        let (client, runtime_id) = {
+            let state = self.lock()?;
+            let client = state.backend_resource_client.clone().ok_or_else(|| {
+                RuntimeError::InvalidRequest(
+                    "Backend Repository access resource client is unavailable".to_string(),
+                )
+            })?;
+            let runtime_id = state.runtime_identity.clone().ok_or_else(|| {
+                RuntimeError::InvalidRequest("Runtime identity is unavailable".to_string())
+            })?;
+            (client, runtime_id)
+        };
+        let mut response = client
+            .0
+            .fetch_resource(BackendResourceFetchRequest {
+                handle: ssh.secret_resource.clone(),
+                runtime_id,
+                worker_id: None,
+                audit_correlation_id: ssh.secret_resource.audit_correlation_id.clone(),
+            })
+            .await
+            .map_err(repository_resource_error)?;
+        if response.kind != BackendResourceKind::RepositorySshAccess
+            || response.content_type != REPOSITORY_SSH_ACCESS_CONTENT_TYPE
+            || response.resource_id != ssh.secret_resource.resource_id
+            || response.digest != ssh.secret_resource.digest
+            || response.bytes.len() as u64 > ssh.secret_resource.max_bytes
+        {
+            return Err(RuntimeError::InvalidRequest(
+                "Backend Repository SSH access resource response was invalid".to_string(),
+            ));
+        }
+        let secret = serde_json::from_slice::<RepositorySshAccessSecret>(&response.bytes);
+        response.bytes.fill(0);
+        let mut secret = secret.map_err(|_| {
+            RuntimeError::InvalidRequest(
+                "Backend Repository SSH access resource payload was invalid".to_string(),
+            )
+        })?;
+        ssh.private_key =
+            crate::catalog::SensitiveString::new(std::mem::take(&mut secret.private_key));
+        ssh.known_hosts_entry =
+            crate::catalog::SensitiveString::new(std::mem::take(&mut secret.known_hosts_entry));
+        Ok(())
+    }
+
+    pub async fn authorize_working_directory_repository_access_from_resource(
+        &self,
+        mut request: WorkingDirectoryRepositoryAccessRequest,
+    ) -> Result<(), RuntimeError> {
+        let ssh = request.materialization.ssh.as_mut().ok_or_else(|| {
+            RuntimeError::InvalidRequest("Repository SSH access metadata is missing".to_string())
+        })?;
+        self.resolve_repository_access_resource(ssh).await?;
+        self.authorize_working_directory_repository_access(request)
+    }
+
     /// List Runtime-owned working directories through the attached execution backend.
     pub fn list_working_directories(
         &self,
@@ -566,12 +675,13 @@ impl Runtime {
             let worker_id = request.worker_id;
             let worker_ref = WorkerRef::new(worker_id);
 
+            let durable_request = durable_create_worker_request(&request);
             let record = WorkerRecord {
                 worker_ref: worker_ref.clone(),
                 worker_id: worker_id.clone(),
                 status: WorkerStatus::Stopped,
                 workspace_id: scope.map(|scope| scope.workspace_id.clone()),
-                request: request.clone(),
+                request: durable_request,
                 run_generation: 1,
                 working_directory: None,
                 execution_handle: None,
@@ -1842,6 +1952,15 @@ struct SubscriptionSink {
     lagged: Arc<AtomicBool>,
 }
 
+#[derive(Clone)]
+struct BackendResourceClientRef(Arc<dyn BackendResourceClient>);
+
+impl std::fmt::Debug for BackendResourceClientRef {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("BackendResourceClientRef(..)")
+    }
+}
+
 #[derive(Debug)]
 struct RuntimeState {
     display_name: Option<String>,
@@ -1853,6 +1972,7 @@ struct RuntimeState {
     persistence: RuntimePersistence,
     status: RuntimeStatus,
     execution_backend: Option<WorkerExecutionBackendRef>,
+    backend_resource_client: Option<BackendResourceClientRef>,
     #[cfg(feature = "fs-store")]
     next_diagnostic_id: u64,
     workers: BTreeMap<WorkerId, WorkerRecord>,
@@ -1880,6 +2000,7 @@ impl RuntimeState {
             persistence: RuntimePersistence::Memory,
             status: RuntimeStatus::Running,
             execution_backend: None,
+            backend_resource_client: None,
             #[cfg(feature = "fs-store")]
             next_diagnostic_id: 1,
             workers: BTreeMap::new(),
@@ -1908,6 +2029,7 @@ impl RuntimeState {
             persistence: RuntimePersistence::Fs(store),
             status: RuntimeStatus::Running,
             execution_backend: None,
+            backend_resource_client: None,
             #[cfg(feature = "fs-store")]
             next_diagnostic_id: 1,
             workers: BTreeMap::new(),
@@ -1959,6 +2081,7 @@ impl RuntimeState {
             persistence: RuntimePersistence::Fs(store),
             status: persisted.status,
             execution_backend: None,
+            backend_resource_client: None,
             next_diagnostic_id,
             workers,
             config_bundles: BTreeMap::new(),
@@ -2619,6 +2742,7 @@ impl RuntimeState {
                 protocol::WorkerStatus::Running => Some(WorkerStatus::Running),
                 protocol::WorkerStatus::Idle => Some(WorkerStatus::Idle),
                 protocol::WorkerStatus::Paused => Some(WorkerStatus::Paused),
+                protocol::WorkerStatus::Stopped => Some(WorkerStatus::Stopped),
             },
             protocol::Event::RunEnd { result } => match result {
                 protocol::RunResult::Finished | protocol::RunResult::RolledBack => {
@@ -2714,6 +2838,33 @@ fn worker_status_from_run_state(run_state: WorkerExecutionRunState) -> WorkerSta
     }
 }
 
+fn repository_resource_error(error: BackendResourceError) -> RuntimeError {
+    let category = match error {
+        BackendResourceError::Expired => "expired",
+        BackendResourceError::Unauthorized { .. } => "unauthorized",
+        BackendResourceError::UnsupportedKind => "unsupported_kind",
+        BackendResourceError::MissingResource => "missing_resource",
+        BackendResourceError::Oversized { .. } => "oversized",
+        BackendResourceError::DigestMismatch { .. } => "digest_mismatch",
+        BackendResourceError::ContentTypeMismatch { .. } => "content_type_mismatch",
+        BackendResourceError::InvalidResponse { .. } => "invalid_response",
+        BackendResourceError::Transport { .. } => "transport",
+    };
+    RuntimeError::InvalidRequest(format!(
+        "Backend Repository SSH access resource fetch failed: {category}"
+    ))
+}
+
+fn durable_create_worker_request(request: &CreateWorkerRequest) -> CreateWorkerRequest {
+    let mut durable = request.clone();
+    if let Some(working_directory) = durable.working_directory_request.as_mut()
+        && let Some(materialization) = working_directory.materialization.as_mut()
+    {
+        materialization.ssh = None;
+    }
+    durable
+}
+
 fn requested_primary_workdir_id(request: &CreateWorkerRequest) -> Option<&str> {
     request
         .working_directory
@@ -2884,7 +3035,9 @@ fn subscription_worker_state(status: WorkerStatus) -> SubscriptionWorkerState {
 mod tests {
     use super::*;
     use crate::catalog::{
-        ConfigBundleRef, ProfileSelector, WorkingDirectoryClaim, WorkspaceApiRef,
+        ConfigBundleRef, MaterializerKind, ProfileSelector, RepositoryMaterializationContext,
+        RepositorySshMaterializationAccess, SensitiveString, WorkingDirectoryClaim,
+        WorkingDirectoryRepository, WorkingDirectoryRequest, WorkspaceApiRef,
     };
     use crate::config_bundle::{
         ConfigBundle, ConfigBundleMetadata, ConfigBundleProvenance, ConfigDeclaration,
@@ -2894,6 +3047,8 @@ mod tests {
         WorkerExecutionBackend, WorkerExecutionContext, WorkerExecutionHandle,
         WorkerExecutionRestoreRequest, WorkerExecutionRunState,
     };
+    use crate::working_directory::WorkingDirectoryDiagnostic;
+    use async_trait::async_trait;
     use std::collections::BTreeMap;
     #[cfg(feature = "fs-store")]
     use std::sync::atomic::{AtomicU64, Ordering};
@@ -2950,7 +3105,7 @@ mod tests {
             &mut activity,
             &internal_worker_status_event(
                 internal_worker_ref("child-b", None),
-                protocol::WorkerStatus::Idle,
+                protocol::WorkerStatus::Stopped,
             ),
         ));
     }
@@ -3115,6 +3270,243 @@ mod tests {
         }
     }
 
+    #[test]
+    fn durable_worker_request_omits_repository_credentials() {
+        let mut request = task_request("worker-secret-redaction");
+        request.working_directory_request = Some(WorkingDirectoryRequest {
+            repository: WorkingDirectoryRepository {
+                id: "repository-1".to_string(),
+                provider: "git".to_string(),
+                source: workspace_api::RepositorySource {
+                    kind: workspace_api::RepositorySourceKind::Ssh,
+                    uri: "ssh://git@example.test/repo.git".to_string(),
+                },
+                source_revision: 1,
+                source_fingerprint: "sha256:source".to_string(),
+                selector: None,
+            },
+            materializer: MaterializerKind::RuntimeGitCache,
+            backend_workdir_id: Some("working-directory-1".to_string()),
+            materialization: Some(RepositoryMaterializationContext {
+                workspace_id: "workspace-1".to_string(),
+                runtime_id: "runtime-1".to_string(),
+                operation_id: "operation-1".to_string(),
+                config_revision: 1,
+                config_projection_digest: "sha256:projection".to_string(),
+                cache_generation: 0,
+                ssh: Some(RepositorySshMaterializationAccess {
+                    credential_id: "credential-1".to_string(),
+                    credential_revision: 1,
+                    host_trust_id: "host-trust-1".to_string(),
+                    host_trust_revision: 1,
+                    access: workspace_api::RepositoryAccessMode::ReadOnly,
+                    expires_at_epoch_seconds: u64::MAX,
+                    repository_id: "repository-1".to_string(),
+                    repository_source_fingerprint: "sha256:source".to_string(),
+                    repository_uri: "ssh://git@example.test/repo.git".to_string(),
+                    secret_resource: repository_resource_handle(),
+                    private_key: SensitiveString::new("private-key-bytes"),
+                    known_hosts_entry: SensitiveString::new("known-hosts-entry"),
+                }),
+            }),
+        });
+
+        let durable = durable_create_worker_request(&request);
+
+        assert!(
+            request
+                .working_directory_request
+                .as_ref()
+                .and_then(|working_directory| working_directory.materialization.as_ref())
+                .and_then(|materialization| materialization.ssh.as_ref())
+                .is_some()
+        );
+        assert!(
+            durable
+                .working_directory_request
+                .as_ref()
+                .and_then(|working_directory| working_directory.materialization.as_ref())
+                .and_then(|materialization| materialization.ssh.as_ref())
+                .is_none()
+        );
+        let serialized = serde_json::to_string(&durable).unwrap();
+        assert!(!serialized.contains("private-key-bytes"));
+        assert!(!serialized.contains("known-hosts-entry"));
+    }
+
+    fn repository_resource_handle() -> crate::resource::BackendResourceHandle {
+        crate::resource::BackendResourceHandle {
+            kind: crate::resource::BackendResourceKind::RepositorySshAccess,
+            workspace_id: "workspace-1".to_string(),
+            scope_id: Some("repository-ssh-access".to_string()),
+            runtime_id: Some("runtime-1".to_string()),
+            worker_id: None,
+            resource_id: "repository-access-1".to_string(),
+            digest: "opaque:repository-access-1".to_string(),
+            operation: crate::resource::BackendResourceOperation::FetchOnce,
+            expires_at_unix_seconds: i64::MAX,
+            nonce: "repository-access-1".to_string(),
+            revision: "1".to_string(),
+            generation: None,
+            max_bytes: crate::resource::DEFAULT_REPOSITORY_SSH_ACCESS_MAX_BYTES,
+            content_type: crate::resource::REPOSITORY_SSH_ACCESS_CONTENT_TYPE.to_string(),
+            redaction: crate::resource::ResourceRedactionPolicy::RuntimeInternalOnly,
+            audit_correlation_id: "repository-access-1".to_string(),
+            profile_source_graph: None,
+        }
+    }
+
+    #[tokio::test]
+    async fn repository_access_resource_is_fetched_before_provider_authorization() {
+        let (runtime, backend) = runtime_and_backend();
+        backend
+            .repository_access_available
+            .store(true, Ordering::SeqCst);
+        runtime.bind_runtime_identity("runtime-1").unwrap();
+        let handle = repository_resource_handle();
+        runtime
+            .install_backend_resource_client(Arc::new(TestRepositoryResourceClient {
+                response: Mutex::new(Some(crate::resource::BackendResourceFetchResponse {
+                    kind: crate::resource::BackendResourceKind::RepositorySshAccess,
+                    resource_id: handle.resource_id.clone(),
+                    digest: handle.digest.clone(),
+                    content_type: crate::resource::REPOSITORY_SSH_ACCESS_CONTENT_TYPE.to_string(),
+                    bytes: serde_json::to_vec(&RepositorySshAccessSecret {
+                        private_key: "private-key-bytes".to_string(),
+                        known_hosts_entry: "known-hosts-entry".to_string(),
+                    })
+                    .unwrap(),
+                    audit_correlation_id: handle.audit_correlation_id.clone(),
+                })),
+            }))
+            .unwrap();
+        let request = WorkingDirectoryRepositoryAccessRequest {
+            working_directory_id: "working-directory-1".to_string(),
+            materialization: RepositoryMaterializationContext {
+                workspace_id: "workspace-1".to_string(),
+                runtime_id: "runtime-1".to_string(),
+                operation_id: "operation-1".to_string(),
+                config_revision: 1,
+                config_projection_digest: "sha256:projection".to_string(),
+                cache_generation: 0,
+                ssh: Some(RepositorySshMaterializationAccess {
+                    credential_id: "credential-1".to_string(),
+                    credential_revision: 1,
+                    host_trust_id: "host-trust-1".to_string(),
+                    host_trust_revision: 1,
+                    access: workspace_api::RepositoryAccessMode::ReadOnly,
+                    expires_at_epoch_seconds: u64::MAX,
+                    repository_id: "repository-1".to_string(),
+                    repository_source_fingerprint: "sha256:source".to_string(),
+                    repository_uri: "ssh://git@example.test/repo.git".to_string(),
+                    secret_resource: handle,
+                    private_key: SensitiveString::default(),
+                    known_hosts_entry: SensitiveString::default(),
+                }),
+            },
+        };
+
+        let replay = request.clone();
+        runtime
+            .authorize_working_directory_repository_access_from_resource(request)
+            .await
+            .unwrap();
+        assert!(
+            runtime
+                .authorize_working_directory_repository_access_from_resource(replay)
+                .await
+                .is_err()
+        );
+
+        let accesses = backend.repository_accesses.lock().unwrap();
+        assert_eq!(accesses.len(), 1);
+        let access = accesses[0].materialization.ssh.as_ref().unwrap();
+        assert_eq!(access.private_key.expose(), "private-key-bytes");
+        assert_eq!(access.known_hosts_entry.expose(), "known-hosts-entry");
+    }
+
+    #[tokio::test]
+    async fn working_directory_create_fetches_repository_access_before_provider_call() {
+        let (runtime, backend) = runtime_and_backend();
+        backend
+            .repository_access_available
+            .store(true, Ordering::SeqCst);
+        runtime.bind_runtime_identity("runtime-1").unwrap();
+        let handle = repository_resource_handle();
+        runtime
+            .install_backend_resource_client(Arc::new(TestRepositoryResourceClient {
+                response: Mutex::new(Some(crate::resource::BackendResourceFetchResponse {
+                    kind: crate::resource::BackendResourceKind::RepositorySshAccess,
+                    resource_id: handle.resource_id.clone(),
+                    digest: handle.digest.clone(),
+                    content_type: crate::resource::REPOSITORY_SSH_ACCESS_CONTENT_TYPE.to_string(),
+                    bytes: serde_json::to_vec(&RepositorySshAccessSecret {
+                        private_key: "create-private-key-bytes".to_string(),
+                        known_hosts_entry: "create-known-hosts-entry".to_string(),
+                    })
+                    .unwrap(),
+                    audit_correlation_id: handle.audit_correlation_id.clone(),
+                })),
+            }))
+            .unwrap();
+        let request = WorkingDirectoryRequest {
+            repository: WorkingDirectoryRepository {
+                id: "repository-1".to_string(),
+                provider: "git".to_string(),
+                source: workspace_api::RepositorySource {
+                    kind: workspace_api::RepositorySourceKind::Ssh,
+                    uri: "ssh://git@example.test/repo.git".to_string(),
+                },
+                source_revision: 1,
+                source_fingerprint: "sha256:source".to_string(),
+                selector: None,
+            },
+            materializer: MaterializerKind::RuntimeGitCache,
+            backend_workdir_id: Some("working-directory-1".to_string()),
+            materialization: Some(RepositoryMaterializationContext {
+                workspace_id: "workspace-1".to_string(),
+                runtime_id: "runtime-1".to_string(),
+                operation_id: "operation-create".to_string(),
+                config_revision: 1,
+                config_projection_digest: "sha256:projection".to_string(),
+                cache_generation: 0,
+                ssh: Some(RepositorySshMaterializationAccess {
+                    credential_id: "credential-1".to_string(),
+                    credential_revision: 1,
+                    host_trust_id: "host-trust-1".to_string(),
+                    host_trust_revision: 1,
+                    access: workspace_api::RepositoryAccessMode::ReadOnly,
+                    expires_at_epoch_seconds: u64::MAX,
+                    repository_id: "repository-1".to_string(),
+                    repository_source_fingerprint: "sha256:source".to_string(),
+                    repository_uri: "ssh://git@example.test/repo.git".to_string(),
+                    secret_resource: handle,
+                    private_key: SensitiveString::default(),
+                    known_hosts_entry: SensitiveString::default(),
+                }),
+            }),
+        };
+
+        assert!(
+            runtime
+                .create_working_directory_from_resource(request)
+                .await
+                .is_err()
+        );
+
+        let requests = backend.working_directory_requests.lock().unwrap();
+        let access = requests[0]
+            .materialization
+            .as_ref()
+            .and_then(|materialization| materialization.ssh.as_ref())
+            .unwrap();
+        assert_eq!(access.private_key.expose(), "create-private-key-bytes");
+        assert_eq!(
+            access.known_hosts_entry.expose(),
+            "create-known-hosts-entry"
+        );
+    }
+
     fn scoped_task_request(objective: &str, workspace_id: &str) -> CreateWorkerRequest {
         let mut request = task_request(objective);
         request.workspace_api = Some(WorkspaceApiRef {
@@ -3196,6 +3588,9 @@ mod tests {
         config_bundles: Mutex<Vec<Option<ConfigBundle>>>,
         contexts: Mutex<BTreeMap<WorkerId, WorkerExecutionContext>>,
         dispatched_inputs: Mutex<Vec<WorkerInput>>,
+        repository_accesses: Mutex<Vec<WorkingDirectoryRepositoryAccessRequest>>,
+        repository_access_available: AtomicBool,
+        working_directory_requests: Mutex<Vec<WorkingDirectoryRequest>>,
         preserve_commit_ack_submission_id: AtomicBool,
         #[cfg(feature = "ws-server")]
         snapshots: Mutex<BTreeMap<WorkerId, protocol::Event>>,
@@ -3236,6 +3631,38 @@ mod tests {
             "test-execution-backend"
         }
 
+        fn create_working_directory(
+            &self,
+            request: &WorkingDirectoryRequest,
+        ) -> Result<CatalogWorkingDirectoryStatus, WorkingDirectoryDiagnostic> {
+            self.working_directory_requests
+                .lock()
+                .unwrap()
+                .push(request.clone());
+            Err(WorkingDirectoryDiagnostic::rejected(
+                "working_directory_unsupported",
+                "Worker execution backend does not support working directory materialization",
+            ))
+        }
+
+        fn authorize_working_directory_repository_access(
+            &self,
+            request: &WorkingDirectoryRepositoryAccessRequest,
+        ) -> Result<(), WorkingDirectoryDiagnostic> {
+            self.repository_accesses
+                .lock()
+                .unwrap()
+                .push(request.clone());
+            if self.repository_access_available.load(Ordering::SeqCst) {
+                Ok(())
+            } else {
+                Err(WorkingDirectoryDiagnostic::rejected(
+                    "working_directory_repository_access_unsupported",
+                    "Worker execution backend does not support Repository access authorization",
+                ))
+            }
+        }
+
         fn spawn_worker(&self, request: WorkerExecutionSpawnRequest) -> WorkerExecutionSpawnResult {
             self.run_generations
                 .lock()
@@ -3343,6 +3770,24 @@ mod tests {
         }
     }
 
+    struct TestRepositoryResourceClient {
+        response: Mutex<Option<crate::resource::BackendResourceFetchResponse>>,
+    }
+
+    #[async_trait]
+    impl BackendResourceClient for TestRepositoryResourceClient {
+        async fn fetch_resource(
+            &self,
+            _request: BackendResourceFetchRequest,
+        ) -> Result<crate::resource::BackendResourceFetchResponse, BackendResourceError> {
+            self.response
+                .lock()
+                .unwrap()
+                .take()
+                .ok_or(BackendResourceError::MissingResource)
+        }
+    }
+
     fn runtime_with_backend() -> Runtime {
         let runtime = Runtime::with_execution_backend(
             RuntimeOptions::default(),

crates/worker-runtime/src/worker_backend.rs

@@ -14,10 +14,13 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex, mpsc};
 use std::time::Duration;
 
-use crate::auth::RuntimeIdentityMaterial;
+use crate::auth::{
+    BACKEND_RESOURCE_FETCH_PERMISSION, RUNTIME_REQUEST_SOURCE_PROOF_HEADER,
+    RuntimeIdentityMaterial, RuntimeRequestSourceSigner, unix_now_seconds,
+};
 use crate::catalog::{
     CreateWorkerRequest, ProfileSourceArchiveHttpRef, ProfileSourceArchiveSource,
-    WorkingDirectoryRequest, WorkingDirectoryStatus,
+    WorkingDirectoryRepositoryAccessRequest, WorkingDirectoryRequest, WorkingDirectoryStatus,
 };
 use crate::execution::{
     WorkerExecutionBackend, WorkerExecutionHandle, WorkerExecutionOperation,
@@ -295,6 +298,7 @@ pub struct ProfileRuntimeWorkerFactory {
     prompt_projection_cache: Arc<WorkspacePromptProjectionCache>,
     runtime_id: Option<String>,
     worker_mutation_identity: Option<RuntimeIdentityMaterial>,
+    runtime_request_audience: Option<String>,
     embedded_worker_mutation_dispatcher: Option<Arc<dyn EmbeddedWorkerMutationDispatcher>>,
     controller_transport: WorkerControllerTransport,
 }
@@ -311,6 +315,7 @@ impl ProfileRuntimeWorkerFactory {
             prompt_projection_cache: Arc::new(WorkspacePromptProjectionCache::default()),
             runtime_id: None,
             worker_mutation_identity: None,
+            runtime_request_audience: None,
             embedded_worker_mutation_dispatcher: None,
             controller_transport: WorkerControllerTransport::UnixSocket,
         }
@@ -331,6 +336,17 @@ impl ProfileRuntimeWorkerFactory {
         self
     }
 
+    pub fn with_runtime_request_identity(
+        mut self,
+        identity: RuntimeIdentityMaterial,
+        audience: impl Into<String>,
+    ) -> Self {
+        self.runtime_id = Some(identity.identity_id.clone());
+        self.worker_mutation_identity = Some(identity);
+        self.runtime_request_audience = Some(audience.into());
+        self
+    }
+
     pub fn with_embedded_worker_mutation_dispatcher(
         mut self,
         runtime_id: impl Into<String>,
@@ -457,13 +473,15 @@ impl ProfileRuntimeWorkerFactory {
     async fn resolve_profile_source_archive(
         &self,
         source: &ProfileSourceArchiveSource,
+        request_audience: Option<&str>,
     ) -> Result<crate::profile_archive::VerifiedProfileSourceArchive, String> {
         match source {
             ProfileSourceArchiveSource::Embedded { archive } => archive
                 .verify()
                 .map_err(|err| format!("failed to verify embedded profile source archive: {err}")),
             ProfileSourceArchiveSource::Http { location } => {
-                self.fetch_profile_source_archive(location).await
+                self.fetch_profile_source_archive(location, request_audience)
+                    .await
             }
         }
     }
@@ -471,10 +489,18 @@ impl ProfileRuntimeWorkerFactory {
     async fn fetch_profile_source_archive(
         &self,
         location: &ProfileSourceArchiveHttpRef,
+        request_audience: Option<&str>,
     ) -> Result<crate::profile_archive::VerifiedProfileSourceArchive, String> {
         if let Some(cached) = self.profile_archive_cache.get(&location.archive.digest) {
-            let response =
-                fetch_profile_source_archive_http(location, Some(&location.archive.digest)).await?;
+            let response = fetch_profile_source_archive_http(
+                location,
+                Some(&location.archive.digest),
+                self.worker_mutation_identity.as_ref(),
+                self.runtime_request_audience
+                    .as_deref()
+                    .or(request_audience),
+            )
+            .await?;
             if let Some(fetched) = response {
                 self.profile_archive_cache.insert(fetched.clone());
                 fetched.verify().map_err(|err| {
@@ -486,12 +512,19 @@ impl ProfileRuntimeWorkerFactory {
                     .map_err(|err| format!("failed to verify cached profile source archive: {err}"))
             }
         } else {
-            let archive = fetch_profile_source_archive_http(location, None)
-                .await?
-                .ok_or_else(|| {
-                    "profile source archive HTTP revalidation returned 304 without a cached archive"
-                        .to_string()
-                })?;
+            let archive = fetch_profile_source_archive_http(
+                location,
+                None,
+                self.worker_mutation_identity.as_ref(),
+                self.runtime_request_audience
+                    .as_deref()
+                    .or(request_audience),
+            )
+            .await?
+            .ok_or_else(|| {
+                "profile source archive HTTP revalidation returned 304 without a cached archive"
+                    .to_string()
+            })?;
             self.profile_archive_cache.insert(archive.clone());
             archive
                 .verify()
@@ -527,6 +560,7 @@ impl RuntimeWorkspaceBackendRef {
         worker_ref: &WorkerRef,
         workspace_scope: Option<&crate::runtime::RuntimeWorkspaceScope>,
         mutation_identity: Option<&RuntimeIdentityMaterial>,
+        runtime_request_audience: Option<&str>,
         embedded_dispatcher: Option<&Arc<dyn EmbeddedWorkerMutationDispatcher>>,
         prompt_projection_cache: Option<Arc<WorkspacePromptProjectionCache>>,
     ) -> WorkerWorkspaceContext {
@@ -546,6 +580,13 @@ impl RuntimeWorkspaceBackendRef {
                 if let Some(cache) = prompt_projection_cache {
                     client = client.with_prompt_projection_cache(cache);
                 }
+                if let Some(identity) = mutation_identity {
+                    let audience = runtime_request_audience
+                        .or_else(|| workspace_scope.map(|scope| scope.server_id.as_str()));
+                    if let Some(audience) = audience {
+                        client = client.with_runtime_request_source(identity, audience.to_owned());
+                    }
+                }
                 if let (Some(scope), Some(identity)) = (workspace_scope, mutation_identity) {
                     client = client.with_worker_remove(RuntimeWorkerMutationForwarder::remote(
                         identity,
@@ -576,9 +617,40 @@ impl RuntimeWorkspaceBackendRef {
 async fn fetch_profile_source_archive_http(
     location: &ProfileSourceArchiveHttpRef,
     cached_digest: Option<&str>,
+    identity: Option<&RuntimeIdentityMaterial>,
+    audience: Option<&str>,
 ) -> Result<Option<crate::profile_archive::ProfileSourceArchive>, String> {
     let client = reqwest::Client::new();
-    let mut request = client.get(&location.url);
+    let url = reqwest::Url::parse(&location.url)
+        .map_err(|error| format!("profile source archive URL is invalid: {error}"))?;
+    let path = url.path().to_owned();
+    let workspace_id = path
+        .split('/')
+        .collect::<Vec<_>>()
+        .windows(2)
+        .find_map(|parts| (parts[0] == "w").then_some(parts[1]))
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| "profile source archive URL is not workspace-scoped".to_owned())?;
+    let mut request = client.get(url);
+    if let Some(identity) = identity {
+        let audience = audience.ok_or_else(|| {
+            "profile source archive request proof audience is unavailable".to_owned()
+        })?;
+        let proof = RuntimeRequestSourceSigner::from_identity(identity)
+            .issue(
+                audience,
+                workspace_id,
+                None,
+                BACKEND_RESOURCE_FETCH_PERMISSION,
+                "GET",
+                &path,
+                b"",
+                i64::try_from(unix_now_seconds()).unwrap_or(i64::MAX),
+                30,
+            )
+            .map_err(|error| error.to_string())?;
+        request = request.header(RUNTIME_REQUEST_SOURCE_PROOF_HEADER, proof);
+    }
     if cached_digest == Some(location.archive.digest.as_str()) {
         if let Some(etag) = location.etag.as_deref() {
             request = request.header(reqwest::header::IF_NONE_MATCH, etag);
@@ -620,6 +692,8 @@ async fn fetch_profile_source_archive_http(
 async fn fetch_profile_source_archive_http(
     _location: &ProfileSourceArchiveHttpRef,
     _cached_digest: Option<&str>,
+    _identity: Option<&RuntimeIdentityMaterial>,
+    _audience: Option<&str>,
 ) -> Result<Option<crate::profile_archive::ProfileSourceArchive>, String> {
     Err(
         "HTTP profile source archive fetch requires the worker-runtime http-server feature"
@@ -632,13 +706,17 @@ fn runtime_local_workdir_session(
     root: &Path,
     cwd: &Path,
     scope: manifest::SharedScope,
+    command_environment: std::collections::BTreeMap<String, String>,
+    resources: Vec<Arc<dyn workdir::WorkdirSessionResource>>,
 ) -> WorkdirSessionHandle {
-    Arc::new(LocalWorkdirSession::materialized_bound(
+    Arc::new(LocalWorkdirSession::materialized_bound_with_environment(
         Workdir::new(workdir_id),
         root.to_path_buf(),
         cwd.to_path_buf(),
         scope,
         WorkdirSessionCapabilities::ALL,
+        command_environment,
+        resources,
     ))
 }
 
@@ -743,12 +821,19 @@ impl RuntimeWorkerFactory for ProfileRuntimeWorkerFactory {
             &request.worker_ref,
             request.workspace_scope.as_ref(),
             self.worker_mutation_identity.as_ref(),
+            self.runtime_request_audience.as_deref(),
             self.embedded_worker_mutation_dispatcher.as_ref(),
             Some(self.prompt_projection_cache.clone()),
         );
         let selector = profile.as_ref();
         let archive = self
-            .resolve_profile_source_archive(&request.request.profile_source)
+            .resolve_profile_source_archive(
+                &request.request.profile_source,
+                request
+                    .workspace_scope
+                    .as_ref()
+                    .map(|scope| scope.server_id.as_str()),
+            )
             .await?;
         let (mut manifest, mut loader) = {
             let manifest = archive
@@ -812,6 +897,8 @@ impl RuntimeWorkerFactory for ProfileRuntimeWorkerFactory {
                 binding.root(),
                 binding.cwd(),
                 worker.scope().clone(),
+                binding.command_environment(),
+                binding.session_resources(),
             )));
         } else {
             worker.bind_workdir_session(None);
@@ -909,6 +996,7 @@ impl RuntimeWorkerFactory for ProfileRuntimeWorkerFactory {
             &request.worker_ref,
             request.workspace_scope.as_ref(),
             self.worker_mutation_identity.as_ref(),
+            self.runtime_request_audience.as_deref(),
             self.embedded_worker_mutation_dispatcher.as_ref(),
             Some(self.prompt_projection_cache.clone()),
         );
@@ -989,6 +1077,8 @@ impl RuntimeWorkerFactory for ProfileRuntimeWorkerFactory {
                 binding.root(),
                 binding.cwd(),
                 worker.scope().clone(),
+                binding.command_environment(),
+                binding.session_resources(),
             )));
         } else {
             worker.bind_workdir_session(None);
@@ -1456,7 +1546,9 @@ fn accepted_notify_run_state(status: WorkerStatus, auto_run: bool) -> WorkerExec
     match status {
         WorkerStatus::Running => WorkerExecutionRunState::Busy,
         WorkerStatus::Idle if auto_run => WorkerExecutionRunState::Busy,
-        WorkerStatus::Idle | WorkerStatus::Paused => WorkerExecutionRunState::Idle,
+        WorkerStatus::Idle | WorkerStatus::Paused | WorkerStatus::Stopped => {
+            WorkerExecutionRunState::Idle
+        }
     }
 }
 
@@ -1500,6 +1592,19 @@ where
         Ok(materializer.create(request)?.status())
     }
 
+    fn authorize_working_directory_repository_access(
+        &self,
+        request: &WorkingDirectoryRepositoryAccessRequest,
+    ) -> Result<(), WorkingDirectoryDiagnostic> {
+        let materializer = self.working_directory_materializer.as_ref().ok_or_else(|| {
+            WorkingDirectoryDiagnostic::rejected(
+                "working_directory_materializer_unavailable",
+                "working directory Repository access requested, but no materializer is configured for this runtime backend",
+            )
+        })?;
+        materializer.authorize_repository_access(request)
+    }
+
     fn list_working_directories(&self) -> Vec<WorkingDirectoryStatus> {
         self.working_directory_materializer
             .as_ref()
@@ -1542,6 +1647,8 @@ where
             binding.root(),
             binding.cwd(),
             manifest::SharedScope::new(scope),
+            binding.command_environment(),
+            binding.session_resources(),
         ))
     }
 
@@ -2060,7 +2167,7 @@ mod tests {
     use crate::identity::WorkerRef;
     use crate::management::RuntimeOptions;
     use crate::observation::WorkerObservationCursor;
-    use crate::working_directory::LocalGitWorktreeMaterializer;
+    use crate::working_directory::RuntimeGitCacheMaterializer;
     use agen::Engine;
     use agen::llm_client::event::{Event as LlmEvent, ResponseStatus, StatusEvent};
     use agen::llm_client::{ClientError, LlmClient, Request};
@@ -2187,12 +2294,18 @@ mod tests {
         let scope = crate::runtime::RuntimeWorkspaceScope::new("workspace-a", "server-main");
 
         let before_restart =
-            backend.worker_context(&worker_ref, Some(&scope), Some(&identity), None, None);
+            backend.worker_context(&worker_ref, Some(&scope), Some(&identity), None, None, None);
         let adapter = WorkerRuntimeExecutionBackend::new(FailingFactory).unwrap();
         let (after_restore_kind, after_restore_workspace_id) = adapter
             .run_on_adapter_runtime(async move {
-                let after_restore =
-                    backend.worker_context(&worker_ref, Some(&scope), Some(&identity), None, None);
+                let after_restore = backend.worker_context(
+                    &worker_ref,
+                    Some(&scope),
+                    Some(&identity),
+                    None,
+                    None,
+                    None,
+                );
                 let client = after_restore.client_handle();
                 Ok((
                     client.kind().to_string(),
@@ -2383,6 +2496,7 @@ mod tests {
                 None,
                 None,
                 None,
+                None,
             );
             let workspace_client = workspace_context.client_handle();
             self.observed_workspace_clients.lock().unwrap().push((
@@ -2631,12 +2745,17 @@ mod tests {
             repository: WorkingDirectoryRepository {
                 id: "repo-main".to_string(),
                 provider: "git".to_string(),
-                uri: ".".to_string(),
-                local_path: Some(repo.to_path_buf()),
+                source: workspace_api::RepositorySource {
+                    kind: workspace_api::RepositorySourceKind::LocalPath,
+                    uri: repo.display().to_string(),
+                },
+                source_revision: 1,
+                source_fingerprint: "sha256:test".to_string(),
                 selector: Some(RepositorySelector::from("HEAD")),
             },
-            materializer: MaterializerKind::LocalGitWorktree,
+            materializer: MaterializerKind::RuntimeGitCache,
             backend_workdir_id: None,
+            materialization: None,
         }
     }
 
@@ -2760,12 +2879,16 @@ mod tests {
             root.path(),
             root.path(),
             manifest::SharedScope::new(Scope::writable(root.path()).unwrap()),
+            Default::default(),
+            Vec::new(),
         );
         let restored = runtime_local_workdir_session(
             "working-directory-42",
             root.path(),
             root.path(),
             manifest::SharedScope::new(Scope::writable(root.path()).unwrap()),
+            Default::default(),
+            Vec::new(),
         );
 
         assert_eq!(spawned.workdir().id().as_str(), "working-directory-42");
@@ -2781,7 +2904,7 @@ mod tests {
             archive: bundle.profile_source_archive.clone().unwrap(),
         };
         factory
-            .resolve_profile_source_archive(&source)
+            .resolve_profile_source_archive(&source, None)
             .await
             .expect("embedded archive should resolve without Backend resource client");
     }
@@ -3237,7 +3360,7 @@ mod tests {
         };
         let backend = WorkerRuntimeExecutionBackend::new(factory)
             .unwrap()
-            .with_working_directory_materializer(LocalGitWorktreeMaterializer::new(
+            .with_working_directory_materializer(RuntimeGitCacheMaterializer::new(
                 runtime_base.path(),
             ));
         let runtime =
@@ -3392,7 +3515,7 @@ mod tests {
         };
         let backend = WorkerRuntimeExecutionBackend::new(factory)
             .unwrap()
-            .with_working_directory_materializer(LocalGitWorktreeMaterializer::new(
+            .with_working_directory_materializer(RuntimeGitCacheMaterializer::new(
                 runtime_base.path(),
             ));
         let runtime =
@@ -3431,7 +3554,7 @@ mod tests {
         let repo = create_clean_repo();
         let backend = WorkerRuntimeExecutionBackend::new(FailingFactory)
             .unwrap()
-            .with_working_directory_materializer(LocalGitWorktreeMaterializer::new(
+            .with_working_directory_materializer(RuntimeGitCacheMaterializer::new(
                 runtime_base.path(),
             ));
         let runtime =
@@ -3467,7 +3590,7 @@ mod tests {
         let repo = create_clean_repo();
         let backend = WorkerRuntimeExecutionBackend::new(FailingFactory)
             .unwrap()
-            .with_working_directory_materializer(LocalGitWorktreeMaterializer::new(
+            .with_working_directory_materializer(RuntimeGitCacheMaterializer::new(
                 runtime_base.path(),
             ));
         let runtime =
@@ -3481,9 +3604,15 @@ mod tests {
 
         assert!(format!("{error:?}").contains("spawn failed"));
         let working_directories_root = runtime_base.path();
-        let remaining_entries = fs::read_dir(working_directories_root)
-            .map(|entries| entries.count())
+        let remaining_workdirs = fs::read_dir(working_directories_root)
+            .map(|entries| {
+                entries
+                    .flatten()
+                    .filter(|entry| !entry.file_name().to_string_lossy().starts_with('.'))
+                    .count()
+            })
             .unwrap_or(0);
-        assert_eq!(remaining_entries, 0);
+        assert_eq!(remaining_workdirs, 0);
+        assert!(working_directories_root.join(".repository-cache").is_dir());
     }
 }

crates/worker-runtime/src/worker_source.rs

@@ -7,8 +7,9 @@ use worker::{
 };
 
 use crate::auth::{
-    RuntimeAuthError, RuntimeIdentityMaterial, RuntimeWorkerMutationSourceSigner,
-    WORKER_REMOVE_PERMISSION, WorkerMutationActorKind, WorkerMutationOperation,
+    RUNTIME_REQUEST_SOURCE_PROOF_HEADER, RuntimeAuthError, RuntimeIdentityMaterial,
+    RuntimeRequestSourceSigner, RuntimeWorkerMutationSourceSigner, WORKER_REMOVE_PERMISSION,
+    WORKSPACE_REQUEST_PERMISSION, WorkerMutationActorKind, WorkerMutationOperation,
     WorkerMutationSourceClaims, new_token_id,
 };
 use crate::runtime::RuntimeWorkspaceScope;
@@ -289,6 +290,8 @@ pub struct RuntimeOwnedWorkspaceClient {
     worker_id: String,
     request_timeout: Option<Duration>,
     worker_remove: Option<RuntimeWorkerMutationForwarder>,
+    request_source_signer: Option<RuntimeRequestSourceSigner>,
+    request_source_audience: Option<String>,
     prompt_projection_cache: Option<Arc<WorkspacePromptProjectionCache>>,
 }
 
@@ -306,6 +309,8 @@ impl RuntimeOwnedWorkspaceClient {
             worker_id: worker_id.into(),
             request_timeout: None,
             worker_remove: None,
+            request_source_signer: None,
+            request_source_audience: None,
             prompt_projection_cache: None,
         }
     }
@@ -315,6 +320,16 @@ impl RuntimeOwnedWorkspaceClient {
         self
     }
 
+    pub fn with_runtime_request_source(
+        mut self,
+        identity: &RuntimeIdentityMaterial,
+        audience: impl Into<String>,
+    ) -> Self {
+        self.request_source_signer = Some(RuntimeRequestSourceSigner::from_identity(identity));
+        self.request_source_audience = Some(audience.into());
+        self
+    }
+
     pub(crate) fn with_prompt_projection_cache(
         mut self,
         cache: Arc<WorkspacePromptProjectionCache>,
@@ -363,15 +378,21 @@ impl WorkspaceClient for RuntimeOwnedWorkspaceClient {
         request: WorkspaceRequest,
     ) -> Result<WorkspaceResponse, WorkspaceClientError> {
         let base_url = self.base_url.clone();
+        let workspace_id = self.workspace_id.clone();
         let runtime_id = self.runtime_id.clone();
         let worker_id = self.worker_id.clone();
+        let request_source_signer = self.request_source_signer.clone();
+        let request_source_audience = self.request_source_audience.clone();
         let request_timeout = self.request_timeout;
         if tokio::runtime::Handle::try_current().is_ok() {
             std::thread::spawn(move || {
                 execute_runtime_owned_workspace_http(
                     &base_url,
+                    &workspace_id,
                     &runtime_id,
                     &worker_id,
+                    request_source_signer.as_ref(),
+                    request_source_audience.as_deref(),
                     request_timeout,
                     request,
                 )
@@ -383,8 +404,11 @@ impl WorkspaceClient for RuntimeOwnedWorkspaceClient {
         } else {
             execute_runtime_owned_workspace_http(
                 &self.base_url,
+                &self.workspace_id,
                 &self.runtime_id,
                 &self.worker_id,
+                self.request_source_signer.as_ref(),
+                self.request_source_audience.as_deref(),
                 self.request_timeout,
                 request,
             )
@@ -484,8 +508,11 @@ impl WorkspaceClient for RuntimeOwnedWorkspaceClient {
 
 fn execute_runtime_owned_workspace_http(
     base_url: &str,
+    workspace_id: &str,
     runtime_id: &str,
     worker_id: &str,
+    request_source_signer: Option<&RuntimeRequestSourceSigner>,
+    request_source_audience: Option<&str>,
     request_timeout: Option<Duration>,
     request: WorkspaceRequest,
 ) -> Result<WorkspaceResponse, WorkspaceClientError> {
@@ -510,11 +537,33 @@ fn execute_runtime_owned_workspace_http(
             ))
         })?;
     let request_label = format!("{method} {}", request.path);
+    let body = request.body.unwrap_or_default();
     let mut request_builder = client
-        .request(method, url)
+        .request(method.clone(), url)
         .header("x-yoi-runtime-id", runtime_id)
         .header("x-yoi-worker-id", worker_id);
-    if let Some(body) = request.body {
+    if let Some(signer) = request_source_signer {
+        let audience = request_source_audience.ok_or_else(|| {
+            WorkspaceClientError::Request(
+                "runtime request proof audience is unavailable".to_owned(),
+            )
+        })?;
+        let proof = signer
+            .issue(
+                audience,
+                workspace_id,
+                Some(worker_id),
+                WORKSPACE_REQUEST_PERMISSION,
+                method.as_str(),
+                &request.path,
+                body.as_bytes(),
+                i64::try_from(unix_now_seconds()).unwrap_or(i64::MAX),
+                30,
+            )
+            .map_err(|error| WorkspaceClientError::Request(error.to_string()))?;
+        request_builder = request_builder.header(RUNTIME_REQUEST_SOURCE_PROOF_HEADER, proof);
+    }
+    if !body.is_empty() {
         request_builder = request_builder
             .header(reqwest::header::CONTENT_TYPE, "application/json")
             .body(body);
@@ -590,8 +639,8 @@ fn unix_now_seconds() -> u64 {
 mod tests {
     use super::*;
     use crate::auth::{
-        WorkerMutationSourceExpectation, decode_worker_mutation_source_claims,
-        verify_worker_mutation_source_proof,
+        WorkerMutationSourceExpectation, decode_runtime_request_source_claims,
+        decode_worker_mutation_source_claims, verify_worker_mutation_source_proof,
     };
 
     #[test]
@@ -797,7 +846,7 @@ mod tests {
     }
 
     #[test]
-    fn ordinary_workspace_forwarding_stamps_legacy_source_only_inside_runtime() {
+    fn ordinary_workspace_forwarding_stamps_runtime_identity_and_signs_path_and_query() {
         use std::io::{Read, Write};
         use std::net::TcpListener;
         use std::sync::Mutex;
@@ -817,21 +866,41 @@ mod tests {
                 .unwrap();
         });
 
+        let identity = RuntimeIdentityMaterial::generate("runtime-a").unwrap();
         let client = RuntimeOwnedWorkspaceClient::new(
             "workspace-a",
             format!("http://{address}"),
             "runtime-a",
             "worker-a",
-        );
+        )
+        .with_runtime_request_source(&identity, "server-a");
         let response = client
-            .execute(WorkspaceRequest::get("/api/w/workspace-a/tickets/search"))
+            .execute(WorkspaceRequest::get(
+                "/api/w/workspace-a/tickets/search?state=planning&limit=20",
+            ))
             .unwrap();
         assert_eq!(response.status, 200);
         server.join().unwrap();
-        let request = received.lock().unwrap().to_ascii_lowercase();
-        assert!(request.contains("x-yoi-runtime-id: runtime-a"));
-        assert!(request.contains("x-yoi-worker-id: worker-a"));
-        assert!(!request.contains("authorization:"));
+        let request = received.lock().unwrap().clone();
+        let lowercase_request = request.to_ascii_lowercase();
+        assert!(lowercase_request.contains("x-yoi-runtime-id: runtime-a"));
+        assert!(lowercase_request.contains("x-yoi-worker-id: worker-a"));
+        assert!(lowercase_request.contains("x-yoi-runtime-request-proof: yoi-runtime-request-v1."));
+        assert!(!lowercase_request.contains("authorization:"));
+        let token = request
+            .lines()
+            .find_map(|line| {
+                line.split_once(':').and_then(|(name, value)| {
+                    name.eq_ignore_ascii_case(RUNTIME_REQUEST_SOURCE_PROOF_HEADER)
+                        .then(|| value.trim())
+                })
+            })
+            .expect("runtime proof header");
+        let claims = decode_runtime_request_source_claims(token).unwrap();
+        assert_eq!(
+            claims.path,
+            "/api/w/workspace-a/tickets/search?state=planning&limit=20"
+        );
     }
 
     #[test]

crates/worker/src/compact/worker.rs

@@ -31,12 +31,11 @@ use workdir::LocalWorkdirSession;
 use workdir::{ReadRequest, WorkdirPath, WorkdirSessionHandle};
 
 use crate::compact::usage_tracker::UsageTracker;
-use crate::fs_view::ReadRequirement;
-#[cfg(test)]
-use crate::fs_view::slice_lines;
-use crate::session_capture::{
-    ReadDetail, ReadOptions, ReadSelector, SearchOptions, SessionCapture, ToolPart,
+use crate::feature::{
+    FeatureDescriptor, FeatureInstallContext, FeatureInstallError, FeatureModule, ToolContribution,
+    ToolDeclaration,
 };
+use crate::fs_view::ReadRequirement;
 
 /// Aggregated output of a compact worker run.
 #[derive(Debug, Default, Clone)]
@@ -91,248 +90,19 @@ struct SummaryParams {
     pub text: String,
 }
 
-/// Input to `search_session_log`.
-#[derive(Debug, Deserialize, schemars::JsonSchema)]
-struct SearchSessionParams {
-    /// Case-insensitive substring to search in compact-target history.
-    pub query: String,
-    /// 0-based item offset to start searching from.
-    #[serde(default)]
-    pub offset: Option<usize>,
-    /// Maximum number of hits to return.
-    #[serde(default)]
-    pub limit: Option<usize>,
-}
-
-/// Input to `read_session_items`.
-#[derive(Debug, Deserialize, schemars::JsonSchema)]
-struct ReadSessionParams {
-    /// 0-based compact-target history item offset.
-    pub offset: usize,
-    /// Maximum number of items to return.
-    pub limit: usize,
-    /// `compact` omits tool arguments/full results; `full` includes message text and tool result content.
-    #[serde(default = "default_session_read_mode")]
-    pub mode: String,
-}
-
-fn default_session_read_mode() -> String {
-    "compact".to_string()
-}
-
-const SESSION_TOOL_MAX_OUTPUT_TOKENS: u64 = 12_000;
-const SESSION_SEARCH_MAX_RESULTS: usize = 50;
-const SESSION_READ_MAX_ITEMS: usize = 80;
-
 const MARK_DESCRIPTION: &str = "Inject a file's contents into the compacted context so the \
 next session starts with it already read. Use this for files the next task needs in full. \
 Optionally specify `offset` (0-based line) and `limit` (line count) to inject only a slice. \
-Counts against `auto_read_budget`; overflow returns an error and the mark is not recorded. \
-Paths must be absolute.";
+Counts against `auto_read_budget`; overflow returns an error and the mark is not recorded.";
 
-const REFERENCE_DESCRIPTION: &str = "Record a file path as a named reference in the compacted \
-context without injecting its contents. Use for files that are contextually relevant but \
-whose current content the next session can fetch on demand.";
+const REFERENCE_DESCRIPTION: &str = "Record a Workdir-relative file path as a named reference in \
+the compacted context without injecting its contents. Use for files that are contextually \
+relevant but whose current content the next session can fetch on demand.";
 
 const SUMMARY_DESCRIPTION: &str = "Provide the final structured summary text. Subsequent calls \
 replace the previous content; only the last call is used. Must be called before the compact run \
 ends or compaction fails.";
 
-const SEARCH_SESSION_DESCRIPTION: &str = "Search the compact-target session history by \
-case-insensitive substring. Returns item indexes and compact snippets. Use this when the initial \
-overview is not enough to identify which part of the session matters. Results are bounded; narrow \
-the query if important details are omitted.";
-
-const READ_SESSION_DESCRIPTION: &str = "Read a bounded range of compact-target session history \
-items by 0-based index. mode='compact' omits tool arguments, full tool results, and reasoning \
-bodies; mode='full' includes message text and tool result content but still remains bounded. Use \
-this to verify details before writing the summary.";
-
-struct SessionLogToolState {
-    items: Arc<Vec<Item>>,
-    view: SessionCapture,
-}
-
-struct SearchSessionLogTool {
-    state: Arc<SessionLogToolState>,
-}
-
-#[async_trait]
-impl Tool for SearchSessionLogTool {
-    async fn execute(
-        &self,
-        input_json: &str,
-        _ctx: agen::tool::ToolExecutionContext,
-    ) -> Result<ToolOutput, ToolError> {
-        let params: SearchSessionParams = serde_json::from_str(input_json).map_err(|e| {
-            ToolError::InvalidArgument(format!("invalid search_session_log input: {e}"))
-        })?;
-        let query = params.query.trim().to_lowercase();
-        if query.is_empty() {
-            return Err(ToolError::InvalidArgument(
-                "search_session_log query must not be empty".to_string(),
-            ));
-        }
-        let offset = params.offset.unwrap_or(0);
-        let limit = params
-            .limit
-            .unwrap_or(20)
-            .clamp(1, SESSION_SEARCH_MAX_RESULTS);
-        let hits = self.state.view.search(&SearchOptions {
-            query: params.query.clone(),
-            kind: None,
-            tool_part: None,
-            tool_name: None,
-            limit: Some(limit),
-            min_entry_index: Some(offset as u64),
-            from: None,
-            through: None,
-            offset: 0,
-        });
-        let blocks = hits
-            .iter()
-            .map(|hit| {
-                let part = hit
-                    .tool_part
-                    .map(|part| format!(" {part:?}"))
-                    .unwrap_or_default();
-                let tool = hit
-                    .tool_name
-                    .as_ref()
-                    .map(|name| format!(" {name}"))
-                    .unwrap_or_default();
-                format!(
-                    "[{} {}{}{} {:?}] {}\n{}",
-                    hit.id,
-                    hit.kind.as_str(),
-                    part,
-                    tool,
-                    hit.entry_range,
-                    hit.label,
-                    hit.summary
-                )
-            })
-            .collect::<Vec<_>>();
-        let mut content = blocks.join("\n\n");
-        let truncated = truncate_to_token_budget(&mut content, SESSION_TOOL_MAX_OUTPUT_TOKENS);
-        let summary = if hits.is_empty() {
-            format!("No session log hits for {query:?} from item offset {offset}.")
-        } else if truncated {
-            format!(
-                "Found {} session log hit(s) for {query:?}; output truncated. Narrow the query.",
-                hits.len()
-            )
-        } else {
-            format!("Found {} session log hit(s) for {query:?}.", hits.len())
-        };
-        Ok(ToolOutput {
-            summary,
-            content: (!content.is_empty()).then_some(content),
-
-            attachments: Vec::new(),
-        })
-    }
-}
-
-struct ReadSessionItemsTool {
-    state: Arc<SessionLogToolState>,
-}
-
-#[async_trait]
-impl Tool for ReadSessionItemsTool {
-    async fn execute(
-        &self,
-        input_json: &str,
-        _ctx: agen::tool::ToolExecutionContext,
-    ) -> Result<ToolOutput, ToolError> {
-        let params: ReadSessionParams = serde_json::from_str(input_json).map_err(|e| {
-            ToolError::InvalidArgument(format!("invalid read_session_items input: {e}"))
-        })?;
-        let mode = SessionReadMode::parse(&params.mode)?;
-        let offset = params.offset.min(self.state.items.len());
-        let limit = params.limit.clamp(1, SESSION_READ_MAX_ITEMS);
-        let end = offset.saturating_add(limit).min(self.state.items.len());
-        let detail = match mode {
-            SessionReadMode::Compact => ReadDetail::Compact,
-            SessionReadMode::Full => ReadDetail::Full,
-        };
-        let read = if offset >= end {
-            crate::session_capture::ReadResult {
-                entries: Vec::new(),
-                truncated: false,
-            }
-        } else {
-            self.state.view.read(
-                ReadSelector::EntryRange([offset as u64, end.saturating_sub(1) as u64]),
-                ReadOptions {
-                    include_tools: true,
-                    tool_part: ToolPart::Both,
-                    detail,
-                    max_items: limit,
-                    max_bytes: 48 * 1024,
-                },
-            )
-        };
-        let mut content = read
-            .entries
-            .iter()
-            .map(|entry| entry.text.clone())
-            .collect::<Vec<_>>()
-            .join("\n\n");
-        let token_truncated =
-            truncate_to_token_budget(&mut content, SESSION_TOOL_MAX_OUTPUT_TOKENS);
-        let truncated = read.truncated || token_truncated;
-        let summary = if truncated {
-            format!(
-                "Read session items {offset}..{end} in {mode:?} mode; output truncated. Narrow the range."
-            )
-        } else {
-            format!("Read session items {offset}..{end} in {mode:?} mode.")
-        };
-        Ok(ToolOutput {
-            summary,
-            content: (!content.is_empty()).then_some(content),
-
-            attachments: Vec::new(),
-        })
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum SessionReadMode {
-    Compact,
-    Full,
-}
-
-impl SessionReadMode {
-    fn parse(value: &str) -> Result<Self, ToolError> {
-        match value {
-            "compact" => Ok(Self::Compact),
-            "full" => Ok(Self::Full),
-            other => Err(ToolError::InvalidArgument(format!(
-                "invalid read_session_items mode {other:?}; expected 'compact' or 'full'"
-            ))),
-        }
-    }
-}
-
-fn truncate_to_token_budget(text: &mut String, max_tokens: u64) -> bool {
-    let max_bytes = max_tokens.saturating_mul(4) as usize;
-    if text.len() <= max_bytes {
-        return false;
-    }
-    let mut cut = 0;
-    for (idx, _) in text.char_indices() {
-        if idx > max_bytes {
-            break;
-        }
-        cut = idx;
-    }
-    text.truncate(cut);
-    text.push_str("\n… [session tool output truncated]");
-    true
-}
-
 struct MarkReadRequiredTool {
     session: WorkdirSessionHandle,
     ctx: Arc<Mutex<CompactWorkerContext>>,
@@ -508,36 +278,63 @@ pub(crate) fn write_summary_tool(ctx: Arc<Mutex<CompactWorkerContext>>) -> ToolD
     })
 }
 
-pub(crate) fn search_session_log_tool(items: Arc<Vec<Item>>) -> ToolDefinition {
-    let view = SessionCapture::new("compact-target", (*items).clone());
-    let state = Arc::new(SessionLogToolState { items, view });
-    Arc::new(move || {
-        let schema = schemars::schema_for!(SearchSessionParams);
-        let schema_value = serde_json::to_value(schema).unwrap_or(serde_json::json!({}));
-        let meta = ToolMeta::new("search_session_log")
-            .description(SEARCH_SESSION_DESCRIPTION)
-            .input_schema(schema_value);
-        let tool: Arc<dyn Tool> = Arc::new(SearchSessionLogTool {
-            state: state.clone(),
-        });
-        (meta, tool)
-    })
+#[derive(Clone)]
+pub(crate) struct CompactionOutputFeature {
+    session: Option<WorkdirSessionHandle>,
+    tracker: tools::Tracker,
+    context: Arc<Mutex<CompactWorkerContext>>,
 }
 
-pub(crate) fn read_session_items_tool(items: Arc<Vec<Item>>) -> ToolDefinition {
-    let view = SessionCapture::new("compact-target", (*items).clone());
-    let state = Arc::new(SessionLogToolState { items, view });
-    Arc::new(move || {
-        let schema = schemars::schema_for!(ReadSessionParams);
-        let schema_value = serde_json::to_value(schema).unwrap_or(serde_json::json!({}));
-        let meta = ToolMeta::new("read_session_items")
-            .description(READ_SESSION_DESCRIPTION)
-            .input_schema(schema_value);
-        let tool: Arc<dyn Tool> = Arc::new(ReadSessionItemsTool {
-            state: state.clone(),
-        });
-        (meta, tool)
-    })
+impl CompactionOutputFeature {
+    pub(crate) fn new(
+        session: Option<WorkdirSessionHandle>,
+        tracker: tools::Tracker,
+        context: Arc<Mutex<CompactWorkerContext>>,
+    ) -> Self {
+        Self {
+            session,
+            tracker,
+            context,
+        }
+    }
+}
+
+impl FeatureModule for CompactionOutputFeature {
+    fn descriptor(&self) -> FeatureDescriptor {
+        let descriptor = FeatureDescriptor::builtin("compaction-output", "Compaction Output")
+            .with_description("Read-only Workdir access and bounded compaction output decisions.")
+            .with_tool(ToolDeclaration::new("add_reference", REFERENCE_DESCRIPTION))
+            .with_tool(ToolDeclaration::new("write_summary", SUMMARY_DESCRIPTION));
+        if self.session.is_some() {
+            descriptor
+                .with_tool(ToolDeclaration::new("Read", "Read a Workdir file."))
+                .with_tool(ToolDeclaration::new("mark_read_required", MARK_DESCRIPTION))
+        } else {
+            descriptor
+        }
+    }
+
+    fn install(&self, context: &mut FeatureInstallContext<'_>) -> Result<(), FeatureInstallError> {
+        if let Some(session) = &self.session {
+            context.tools().register(ToolContribution::new(
+                "Read",
+                tools::read_tool(session.clone(), self.tracker.clone()),
+            ))?;
+            context.tools().register(ToolContribution::new(
+                "mark_read_required",
+                mark_read_required_tool(session.clone(), self.context.clone()),
+            ))?;
+        }
+        context.tools().register(ToolContribution::new(
+            "add_reference",
+            add_reference_tool(self.context.clone()),
+        ))?;
+        context.tools().register(ToolContribution::new(
+            "write_summary",
+            write_summary_tool(self.context.clone()),
+        ))?;
+        Ok(())
+    }
 }
 
 /// Interceptor that monitors compact-worker context occupancy.
@@ -810,53 +607,4 @@ mod tests {
         assert_eq!(guard.references.len(), 1);
         assert_eq!(guard.references[0], PathBuf::from(p));
     }
-
-    #[tokio::test]
-    async fn search_session_log_returns_bounded_hits_without_full_tool_content() {
-        let items = Arc::new(vec![
-            Item::user_message("investigate compact failure"),
-            Item::tool_result_with_content(
-                "call-1",
-                "read trace with compact failure",
-                "very large raw trace body with secret detail",
-            ),
-        ]);
-        let view = SessionCapture::new("test", (*items).clone());
-        let tool: Arc<dyn Tool> = Arc::new(SearchSessionLogTool {
-            state: Arc::new(SessionLogToolState { items, view }),
-        });
-        let input = serde_json::json!({ "query": "compact", "limit": 10 }).to_string();
-        let out = tool.execute(&input, Default::default()).await.unwrap();
-        let content = out.content.unwrap();
-
-        assert!(content.contains("investigate compact failure"));
-        assert!(content.contains("read trace with compact failure"));
-        assert!(!content.contains("secret detail"));
-    }
-
-    #[tokio::test]
-    async fn read_session_items_full_mode_can_read_tool_result_content() {
-        let items = Arc::new(vec![Item::tool_result_with_content(
-            "call-1",
-            "read trace",
-            "raw trace detail",
-        )]);
-        let view = SessionCapture::new("test", (*items).clone());
-        let tool: Arc<dyn Tool> = Arc::new(ReadSessionItemsTool {
-            state: Arc::new(SessionLogToolState { items, view }),
-        });
-        let input = serde_json::json!({ "offset": 0, "limit": 1, "mode": "full" }).to_string();
-        let out = tool.execute(&input, Default::default()).await.unwrap();
-        let content = out.content.unwrap();
-
-        assert!(content.contains("raw trace detail"));
-    }
-
-    #[test]
-    fn slice_lines_handles_offset_and_limit() {
-        let text = "a\nb\nc\nd";
-        assert_eq!(slice_lines(text, 0, None), "a\nb\nc\nd");
-        assert_eq!(slice_lines(text, 1, Some(2)), "b\nc");
-        assert_eq!(slice_lines(text, 10, None), "");
-    }
 }

crates/worker/src/controller.rs

@@ -383,6 +383,7 @@ impl WorkerController {
         worker.attach_alerter(alerter.clone());
         // Also hand the raw broadcast sender so Worker-internal operations
         // can emit typed lifecycle `Event`s (currently: compact progress).
+        worker.attach_internal_worker_registry(spawned_registry.clone());
         worker.attach_event_tx(event_tx.clone());
 
         // Bash spills long outputs to a per-worker subdir under the runtime
@@ -421,7 +422,6 @@ impl WorkerController {
         wire_event_bridges_on_engine(&mut worker, &event_tx, &alerter, &in_flight);
 
         // === 3. Tool registration (builtin / memory / spawn-orchestration) ===
-        spawned_registry.attach_parent_protocol(event_tx.clone(), worker.session_id().to_string());
         let fs_for_view = register_worker_tools(
             &mut worker,
             bash_output_dir,
@@ -873,6 +873,14 @@ where
     }
 
     let mut feature_registry = FeatureRegistryBuilder::new();
+    if feature_config.sub_worker.enabled {
+        feature_registry.add_module(
+            crate::feature::builtin::manage_worker::sub_worker_control_feature(
+                worker.workspace_client_handle(),
+                spawned_registry.clone(),
+            ),
+        );
+    }
     if feature_config.task.enabled {
         feature_registry.add_module(task_feature);
     }
@@ -975,6 +983,14 @@ where
 
     if feature_config.sub_worker.enabled {
         worker.register_worker_orchestration_instruction();
+        if !feature_config.worker.enabled {
+            feature_registry.add_module(
+                crate::feature::builtin::manage_worker::sub_worker_control_feature(
+                    worker.workspace_client_handle(),
+                    spawned_registry.clone(),
+                ),
+            );
+        }
     }
 
     let host_worker_observation_provider = worker.worker_observation_provider();
@@ -1338,7 +1354,7 @@ async fn controller_loop<C, St>(
                         });
                     }
                 },
-                WorkerStatus::Idle => {
+                WorkerStatus::Idle | WorkerStatus::Stopped => {
                     let _ = event_tx.send(Event::Error {
                         code: ErrorCode::NotRunning,
                         message: "Worker is not running".into(),
@@ -1379,7 +1395,7 @@ async fn controller_loop<C, St>(
                             .into(),
                     });
                 }
-                WorkerStatus::Running => {
+                WorkerStatus::Running | WorkerStatus::Stopped => {
                     let _ = event_tx.send(Event::Error {
                         code: ErrorCode::AlreadyRunning,
                         message:
@@ -1393,7 +1409,7 @@ async fn controller_loop<C, St>(
                 WorkerStatus::Idle | WorkerStatus::Paused => {
                     emit_rewind_targets(&worker, &event_tx)
                 }
-                WorkerStatus::Running => {
+                WorkerStatus::Running | WorkerStatus::Stopped => {
                     let _ = event_tx.send(Event::Error {
                         code: ErrorCode::AlreadyRunning,
                         message: "Worker is already executing a turn; rewind can only run while idle or paused"
@@ -1422,7 +1438,7 @@ async fn controller_loop<C, St>(
                             .into(),
                     });
                 }
-                WorkerStatus::Running => {
+                WorkerStatus::Running | WorkerStatus::Stopped => {
                     let _ = event_tx.send(Event::Error {
                         code: ErrorCode::AlreadyRunning,
                         message: "Worker is already executing a turn; rewind can only run while idle or paused"
@@ -1634,6 +1650,26 @@ where
                             WorkerRunResult::Paused => (WorkerStatus::Paused, RunResult::Paused),
                             WorkerRunResult::LimitReached => (WorkerStatus::Idle, RunResult::LimitReached),
                             WorkerRunResult::RolledBack => (WorkerStatus::Idle, RunResult::RolledBack),
+                            WorkerRunResult::Interrupted(_message) if pause_requested => {
+                                let _ = event_tx.send(Event::RunEnd { result: RunResult::Paused });
+                                return (WorkerStatus::Paused, shutdown_requested);
+                            }
+                            WorkerRunResult::Interrupted(message) => {
+                                let _ = event_tx.send(Event::Error {
+                                    code: ErrorCode::Internal,
+                                    message: message.clone(),
+                                });
+                                if parent_originated {
+                                    crate::ipc::event::fire_and_forget(
+                                        parent_socket.cloned(),
+                                        protocol::WorkerEvent::Errored {
+                                            worker_name: self_name.to_string(),
+                                            message,
+                                        },
+                                    );
+                                }
+                                return (WorkerStatus::Idle, shutdown_requested);
+                            }
                         };
                         let _ = event_tx.send(Event::RunEnd { result: run_result });
                         if parent_originated && matches!(run_result, RunResult::Finished) {

crates/worker/src/feature.rs

@@ -12,7 +12,7 @@
 //! ordinary feature reports/diagnostics instead of a separate authority layer.
 
 use std::any::{Any, type_name};
-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
 use std::fmt;
 use std::sync::Arc;
 
@@ -447,6 +447,16 @@ impl ServiceVersionReq {
             requirement: "*".into(),
         }
     }
+
+    pub fn exact(version: impl Into<String>) -> Self {
+        Self {
+            requirement: version.into(),
+        }
+    }
+
+    fn matches(&self, provider_version: &str) -> bool {
+        self.requirement == "*" || self.requirement == provider_version
+    }
 }
 
 /// Feature-provided service declaration. This first slice records provider
@@ -1430,30 +1440,34 @@ impl FeatureInstallContext<'_> {
 pub struct FeatureRegistryInstallReport {
     pub reports: Vec<FeatureInstallReport>,
     pub services: FeatureServiceRegistry,
+    pub plan_error: Option<FeaturePlanError>,
 }
 
 impl FeatureRegistryInstallReport {
     pub fn has_errors(&self) -> bool {
-        self.reports.iter().any(|report| {
-            report
-                .diagnostics
-                .iter()
-                .any(|diagnostic| diagnostic.severity == FeatureDiagnosticSeverity::Error)
-        })
-    }
-
-    pub fn error_message(&self) -> String {
-        self.reports
-            .iter()
-            .flat_map(|report| {
+        self.plan_error.is_some()
+            || self.reports.iter().any(|report| {
                 report
                     .diagnostics
                     .iter()
-                    .filter(|diagnostic| diagnostic.severity == FeatureDiagnosticSeverity::Error)
-                    .map(move |diagnostic| format!("{}: {}", report.feature_id, diagnostic.message))
+                    .any(|diagnostic| diagnostic.severity == FeatureDiagnosticSeverity::Error)
             })
-            .collect::<Vec<_>>()
-            .join("; ")
+    }
+
+    pub fn error_message(&self) -> String {
+        let mut errors = self
+            .plan_error
+            .iter()
+            .map(ToString::to_string)
+            .collect::<Vec<_>>();
+        errors.extend(self.reports.iter().flat_map(|report| {
+            report
+                .diagnostics
+                .iter()
+                .filter(|diagnostic| diagnostic.severity == FeatureDiagnosticSeverity::Error)
+                .map(move |diagnostic| format!("{}: {}", report.feature_id, diagnostic.message))
+        }));
+        errors.join("; ")
     }
 
     pub fn installed_tool_names(&self) -> Vec<String> {
@@ -1485,12 +1499,265 @@ pub fn dedupe_instruction_contributions(
     deduped
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PlannedServiceProvider {
+    pub service: ServiceId,
+    pub provider: FeatureId,
+    pub version: String,
+}
+
+/// A validated, deterministic installation order and its selected service providers.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct FeatureInstallPlan {
+    ordered_features: Vec<FeatureId>,
+    service_providers: BTreeMap<ServiceId, PlannedServiceProvider>,
+    ordered_indices: Vec<usize>,
+}
+
+impl FeatureInstallPlan {
+    pub fn ordered_features(&self) -> &[FeatureId] {
+        &self.ordered_features
+    }
+
+    pub fn service_providers(&self) -> &BTreeMap<ServiceId, PlannedServiceProvider> {
+        &self.service_providers
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Error)]
+pub enum FeaturePlanError {
+    #[error("feature `{feature}` is registered more than once")]
+    DuplicateFeature { feature: FeatureId },
+    #[error("service `{service}` has multiple selected providers: {providers:?}")]
+    AmbiguousServiceProvider {
+        service: ServiceId,
+        providers: Vec<FeatureId>,
+    },
+    #[error("feature `{consumer}` requires service `{service}`, but no provider is selected")]
+    MissingServiceProvider {
+        consumer: FeatureId,
+        service: ServiceId,
+    },
+    #[error(
+        "feature `{consumer}` requires service `{service}` version `{requirement}`, but provider `{provider}` provides `{provider_version}`"
+    )]
+    ServiceVersionMismatch {
+        consumer: FeatureId,
+        service: ServiceId,
+        requirement: String,
+        provider: FeatureId,
+        provider_version: String,
+    },
+    #[error(
+        "service dependency cycle involves features {features:?} through services {services:?}"
+    )]
+    ServiceDependencyCycle {
+        features: Vec<FeatureId>,
+        services: Vec<ServiceId>,
+    },
+}
+
 /// Builder/installer for enabled feature modules.
-#[derive(Default)]
 pub struct FeatureRegistryBuilder {
     modules: Vec<Arc<dyn FeatureModule>>,
 }
 
+fn build_feature_install_plan(
+    descriptors: &[FeatureDescriptor],
+) -> Result<FeatureInstallPlan, FeaturePlanError> {
+    let mut feature_ids = BTreeSet::new();
+    for descriptor in descriptors {
+        if !feature_ids.insert(descriptor.id.clone()) {
+            return Err(FeaturePlanError::DuplicateFeature {
+                feature: descriptor.id.clone(),
+            });
+        }
+    }
+
+    let mut provider_candidates: BTreeMap<ServiceId, Vec<(usize, ServiceDeclaration)>> =
+        BTreeMap::new();
+    for (index, descriptor) in descriptors.iter().enumerate() {
+        for service in &descriptor.provides_services {
+            provider_candidates
+                .entry(service.id.clone())
+                .or_default()
+                .push((index, service.clone()));
+        }
+    }
+
+    let mut selected_providers = BTreeMap::new();
+    for (service, candidates) in provider_candidates {
+        if candidates.len() > 1 {
+            let mut providers = candidates
+                .iter()
+                .map(|(index, _)| descriptors[*index].id.clone())
+                .collect::<Vec<_>>();
+            providers.sort();
+            return Err(FeaturePlanError::AmbiguousServiceProvider { service, providers });
+        }
+        let (provider_index, declaration) = candidates
+            .into_iter()
+            .next()
+            .expect("provider candidates are non-empty");
+        selected_providers.insert(service, (provider_index, declaration));
+    }
+
+    let active = (0..descriptors.len()).collect::<BTreeSet<_>>();
+    let mut adjacency = vec![BTreeSet::new(); descriptors.len()];
+    let mut indegree = vec![0usize; descriptors.len()];
+    let mut edge_services: BTreeMap<(usize, usize), BTreeSet<ServiceId>> = BTreeMap::new();
+
+    for &consumer_index in &active {
+        let consumer = &descriptors[consumer_index];
+        for requirement in &consumer.requires_services {
+            let provider = selected_providers.get(&requirement.id);
+            let Some((provider_index, declaration)) = provider else {
+                if requirement.required {
+                    return Err(FeaturePlanError::MissingServiceProvider {
+                        consumer: consumer.id.clone(),
+                        service: requirement.id.clone(),
+                    });
+                }
+                continue;
+            };
+            if !requirement.version.matches(&declaration.version) {
+                return Err(FeaturePlanError::ServiceVersionMismatch {
+                    consumer: consumer.id.clone(),
+                    service: requirement.id.clone(),
+                    requirement: requirement.version.requirement.clone(),
+                    provider: descriptors[*provider_index].id.clone(),
+                    provider_version: declaration.version.clone(),
+                });
+            }
+            if adjacency[*provider_index].insert(consumer_index) {
+                indegree[consumer_index] += 1;
+            }
+            edge_services
+                .entry((*provider_index, consumer_index))
+                .or_default()
+                .insert(requirement.id.clone());
+        }
+    }
+
+    let mut ready = active
+        .iter()
+        .copied()
+        .filter(|index| indegree[*index] == 0)
+        .collect::<BTreeSet<_>>();
+    let mut ordered_indices = Vec::with_capacity(active.len());
+    while let Some(index) = ready.pop_first() {
+        ordered_indices.push(index);
+        for &dependent in &adjacency[index] {
+            indegree[dependent] -= 1;
+            if indegree[dependent] == 0 {
+                ready.insert(dependent);
+            }
+        }
+    }
+
+    if ordered_indices.len() != active.len() {
+        let cycle_indices = find_service_dependency_cycle(&active, &adjacency);
+        let features = cycle_indices
+            .iter()
+            .map(|index| descriptors[*index].id.clone())
+            .collect::<Vec<_>>();
+        let mut services = BTreeSet::new();
+        for edge in cycle_indices.windows(2) {
+            if let Some(ids) = edge_services.get(&(edge[0], edge[1])) {
+                services.extend(ids.iter().cloned());
+            }
+        }
+        if let (Some(first), Some(last)) = (cycle_indices.first(), cycle_indices.last())
+            && let Some(ids) = edge_services.get(&(*last, *first))
+        {
+            services.extend(ids.iter().cloned());
+        }
+        return Err(FeaturePlanError::ServiceDependencyCycle {
+            features,
+            services: services.into_iter().collect(),
+        });
+    }
+
+    let service_providers = selected_providers
+        .into_iter()
+        .map(|(service, (provider_index, declaration))| {
+            let planned = PlannedServiceProvider {
+                service: service.clone(),
+                provider: descriptors[provider_index].id.clone(),
+                version: declaration.version,
+            };
+            (service, planned)
+        })
+        .collect();
+    let ordered_features = ordered_indices
+        .iter()
+        .map(|index| descriptors[*index].id.clone())
+        .collect();
+    Ok(FeatureInstallPlan {
+        ordered_features,
+        service_providers,
+        ordered_indices,
+    })
+}
+
+fn find_service_dependency_cycle(
+    active: &BTreeSet<usize>,
+    adjacency: &[BTreeSet<usize>],
+) -> Vec<usize> {
+    fn visit(
+        index: usize,
+        active: &BTreeSet<usize>,
+        adjacency: &[BTreeSet<usize>],
+        state: &mut [u8],
+        stack: &mut Vec<usize>,
+    ) -> Option<Vec<usize>> {
+        state[index] = 1;
+        stack.push(index);
+        for &next in &adjacency[index] {
+            if !active.contains(&next) {
+                continue;
+            }
+            match state[next] {
+                0 => {
+                    if let Some(cycle) = visit(next, active, adjacency, state, stack) {
+                        return Some(cycle);
+                    }
+                }
+                1 => {
+                    let start = stack
+                        .iter()
+                        .position(|candidate| *candidate == next)
+                        .expect("visiting node is present in DFS stack");
+                    return Some(stack[start..].to_vec());
+                }
+                _ => {}
+            }
+        }
+        stack.pop();
+        state[index] = 2;
+        None
+    }
+
+    let mut state = vec![0u8; adjacency.len()];
+    let mut stack = Vec::new();
+    for &index in active {
+        if state[index] == 0
+            && let Some(cycle) = visit(index, active, adjacency, &mut state, &mut stack)
+        {
+            return cycle;
+        }
+    }
+    Vec::new()
+}
+
+impl Default for FeatureRegistryBuilder {
+    fn default() -> Self {
+        Self {
+            modules: Vec::new(),
+        }
+    }
+}
+
 impl FeatureRegistryBuilder {
     pub fn new() -> Self {
         Self::default()
@@ -1523,6 +1790,10 @@ impl FeatureRegistryBuilder {
             .collect()
     }
 
+    pub fn plan(&self) -> Result<FeatureInstallPlan, FeaturePlanError> {
+        build_feature_install_plan(&self.descriptors())
+    }
+
     /// Install modules into the existing Engine tool path and hook builder.
     pub(crate) fn install_into_engine<C: LlmClient>(
         self,
@@ -1568,53 +1839,52 @@ impl FeatureRegistryBuilder {
             .iter()
             .map(|module| module.descriptor())
             .collect();
-        let mut service_registry = FeatureServiceRegistry::default();
-        let mut reports = Vec::with_capacity(self.modules.len());
-        let mut seen_features = HashSet::new();
-
-        let mut pending_modules: Vec<_> = self.modules.into_iter().zip(descriptors).collect();
-        let mut ordered_modules = Vec::with_capacity(pending_modules.len());
-        let mut declared_services = HashSet::new();
-        while !pending_modules.is_empty() {
-            let next = pending_modules
-                .iter()
-                .position(|(_, descriptor)| {
-                    descriptor
-                        .requires_services
-                        .iter()
-                        .filter(|requirement| requirement.required)
-                        .all(|requirement| declared_services.contains(&requirement.id))
-                })
-                .unwrap_or(0);
-            let entry = pending_modules.remove(next);
-            declared_services.extend(
-                entry
-                    .1
-                    .provides_services
+        let plan = match build_feature_install_plan(&descriptors) {
+            Ok(plan) => plan,
+            Err(error) => {
+                let message = error.to_string();
+                let reports = descriptors
                     .iter()
-                    .map(|service| service.id.clone()),
-            );
-            ordered_modules.push(entry);
-        }
+                    .map(|descriptor| {
+                        let mut report = FeatureInstallReport::new(descriptor);
+                        report
+                            .diagnostics
+                            .push(FeatureDiagnostic::error(message.clone()));
+                        report.mark_skipped(
+                            FeatureContributionKind::Diagnostic,
+                            descriptor.id.to_string(),
+                            "feature installation plan rejected before installation",
+                        );
+                        report
+                    })
+                    .collect();
+                return FeatureRegistryInstallReport {
+                    reports,
+                    services: FeatureServiceRegistry::default(),
+                    plan_error: Some(error),
+                };
+            }
+        };
+        let mut service_registry = FeatureServiceRegistry::default();
+        let mut reports = Vec::with_capacity(plan.ordered_indices.len());
+        let mut modules = self.modules.into_iter().map(Some).collect::<Vec<_>>();
+        let ordered_modules = plan
+            .ordered_indices
+            .into_iter()
+            .map(|index| {
+                (
+                    modules[index]
+                        .take()
+                        .expect("planned feature module is selected exactly once"),
+                    descriptors[index].clone(),
+                )
+            })
+            .collect::<Vec<_>>();
 
         for (module, descriptor) in ordered_modules {
             let declarations = FeatureContributionDeclarations::from_descriptor(&descriptor);
             let mut report = FeatureInstallReport::new(&descriptor);
 
-            if !seen_features.insert(descriptor.id.clone()) {
-                report.diagnostics.push(FeatureDiagnostic::error(format!(
-                    "duplicate feature id: {}",
-                    descriptor.id
-                )));
-                report.mark_skipped(
-                    FeatureContributionKind::Diagnostic,
-                    descriptor.id.to_string(),
-                    "duplicate feature id",
-                );
-                reports.push(report);
-                continue;
-            }
-
             let mut required_service_failed = false;
             for requirement in descriptor.requires_services.iter().cloned() {
                 if service_registry.provides(&requirement.id) {
@@ -1681,6 +1951,7 @@ impl FeatureRegistryBuilder {
         FeatureRegistryInstallReport {
             reports,
             services: service_registry,
+            plan_error: None,
         }
     }
 }
@@ -1821,6 +2092,59 @@ mod tests {
         }
     }
 
+    struct PlannedServiceFeature {
+        descriptor: FeatureDescriptor,
+        install_calls: Arc<AtomicUsize>,
+        fail_install: bool,
+    }
+
+    impl PlannedServiceFeature {
+        fn new(descriptor: FeatureDescriptor) -> Self {
+            Self {
+                descriptor,
+                install_calls: Arc::new(AtomicUsize::new(0)),
+                fail_install: false,
+            }
+        }
+    }
+
+    impl FeatureModule for PlannedServiceFeature {
+        fn descriptor(&self) -> FeatureDescriptor {
+            self.descriptor.clone()
+        }
+
+        fn install(
+            &self,
+            context: &mut FeatureInstallContext<'_>,
+        ) -> Result<(), FeatureInstallError> {
+            self.install_calls.fetch_add(1, Ordering::SeqCst);
+            if self.fail_install {
+                return Err(FeatureInstallError::Install(
+                    "injected provider failure".into(),
+                ));
+            }
+            for service in &self.descriptor.provides_services {
+                context
+                    .services()
+                    .provide(service.clone(), Arc::new(service.id.to_string()))?;
+            }
+            Ok(())
+        }
+    }
+
+    fn provided_service(id: &'static str, version: &'static str) -> ServiceDeclaration {
+        ServiceDeclaration::new(ServiceId::builtin(id), version, "test service")
+    }
+
+    fn required_service(id: &'static str, version: ServiceVersionReq) -> ServiceRequirement {
+        {
+            let mut requirement =
+                ServiceRequirement::required(ServiceId::builtin(id), "test dependency");
+            requirement.version = version;
+            requirement
+        }
+    }
+
     fn instruction(id: &'static str, prompt_ref: &'static str) -> FeatureInstructionDeclaration {
         FeatureInstructionDeclaration::new(
             FeatureInstructionId::builtin(id),
@@ -1830,6 +2154,249 @@ mod tests {
         .unwrap()
     }
 
+    #[test]
+    fn install_plan_orders_provider_before_consumer_stably() {
+        let consumer = PlannedServiceFeature::new(
+            FeatureDescriptor::builtin("consumer", "Consumer")
+                .with_service_requirement(required_service("catalog", ServiceVersionReq::any())),
+        );
+        let unrelated =
+            PlannedServiceFeature::new(FeatureDescriptor::builtin("unrelated", "Unrelated"));
+        let provider = PlannedServiceFeature::new(
+            FeatureDescriptor::builtin("provider", "Provider")
+                .with_provided_service(provided_service("catalog", "1")),
+        );
+        let builder = FeatureRegistryBuilder::new()
+            .with_module(consumer)
+            .with_module(unrelated)
+            .with_module(provider);
+
+        let plan = builder.plan().expect("service graph should be valid");
+        assert_eq!(
+            plan.ordered_features(),
+            &[
+                FeatureId::builtin("unrelated"),
+                FeatureId::builtin("provider"),
+                FeatureId::builtin("consumer"),
+            ]
+        );
+    }
+
+    #[test]
+    fn install_plan_orders_compatible_optional_provider_before_consumer() {
+        let service = ServiceId::builtin("catalog");
+        let consumer = PlannedServiceFeature::new(
+            FeatureDescriptor::builtin("consumer", "Consumer").with_service_requirement(
+                ServiceRequirement::optional(service.clone(), "optional catalog"),
+            ),
+        );
+        let provider = PlannedServiceFeature::new(
+            FeatureDescriptor::builtin("provider", "Provider")
+                .with_provided_service(provided_service("catalog", "1")),
+        );
+        let builder = FeatureRegistryBuilder::new()
+            .with_module(consumer)
+            .with_module(provider);
+
+        let plan = builder.plan().expect("optional binding should be valid");
+        assert_eq!(
+            plan.ordered_features(),
+            &[
+                FeatureId::builtin("provider"),
+                FeatureId::builtin("consumer"),
+            ]
+        );
+
+        let mut hooks = HookRegistryBuilder::default();
+        let mut pending_tools = Vec::new();
+        let report = builder.install_into_pending(&mut pending_tools, &mut hooks);
+        assert!(!report.has_errors());
+        let consumer = report
+            .reports
+            .iter()
+            .find(|report| report.feature_id == FeatureId::builtin("consumer"))
+            .expect("consumer report");
+        assert!(
+            consumer
+                .resolved_service_requirements
+                .iter()
+                .any(|requirement| requirement.id == service)
+        );
+    }
+
+    #[test]
+    fn install_plan_rejects_missing_required_service() {
+        let builder = FeatureRegistryBuilder::new().with_module(PlannedServiceFeature::new(
+            FeatureDescriptor::builtin("consumer", "Consumer")
+                .with_service_requirement(required_service("missing", ServiceVersionReq::any())),
+        ));
+
+        assert_eq!(
+            builder.plan(),
+            Err(FeaturePlanError::MissingServiceProvider {
+                consumer: FeatureId::builtin("consumer"),
+                service: ServiceId::builtin("missing"),
+            })
+        );
+    }
+
+    #[test]
+    fn install_plan_rejects_ambiguous_provider_independent_of_registration_order() {
+        fn plan(reverse: bool) -> FeaturePlanError {
+            let provider_a = PlannedServiceFeature::new(
+                FeatureDescriptor::builtin("provider-a", "Provider A")
+                    .with_provided_service(provided_service("catalog", "1")),
+            );
+            let provider_b = PlannedServiceFeature::new(
+                FeatureDescriptor::builtin("provider-b", "Provider B")
+                    .with_provided_service(provided_service("catalog", "1")),
+            );
+            let mut builder = FeatureRegistryBuilder::new();
+            if reverse {
+                builder.add_module(provider_b).add_module(provider_a);
+            } else {
+                builder.add_module(provider_a).add_module(provider_b);
+            }
+            builder.plan().expect_err("duplicate providers must fail")
+        }
+
+        let expected = FeaturePlanError::AmbiguousServiceProvider {
+            service: ServiceId::builtin("catalog"),
+            providers: vec![
+                FeatureId::builtin("provider-a"),
+                FeatureId::builtin("provider-b"),
+            ],
+        };
+        assert_eq!(plan(false), expected);
+        assert_eq!(plan(true), expected);
+    }
+
+    #[test]
+    fn install_plan_rejects_service_version_mismatch() {
+        let builder = FeatureRegistryBuilder::new()
+            .with_module(PlannedServiceFeature::new(
+                FeatureDescriptor::builtin("consumer", "Consumer").with_service_requirement(
+                    required_service("catalog", ServiceVersionReq::exact("2")),
+                ),
+            ))
+            .with_module(PlannedServiceFeature::new(
+                FeatureDescriptor::builtin("provider", "Provider")
+                    .with_provided_service(provided_service("catalog", "1")),
+            ));
+
+        assert_eq!(
+            builder.plan(),
+            Err(FeaturePlanError::ServiceVersionMismatch {
+                consumer: FeatureId::builtin("consumer"),
+                service: ServiceId::builtin("catalog"),
+                requirement: "2".into(),
+                provider: FeatureId::builtin("provider"),
+                provider_version: "1".into(),
+            })
+        );
+    }
+
+    #[test]
+    fn install_plan_reports_service_cycle_members() {
+        let builder = FeatureRegistryBuilder::new()
+            .with_module(PlannedServiceFeature::new(
+                FeatureDescriptor::builtin("alpha", "Alpha")
+                    .with_provided_service(provided_service("alpha-service", "1"))
+                    .with_service_requirement(required_service(
+                        "beta-service",
+                        ServiceVersionReq::any(),
+                    )),
+            ))
+            .with_module(PlannedServiceFeature::new(
+                FeatureDescriptor::builtin("beta", "Beta")
+                    .with_provided_service(provided_service("beta-service", "1"))
+                    .with_service_requirement(required_service(
+                        "alpha-service",
+                        ServiceVersionReq::any(),
+                    )),
+            ));
+
+        let error = builder.plan().expect_err("cycle must fail before install");
+        let FeaturePlanError::ServiceDependencyCycle { features, services } = error else {
+            panic!("unexpected plan error: {error:?}");
+        };
+        assert_eq!(
+            features.into_iter().collect::<BTreeSet<_>>(),
+            BTreeSet::from([FeatureId::builtin("alpha"), FeatureId::builtin("beta")])
+        );
+        assert_eq!(
+            services.into_iter().collect::<BTreeSet<_>>(),
+            BTreeSet::from([
+                ServiceId::builtin("alpha-service"),
+                ServiceId::builtin("beta-service"),
+            ])
+        );
+    }
+
+    #[test]
+    fn plan_failure_has_no_install_side_effects_and_reports_identities() {
+        let first = PlannedServiceFeature::new(
+            FeatureDescriptor::builtin("first", "First")
+                .with_provided_service(provided_service("control", "1")),
+        );
+        let first_calls = Arc::clone(&first.install_calls);
+        let second = PlannedServiceFeature::new(
+            FeatureDescriptor::builtin("second", "Second")
+                .with_provided_service(provided_service("control", "1")),
+        );
+        let second_calls = Arc::clone(&second.install_calls);
+        let mut hook_builder = HookRegistryBuilder::default();
+        let mut pending_tools = Vec::new();
+
+        let report = FeatureRegistryBuilder::new()
+            .with_module(first)
+            .with_module(second)
+            .install_into_pending(&mut pending_tools, &mut hook_builder);
+
+        assert!(report.has_errors());
+        assert!(matches!(
+            report.plan_error,
+            Some(FeaturePlanError::AmbiguousServiceProvider { .. })
+        ));
+        assert!(report.error_message().contains("builtin:control"));
+        assert!(report.error_message().contains("builtin:first"));
+        assert!(report.error_message().contains("builtin:second"));
+        assert_eq!(first_calls.load(Ordering::SeqCst), 0);
+        assert_eq!(second_calls.load(Ordering::SeqCst), 0);
+        assert!(pending_tools.is_empty());
+    }
+
+    #[test]
+    fn provider_install_failure_is_fatal_and_does_not_queue_tools() {
+        let provider_calls = Arc::new(AtomicUsize::new(0));
+        let provider = PlannedServiceFeature {
+            descriptor: FeatureDescriptor::builtin("provider", "Provider")
+                .with_provided_service(provided_service("control", "1")),
+            install_calls: Arc::clone(&provider_calls),
+            fail_install: true,
+        };
+        let consumer = ToolFeature {
+            descriptor: FeatureDescriptor::builtin("consumer", "Consumer")
+                .with_service_requirement(required_service("control", ServiceVersionReq::any()))
+                .with_tool(ToolDeclaration::new("Dependent", "dependent tool")),
+            contribution_name: "Dependent",
+            model_visible_name: "Dependent",
+        };
+        let mut hook_builder = HookRegistryBuilder::default();
+        let mut pending_tools = Vec::new();
+
+        let report = FeatureRegistryBuilder::new()
+            .with_module(consumer)
+            .with_module(provider)
+            .install_into_pending(&mut pending_tools, &mut hook_builder);
+
+        assert!(report.has_errors());
+        assert_eq!(provider_calls.load(Ordering::SeqCst), 1);
+        assert!(pending_tools.is_empty());
+        assert!(report.error_message().contains("builtin:provider"));
+        assert!(report.error_message().contains("injected provider failure"));
+    }
+
     #[test]
     fn descriptor_contributions_are_recorded() {
         let descriptor = FeatureDescriptor::builtin("dummy", "Dummy")
@@ -2382,10 +2949,6 @@ mod tests {
         );
         let consumer = FeatureDescriptor::builtin("consumer", "Consumer")
             .with_service_requirement(ServiceRequirement::required(service.clone(), "needs demo"));
-        let missing_service = ServiceId::builtin("missing-service");
-        let missing = FeatureDescriptor::builtin("missing", "Missing").with_service_requirement(
-            ServiceRequirement::required(missing_service, "needs missing"),
-        );
         let optional_service = ServiceId::builtin("optional-service");
         let optional = FeatureDescriptor::builtin("optional", "Optional").with_service_requirement(
             ServiceRequirement::optional(optional_service, "nice to have"),
@@ -2399,9 +2962,6 @@ mod tests {
             .with_module(ServiceFeature {
                 descriptor: consumer,
             })
-            .with_module(ServiceFeature {
-                descriptor: missing,
-            })
             .with_module(ServiceFeature {
                 descriptor: optional,
             })
@@ -2413,18 +2973,6 @@ mod tests {
             report.reports[1].resolved_service_requirements[0].id,
             service
         );
-        let missing_report = report
-            .reports
-            .iter()
-            .find(|feature| feature.feature_id == FeatureId::builtin("missing"))
-            .unwrap();
-        assert!(!missing_report.installed);
-        assert!(
-            missing_report
-                .diagnostics
-                .iter()
-                .any(|diagnostic| diagnostic.message.contains("required service requirement"))
-        );
         let optional_report = report
             .reports
             .iter()
@@ -2543,11 +3091,12 @@ mod tests {
             .with_module(ServiceFeature { descriptor })
             .install_into_pending(&mut pending_tools, &mut hook_builder);
         assert!(report.has_errors());
-        assert!(
-            report
-                .error_message()
-                .contains("required service requirement")
-        );
+        assert!(matches!(
+            report.plan_error,
+            Some(FeaturePlanError::MissingServiceProvider { .. })
+        ));
+        assert!(report.error_message().contains("builtin:consumer"));
+        assert!(report.error_message().contains("builtin:missing-service"));
     }
 
     #[test]

crates/worker/src/feature/builtin/flow_transition.rs

@@ -560,6 +560,7 @@ where
                 attempt.instance_id, attempt.checked_state_revision
             )),
             max_turns: Some(12),
+            engine_configurator: None,
             features,
             required_tools: &[
                 "ShowOverview",
@@ -571,6 +572,7 @@ where
                 workspace: WorkerWorkspaceContext::no_workspace(),
                 filesystem: WorkerFilesystemAuthority::None,
                 scope: Scope::empty(),
+                workdir_session: None,
             },
         };
         match run_internal_worker(spec).await {

crates/worker/src/feature/builtin/manage_workdir.rs

@@ -398,24 +398,35 @@ impl WorkspaceHttpWorkdirBackend {
         workdir_output(format!("Listed {count} Workdir(s)"), &response)
     }
 
-    fn create(&self, input: WorkdirCreateInput) -> Result<ToolOutput, ToolError> {
-        let runtime_id = validate_identity(&input.runtime_id, CREATE_TOOL, "runtime_id")?;
+    fn create(
+        &self,
+        input: WorkdirCreateInput,
+        operation_id: String,
+    ) -> Result<ToolOutput, ToolError> {
+        let runtime_id = input
+            .runtime_id
+            .as_deref()
+            .map(|value| validate_identity(value, CREATE_TOOL, "runtime_id"))
+            .transpose()?;
         let repository_id = validate_identity(&input.repository_id, CREATE_TOOL, "repository_id")?;
         let selector = validate_optional_selector(input.selector)?;
         let workspace_id = encode_path_segment(self.workspace_id()?);
-        let runtime_path = encode_path_segment(runtime_id);
         let request = WorkdirCreateRequest {
-            runtime_id: runtime_id.to_string(),
+            runtime_id: runtime_id.map(str::to_string),
             repository_id: repository_id.to_string(),
             selector,
+            operation_id,
         };
         let response = self.execute_json::<WorkdirDetailResponse>(WorkspaceRequest::json(
             WorkspaceRequestMethod::Post,
-            format!("/api/w/{workspace_id}/runtimes/{runtime_path}/working-directories"),
+            format!("/api/w/{workspace_id}/working-directories"),
             serde_json::to_string(&request).map_err(decode_error)?,
         ))?;
         workdir_output(
-            format!("Created Workdir {}", response.item.working_directory_id),
+            format!(
+                "Created Workdir {} on Runtime {}",
+                response.item.working_directory_id, response.runtime_id
+            ),
             &response,
         )
     }
@@ -518,16 +529,17 @@ impl Tool for WorkspaceHttpWorkdirTool {
     async fn execute(
         &self,
         input_json: &str,
-        _ctx: ToolExecutionContext,
+        ctx: ToolExecutionContext,
     ) -> Result<ToolOutput, ToolError> {
         match self.operation {
             WorkdirOperation::List => {
                 let _input = parse_input::<WorkdirListInput>(input_json)?;
                 self.backend.list()
             }
-            WorkdirOperation::Create => self
-                .backend
-                .create(parse_input::<WorkdirCreateInput>(input_json)?),
+            WorkdirOperation::Create => self.backend.create(
+                parse_input::<WorkdirCreateInput>(input_json)?,
+                ctx.call_id.to_string(),
+            ),
             WorkdirOperation::Attach => self
                 .backend
                 .attach(parse_input::<WorkdirAttachInput>(input_json)?),
@@ -635,9 +647,9 @@ fn create_schema() -> serde_json::Value {
     json!({
         "type": "object",
         "additionalProperties": false,
-        "required": ["runtime_id", "repository_id"],
+        "required": ["repository_id"],
         "properties": {
-            "runtime_id": {"type": "string", "minLength": 1},
+            "runtime_id": {"type": ["string", "null"], "minLength": 1},
             "repository_id": {"type": "string", "minLength": 1},
             "selector": {"type": ["string", "null"], "minLength": 1}
         }
@@ -677,7 +689,8 @@ struct WorkdirListInput {}
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct WorkdirCreateInput {
-    runtime_id: String,
+    #[serde(default)]
+    runtime_id: Option<String>,
     repository_id: String,
     #[serde(default)]
     selector: Option<String>,
@@ -685,10 +698,12 @@ struct WorkdirCreateInput {
 
 #[derive(Debug, Serialize)]
 struct WorkdirCreateRequest {
-    runtime_id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    runtime_id: Option<String>,
     repository_id: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     selector: Option<String>,
+    operation_id: String,
 }
 
 #[derive(Debug, Deserialize)]
@@ -916,7 +931,11 @@ mod tests {
     #[test]
     fn schemas_expose_identities_without_paths_or_session_handles() {
         let create = create_schema();
-        assert_eq!(create["required"], json!(["runtime_id", "repository_id"]));
+        assert_eq!(create["required"], json!(["repository_id"]));
+        assert_eq!(
+            create["properties"]["runtime_id"]["type"],
+            json!(["string", "null"])
+        );
         assert!(create["properties"].get("path").is_none());
         assert!(create["properties"].get("session_id").is_none());
         assert_eq!(attach_schema()["required"], json!(["workdir_id"]));
@@ -946,6 +965,7 @@ mod tests {
             })),
             response(json!({
                 "workspace_id": "workspace/test",
+                "runtime_id": "runtime/one",
                 "item": workdir_json("wd-created"),
                 "diagnostics": []
             })),
@@ -961,6 +981,7 @@ mod tests {
             })),
             response(json!({
                 "workspace_id": "workspace/test",
+                "runtime_id": "runtime/one",
                 "item": {
                     "working_directory_id": "wd-created",
                     "repository_id": "main",
@@ -985,13 +1006,19 @@ mod tests {
                 .is_none()
         );
         let created = backend
-            .create(WorkdirCreateInput {
-                runtime_id: "runtime/one".to_string(),
-                repository_id: "main".to_string(),
-                selector: Some("refs/heads/topic".to_string()),
-            })
+            .create(
+                WorkdirCreateInput {
+                    runtime_id: Some("runtime/one".to_string()),
+                    repository_id: "main".to_string(),
+                    selector: Some("refs/heads/topic".to_string()),
+                },
+                "call-create-1".to_string(),
+            )
             .unwrap();
-        assert_eq!(created.summary, "Created Workdir wd-created");
+        assert_eq!(
+            created.summary,
+            "Created Workdir wd-created on Runtime runtime/one"
+        );
         let created: serde_json::Value =
             serde_json::from_str(created.content.as_deref().unwrap()).unwrap();
         assert_eq!(created["item"]["working_directory_id"], "wd-created");
@@ -1017,12 +1044,14 @@ mod tests {
         assert_eq!(requests[0].method, WorkspaceRequestMethod::Get);
         assert_eq!(
             requests[1].path,
-            "/api/w/workspace%2Ftest/runtimes/runtime%2Fone/working-directories"
+            "/api/w/workspace%2Ftest/working-directories"
         );
         assert_eq!(requests[1].method, WorkspaceRequestMethod::Post);
         let body: serde_json::Value =
             serde_json::from_str(requests[1].body.as_deref().unwrap()).unwrap();
         assert_eq!(body["repository_id"], "main");
+        assert_eq!(body["runtime_id"], "runtime/one");
+        assert_eq!(body["operation_id"], "call-create-1");
         assert_eq!(body["selector"], "refs/heads/topic");
         assert_eq!(
             requests[2].path,
@@ -1216,16 +1245,50 @@ mod tests {
         assert_eq!(body["operation"]["request"]["path"], "file");
     }
 
+    #[test]
+    fn create_omits_runtime_for_backend_default_resolution() {
+        let client = Arc::new(RecordingWorkspaceClient::new(vec![response(json!({
+            "workspace_id": "workspace/test",
+            "runtime_id": "arcadia",
+            "item": workdir_json("wd-default"),
+            "diagnostics": []
+        }))]));
+        let backend = WorkspaceHttpWorkdirBackend::new(client.clone());
+
+        let created = backend
+            .create(
+                WorkdirCreateInput {
+                    runtime_id: None,
+                    repository_id: "main".to_string(),
+                    selector: None,
+                },
+                "call-default".to_string(),
+            )
+            .unwrap();
+        assert_eq!(
+            created.summary,
+            "Created Workdir wd-default on Runtime arcadia"
+        );
+        let requests = client.requests();
+        let body: serde_json::Value =
+            serde_json::from_str(requests[0].body.as_deref().unwrap()).unwrap();
+        assert!(body.get("runtime_id").is_none());
+        assert_eq!(body["operation_id"], "call-default");
+    }
+
     #[test]
     fn invalid_or_extra_inputs_are_rejected_before_workspace_request() {
         let client = Arc::new(RecordingWorkspaceClient::new(Vec::new()));
         let backend = WorkspaceHttpWorkdirBackend::new(client.clone());
         let error = backend
-            .create(WorkdirCreateInput {
-                runtime_id: " ".to_string(),
-                repository_id: "main".to_string(),
-                selector: None,
-            })
+            .create(
+                WorkdirCreateInput {
+                    runtime_id: Some(" ".to_string()),
+                    repository_id: "main".to_string(),
+                    selector: None,
+                },
+                "call-invalid".to_string(),
+            )
             .unwrap_err();
         assert!(matches!(error, ToolError::InvalidArgument(_)));
         assert!(client.requests().is_empty());

crates/worker/src/feature/builtin/manage_worker.rs

@@ -356,6 +356,52 @@ pub fn manage_worker_feature(
     }
 }
 
+pub struct SubWorkerControlFeature {
+    client: Arc<dyn WorkspaceClient>,
+    registry: Arc<SpawnedWorkerRegistry>,
+}
+
+impl SubWorkerControlFeature {
+    pub fn new(client: Arc<dyn WorkspaceClient>, registry: Arc<SpawnedWorkerRegistry>) -> Self {
+        Self { client, registry }
+    }
+}
+
+impl FeatureModule for SubWorkerControlFeature {
+    fn descriptor(&self) -> FeatureDescriptor {
+        FeatureDescriptor::builtin("sub-worker-control", "SubWorker Control")
+            .with_description("Parent-owned SubWorker control service provider")
+            .with_provided_service(ServiceDeclaration::new(
+                ServiceId::builtin(WORKER_CONTROL_SERVICE_ID),
+                WORKER_LIFECYCLE_SERVICE_VERSION,
+                "Parent-owned SubWorker discovery and control operations",
+            ))
+    }
+
+    fn install(&self, context: &mut FeatureInstallContext<'_>) -> Result<(), FeatureInstallError> {
+        let control: Arc<dyn WorkerControlService> = Arc::new(WorkspaceWorkerControlService {
+            workspace_id: self.client.workspace_id().unwrap_or_default().to_string(),
+            client: self.client.clone(),
+            registry: Some(self.registry.clone()),
+        });
+        context.services().provide(
+            ServiceDeclaration::new(
+                ServiceId::builtin(WORKER_CONTROL_SERVICE_ID),
+                WORKER_LIFECYCLE_SERVICE_VERSION,
+                "Parent-owned SubWorker discovery and control operations",
+            ),
+            control,
+        )
+    }
+}
+
+pub fn sub_worker_control_feature(
+    client: Arc<dyn WorkspaceClient>,
+    registry: Arc<SpawnedWorkerRegistry>,
+) -> SubWorkerControlFeature {
+    SubWorkerControlFeature::new(client, registry)
+}
+
 impl FeatureModule for ManageWorkerFeature {
     fn descriptor(&self) -> FeatureDescriptor {
         let mut descriptor = FeatureDescriptor::builtin(FEATURE_ID, FEATURE_NAME)
@@ -1046,6 +1092,42 @@ mod tests {
         assert!(body.get("initial_text").is_none());
     }
 
+    #[tokio::test]
+    async fn worker_and_sub_worker_providers_are_ambiguous_before_install() {
+        let runtime_base = tempfile::tempdir().unwrap();
+        let runtime_dir = Arc::new(
+            crate::runtime::dir::RuntimeDir::create(runtime_base.path(), "feature-plan")
+                .await
+                .unwrap(),
+        );
+        let registry = SpawnedWorkerRegistry::new(runtime_dir);
+        let client: Arc<dyn WorkspaceClient> = Arc::new(RecordingWorkspaceClient::default());
+        let mut builder = crate::feature::FeatureRegistryBuilder::new();
+        builder.add_module(sub_worker_control_feature(client.clone(), registry.clone()));
+        builder.add_module(manage_worker_feature(client, Some(registry), true));
+
+        assert_eq!(
+            builder.plan(),
+            Err(crate::feature::FeaturePlanError::AmbiguousServiceProvider {
+                service: ServiceId::builtin(WORKER_CONTROL_SERVICE_ID),
+                providers: vec![
+                    crate::feature::FeatureId::builtin("sub-worker-control"),
+                    crate::feature::FeatureId::builtin("worker"),
+                ],
+            })
+        );
+
+        let mut hooks = crate::HookRegistryBuilder::default();
+        let mut pending_tools = Vec::new();
+        let report = builder.install_into_pending(&mut pending_tools, &mut hooks);
+        assert!(matches!(
+            report.plan_error,
+            Some(crate::feature::FeaturePlanError::AmbiguousServiceProvider { .. })
+        ));
+        assert!(pending_tools.is_empty());
+        assert!(report.services.providers().is_empty());
+    }
+
     #[test]
     fn worker_service_can_remain_enabled_without_direct_spawn_surface() {
         let client = Arc::new(RecordingWorkspaceClient::default());

crates/worker/src/feature/builtin/merge_request.rs

@@ -50,11 +50,11 @@ struct MergeRequestTool {
     kind: Kind,
 }
 #[derive(Debug, Deserialize, JsonSchema)]
-struct ShowInput {
+struct TicketInput {
     ticket: String,
 }
 #[derive(Debug, Deserialize, JsonSchema)]
-struct OpenInput {
+struct OpenMergeRequestInput {
     ticket: String,
     repository_id: String,
     selector_from: String,
@@ -63,7 +63,7 @@ struct OpenInput {
     summary: String,
 }
 #[derive(Debug, Deserialize, JsonSchema)]
-struct CompleteInput {
+struct CompleteMergeRequestInput {
     ticket: String,
     operation_id: String,
     approval_event_id: String,
@@ -86,7 +86,7 @@ enum MergeResolutionInput {
     ConflictsResolved,
 }
 #[derive(Debug, Deserialize, JsonSchema)]
-struct ReviewInput {
+struct ReviewMergeRequestInput {
     decision: ReviewDecisionInput,
     #[serde(default)]
     body: String,
@@ -133,19 +133,19 @@ impl Kind {
 
     fn name(self) -> &'static str {
         match self {
-            Self::Show => "MergeRequestShow",
-            Self::Readiness => "MergeRequestReadinessCheck",
-            Self::Open => "MergeRequestOpen",
-            Self::Complete => "MergeRequestComplete",
-            Self::Review => "MergeRequestReview",
+            Self::Show => "ShowMergeRequest",
+            Self::Readiness => "CheckMergeRequestReadiness",
+            Self::Open => "OpenMergeRequest",
+            Self::Complete => "CompleteMergeRequest",
+            Self::Review => "ReviewMergeRequest",
         }
     }
     fn schema(self) -> serde_json::Value {
         match self {
-            Self::Show | Self::Readiness => json!(schemars::schema_for!(ShowInput)),
-            Self::Open => json!(schemars::schema_for!(OpenInput)),
-            Self::Complete => json!(schemars::schema_for!(CompleteInput)),
-            Self::Review => json!(schemars::schema_for!(ReviewInput)),
+            Self::Show | Self::Readiness => json!(schemars::schema_for!(TicketInput)),
+            Self::Open => json!(schemars::schema_for!(OpenMergeRequestInput)),
+            Self::Complete => json!(schemars::schema_for!(CompleteMergeRequestInput)),
+            Self::Review => json!(schemars::schema_for!(ReviewMergeRequestInput)),
         }
     }
 }
@@ -156,13 +156,13 @@ impl Tool for MergeRequestTool {
             ToolError::ExecutionFailed("Merge Request tools require Workspace identity".into())
         })?;
         if matches!(self.kind, Kind::Show) {
-            let value: ShowInput = parse(input)?;
+            let value: TicketInput = parse(input)?;
             nonempty(&value.ticket)?;
             return self.show_current_merge_request(ws, &value.ticket);
         }
         let (method, path, body) = match self.kind {
             Kind::Readiness => {
-                let v: ShowInput = parse(input)?;
+                let v: TicketInput = parse(input)?;
                 nonempty(&v.ticket)?;
                 (
                     WorkspaceRequestMethod::Get,
@@ -170,9 +170,9 @@ impl Tool for MergeRequestTool {
                     None,
                 )
             }
-            Kind::Show => unreachable!("MergeRequestShow is handled above"),
+            Kind::Show => unreachable!("ShowMergeRequest is handled above"),
             Kind::Open => {
-                let v: OpenInput = parse(input)?;
+                let v: OpenMergeRequestInput = parse(input)?;
                 nonempty(&v.ticket)?;
                 (
                     WorkspaceRequestMethod::Post,
@@ -183,7 +183,7 @@ impl Tool for MergeRequestTool {
                 )
             }
             Kind::Complete => {
-                let v: CompleteInput = parse(input)?;
+                let v: CompleteMergeRequestInput = parse(input)?;
                 nonempty(&v.ticket)?;
                 (
                     WorkspaceRequestMethod::Post,
@@ -194,7 +194,7 @@ impl Tool for MergeRequestTool {
                 )
             }
             Kind::Review => {
-                let v: ReviewInput = parse(input)?;
+                let v: ReviewMergeRequestInput = parse(input)?;
                 let ctx = self.client.reviewer_context().ok_or_else(|| {
                     ToolError::ExecutionFailed(
                         "Review submit requires injected Reviewer capability".into(),
@@ -397,19 +397,21 @@ impl FeatureModule for MergeRequestFeature {
 
 pub fn description(n: &str) -> Option<&'static str> {
     match n {
-        "MergeRequestShow" => Some("Read the selector-based Merge Request and append-only thread."),
-        "MergeRequestReadinessCheck" => {
-            Some("Resolve current provider refs and derive readiness from valid review events.")
-        }
-        "MergeRequestOpen" => {
-            Some("Open a Merge Request with immutable source and target selectors.")
-        }
-        "MergeRequestComplete" => {
-            Some("Complete using an approved review event and final target-ref evidence.")
-        }
-        "MergeRequestReview" => {
-            Some("Submit the injected Reviewer capability result for its captured subject ref.")
-        }
+        "ShowMergeRequest" => Some(
+            "Read the selector-based Merge Request, append-only thread, source-review freshness, and target-integration evidence before review, fix, or handoff decisions.",
+        ),
+        "CheckMergeRequestReadiness" => Some(
+            "Resolve current provider refs and derive readiness from exact-source review evidence; source movement requires fresh review while target-only movement preserves unchanged-source approval.",
+        ),
+        "OpenMergeRequest" => Some(
+            "Open the Ticket's one Merge Request with immutable source and target selectors; reuse it and advance only selector_from with a normal non-force push for later fixes.",
+        ),
+        "CompleteMergeRequest" => Some(
+            "Record Orchestrator-owned integration using unchanged-source approval and refreshed final target-ref evidence.",
+        ),
+        "ReviewMergeRequest" => Some(
+            "Submit the injected Reviewer capability result for its captured exact source ref; source movement cancels it, while target-only movement does not.",
+        ),
         _ => None,
     }
 }
@@ -469,6 +471,31 @@ mod tests {
         }
     }
 
+    #[test]
+    fn model_facing_operations_use_only_verb_first_names() {
+        for name in [
+            "ShowMergeRequest",
+            "CheckMergeRequestReadiness",
+            "OpenMergeRequest",
+            "CompleteMergeRequest",
+            "ReviewMergeRequest",
+        ] {
+            assert!(description(name).is_some(), "missing operation {name}");
+        }
+        for legacy in [
+            "MergeRequestShow",
+            "MergeRequestReadinessCheck",
+            "MergeRequestOpen",
+            "MergeRequestComplete",
+            "MergeRequestReview",
+        ] {
+            assert!(
+                description(legacy).is_none(),
+                "legacy alias {legacy} must not remain registered"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn show_resolves_ticket_projection_then_reads_canonical_resource() {
         let client = Arc::new(RecordingWorkspaceClient::new(vec![
@@ -546,7 +573,7 @@ mod tests {
             open: true,
             ..Default::default()
         };
-        assert_eq!(tool_names(coder), ["MergeRequestShow", "MergeRequestOpen"]);
+        assert_eq!(tool_names(coder), ["ShowMergeRequest", "OpenMergeRequest"]);
 
         let reviewer = MergeRequestFeatureConfig {
             show: true,
@@ -555,7 +582,7 @@ mod tests {
         };
         assert_eq!(
             tool_names(reviewer),
-            ["MergeRequestShow", "MergeRequestReview"]
+            ["ShowMergeRequest", "ReviewMergeRequest"]
         );
 
         let orchestrator = MergeRequestFeatureConfig {
@@ -567,9 +594,9 @@ mod tests {
         assert_eq!(
             tool_names(orchestrator),
             [
-                "MergeRequestShow",
-                "MergeRequestReadinessCheck",
-                "MergeRequestComplete"
+                "ShowMergeRequest",
+                "CheckMergeRequestReadiness",
+                "CompleteMergeRequest"
             ]
         );
         assert_eq!(install(coder).1, [FEATURE_PROMPT_REF]);
@@ -581,8 +608,8 @@ mod tests {
     #[test]
     fn schemas_hide_revision_and_commit_authority() {
         let schemas = [
-            schemars::schema_for!(OpenInput),
-            schemars::schema_for!(CompleteInput),
+            schemars::schema_for!(OpenMergeRequestInput),
+            schemars::schema_for!(CompleteMergeRequestInput),
         ];
         for s in schemas {
             let j = serde_json::to_string(&s).unwrap();

crates/worker/src/feature/builtin/ticket.rs

@@ -873,12 +873,13 @@ impl WorkspaceHttpTicketBackend {
                 })?),
             )
             .map(TicketBackendOperationResult::Ticket),
-            TicketBackendOperation::QueueReady { id, .. } => Self::request_unit(
+            TicketBackendOperation::QueueReady { id, .. } => Self::request(
                 client,
                 WorkspaceRequestMethod::Post,
                 format!("{base}/{}/workflow/queue", Self::ticket_path(&id)),
                 None,
-            ),
+            )
+            .map(TicketBackendOperationResult::QueueOutcome),
             TicketBackendOperation::Close { id, resolution } => Self::request_unit(
                 client,
                 WorkspaceRequestMethod::Post,
@@ -1099,16 +1100,18 @@ impl TicketBackend for WorkspaceHttpTicketBackend {
         )
     }
 
-    fn queue_ready(&self, id: TicketIdOrSlug, queued_by: &str) -> TicketResult<()> {
-        match self.invoke(TicketBackendOperation::QueueReady {
-            id,
-            queued_by: queued_by.to_string(),
-        })? {
-            TicketBackendOperationResult::Unit => Ok(()),
-            other => Err(TicketError::Conflict(format!(
-                "unexpected ticket backend response: {other:?}"
-            ))),
-        }
+    fn queue_ready(
+        &self,
+        id: TicketIdOrSlug,
+        queued_by: &str,
+    ) -> TicketResult<ticket::TicketQueueOutcome> {
+        expect_ticket_result!(
+            self.invoke(TicketBackendOperation::QueueReady {
+                id,
+                queued_by: queued_by.to_string(),
+            }),
+            TicketBackendOperationResult::QueueOutcome
+        )
     }
 
     fn close(&self, id: TicketIdOrSlug, resolution: MarkdownText) -> TicketResult<()> {

crates/worker/src/internal_worker.rs

@@ -10,7 +10,7 @@ use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
 
 use agen::timeline::event::UsageEvent;
-use agen::{Engine, llm_client::LlmClient};
+use agen::{Engine, EngineError, llm_client::LlmClient};
 use manifest::{Scope, WorkerManifest};
 use protocol::{Event, InFlightSnapshot, WorkerStatus};
 use session_store::{LogEntry, SegmentId, SessionId, Store, StoreError, TraceEntry};
@@ -43,6 +43,8 @@ pub(crate) struct InternalWorkerAuthority {
     pub workspace: WorkerWorkspaceContext,
     pub filesystem: WorkerFilesystemAuthority,
     pub scope: Scope,
+    /// Provider-bound session inherited in an attenuated form from the owner.
+    pub workdir_session: Option<workdir::WorkdirSessionHandle>,
 }
 
 pub(crate) struct InternalWorkerSpec {
@@ -53,6 +55,7 @@ pub(crate) struct InternalWorkerSpec {
     pub input: String,
     pub cache_key: Option<String>,
     pub max_turns: Option<u32>,
+    pub engine_configurator: Option<Box<dyn FnOnce(&mut Engine<Box<dyn LlmClient>>) + Send>>,
     pub features: FeatureRegistryBuilder,
     pub required_tools: &'static [&'static str],
     pub authority: InternalWorkerAuthority,
@@ -102,6 +105,7 @@ where
         input,
         cache_key,
         max_turns,
+        engine_configurator,
         features,
         required_tools,
         authority,
@@ -128,7 +132,11 @@ where
     });
     engine.set_cache_key(cache_key);
     engine.set_max_turns(max_turns);
+    if let Some(configure) = engine_configurator {
+        configure(&mut engine);
+    }
     let store = EphemeralSessionStore::default();
+    let inherited_workdir_session = authority.workdir_session.clone();
     let mut worker = Worker::new(
         manifest,
         engine,
@@ -144,6 +152,9 @@ where
         identity: identity.clone(),
         history_entries: 0,
     })?;
+    if let Some(session) = inherited_workdir_session {
+        worker.bind_workdir_session(Some(session));
+    }
 
     let install_report = worker.install_features(features);
     let installed_tools = install_report.installed_tool_names();
@@ -188,6 +199,20 @@ where
     on_cancel_sender(worker.engine_mut().cancel_sender());
 
     match worker.run_text(&input).await {
+        Ok(WorkerRunResult::Interrupted(message)) => Err(InternalWorkerError {
+            source: WorkerError::Engine(EngineError::Aborted(message)),
+            usage: last_usage.lock().ok().and_then(|slot| slot.clone()),
+            identity,
+            history_entries: store.entries_count(session_id, segment_id),
+        }),
+        Ok(WorkerRunResult::LimitReached) => Err(InternalWorkerError {
+            source: WorkerError::Engine(EngineError::Aborted(
+                "internal Worker reached its turn limit".to_string(),
+            )),
+            usage: last_usage.lock().ok().and_then(|slot| slot.clone()),
+            identity,
+            history_entries: store.entries_count(session_id, segment_id),
+        }),
         Ok(lifecycle) => Ok(InternalWorkerResult {
             usage: last_usage.lock().ok().and_then(|slot| slot.clone()),
             identity,
@@ -250,7 +275,6 @@ impl InternalWorkerSessionStatus {
 
 #[derive(Debug, thiserror::Error)]
 pub(crate) enum InternalWorkerSessionError {
-    #[cfg(test)]
     #[error("failed to build internal Worker session: {message}")]
     Build { message: String },
     #[error("internal Worker session is busy")]
@@ -346,7 +370,7 @@ impl InternalWorkerSessionHandle {
                 InternalWorkerSessionStatus::Idle => WorkerStatus::Idle,
                 InternalWorkerSessionStatus::Stopping
                 | InternalWorkerSessionStatus::Stopped
-                | InternalWorkerSessionStatus::Failed => WorkerStatus::Paused,
+                | InternalWorkerSessionStatus::Failed => WorkerStatus::Stopped,
             },
             error: self.last_error.lock().unwrap().clone(),
             in_flight,
@@ -410,7 +434,6 @@ impl InternalWorkerSessionHandle {
         Ok(())
     }
 
-    #[cfg(test)]
     pub(crate) async fn wait_until_idle(&self) -> InternalWorkerSessionStatus {
         loop {
             let notified = self.state_changed.notified();
@@ -475,6 +498,7 @@ pub(crate) async fn spawn_internal_worker_session(
         input,
         cache_key,
         max_turns,
+        engine_configurator,
         features,
         required_tools,
         authority,
@@ -492,7 +516,11 @@ pub(crate) async fn spawn_internal_worker_session(
     });
     engine.set_cache_key(cache_key);
     engine.set_max_turns(max_turns);
+    if let Some(configure) = engine_configurator {
+        configure(&mut engine);
+    }
     let store = EphemeralSessionStore::default();
+    let inherited_workdir_session = authority.workdir_session.clone();
     let mut worker = Worker::new(
         manifest,
         engine,
@@ -505,6 +533,9 @@ pub(crate) async fn spawn_internal_worker_session(
     .map_err(|source| InternalWorkerSessionError::Build {
         message: source.to_string(),
     })?;
+    if let Some(session) = inherited_workdir_session {
+        worker.bind_workdir_session(Some(session));
+    }
     let install_report = worker.install_features(features);
     let installed_tools = install_report.installed_tool_names();
     let install_failed = install_report
@@ -539,6 +570,102 @@ pub(crate) async fn spawn_internal_worker_session(
     spawn_prepared_internal_worker_session(worker, store, input, None).await
 }
 
+/// Prepare an observable Internal Worker from the same bounded spec as one-shot
+/// helpers, but do not start its first turn. The owner must register the returned
+/// handle before calling `send`, preserving the snapshot/live boundary.
+pub(crate) fn prepare_internal_worker_from_spec(
+    spec: InternalWorkerSpec,
+    visibility: InternalWorkerVisibility,
+) -> std::pin::Pin<
+    Box<
+        dyn std::future::Future<
+                Output = Result<InternalWorkerSessionHandle, InternalWorkerSessionError>,
+            > + Send,
+    >,
+> {
+    Box::pin(async move {
+        let InternalWorkerSpec {
+            identity,
+            mut manifest,
+            client,
+            system_prompt,
+            input: _,
+            cache_key,
+            max_turns,
+            engine_configurator,
+            features,
+            required_tools,
+            authority,
+        } = spec;
+        manifest.worker.name = format!("internal-{}-{}", identity.kind, identity.run_id);
+        manifest.feature = Default::default();
+        manifest.plugins = Default::default();
+        manifest.mcp = Default::default();
+        manifest.skills = None;
+        manifest.compaction = None;
+        manifest.memory = None;
+
+        let mut engine = Engine::new(client).system_prompt(system_prompt);
+        engine.set_cache_key(cache_key);
+        engine.set_max_turns(max_turns);
+        if let Some(configure) = engine_configurator {
+            configure(&mut engine);
+        }
+        let store = EphemeralSessionStore::default();
+        let inherited_workdir_session = authority.workdir_session.clone();
+        let mut worker = Worker::new(
+            manifest,
+            engine,
+            store.clone(),
+            authority.workspace,
+            authority.filesystem,
+            authority.scope,
+        )
+        .await
+        .map_err(|source| InternalWorkerSessionError::Build {
+            message: source.to_string(),
+        })?;
+        if let Some(session) = inherited_workdir_session {
+            worker.bind_workdir_session(Some(session));
+        }
+        let install_report = worker.install_features(features);
+        let installed_tools = install_report.installed_tool_names();
+        let install_failed = install_report
+            .reports
+            .iter()
+            .any(|report| !report.installed);
+        let missing = required_tools
+            .iter()
+            .filter(|required| {
+                !installed_tools
+                    .iter()
+                    .any(|installed| installed == **required)
+            })
+            .copied()
+            .collect::<Vec<_>>();
+        if install_failed || !missing.is_empty() {
+            let diagnostics = install_report
+                .reports
+                .iter()
+                .flat_map(|report| report.diagnostics.iter())
+                .map(|diagnostic| diagnostic.message.as_str())
+                .collect::<Vec<_>>()
+                .join("; ");
+            return Err(InternalWorkerSessionError::Build {
+                message: format!(
+                    "internal Worker feature installation failed: {diagnostics}; missing tools: {}",
+                    missing.join(", ")
+                ),
+            });
+        }
+
+        Box::pin(prepare_internal_worker_session(
+            worker, store, visibility, None, None,
+        ))
+        .await
+    })
+}
+
 fn spawn_internal_log_event_bridge(sink: SegmentLogSink, event_tx: broadcast::Sender<Event>) {
     let (_, mut log_rx) = sink.subscribe_with_snapshot();
     tokio::spawn(async move {
@@ -621,6 +748,14 @@ pub(crate) async fn prepare_internal_worker_session(
                         tokio::select! {
                             result = &mut run => {
                                 let (turn_status, error) = match result {
+                                    Ok(WorkerRunResult::Interrupted(message)) => (
+                                        InternalWorkerSessionStatus::Stopped,
+                                        Some(message),
+                                    ),
+                                    Ok(WorkerRunResult::LimitReached) => (
+                                        InternalWorkerSessionStatus::Stopped,
+                                        Some("internal Worker reached its turn limit".to_string()),
+                                    ),
                                     Ok(_) => (InternalWorkerSessionStatus::Idle, None),
                                     Err(error) => (
                                         InternalWorkerSessionStatus::Failed,
@@ -635,11 +770,15 @@ pub(crate) async fn prepare_internal_worker_session(
                                         code: protocol::ErrorCode::Internal,
                                         message,
                                     });
-                                } else {
-                                    let _ = event_tx.send(Event::Status {
-                                        status: WorkerStatus::Idle,
-                                    });
                                 }
+                                let protocol_status = if turn_status == InternalWorkerSessionStatus::Idle {
+                                    WorkerStatus::Idle
+                                } else {
+                                    WorkerStatus::Stopped
+                                };
+                                let _ = event_tx.send(Event::Status {
+                                    status: protocol_status,
+                                });
                                 if let Some(callback) = &on_turn_end {
                                     callback(turn_status);
                                 }
@@ -653,7 +792,7 @@ pub(crate) async fn prepare_internal_worker_session(
                                         let _ = (&mut run).await;
                                         actor_in_flight.clear();
                                         status.store(InternalWorkerSessionStatus::Stopped.encode(), std::sync::atomic::Ordering::Release);
-                                        let _ = event_tx.send(Event::Status { status: WorkerStatus::Paused });
+                                        let _ = event_tx.send(Event::Status { status: WorkerStatus::Stopped });
                                         let _ = event_tx.send(Event::Shutdown);
                                         state_changed.notify_waiters();
                                         let _ = done.send(());
@@ -679,7 +818,7 @@ pub(crate) async fn prepare_internal_worker_session(
                         std::sync::atomic::Ordering::Release,
                     );
                     let _ = event_tx.send(Event::Status {
-                        status: WorkerStatus::Paused,
+                        status: WorkerStatus::Stopped,
                     });
                     let _ = event_tx.send(Event::Shutdown);
                     state_changed.notify_waiters();
@@ -989,6 +1128,26 @@ mod tests {
         }
     }
 
+    #[derive(Clone)]
+    struct FailingClient;
+
+    #[async_trait]
+    impl LlmClient for FailingClient {
+        fn clone_boxed(&self) -> Box<dyn LlmClient> {
+            Box::new(self.clone())
+        }
+
+        async fn stream(
+            &self,
+            _request: Request,
+        ) -> Result<Pin<Box<dyn Stream<Item = Result<LlmEvent, ClientError>> + Send>>, ClientError>
+        {
+            Err(ClientError::Config(
+                "intentional internal failure".to_string(),
+            ))
+        }
+    }
+
     #[derive(Clone)]
     struct CancelBeforeAiClient {
         calls: Arc<AtomicUsize>,
@@ -1076,12 +1235,14 @@ permission = "write"
             input: "input".to_string(),
             cache_key: Some("internal-test".to_string()),
             max_turns: Some(1),
+            engine_configurator: None,
             features: FeatureRegistryBuilder::new(),
             required_tools,
             authority: InternalWorkerAuthority {
                 workspace: WorkerWorkspaceContext::no_workspace(),
                 filesystem: WorkerFilesystemAuthority::None,
                 scope: Scope::empty(),
+                workdir_session: None,
             },
         }
     }
@@ -1100,6 +1261,31 @@ permission = "write"
         assert_eq!(result.identity.kind, "test");
     }
 
+    #[tokio::test]
+    async fn fatal_internal_run_transitions_to_stopped_protocol_status() {
+        let calls = Arc::new(AtomicUsize::new(0));
+        let mut internal_spec = spec(calls, &[]);
+        internal_spec.client = Box::new(FailingClient);
+
+        let handle = spawn_internal_worker_session(internal_spec)
+            .await
+            .expect("spawn failing Internal Worker session");
+        assert_eq!(
+            handle.wait_until_idle().await,
+            InternalWorkerSessionStatus::Stopped
+        );
+        assert_eq!(handle.status(), InternalWorkerSessionStatus::Stopped);
+        assert_eq!(handle.protocol_snapshot().status, WorkerStatus::Stopped);
+        assert!(
+            handle
+                .last_error
+                .lock()
+                .unwrap()
+                .as_ref()
+                .is_some_and(|message| message.contains("intentional internal failure"))
+        );
+    }
+
     #[tokio::test]
     async fn session_accepts_follow_up_turns_and_stops_without_runtime_registration() {
         let calls = Arc::new(AtomicUsize::new(0));

crates/worker/src/prompt/catalog.rs

@@ -609,6 +609,47 @@ mod tests {
         assert!(!prompt.contains("use the Ticket repository `origin` transport"));
     }
 
+    #[test]
+    fn merge_request_prompts_use_selector_refs_and_verb_first_operations() {
+        let catalog = PromptCatalog::builtins_only().unwrap();
+        let templates = &catalog.projection.templates;
+        let common = &templates["common.merge_request"];
+        let coder = &templates["role.coder"];
+        let orchestrator = &templates["role.orchestrator"];
+        let reviewer = &templates["role.reviewer"];
+        let combined = format!("{common}\n{coder}\n{orchestrator}\n{reviewer}");
+
+        for operation in [
+            "OpenMergeRequest",
+            "ShowMergeRequest",
+            "ReviewMergeRequest",
+            "CheckMergeRequestReadiness",
+            "CompleteMergeRequest",
+        ] {
+            assert!(combined.contains(operation), "missing {operation}");
+        }
+        for stale_operation in [
+            "MergeRequestOpen",
+            "MergeRequestShow",
+            "MergeRequestReview",
+            "MergeRequestReadinessCheck",
+            "MergeRequestComplete",
+            "MergeRequestAddRevision",
+        ] {
+            assert!(
+                !combined.contains(stale_operation),
+                "stale operation {stale_operation} remains in prompt authority"
+            );
+        }
+        assert!(common.contains("selector_from"));
+        assert!(common.contains("normal non-force push"));
+        assert!(common.contains("Moving only the target ref does not invalidate approval"));
+        assert!(common.contains("take precedence over stale Memory"));
+        assert!(coder.contains("Never invent an add-revision operation"));
+        assert!(orchestrator.contains("Target-only movement preserves source approval"));
+        assert!(reviewer.contains("target-only movement does not invalidate approval"));
+    }
+
     #[test]
     fn graph_rejects_dynamic_legacy_missing_and_cycles() {
         let invalid = BTreeMap::from([

crates/worker/src/session_capture.rs

@@ -143,6 +143,7 @@ pub(crate) struct SearchHit {
 #[derive(Debug, Clone, Copy)]
 pub(crate) enum ReadSelector<'a> {
     Id(&'a str),
+    #[cfg(test)]
     EntryRange([u64; 2]),
 }
 
@@ -418,6 +419,7 @@ impl SessionCapture {
                 .iter()
                 .filter(|entry| entry.id.as_str() == id)
                 .collect(),
+            #[cfg(test)]
             ReadSelector::EntryRange([start, end]) => self
                 .index
                 .iter()

crates/worker/src/spawn/registry.rs

@@ -1,7 +1,8 @@
-//! Parent-owned registry of direct Internal SubWorker sessions.
+//! Parent-owned registry of direct Internal Worker sessions.
 //!
-//! `SubWorkerSpawn` inserts typed `InternalWorkerSessionHandle`s; List/Send/Stop and
-//! worker-observation use the same in-memory authority. Internal children are not persisted, restored, discovered as
+//! `SubWorkerSpawn` inserts controllable SubWorker handles, while host services such as
+//! compaction insert parent-visible service handles without joining the model-facing
+//! List/Send/Stop surface. Internal children are not persisted, restored, discovered as
 //! Runtime Workers, or addressed through sockets. Restore consumes any legacy persisted process
 //! child records only to reclaim their delegated scope and clear obsolete metadata.
 //! Parent registry drop closes all session handles and synchronously returns delegated Write deny
@@ -177,6 +178,52 @@ impl InternalSpawnedWorkerRecord {
     }
 }
 
+/// Parent-visible service Internal Worker. Unlike a SubWorker this record has no
+/// delegated scope, model-facing control name, or stop-summary authority.
+#[derive(Clone)]
+pub(crate) struct InternalServiceWorkerRecord {
+    pub service_kind: String,
+    pub display_name: String,
+    pub session: InternalWorkerSessionHandle,
+    protocol_revision: Arc<AtomicU64>,
+    protocol_emit_lock: Arc<Mutex<()>>,
+    protocol_terminal: Arc<AtomicBool>,
+    forwarding_started: Arc<AtomicBool>,
+}
+
+impl InternalServiceWorkerRecord {
+    pub(crate) fn new(
+        service_kind: impl Into<String>,
+        display_name: impl Into<String>,
+        session: InternalWorkerSessionHandle,
+    ) -> Self {
+        Self {
+            service_kind: service_kind.into(),
+            display_name: display_name.into(),
+            session,
+            protocol_revision: Arc::new(AtomicU64::new(0)),
+            protocol_emit_lock: Arc::new(Mutex::new(())),
+            protocol_terminal: Arc::new(AtomicBool::new(false)),
+            forwarding_started: Arc::new(AtomicBool::new(false)),
+        }
+    }
+
+    fn protocol_ref(&self, parent_session_id: Option<String>) -> InternalWorkerRef {
+        InternalWorkerRef {
+            session_id: self.session.session_id_string(),
+            name: self.display_name.clone(),
+            parent_session_id,
+            kind: InternalWorkerKind::Service {
+                kind: self.service_kind.clone(),
+            },
+        }
+    }
+
+    fn protocol_revision(&self) -> u64 {
+        self.protocol_revision.load(Ordering::Acquire)
+    }
+}
+
 pub(crate) struct InternalSpawnReservation {
     registry: Arc<SpawnedWorkerRegistry>,
     worker_name: String,
@@ -214,6 +261,7 @@ impl Drop for InternalSpawnReservation {
 
 pub struct SpawnedWorkerRegistry {
     internal_records: std::sync::Mutex<Vec<InternalSpawnedWorkerRecord>>,
+    service_records: std::sync::Mutex<Vec<InternalServiceWorkerRecord>>,
     internal_names: std::sync::Mutex<HashSet<String>>,
     parent_scope: Option<SharedScope>,
     parent_protocol: Mutex<Option<(broadcast::Sender<Event>, String)>>,
@@ -226,10 +274,21 @@ pub struct SpawnedWorkerRegistryLoad {
 }
 
 impl SpawnedWorkerRegistry {
+    pub(crate) fn new_for_internal_services() -> Arc<Self> {
+        Arc::new(Self {
+            internal_records: std::sync::Mutex::new(Vec::new()),
+            service_records: std::sync::Mutex::new(Vec::new()),
+            internal_names: std::sync::Mutex::new(HashSet::new()),
+            parent_scope: None,
+            parent_protocol: Mutex::new(None),
+        })
+    }
+
     /// Empty registry used by tests and non-spawning projections.
     pub fn new(_runtime_dir: Arc<RuntimeDir>) -> Arc<Self> {
         Arc::new(Self {
             internal_records: std::sync::Mutex::new(Vec::new()),
+            service_records: std::sync::Mutex::new(Vec::new()),
             internal_names: std::sync::Mutex::new(HashSet::new()),
             parent_scope: None,
             parent_protocol: Mutex::new(None),
@@ -239,6 +298,7 @@ impl SpawnedWorkerRegistry {
     pub(crate) fn new_internal(_parent_name: String, parent_scope: SharedScope) -> Arc<Self> {
         Arc::new(Self {
             internal_records: std::sync::Mutex::new(Vec::new()),
+            service_records: std::sync::Mutex::new(Vec::new()),
             internal_names: std::sync::Mutex::new(HashSet::new()),
             parent_scope: Some(parent_scope),
             parent_protocol: Mutex::new(None),
@@ -317,6 +377,7 @@ impl SpawnedWorkerRegistry {
         Ok(SpawnedWorkerRegistryLoad {
             registry: Arc::new(Self {
                 internal_records: std::sync::Mutex::new(Vec::new()),
+                service_records: std::sync::Mutex::new(Vec::new()),
                 internal_names: std::sync::Mutex::new(HashSet::new()),
                 parent_scope,
                 parent_protocol: Mutex::new(None),
@@ -356,6 +417,144 @@ impl SpawnedWorkerRegistry {
         for record in self.internal_records.lock().unwrap().clone() {
             self.start_protocol_forwarding(record);
         }
+        for record in self.service_records.lock().unwrap().clone() {
+            self.start_service_protocol_forwarding(record);
+        }
+    }
+
+    /// Register a parent-visible service Internal Worker before its first turn.
+    pub(crate) fn attach_service(
+        &self,
+        record: InternalServiceWorkerRecord,
+    ) -> io::Result<InternalWorkerRef> {
+        let parent_session_id = self
+            .parent_protocol
+            .lock()
+            .unwrap()
+            .as_ref()
+            .map(|(_, id)| id.clone());
+        let worker_ref = record.protocol_ref(parent_session_id);
+        let session_id = record.session.session_id_string();
+        let mut records = self
+            .service_records
+            .lock()
+            .map_err(|_| io::Error::other("internal service-worker registry lock poisoned"))?;
+        if records
+            .iter()
+            .any(|candidate| candidate.session.session_id_string() == session_id)
+        {
+            return Err(io::Error::new(
+                io::ErrorKind::AlreadyExists,
+                "internal service Worker is already registered",
+            ));
+        }
+        records.push(record.clone());
+        drop(records);
+        self.start_service_protocol_forwarding(record);
+        Ok(worker_ref)
+    }
+
+    /// Stop and remove one parent-owned service Worker. This is host-only and is
+    /// intentionally separate from the SubWorker control surface.
+    pub(crate) async fn stop_service(&self, session_id: &str) -> io::Result<bool> {
+        let record = self
+            .service_records
+            .lock()
+            .map_err(|_| io::Error::other("internal service-worker registry lock poisoned"))?
+            .iter()
+            .find(|record| record.session.session_id_string() == session_id)
+            .cloned();
+        let Some(record) = record else {
+            return Ok(false);
+        };
+        record
+            .session
+            .stop()
+            .await
+            .map_err(|error| io::Error::other(error.to_string()))?;
+        self.remove_service(session_id)
+    }
+
+    /// Remove one service Worker and emit the terminal projection fence.
+    pub(crate) fn remove_service(&self, session_id: &str) -> io::Result<bool> {
+        let removed = {
+            let mut records = self
+                .service_records
+                .lock()
+                .map_err(|_| io::Error::other("internal service-worker registry lock poisoned"))?;
+            records
+                .iter()
+                .position(|record| record.session.session_id_string() == session_id)
+                .map(|index| records.remove(index))
+        };
+        if let Some(record) = removed {
+            self.publish_service_removal(&record);
+            Ok(true)
+        } else {
+            Ok(false)
+        }
+    }
+
+    fn start_service_protocol_forwarding(&self, record: InternalServiceWorkerRecord) {
+        if record.session.visibility() != InternalWorkerVisibility::ParentClient
+            || record.forwarding_started.swap(true, Ordering::AcqRel)
+        {
+            return;
+        }
+        let Some((parent_tx, parent_session_id)) = self.parent_protocol.lock().unwrap().clone()
+        else {
+            record.forwarding_started.store(false, Ordering::Release);
+            return;
+        };
+        let worker = record.protocol_ref(Some(parent_session_id));
+        let protocol_revision = record.protocol_revision.clone();
+        let protocol_emit_lock = record.protocol_emit_lock.clone();
+        let protocol_terminal = record.protocol_terminal.clone();
+        let mut child_rx = record.session.subscribe_events();
+        tokio::spawn(async move {
+            loop {
+                match child_rx.recv().await {
+                    Ok(event) => {
+                        let shutdown = matches!(event, Event::Shutdown);
+                        let _emit_guard = protocol_emit_lock
+                            .lock()
+                            .unwrap_or_else(|error| error.into_inner());
+                        if protocol_terminal.load(Ordering::Acquire) {
+                            break;
+                        }
+                        let revision = protocol_revision.fetch_add(1, Ordering::AcqRel) + 1;
+                        let _ = parent_tx.send(Event::InternalWorker {
+                            worker: worker.clone(),
+                            revision,
+                            event: Box::new(event),
+                        });
+                        if shutdown {
+                            break;
+                        }
+                    }
+                    Err(broadcast::error::RecvError::Lagged(skipped)) => {
+                        let _emit_guard = protocol_emit_lock
+                            .lock()
+                            .unwrap_or_else(|error| error.into_inner());
+                        if protocol_terminal.load(Ordering::Acquire) {
+                            break;
+                        }
+                        let revision = protocol_revision.fetch_add(1, Ordering::AcqRel) + 1;
+                        let _ = parent_tx.send(Event::InternalWorker {
+                            worker: worker.clone(),
+                            revision,
+                            event: Box::new(Event::Error {
+                                code: protocol::ErrorCode::Internal,
+                                message: format!(
+                                    "internal Worker output lagged by {skipped} events; reconnect to resynchronize"
+                                ),
+                            }),
+                        });
+                    }
+                    Err(broadcast::error::RecvError::Closed) => break,
+                }
+            }
+        });
     }
 
     fn start_protocol_forwarding(&self, record: InternalSpawnedWorkerRecord) {
@@ -427,28 +626,37 @@ impl SpawnedWorkerRegistry {
             .unwrap()
             .as_ref()
             .map(|(_, id)| id.clone());
-        self.internal_records
+        let mut snapshots = self
+            .internal_records
             .lock()
             .unwrap()
             .iter()
             .filter(|record| record.session.visibility() == InternalWorkerVisibility::ParentClient)
             .map(|record| {
-                let snapshot = record.session.protocol_snapshot();
-                InternalWorkerSnapshot {
-                    worker: record.protocol_ref(parent_session_id.clone()),
-                    revision: record.protocol_revision(),
-                    entries: snapshot
-                        .entries
-                        .into_iter()
-                        .filter_map(|entry| serde_json::to_value(entry).ok())
-                        .collect(),
-                    status: snapshot.status,
-                    error: snapshot.error,
-                    in_flight: snapshot.in_flight,
-                    internal_workers: snapshot.internal_workers,
-                }
+                internal_worker_snapshot(
+                    record.protocol_ref(parent_session_id.clone()),
+                    record.protocol_revision(),
+                    &record.session,
+                )
             })
-            .collect()
+            .collect::<Vec<_>>();
+        snapshots.extend(
+            self.service_records
+                .lock()
+                .unwrap()
+                .iter()
+                .filter(|record| {
+                    record.session.visibility() == InternalWorkerVisibility::ParentClient
+                })
+                .map(|record| {
+                    internal_worker_snapshot(
+                        record.protocol_ref(parent_session_id.clone()),
+                        record.protocol_revision(),
+                        &record.session,
+                    )
+                }),
+        );
+        snapshots
     }
 
     pub(crate) fn get_internal(&self, worker_name: &str) -> Option<InternalSpawnedWorkerRecord> {
@@ -567,6 +775,47 @@ impl SpawnedWorkerRegistry {
             revision,
         });
     }
+
+    fn publish_service_removal(&self, record: &InternalServiceWorkerRecord) {
+        if record.session.visibility() != InternalWorkerVisibility::ParentClient {
+            return;
+        }
+        let Some((parent_tx, parent_session_id)) = self.parent_protocol.lock().unwrap().clone()
+        else {
+            return;
+        };
+        let _emit_guard = record
+            .protocol_emit_lock
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        record.protocol_terminal.store(true, Ordering::Release);
+        let revision = record.protocol_revision.fetch_add(1, Ordering::AcqRel) + 1;
+        let _ = parent_tx.send(Event::InternalWorkerRemoved {
+            worker: record.protocol_ref(Some(parent_session_id)),
+            revision,
+        });
+    }
+}
+
+fn internal_worker_snapshot(
+    worker: InternalWorkerRef,
+    revision: u64,
+    session: &InternalWorkerSessionHandle,
+) -> InternalWorkerSnapshot {
+    let snapshot = session.protocol_snapshot();
+    InternalWorkerSnapshot {
+        worker,
+        revision,
+        entries: snapshot
+            .entries
+            .into_iter()
+            .filter_map(|entry| serde_json::to_value(entry).ok())
+            .collect(),
+        status: snapshot.status,
+        error: snapshot.error,
+        in_flight: snapshot.in_flight,
+        internal_workers: snapshot.internal_workers,
+    }
 }
 
 impl Drop for SpawnedWorkerRegistry {
@@ -813,6 +1062,63 @@ mod tests {
         assert_eq!(snapshots[0].in_flight.blocks.len(), 1);
     }
 
+    #[tokio::test]
+    async fn service_worker_is_parent_visible_but_not_subworker_controllable() {
+        let registry = registry();
+        let (parent_tx, mut parent_rx) = broadcast::channel(16);
+        registry.attach_parent_protocol(parent_tx, "parent-session".into());
+        let (session, child_tx) =
+            test_internal_worker_session(InternalWorkerVisibility::ParentClient);
+        let session_id = session.session_id_string();
+
+        let worker_ref = registry
+            .attach_service(InternalServiceWorkerRecord::new(
+                "compaction",
+                "Compaction",
+                session,
+            ))
+            .unwrap();
+        assert!(matches!(
+            worker_ref.kind,
+            InternalWorkerKind::Service { ref kind } if kind == "compaction"
+        ));
+        assert!(registry.list_internal().is_empty());
+
+        child_tx
+            .send(Event::TextDone {
+                text: "summary candidate".into(),
+            })
+            .unwrap();
+        let event = tokio::time::timeout(Duration::from_secs(1), parent_rx.recv())
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(matches!(
+            event,
+            Event::InternalWorker { worker, revision: 1, event }
+                if worker.session_id == session_id
+                    && matches!(worker.kind, InternalWorkerKind::Service { ref kind } if kind == "compaction")
+                    && matches!(*event, Event::TextDone { ref text } if text == "summary candidate")
+        ));
+        let snapshots = registry.internal_worker_snapshots();
+        assert_eq!(snapshots.len(), 1);
+        assert!(matches!(
+            snapshots[0].worker.kind,
+            InternalWorkerKind::Service { ref kind } if kind == "compaction"
+        ));
+        assert!(registry.remove_service(&session_id).unwrap());
+        let removed = tokio::time::timeout(Duration::from_secs(1), parent_rx.recv())
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(matches!(
+            removed,
+            Event::InternalWorkerRemoved { worker, revision: 2 }
+                if worker.session_id == session_id
+        ));
+        assert!(registry.internal_worker_snapshots().is_empty());
+    }
+
     #[tokio::test]
     async fn service_private_internal_output_is_never_disclosed() {
         let registry = registry();

crates/worker/src/spawn/tool.rs

@@ -329,13 +329,13 @@ fn validate_reviewer_handoff(input: &SubWorkerSpawnInput) -> Result<(), ToolErro
             "reviewer handoff requires the explicit effective profile builtin:reviewer".to_string(),
         ));
     }
-    if input
+    if !input
         .scope
         .iter()
         .any(|rule| matches!(rule.permission, PermissionInput::Write))
     {
         return Err(ToolError::InvalidArgument(
-            "Merge Request Reviewer SubWorkers must have read-only delegated scope".to_string(),
+            "Merge Request Reviewer SubWorkers must include writable delegated scope".to_string(),
         ));
     }
     Ok(())
@@ -499,7 +499,10 @@ impl Tool for SubWorkerSpawnTool {
             InternalWorkerVisibility::ParentClient,
             Some(child_registry.clone()),
             Some(Arc::new(move |status| {
-                if status == InternalWorkerSessionStatus::Failed {
+                if matches!(
+                    status,
+                    InternalWorkerSessionStatus::Failed | InternalWorkerSessionStatus::Stopped
+                ) {
                     if let Some(registry) = registry.upgrade() {
                         if let Err(error) = registry.reclaim_internal_scope(&child_name) {
                             tracing::warn!(
@@ -1008,28 +1011,28 @@ mod tests {
     }
 
     #[test]
-    fn reviewer_handoff_requires_explicit_builtin_profile_and_read_only_scope() {
+    fn reviewer_handoff_requires_explicit_builtin_profile_and_writable_scope() {
         let valid: SubWorkerSpawnInput = serde_json::from_value(serde_json::json!({
             "name":"reviewer","task":"review","profile":"builtin:reviewer",
-            "scope":[{"target":"work","permission":"read"}],
+            "scope":[{"target":"work","permission":"write"}],
             "review":{"ticket_id":"T1"}
         }))
         .unwrap();
         assert!(validate_reviewer_handoff(&valid).is_ok());
         let wrong_profile: SubWorkerSpawnInput = serde_json::from_value(serde_json::json!({
             "name":"reviewer","task":"review","profile":"builtin:coder",
-            "scope":[{"target":"work","permission":"read"}],
-            "review":{"ticket_id":"T1"}
-        }))
-        .unwrap();
-        assert!(validate_reviewer_handoff(&wrong_profile).is_err());
-        let writable: SubWorkerSpawnInput = serde_json::from_value(serde_json::json!({
-            "name":"reviewer","task":"review","profile":"builtin:reviewer",
             "scope":[{"target":"work","permission":"write"}],
             "review":{"ticket_id":"T1"}
         }))
         .unwrap();
-        assert!(validate_reviewer_handoff(&writable).is_err());
+        assert!(validate_reviewer_handoff(&wrong_profile).is_err());
+        let read_only: SubWorkerSpawnInput = serde_json::from_value(serde_json::json!({
+            "name":"reviewer","task":"review","profile":"builtin:reviewer",
+            "scope":[{"target":"work","permission":"read"}],
+            "review":{"ticket_id":"T1"}
+        }))
+        .unwrap();
+        assert!(validate_reviewer_handoff(&read_only).is_err());
     }
 
     fn abs_rule(path: &Path, permission: Permission) -> ScopeRule {
@@ -1079,7 +1082,7 @@ extract_threshold = 4000
     }
 
     #[tokio::test]
-    async fn reviewer_profile_spawns_and_notifies_parent_controller() {
+    async fn reviewer_profile_write_scope_exposes_command_tools_and_notifies_parent_controller() {
         let runtime = TempDir::new().unwrap();
         let workspace_root = runtime.path().join("project");
         let available_profiles = write_project_profile_registry(
@@ -1140,7 +1143,7 @@ extract_threshold = 4000
             "task": "review immutable commit",
             "scope": [{
                 "target": ".",
-                "permission": "read",
+                "permission": "write",
                 "recursive": true
             }]
         });
@@ -1171,11 +1174,10 @@ extract_threshold = 4000
         let record = registry
             .get_internal("reviewer-child")
             .expect("Internal reviewer registry record");
-        assert!(record.installed_tools.iter().any(|name| name == "Read"));
-        for denied in ["Write", "Edit", "Bash"] {
+        for required in ["Read", "Write", "Edit", "Glob", "Grep", "Bash"] {
             assert!(
-                !record.installed_tools.iter().any(|name| name == denied),
-                "read-only child unexpectedly received {denied}: {:?}",
+                record.installed_tools.iter().any(|name| name == required),
+                "write-scoped child is missing {required}: {:?}",
                 record.installed_tools
             );
         }
@@ -1283,16 +1285,16 @@ extract_threshold = 4000
         .unwrap();
         assert_eq!(
             record.session.wait_until_idle().await,
-            InternalWorkerSessionStatus::Failed
+            InternalWorkerSessionStatus::Stopped
         );
         assert_eq!(calls.load(Ordering::SeqCst), 3);
         assert!(
             spawner_scope.snapshot().is_writable(&workspace_root),
-            "Failed terminal child must release its delegated Workdir session"
+            "Stopped terminal child must release its delegated Workdir session"
         );
         assert!(
             !record.workdir_delegation.is_active(),
-            "failed child must revoke cloned scoped sessions"
+            "stopped child must revoke cloned scoped sessions"
         );
         assert!(registry.get_internal("reviewer-child").is_some());
 

crates/worker/tests/compact_events_test.rs

@@ -431,7 +431,7 @@ async fn pre_run_compact_success_broadcasts_start_and_done() {
     let kinds: Vec<&str> = events
         .iter()
         .map(|e| match e {
-            Event::CompactStart => "start",
+            Event::CompactStart { .. } => "start",
             Event::CompactDone { .. } => "done",
             Event::CompactFailed { .. } => "failed",
             _ => "other",
@@ -445,10 +445,61 @@ async fn pre_run_compact_success_broadcasts_start_and_done() {
         !kinds.contains(&"failed"),
         "unexpected CompactFailed in {kinds:?}"
     );
+    let starts = events
+        .iter()
+        .filter_map(|event| match event {
+            Event::CompactStart { lifecycle } => Some(lifecycle),
+            _ => None,
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(
+        starts.len(),
+        2,
+        "start and Internal Worker binding revisions"
+    );
+    assert_eq!(starts[0].compaction_id, starts[1].compaction_id);
+    assert_eq!(starts[0].revision, 1);
+    assert!(starts[0].internal_worker.is_none());
+    assert_eq!(starts[1].revision, 2);
+    assert!(matches!(
+        starts[1].internal_worker.as_ref().map(|worker| &worker.kind),
+        Some(protocol::InternalWorkerKind::Service { kind }) if kind == "compaction"
+    ));
+    assert!(events.iter().any(|event| matches!(
+        event,
+        Event::InternalWorker { worker, .. }
+            if matches!(&worker.kind, protocol::InternalWorkerKind::Service { kind } if kind == "compaction")
+    )), "compactor activity must be projected through the parent stream");
+    let completed = events
+        .iter()
+        .find_map(|event| match event {
+            Event::CompactDone { lifecycle } => Some(lifecycle),
+            _ => None,
+        })
+        .expect("completed lifecycle");
+    assert_eq!(completed.compaction_id, starts[0].compaction_id);
+    assert_eq!(completed.revision, 3);
+    assert_eq!(completed.summary.as_deref(), Some("summary"));
+    assert_eq!(completed.state, protocol::CompactionLifecycleState::Done);
+    let done_index = events
+        .iter()
+        .position(|event| matches!(event, Event::CompactDone { .. }))
+        .expect("done event");
+    let removed_index = events
+        .iter()
+        .position(|event| matches!(event, Event::InternalWorkerRemoved { .. }))
+        .expect("terminal compactor session must be released");
+    assert!(
+        done_index < removed_index,
+        "terminal lifecycle precedes release fence"
+    );
 
     // CompactDone carries the new Segment ID; the Session ID is unchanged.
     let new_id_in_event = events.iter().find_map(|e| match e {
-        Event::CompactDone { new_segment_id } => Some(*new_segment_id),
+        Event::CompactDone { lifecycle } => lifecycle
+            .new_segment_id
+            .as_deref()
+            .and_then(|value| uuid::Uuid::parse_str(value).ok()),
         _ => None,
     });
     assert!(new_id_in_event.is_some(), "CompactDone missing");
@@ -488,7 +539,7 @@ async fn mid_turn_compact_success_broadcasts_start_and_done() {
     let kinds: Vec<&str> = events
         .iter()
         .map(|e| match e {
-            Event::CompactStart => "start",
+            Event::CompactStart { .. } => "start",
             Event::CompactDone { .. } => "done",
             Event::CompactFailed { .. } => "failed",
             _ => "other",
@@ -504,7 +555,10 @@ async fn mid_turn_compact_success_broadcasts_start_and_done() {
     );
 
     let new_id_in_event = events.iter().find_map(|e| match e {
-        Event::CompactDone { new_segment_id } => Some(*new_segment_id),
+        Event::CompactDone { lifecycle } => lifecycle
+            .new_segment_id
+            .as_deref()
+            .and_then(|value| uuid::Uuid::parse_str(value).ok()),
         _ => None,
     });
     assert_eq!(new_id_in_event, Some(worker.segment_id()));
@@ -533,6 +587,9 @@ model_id = "test-model"
 max_tokens = 100
 
 [memory]
+workspace_id = "test-workspace"
+settings_revision = 1
+language = "English"
 extract_threshold = 1
 
 [compaction]
@@ -659,7 +716,7 @@ async fn pre_run_compact_failure_broadcasts_start_and_failed() {
     let kinds: Vec<&str> = events
         .iter()
         .map(|e| match e {
-            Event::CompactStart => "start",
+            Event::CompactStart { .. } => "start",
             Event::CompactDone { .. } => "done",
             Event::CompactFailed { .. } => "failed",
             _ => "other",
@@ -695,6 +752,9 @@ model_id = "test-model"
 max_tokens = 100
 
 [memory]
+workspace_id = "test-workspace"
+settings_revision = 1
+language = "English"
 extract_threshold = 1
 
 [[scope.allow]]
@@ -817,11 +877,14 @@ async fn controller_compact_method_emits_start_and_done() {
             .expect("timeout waiting for compact events")
             .expect("event")
         {
-            Event::CompactStart => saw_start = true,
+            Event::CompactStart { .. } => saw_start = true,
             Event::CompactDone { .. } => {
                 break;
             }
-            Event::CompactFailed { error } => panic!("manual compact failed: {error}"),
+            Event::CompactFailed { lifecycle } => panic!(
+                "manual compact failed: {}",
+                lifecycle.error.as_deref().unwrap_or("unknown error")
+            ),
             _ => {}
         }
     }

crates/worker/tests/session_metrics_test.rs

@@ -87,6 +87,7 @@ impl Tool for BigContentTool {
         Ok(ToolOutput {
             summary: self.summary.into(),
             content: Some(self.content.clone()),
+            attachments: Vec::new(),
         })
     }
 }

crates/workspace-api/src/lib.rs

@@ -7,6 +7,88 @@
 use serde::{Deserialize, Serialize};
 use workdir::workspace::WorkingDirectorySummary;
 
+/// Provider-neutral classification of an authoritative Repository source.
+///
+/// Local paths remain distinct from network Git transports so callers cannot
+/// accidentally treat an unmaterialized remote as a server-local filesystem path.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RepositorySourceKind {
+    LocalPath,
+    File,
+    Ssh,
+    Http,
+    Https,
+    /// A legacy value that could not be classified during migration. It remains
+    /// inspectable but every provider operation must fail closed.
+    Invalid,
+}
+
+impl RepositorySourceKind {
+    pub const fn is_remote(self) -> bool {
+        matches!(self, Self::Ssh | Self::Http | Self::Https)
+    }
+
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::LocalPath => "local_path",
+            Self::File => "file",
+            Self::Ssh => "ssh",
+            Self::Http => "http",
+            Self::Https => "https",
+            Self::Invalid => "invalid",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        Some(match value {
+            "local_path" => Self::LocalPath,
+            "file" => Self::File,
+            "ssh" => Self::Ssh,
+            "http" => Self::Http,
+            "https" => Self::Https,
+            "invalid" => Self::Invalid,
+            _ => return None,
+        })
+    }
+}
+
+/// Stable Repository source identity stored by Workspace authority.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RepositorySource {
+    pub kind: RepositorySourceKind,
+    /// Canonical source representation. This is an absolute local path for
+    /// `local_path`, and a normalized URI/remote specification otherwise.
+    pub uri: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RepositoryObservedStatus {
+    Unverified,
+    Ready,
+    Invalid,
+}
+
+impl RepositoryObservedStatus {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Unverified => "unverified",
+            Self::Ready => "ready",
+            Self::Invalid => "invalid",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        Some(match value {
+            "unverified" => Self::Unverified,
+            "ready" => Self::Ready,
+            "invalid" => Self::Invalid,
+            _ => return None,
+        })
+    }
+}
+
 pub const TICKET_RELATIONS_QUERY_PATH: &str = "/tickets/relations/search";
 pub const TICKET_ORCHESTRATION_PLANS_QUERY_PATH: &str = "/tickets/orchestration-plans/search";
 
@@ -165,24 +247,6 @@ pub struct RuntimeSourceSummary {
     pub note: String,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct RuntimeCapabilitySummary {
-    pub can_list_hosts: bool,
-    pub can_list_workers: bool,
-    pub can_get_worker: bool,
-    pub can_spawn_worker: bool,
-    pub can_stop_worker: bool,
-    pub has_workspace_fs: bool,
-    pub has_shell: bool,
-    pub has_git: bool,
-    pub supports_worktrees: bool,
-    pub supports_backend_internal_tools: bool,
-    pub workspace_scope: String,
-    pub max_workers: usize,
-    pub os: String,
-    pub arch: String,
-}
-
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct RuntimeSummary {
     pub runtime_id: String,
@@ -192,7 +256,9 @@ pub struct RuntimeSummary {
     pub source: RuntimeSourceSummary,
     #[serde(default)]
     pub host_ids: Vec<String>,
-    pub capabilities: RuntimeCapabilitySummary,
+    pub worker_creation_available: bool,
+    pub os: String,
+    pub arch: String,
     #[serde(default)]
     pub diagnostics: Vec<Diagnostic>,
 }
@@ -291,6 +357,116 @@ pub struct UpdateWorkspaceMemorySettingsRequest {
     pub language: String,
 }
 
+/// Public metadata for one Workspace-scoped Repository SSH credential.
+///
+/// Secret references and secret material are deliberately not part of this DTO.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct RepositorySshCredential {
+    pub credential_id: String,
+    pub workspace_id: String,
+    pub name: String,
+    pub public_key_algorithm: String,
+    pub public_key_fingerprint: String,
+    pub current_revision: u64,
+    pub status: String,
+    pub created_at: String,
+    pub rotated_at: Option<String>,
+    #[serde(default)]
+    pub referenced_repositories: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct CreateRepositorySshCredentialRequest {
+    pub operation_id: String,
+    pub credential_id: String,
+    pub name: String,
+    pub private_key: String,
+    #[serde(default)]
+    pub passphrase: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct RotateRepositorySshCredentialRequest {
+    pub operation_id: String,
+    pub expected_revision: u64,
+    pub private_key: String,
+    #[serde(default)]
+    pub passphrase: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct DeleteRepositorySshCredentialRequest {
+    pub operation_id: String,
+    pub expected_revision: u64,
+}
+
+/// Public metadata for an explicitly pinned SSH host key.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct RepositorySshHostTrust {
+    pub host_trust_id: String,
+    pub workspace_id: String,
+    pub hostname: String,
+    pub port: u16,
+    pub key_algorithm: String,
+    pub host_key: String,
+    pub fingerprint: String,
+    pub current_revision: u64,
+    pub created_at: String,
+    pub updated_at: String,
+    #[serde(default)]
+    pub referenced_repositories: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct PutRepositorySshHostTrustRequest {
+    pub operation_id: String,
+    pub host_trust_id: String,
+    pub hostname: String,
+    pub port: u16,
+    pub host_key: String,
+    #[serde(default)]
+    pub expected_revision: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct DeleteRepositorySshHostTrustRequest {
+    pub operation_id: String,
+    pub expected_revision: u64,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum RepositoryAccessMode {
+    ReadOnly,
+    ReadWrite,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct RepositorySshAccessBinding {
+    pub repository_id: String,
+    pub credential_id: String,
+    pub host_trust_id: String,
+    pub access: RepositoryAccessMode,
+}
+
+/// Secret-free active Repository access projection consumed by later Runtime work.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct RepositoryAccessProjection {
+    pub workspace_id: String,
+    pub config_revision: u64,
+    pub projection_digest: String,
+    pub bindings: Vec<RepositorySshAccessBinding>,
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

crates/workspace-server/Cargo.toml

@@ -25,11 +25,13 @@ manifest.workspace = true
 protocol = { workspace = true }
 project-record.workspace = true
 reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "native-tls"] }
+ring.workspace = true
 rusqlite.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 serde_yaml.workspace = true
 sha2.workspace = true
+ssh-key.workspace = true
 thiserror.workspace = true
 ticket.workspace = true
 memory.workspace = true
@@ -46,6 +48,7 @@ tracing.workspace = true
 ts-rs = { version = "12.0.1", optional = true }
 url.workspace = true
 uuid = { workspace = true, features = ["v7"] }
+zeroize.workspace = true
 webauthn-rs = { workspace = true }
 
 [dev-dependencies]

crates/workspace-server/src/auth.rs

@@ -176,8 +176,28 @@ fn actor_for_user<S: ControlPlaneStore + ?Sized>(
     }))
 }
 
-pub fn session_set_cookie(cookie_name: &str, token: &str, max_age_seconds: i64) -> String {
-    format!("{cookie_name}={token}; Max-Age={max_age_seconds}; Path=/; HttpOnly; SameSite=Lax")
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SessionCookiePolicy<'a> {
+    pub cookie_name: &'a str,
+    pub path: &'a str,
+    pub domain: Option<&'a str>,
+    pub secure: bool,
+}
+
+pub fn session_set_cookie(
+    policy: SessionCookiePolicy<'_>,
+    token: &str,
+    max_age_seconds: i64,
+) -> String {
+    let domain = policy
+        .domain
+        .map(|domain| format!("; Domain={domain}"))
+        .unwrap_or_default();
+    let secure = if policy.secure { "; Secure" } else { "" };
+    format!(
+        "{}={token}; Max-Age={max_age_seconds}; Path={}; HttpOnly; SameSite=Lax{domain}{secure}",
+        policy.cookie_name, policy.path
+    )
 }
 
 pub fn auth_error(code: &str, message: &str) -> Error {

crates/workspace-server/src/authority.rs

@@ -704,6 +704,15 @@ impl SqliteWorkspaceAuthority {
         &self,
         reference: &str,
         request: TicketShowRequest,
+    ) -> Result<TicketDetail> {
+        self.read_ticket_detail_with_backend(reference, request, &self.ticket_backend)
+    }
+
+    pub(crate) fn read_ticket_detail_with_backend(
+        &self,
+        reference: &str,
+        request: TicketShowRequest,
+        backend: &SqliteTicketBackend,
     ) -> Result<TicketDetail> {
         let id = self
             .store
@@ -713,16 +722,19 @@ impl SqliteWorkspaceAuthority {
                 reference,
             )?
             .ok_or_else(|| Error::Ticket(ticket::TicketError::NotFound(reference.to_string())))?;
-        let ticket = self.ticket_backend.show(TicketIdOrSlug::Id(id))?;
-        self.ticket_detail_from_ticket(ticket, request)
+        let ticket = backend.show(TicketIdOrSlug::Id(id))?;
+        self.ticket_detail_from_ticket(ticket, request, backend)
     }
 
     fn ticket_detail_from_ticket(
         &self,
         ticket: ticket::Ticket,
         request: TicketShowRequest,
+        dependency_backend: &SqliteTicketBackend,
     ) -> Result<TicketDetail> {
         let id = ticket.meta.id.as_str();
+        let dependency_check =
+            dependency_backend.dependency_check(TicketIdOrSlug::Id(id.to_string()))?;
         let (body, body_truncated) =
             truncate_body(ticket.document.body.as_str(), DETAIL_BODY_LIMIT);
         let event_limit = request
@@ -822,6 +834,27 @@ impl SqliteWorkspaceAuthority {
             .any(|assignment| assignment.role == TicketAssignmentRole::Coder);
         let has_target = ticket.meta.repository_id.is_some() && ticket.meta.ref_selector.is_some();
         let has_blockers = !ticket.relations.blockers.is_empty();
+        let mut queue_assignment_blockers = Vec::new();
+        for ticket_id in &dependency_check.queue_tickets {
+            let assignments = self
+                .store
+                .list_current_ticket_role_assignments(&self.workspace_id, ticket_id)?;
+            if !assignments
+                .iter()
+                .any(|assignment| assignment.role == TicketAssignmentRole::Orchestrator)
+            {
+                queue_assignment_blockers.push(format!(
+                    "Ticket {ticket_id} requires an active Orchestrator assignment"
+                ));
+            }
+            if assignments
+                .iter()
+                .any(|assignment| assignment.role == TicketAssignmentRole::Coder)
+            {
+                queue_assignment_blockers
+                    .push(format!("Ticket {ticket_id} has an active Coder assignment"));
+            }
+        }
         let mut assignment_diagnostics = Vec::new();
         if let Some(legacy_assignee) = ticket
             .meta
@@ -833,6 +866,19 @@ impl SqliteWorkspaceAuthority {
                 "legacy Ticket assignee `{legacy_assignee}` is not assignment authority"
             ));
         }
+        let mut action_blockers = Vec::new();
+        if !has_target {
+            action_blockers.push("Ticket target is required".to_string());
+        }
+        if !dependency_check.queue_guard.can_queue_for_orchestrator {
+            if let Some(reason) = dependency_check.queue_guard.blocked_reason.clone() {
+                action_blockers.push(reason);
+            } else if let Some(reason) = dependency_check.queue_guard.reason.clone() {
+                action_blockers.push(reason);
+            }
+        }
+        let queue_assignments_valid = queue_assignment_blockers.is_empty();
+        action_blockers.extend(queue_assignment_blockers);
         let action_eligibility = TicketActionEligibility {
             can_assign_orchestrator: matches!(
                 ticket.meta.workflow_state,
@@ -848,19 +894,15 @@ impl SqliteWorkspaceAuthority {
                 && has_orchestrator
                 && !has_coder
                 && has_target
-                && !has_blockers,
+                && dependency_check.queue_guard.can_queue_for_orchestrator
+                && queue_assignments_valid,
             can_start_manual_coder: ticket.meta.workflow_state == TicketWorkflowState::Ready
                 && !has_orchestrator
                 && !has_coder
                 && has_target
                 && !has_blockers,
-            blockers: [
-                (!has_target).then_some("Ticket target is required".to_string()),
-                has_blockers.then_some("unresolved blocking relations remain".to_string()),
-            ]
-            .into_iter()
-            .flatten()
-            .collect(),
+            queue_tickets: dependency_check.queue_tickets.clone(),
+            blockers: action_blockers,
         };
         let merge_request = match self.merge_request_store.get(&self.workspace_id, id) {
             Ok(request) => {
@@ -1084,6 +1126,7 @@ impl TicketAuthority for SqliteWorkspaceAuthority {
                     event_limit: Some(TICKET_EVENT_LIMIT),
                     event_cursor: None,
                 },
+                &self.ticket_backend,
             )?;
             if ticket_matches_query(
                 &summary,
@@ -2927,7 +2970,7 @@ mod tests {
     async fn sqlite_workspace_authority_reads_sqlite_records_without_filesystem_authority() {
         let dir = tempfile::tempdir().unwrap();
         write_ticket(dir.path(), "00000000001J2", "Read bridge", "ready");
-        write_ticket(dir.path(), "00000000001J5", "Second ticket", "planning");
+        write_ticket(dir.path(), "00000000001J5", "Second ticket", "queued");
         write_ticket(dir.path(), "00000000001J6", "Third ticket", "planning");
         let db_path = dir.path().join("workspace.db");
         let store = SqliteWorkspaceStore::open(&db_path).unwrap();
@@ -3038,10 +3081,22 @@ VALUES ('workspace-test', 'ticket', 4);
             .ticket_backend
             .add_ticket_relation(
                 TicketIdOrSlug::Id("00000000001J2".to_string()),
+                ticket::NewTicketRelation {
+                    kind: ticket::TicketRelationKind::DependsOn,
+                    target: "00000000001J5".to_string(),
+                    note: Some("queued dependency with a transitive blocker".to_string()),
+                    author: Some("tester".to_string()),
+                },
+            )
+            .unwrap();
+        authority
+            .ticket_backend
+            .add_ticket_relation(
+                TicketIdOrSlug::Id("00000000001J5".to_string()),
                 ticket::NewTicketRelation {
                     kind: ticket::TicketRelationKind::DependsOn,
                     target: "00000000001J6".to_string(),
-                    note: Some("separate dependency relation".to_string()),
+                    note: Some("transitive planning dependency".to_string()),
                     author: Some("tester".to_string()),
                 },
             )
@@ -3056,6 +3111,14 @@ VALUES ('workspace-test', 'ticket', 4);
         assert_eq!(ticket_by_key.id, tickets.items[0].id);
 
         let ticket = authority.ticket("00000000001J2").unwrap();
+        assert!(!ticket.action_eligibility.can_queue);
+        assert!(
+            ticket
+                .action_eligibility
+                .blockers
+                .iter()
+                .any(|reason| reason.contains("00000000001J6"))
+        );
         assert!(ticket.body.contains("Ticket body"));
         assert!(ticket.body_truncated);
         assert!(!ticket.body.contains("Deep Ticket marker"));
@@ -3139,8 +3202,8 @@ VALUES ('workspace-test', 'ticket', 4);
         assert!(note_only_kind.items.is_empty());
         let crossed_relation_filters = authority
             .query_tickets(TicketQueryRequest {
-                related_ticket_id: Some("00000000001J5".to_string()),
-                relation_kind: Some("depends_on".to_string()),
+                related_ticket_id: Some("00000000001J6".to_string()),
+                relation_kind: Some("related".to_string()),
                 ..TicketQueryRequest::default()
             })
             .unwrap();

crates/workspace-server/src/config.rs

@@ -3,53 +3,52 @@ use std::path::{Path, PathBuf};
 use std::{fs, io};
 
 use serde::{Deserialize, Serialize};
+use url::Url;
 
 use crate::hosts::RemoteRuntimeConfig;
 use crate::identity::WorkspaceIdentity;
-use crate::repositories::ConfiguredRepository;
 use crate::server::{AuthConfig, ServerConfig};
 use crate::{Error, Result};
 
-pub const WORKSPACE_BACKEND_CONFIG_RELATIVE_PATH: &str = ".yoi/workspace-backend.local.toml";
 pub const BACKEND_RUNTIMES_CONFIG_FILE_NAME: &str = "runtimes.toml";
-pub const WORKSPACE_BACKEND_CONFIG_TEMPLATE: &str =
-    include_str!("../../../resources/workspace-backend.default.toml");
+pub const SERVER_HOST_CONFIG_FILE_NAME: &str = "server.toml";
 const DEFAULT_LISTEN: &str = "127.0.0.1:8787";
-const DEFAULT_FRONTEND_URL: &str = "http://127.0.0.1:5173";
-const DEFAULT_AUTH_PUBLIC_BASE_URL: &str = "http://localhost:8787";
-const DEFAULT_AUTH_RP_ID: &str = "localhost";
+const DEFAULT_BROWSER_PUBLIC_URL: &str = "http://localhost:5173";
 const DEFAULT_AUTH_COOKIE_NAME: &str = "yoi_workspace_session";
 const DEFAULT_MAX_RECORDS: usize = 200;
 
-fn default_auth_rp_id() -> String {
-    DEFAULT_AUTH_RP_ID.to_string()
-}
-
-fn default_auth_origin() -> String {
-    DEFAULT_AUTH_PUBLIC_BASE_URL.to_string()
-}
-
-fn default_auth_public_base_url() -> String {
-    DEFAULT_AUTH_PUBLIC_BASE_URL.to_string()
-}
-
-fn default_auth_cookie_name() -> String {
-    DEFAULT_AUTH_COOKIE_NAME.to_string()
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(deny_unknown_fields)]
-pub struct WorkspaceBackendConfigFile {
+pub struct ServerHostConfigFile {
     #[serde(default)]
-    pub server: WorkspaceBackendServerConfig,
-    #[serde(default)]
-    pub data: WorkspaceBackendDataConfig,
-    #[serde(default)]
-    pub limits: WorkspaceBackendLimitsConfig,
-    #[serde(default)]
-    pub auth: WorkspaceBackendAuthConfig,
-    #[serde(default)]
-    pub repositories: Vec<WorkspaceRepositoryConfigFile>,
+    pub browser: ServerBrowserConfig,
+}
+
+impl Default for ServerHostConfigFile {
+    fn default() -> Self {
+        Self {
+            browser: ServerBrowserConfig::default(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct ServerBrowserConfig {
+    #[serde(default = "default_browser_public_url")]
+    pub public_url: String,
+}
+
+impl Default for ServerBrowserConfig {
+    fn default() -> Self {
+        Self {
+            public_url: default_browser_public_url(),
+        }
+    }
+}
+
+fn default_browser_public_url() -> String {
+    DEFAULT_BROWSER_PUBLIC_URL.to_string()
 }
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
@@ -59,71 +58,6 @@ pub struct BackendRuntimesConfigFile {
     pub runtimes: WorkspaceBackendRuntimesConfig,
 }
 
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct WorkspaceBackendServerConfig {
-    #[serde(default)]
-    pub listen: Option<String>,
-    #[serde(default)]
-    pub frontend_url: Option<String>,
-    #[serde(default)]
-    pub static_assets_dir: Option<PathBuf>,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct WorkspaceBackendDataConfig {
-    #[serde(default)]
-    pub root: Option<PathBuf>,
-    #[serde(default)]
-    pub workspace_database_path: Option<PathBuf>,
-    #[serde(default)]
-    pub embedded_runtime_store_root: Option<PathBuf>,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct WorkspaceBackendLimitsConfig {
-    #[serde(default)]
-    pub max_records: Option<usize>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct WorkspaceBackendAuthConfig {
-    #[serde(default = "default_auth_rp_id")]
-    pub rp_id: String,
-    #[serde(default = "default_auth_origin")]
-    pub origin: String,
-    #[serde(default = "default_auth_public_base_url")]
-    pub public_base_url: String,
-    #[serde(default = "default_auth_cookie_name")]
-    pub cookie_name: String,
-}
-
-impl Default for WorkspaceBackendAuthConfig {
-    fn default() -> Self {
-        Self {
-            rp_id: default_auth_rp_id(),
-            origin: default_auth_origin(),
-            public_base_url: default_auth_public_base_url(),
-            cookie_name: default_auth_cookie_name(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct WorkspaceRepositoryConfigFile {
-    pub id: String,
-    pub provider: String,
-    pub uri: String,
-    #[serde(default)]
-    pub display_name: Option<String>,
-    #[serde(default)]
-    pub default_selector: Option<String>,
-}
-
 #[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(deny_unknown_fields)]
 pub struct WorkspaceBackendRuntimesConfig {
@@ -142,61 +76,6 @@ pub struct RemoteRuntimeConfigFile {
     pub token_ref: Option<String>,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ConfigDiff {
-    pub differs: bool,
-    pub text: String,
-}
-
-impl ConfigDiff {
-    fn new(default: &str, local: &str) -> Self {
-        if default == local {
-            return Self {
-                differs: false,
-                text: "workspace backend local config matches the packaged default\n".to_string(),
-            };
-        }
-
-        let mut text = String::from("--- packaged default\n+++ workspace local\n");
-        let default_lines = default.lines().collect::<Vec<_>>();
-        let local_lines = local.lines().collect::<Vec<_>>();
-        let max = default_lines.len().max(local_lines.len());
-        for index in 0..max {
-            match (default_lines.get(index), local_lines.get(index)) {
-                (Some(left), Some(right)) if left == right => {
-                    text.push(' ');
-                    text.push_str(left);
-                    text.push('\n');
-                }
-                (Some(left), Some(right)) => {
-                    text.push('-');
-                    text.push_str(left);
-                    text.push('\n');
-                    text.push('+');
-                    text.push_str(right);
-                    text.push('\n');
-                }
-                (Some(left), None) => {
-                    text.push('-');
-                    text.push_str(left);
-                    text.push('\n');
-                }
-                (None, Some(right)) => {
-                    text.push('+');
-                    text.push_str(right);
-                    text.push('\n');
-                }
-                (None, None) => {}
-            }
-        }
-
-        Self {
-            differs: true,
-            text,
-        }
-    }
-}
-
 #[derive(Clone)]
 pub struct ResolvedWorkspaceBackendConfig {
     pub server: ServerConfig,
@@ -204,6 +83,47 @@ pub struct ResolvedWorkspaceBackendConfig {
     pub database_path: PathBuf,
 }
 
+impl ServerHostConfigFile {
+    pub fn path_for_config_dir(config_dir: impl AsRef<Path>) -> PathBuf {
+        config_dir.as_ref().join(SERVER_HOST_CONFIG_FILE_NAME)
+    }
+
+    pub fn default_path() -> Option<PathBuf> {
+        manifest::paths::config_dir().map(Self::path_for_config_dir)
+    }
+
+    pub fn load_default() -> Result<Self> {
+        let Some(path) = Self::default_path() else {
+            return Ok(Self::default());
+        };
+        match fs::read_to_string(&path) {
+            Ok(raw) => Self::parse_str(&raw, &path),
+            Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(Self::default()),
+            Err(error) => Err(Error::Io(error)),
+        }
+    }
+
+    pub fn load_from_path(path: impl AsRef<Path>) -> Result<Self> {
+        let path = path.as_ref();
+        let raw = fs::read_to_string(path).map_err(|error| {
+            Error::Config(format!(
+                "failed to read Server host config `{}`: {error}",
+                path.display()
+            ))
+        })?;
+        Self::parse_str(&raw, path)
+    }
+
+    pub fn parse_str(raw: &str, path: impl AsRef<Path>) -> Result<Self> {
+        toml::from_str(raw).map_err(|error| {
+            Error::Config(format!(
+                "failed to parse Server host config `{}`: {error}",
+                path.as_ref().display()
+            ))
+        })
+    }
+}
+
 impl BackendRuntimesConfigFile {
     pub fn path_for_config_dir(config_dir: impl AsRef<Path>) -> PathBuf {
         config_dir.as_ref().join(BACKEND_RUNTIMES_CONFIG_FILE_NAME)
@@ -272,151 +192,22 @@ impl BackendRuntimesConfigFile {
     }
 }
 
-impl WorkspaceBackendConfigFile {
-    pub fn path_for_workspace(workspace_root: impl AsRef<Path>) -> PathBuf {
-        workspace_root
-            .as_ref()
-            .join(WORKSPACE_BACKEND_CONFIG_RELATIVE_PATH)
-    }
-
-    pub fn ensure_local_config_for_workspace(workspace_root: impl AsRef<Path>) -> Result<()> {
-        let path = Self::path_for_workspace(workspace_root);
-        if let Some(parent) = path.parent() {
-            fs::create_dir_all(parent)?;
-        }
-        match fs::OpenOptions::new()
-            .write(true)
-            .create_new(true)
-            .open(&path)
-        {
-            Ok(mut file) => {
-                use std::io::Write;
-                file.write_all(WORKSPACE_BACKEND_CONFIG_TEMPLATE.as_bytes())?;
-                file.sync_all()?;
-                Ok(())
-            }
-            Err(error) if error.kind() == io::ErrorKind::AlreadyExists => Ok(()),
-            Err(error) => Err(Error::Io(error)),
-        }
-    }
-
-    pub fn local_config_diff_for_workspace(workspace_root: impl AsRef<Path>) -> Result<ConfigDiff> {
-        let workspace_root = workspace_root.as_ref();
-        let path = Self::path_for_workspace(workspace_root);
-        match fs::read_to_string(&path) {
-            Ok(local) => Ok(ConfigDiff::new(WORKSPACE_BACKEND_CONFIG_TEMPLATE, &local)),
-            Err(error) if error.kind() == io::ErrorKind::NotFound => Err(Error::Config(format!(
-                "workspace backend local config `{}` does not exist; run `yoi-server init --workspace {}` first",
-                path.display(),
-                workspace_root.display()
-            ))),
-            Err(error) => Err(Error::Io(error)),
-        }
-    }
-
-    pub fn load_for_workspace(workspace_root: impl AsRef<Path>) -> Result<Self> {
-        let path = Self::path_for_workspace(workspace_root);
-        match fs::read_to_string(&path) {
-            Ok(raw) => Self::parse_str(&raw, &path),
-            Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(Self::default()),
-            Err(error) => Err(Error::Io(error)),
-        }
-    }
-
-    pub fn write_for_workspace(&self, workspace_root: impl AsRef<Path>) -> Result<()> {
-        let path = Self::path_for_workspace(workspace_root);
-        if let Some(parent) = path.parent() {
-            fs::create_dir_all(parent)?;
-        }
-        let raw = toml::to_string_pretty(self).map_err(|error| {
-            Error::Config(format!(
-                "failed to serialize workspace backend config: {error}"
-            ))
-        })?;
-        fs::write(path, raw)?;
-        Ok(())
-    }
-
-    pub fn parse_str(raw: &str, path: impl AsRef<Path>) -> Result<Self> {
-        toml::from_str(raw).map_err(|error| {
-            Error::Config(format!(
-                "failed to parse workspace backend config `{}`: {error}",
-                path.as_ref().display()
-            ))
-        })
-    }
-
-    pub fn resolve(
-        &self,
-        workspace_root: impl AsRef<Path>,
-        identity: WorkspaceIdentity,
-    ) -> Result<ResolvedWorkspaceBackendConfig> {
-        self.resolve_with_runtime_config(
-            workspace_root,
-            identity,
-            &BackendRuntimesConfigFile::default(),
-        )
-    }
-
-    pub fn resolve_with_runtime_config(
-        &self,
+impl ResolvedWorkspaceBackendConfig {
+    pub fn local_dev(
         workspace_root: impl AsRef<Path>,
         identity: WorkspaceIdentity,
+        host_config: &ServerHostConfigFile,
         runtime_config: &BackendRuntimesConfigFile,
-    ) -> Result<ResolvedWorkspaceBackendConfig> {
+    ) -> Result<Self> {
         let workspace_root = workspace_root.as_ref();
-        let data_root = self
-            .data
-            .root
-            .as_ref()
-            .map(|path| resolve_workspace_path(workspace_root, path))
-            .unwrap_or_else(|| {
-                ServerConfig::default_workspace_backend_data_root(&identity.workspace_id)
-            });
-        let database_path = self
-            .data
-            .workspace_database_path
-            .as_ref()
-            .map(|path| resolve_workspace_path(workspace_root, path))
-            .unwrap_or_else(ServerConfig::default_server_database_path);
-        let embedded_runtime_store_root = self
-            .data
-            .embedded_runtime_store_root
-            .as_ref()
-            .map(|path| resolve_workspace_path(workspace_root, path))
-            .unwrap_or_else(|| data_root.join("embedded-runtime"));
-        let listen = self
-            .server
-            .listen
-            .as_deref()
-            .unwrap_or(DEFAULT_LISTEN)
-            .parse::<SocketAddr>()
-            .map_err(|_| {
-                Error::Config(format!(
-                    "invalid workspace backend server.listen `{}`",
-                    self.server.listen.as_deref().unwrap_or(DEFAULT_LISTEN)
-                ))
-            })?;
-
+        let data_root = ServerConfig::default_workspace_backend_data_root(&identity.workspace_id);
+        let database_path = ServerConfig::default_server_database_path();
+        let (browser_public_url, browser_rp_id) =
+            resolve_browser_public_url(&host_config.browser.public_url)?;
         let mut server = ServerConfig::local_dev(workspace_root.to_path_buf(), identity);
         server.database_path = database_path.clone();
-        server.frontend_url = self
-            .server
-            .frontend_url
-            .clone()
-            .unwrap_or_else(|| DEFAULT_FRONTEND_URL.to_string());
-        server.static_assets_dir = self
-            .server
-            .static_assets_dir
-            .as_ref()
-            .map(|path| resolve_workspace_path(workspace_root, path));
-        server.embedded_runtime_store_root = embedded_runtime_store_root;
-        server.max_records = self.limits.max_records.unwrap_or(DEFAULT_MAX_RECORDS);
-        server.repositories = self
-            .repositories
-            .iter()
-            .map(|repository| resolve_repository(workspace_root, repository))
-            .collect::<Result<Vec<_>>>()?;
+        server.embedded_runtime_store_root = data_root.join("embedded-runtime");
+        server.max_records = DEFAULT_MAX_RECORDS;
         server.remote_runtime_sources = runtime_config
             .runtimes
             .remote
@@ -424,13 +215,16 @@ impl WorkspaceBackendConfigFile {
             .map(resolve_remote_runtime)
             .collect::<Result<Vec<_>>>()?;
         server.auth = AuthConfig::Passkey {
-            rp_id: self.auth.rp_id.trim().to_string(),
-            origin: self.auth.origin.trim().to_string(),
-            public_base_url: self.auth.public_base_url.trim().to_string(),
-            cookie_name: self.auth.cookie_name.trim().to_string(),
+            rp_id: browser_rp_id,
+            origin: browser_public_url.clone(),
+            public_base_url: browser_public_url,
+            cookie_name: DEFAULT_AUTH_COOKIE_NAME.to_string(),
         };
+        let listen = DEFAULT_LISTEN.parse::<SocketAddr>().map_err(|error| {
+            Error::Config(format!("invalid built-in Server listen address: {error}"))
+        })?;
 
-        Ok(ResolvedWorkspaceBackendConfig {
+        Ok(Self {
             server,
             listen,
             database_path,
@@ -439,18 +233,6 @@ impl WorkspaceBackendConfigFile {
 }
 
 impl ResolvedWorkspaceBackendConfig {
-    pub fn with_database_path(mut self, path: impl Into<PathBuf>) -> Self {
-        let path = path.into();
-        self.database_path = path.clone();
-        self.server.database_path = path;
-        self
-    }
-
-    pub fn with_static_assets_dir(mut self, path: Option<PathBuf>) -> Self {
-        self.server.static_assets_dir = path;
-        self
-    }
-
     pub fn with_backend_base_url(mut self, base_url: impl Into<String>) -> Self {
         self.server.backend_base_url = Some(base_url.into().trim_end_matches('/').to_string());
         self
@@ -462,29 +244,6 @@ impl ResolvedWorkspaceBackendConfig {
     }
 }
 
-fn resolve_repository(
-    workspace_root: &Path,
-    config: &WorkspaceRepositoryConfigFile,
-) -> Result<ConfiguredRepository> {
-    let id = normalize_required_string("repository id", &config.id)?;
-    validate_repository_id(&id)?;
-    let provider =
-        normalize_required_string("repository provider", &config.provider)?.to_ascii_lowercase();
-    let uri = normalize_required_string("repository uri", &config.uri)?;
-    let path = resolve_repository_uri(workspace_root, &id, &uri)?;
-    let display_name = normalize_optional_string(config.display_name.as_deref());
-    let default_selector = normalize_optional_string(config.default_selector.as_deref());
-
-    Ok(ConfiguredRepository {
-        id,
-        provider,
-        uri,
-        path,
-        display_name,
-        default_selector,
-    })
-}
-
 fn normalize_required_string(field: &str, value: &str) -> Result<String> {
     let trimmed = value.trim();
     if trimmed.is_empty() {
@@ -493,45 +252,12 @@ fn normalize_required_string(field: &str, value: &str) -> Result<String> {
     Ok(trimmed.to_string())
 }
 
-fn normalize_optional_string(value: Option<&str>) -> Option<String> {
-    value.and_then(|value| {
-        let trimmed = value.trim();
-        if trimmed.is_empty() {
-            None
-        } else {
-            Some(trimmed.to_string())
-        }
-    })
-}
-
-fn validate_repository_id(id: &str) -> Result<()> {
-    if id
-        .chars()
-        .all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '_' | '-' | '.'))
-    {
-        Ok(())
-    } else {
-        Err(Error::Config(format!(
-            "repository id `{id}` must contain only ASCII letters, digits, `_`, `-`, or `.`"
-        )))
-    }
-}
-
-fn resolve_repository_uri(workspace_root: &Path, id: &str, uri: &str) -> Result<PathBuf> {
-    if uri.contains("://") {
-        return Err(Error::Config(format!(
-            "repository `{id}` uses a remote URI, but remote repository materialization is not implemented"
-        )));
-    }
-    Ok(resolve_workspace_path(workspace_root, Path::new(uri)))
-}
-
 pub(crate) fn resolve_remote_runtime(
     config: &RemoteRuntimeConfigFile,
 ) -> Result<RemoteRuntimeConfig> {
     if let Some(token_ref) = config.token_ref.as_deref() {
         return Err(Error::Config(format!(
-            "remote runtime `{}` uses token_ref `{token_ref}`, but secret ref resolution is not implemented for workspace backend config yet",
+            "remote runtime `{}` uses token_ref `{token_ref}`, but secret ref resolution is not implemented for Backend runtime settings yet",
             config.id
         )));
     }
@@ -546,12 +272,34 @@ pub(crate) fn resolve_remote_runtime(
     ))
 }
 
-fn resolve_workspace_path(workspace_root: &Path, path: &Path) -> PathBuf {
-    if path.is_absolute() {
-        path.to_path_buf()
-    } else {
-        workspace_root.join(path)
+fn resolve_browser_public_url(value: &str) -> Result<(String, String)> {
+    let value = normalize_required_string("browser.public_url", value)?;
+    let url = Url::parse(&value).map_err(|error| {
+        Error::Config(format!(
+            "browser.public_url must be an absolute http(s) URL: {error}"
+        ))
+    })?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(Error::Config(
+            "browser.public_url must use the http or https scheme".to_string(),
+        ));
     }
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(Error::Config(
+            "browser.public_url must not contain user information".to_string(),
+        ));
+    }
+    if url.path() != "/" || url.query().is_some() || url.fragment().is_some() {
+        return Err(Error::Config(
+            "browser.public_url must contain only an origin without a path, query, or fragment"
+                .to_string(),
+        ));
+    }
+    let rp_id = url
+        .host_str()
+        .ok_or_else(|| Error::Config("browser.public_url must contain a host".to_string()))?
+        .to_string();
+    Ok((url.origin().ascii_serialization(), rp_id))
 }
 
 #[cfg(test)]
@@ -566,14 +314,33 @@ mod tests {
         }
     }
 
-    #[test]
-    fn missing_config_path_uses_defaults() {
+    fn resolved_with_runtimes(
+        runtimes: &BackendRuntimesConfigFile,
+    ) -> ResolvedWorkspaceBackendConfig {
         let dir = tempfile::tempdir().unwrap();
-        let config = WorkspaceBackendConfigFile::load_for_workspace(dir.path()).unwrap();
-        let resolved = config.resolve(dir.path(), identity()).unwrap();
+        ResolvedWorkspaceBackendConfig::local_dev(
+            dir.path(),
+            identity(),
+            &ServerHostConfigFile::default(),
+            runtimes,
+        )
+        .unwrap()
+    }
+
+    #[test]
+    fn default_settings_resolve_without_a_repository_file() {
+        let resolved = resolved_with_runtimes(&BackendRuntimesConfigFile::default());
 
         assert_eq!(resolved.listen, "127.0.0.1:8787".parse().unwrap());
-        assert_eq!(resolved.server.frontend_url, DEFAULT_FRONTEND_URL);
+        let AuthConfig::Passkey {
+            rp_id,
+            origin,
+            public_base_url,
+            ..
+        } = &resolved.server.auth;
+        assert_eq!(rp_id, "localhost");
+        assert_eq!(origin, DEFAULT_BROWSER_PUBLIC_URL);
+        assert_eq!(public_base_url, DEFAULT_BROWSER_PUBLIC_URL);
         assert_eq!(resolved.server.max_records, DEFAULT_MAX_RECORDS);
         assert!(resolved.database_path.ends_with("server.db"));
         assert!(
@@ -586,12 +353,8 @@ mod tests {
 
     #[test]
     fn backend_base_url_is_explicit_and_normalized() {
-        let dir = tempfile::tempdir().unwrap();
         let listen = "127.0.0.1:48787".parse().unwrap();
-        let resolved = WorkspaceBackendConfigFile::load_for_workspace(dir.path())
-            .unwrap()
-            .resolve(dir.path(), identity())
-            .unwrap()
+        let resolved = resolved_with_runtimes(&BackendRuntimesConfigFile::default())
             .with_listen(listen)
             .with_backend_base_url("http://127.0.0.1:48787/");
 
@@ -603,172 +366,82 @@ mod tests {
     }
 
     #[test]
-    fn rejects_unknown_fields() {
-        let error = WorkspaceBackendConfigFile::parse_str("[server]\nunknown = true\n", "test")
-            .unwrap_err();
-        assert!(
-            error.to_string().contains("unknown field"),
-            "unexpected error: {error}"
-        );
-    }
-
-    #[test]
-    fn resolves_relative_paths_against_workspace_root() {
-        let dir = tempfile::tempdir().unwrap();
-        let config = WorkspaceBackendConfigFile::parse_str(
-            r#"
-[server]
-static_assets_dir = "web/build"
-
-[data]
-root = ".yoi/backend-data"
-workspace_database_path = ".yoi/custom.db"
-embedded_runtime_store_root = ".yoi/runtime-store"
-"#,
-            "test",
+    fn browser_public_url_from_host_config_drives_all_browser_auth_settings() {
+        let host_config = ServerHostConfigFile::parse_str(
+            "[browser]\npublic_url = \"https://Yoi.Example:443/\"\n",
+            "server.toml",
         )
         .unwrap();
-        let resolved = config.resolve(dir.path(), identity()).unwrap();
-
-        assert_eq!(
-            resolved.server.static_assets_dir,
-            Some(dir.path().join("web/build"))
-        );
-        assert_eq!(resolved.database_path, dir.path().join(".yoi/custom.db"));
-        assert_eq!(
-            resolved.server.embedded_runtime_store_root,
-            dir.path().join(".yoi/runtime-store")
-        );
-    }
-
-    #[test]
-    fn absolute_paths_are_preserved() {
-        let dir = tempfile::tempdir().unwrap();
-        let config = WorkspaceBackendConfigFile::parse_str(
-            r#"
-[data]
-workspace_database_path = "/tmp/yoi-workspace.db"
-embedded_runtime_store_root = "/tmp/yoi-runtime"
-"#,
-            "test",
+        let resolved = ResolvedWorkspaceBackendConfig::local_dev(
+            tempfile::tempdir().unwrap().path(),
+            identity(),
+            &host_config,
+            &BackendRuntimesConfigFile::default(),
         )
         .unwrap();
-        let resolved = config.resolve(dir.path(), identity()).unwrap();
 
-        assert_eq!(
-            resolved.database_path,
-            PathBuf::from("/tmp/yoi-workspace.db")
-        );
-        assert_eq!(
-            resolved.server.embedded_runtime_store_root,
-            PathBuf::from("/tmp/yoi-runtime")
-        );
+        let AuthConfig::Passkey {
+            rp_id,
+            origin,
+            public_base_url,
+            ..
+        } = &resolved.server.auth;
+        assert_eq!(rp_id, "yoi.example");
+        assert_eq!(origin, "https://yoi.example");
+        assert_eq!(public_base_url, "https://yoi.example");
     }
 
     #[test]
-    fn data_root_derives_runtime_store_path_only() {
-        let dir = tempfile::tempdir().unwrap();
-        let config = WorkspaceBackendConfigFile::parse_str(
-            r#"
-[data]
-root = ".local-data"
-"#,
-            "test",
-        )
-        .unwrap();
-        let resolved = config.resolve(dir.path(), identity()).unwrap();
-
-        assert!(resolved.database_path.ends_with("server.db"));
-        assert_eq!(
-            resolved.server.embedded_runtime_store_root,
-            dir.path().join(".local-data/embedded-runtime")
-        );
+    fn browser_public_url_rejects_non_origin_urls() {
+        for value in [
+            "https://example.test/path",
+            "https://example.test?query=true",
+            "file:///tmp/web",
+        ] {
+            let host_config = ServerHostConfigFile {
+                browser: ServerBrowserConfig {
+                    public_url: value.to_string(),
+                },
+            };
+            let result = ResolvedWorkspaceBackendConfig::local_dev(
+                tempfile::tempdir().unwrap().path(),
+                identity(),
+                &host_config,
+                &BackendRuntimesConfigFile::default(),
+            );
+            let error = match result {
+                Ok(_) => panic!("expected {value} to be rejected"),
+                Err(error) => error,
+            };
+            assert!(
+                error.to_string().contains("browser.public_url"),
+                "unexpected error for {value}: {error}"
+            );
+        }
     }
 
     #[test]
-    fn copies_local_config_without_overwriting() {
+    fn server_host_config_loads_only_from_the_explicit_host_path() {
         let dir = tempfile::tempdir().unwrap();
-        WorkspaceBackendConfigFile::ensure_local_config_for_workspace(dir.path()).unwrap();
-        let path = WorkspaceBackendConfigFile::path_for_workspace(dir.path());
-        let raw = fs::read_to_string(&path).unwrap();
-        assert_eq!(raw, WORKSPACE_BACKEND_CONFIG_TEMPLATE);
-        WorkspaceBackendConfigFile::parse_str(&raw, &path).unwrap();
-
-        fs::write(&path, "# custom local config\n").unwrap();
-        WorkspaceBackendConfigFile::ensure_local_config_for_workspace(dir.path()).unwrap();
-        assert_eq!(
-            fs::read_to_string(&path).unwrap(),
-            "# custom local config\n"
-        );
-    }
-
-    #[test]
-    fn local_config_diff_reports_match_and_difference() {
-        let dir = tempfile::tempdir().unwrap();
-        WorkspaceBackendConfigFile::ensure_local_config_for_workspace(dir.path()).unwrap();
-        let matched =
-            WorkspaceBackendConfigFile::local_config_diff_for_workspace(dir.path()).unwrap();
-        assert!(!matched.differs);
-
+        let path = ServerHostConfigFile::path_for_config_dir(dir.path());
         fs::write(
-            WorkspaceBackendConfigFile::path_for_workspace(dir.path()),
-            "[server]\nlisten = \"127.0.0.1:9999\"\n",
+            &path,
+            "[browser]\npublic_url = \"https://deploy.example.test\"\n",
         )
         .unwrap();
-        let diff = WorkspaceBackendConfigFile::local_config_diff_for_workspace(dir.path()).unwrap();
-        assert!(diff.differs);
-        assert!(diff.text.contains("+++ workspace local"));
-        assert!(diff.text.contains("127.0.0.1:9999"));
+
+        let loaded = ServerHostConfigFile::load_from_path(&path).unwrap();
+        assert_eq!(loaded.browser.public_url, "https://deploy.example.test");
+        assert_eq!(path, dir.path().join("server.toml"));
     }
 
     #[test]
-    fn resolves_repository_uri_relative_to_workspace_root() {
-        let dir = tempfile::tempdir().unwrap();
-        let config = WorkspaceBackendConfigFile::parse_str(
-            r#"
-[[repositories]]
-id = "main"
-provider = "git"
-uri = "."
-display_name = "Main"
-default_selector = "HEAD"
-"#,
-            "test",
-        )
-        .unwrap();
-        let resolved = config.resolve(dir.path(), identity()).unwrap();
-        let repository = resolved.server.repositories.first().unwrap();
-
-        assert_eq!(repository.id, "main");
-        assert_eq!(repository.provider, "git");
-        assert_eq!(repository.path, dir.path());
-        assert_eq!(repository.display_name.as_deref(), Some("Main"));
-        assert_eq!(repository.default_selector.as_deref(), Some("HEAD"));
-    }
-
-    #[test]
-    fn remote_repository_uri_fails_closed() {
-        let dir = tempfile::tempdir().unwrap();
-        let config = WorkspaceBackendConfigFile::parse_str(
-            r#"
-[[repositories]]
-id = "main"
-provider = "git"
-uri = "https://example.com/org/repo.git"
-"#,
-            "test",
-        )
-        .unwrap();
-        let error = match config.resolve(dir.path(), identity()) {
-            Ok(_) => panic!("remote repository URI should fail closed"),
-            Err(error) => error,
-        };
-
+    fn explicit_missing_server_host_config_fails_closed() {
+        let error = ServerHostConfigFile::load_from_path("/missing/yoi/server.toml").unwrap_err();
         assert!(
             error
                 .to_string()
-                .contains("remote repository materialization is not implemented"),
-            "unexpected error: {error}"
+                .contains("failed to read Server host config")
         );
     }
 
@@ -794,28 +467,8 @@ uri = "https://example.com/org/repo.git"
         );
     }
 
-    #[test]
-    fn workspace_backend_config_rejects_runtime_entries() {
-        let error = WorkspaceBackendConfigFile::parse_str(
-            r#"
-[[runtimes.remote]]
-id = "arc"
-endpoint = "http://legacy.example.test"
-display_name = "legacy arc"
-"#,
-            "test",
-        )
-        .unwrap_err();
-        assert!(
-            error.to_string().contains("unknown field `runtimes`"),
-            "unexpected error: {error}"
-        );
-    }
-
     #[test]
     fn backend_runtimes_config_is_the_only_runtime_source() {
-        let dir = tempfile::tempdir().unwrap();
-        let workspace_config = WorkspaceBackendConfigFile::parse_str("", "test").unwrap();
         let runtime_config = BackendRuntimesConfigFile::parse_str(
             r#"
 [[runtimes.remote]]
@@ -826,9 +479,7 @@ display_name = "xdg arc"
             "runtimes.toml",
         )
         .unwrap();
-        let resolved = workspace_config
-            .resolve_with_runtime_config(dir.path(), identity(), &runtime_config)
-            .unwrap();
+        let resolved = resolved_with_runtimes(&runtime_config);
         assert_eq!(resolved.server.remote_runtime_sources.len(), 1);
         assert_eq!(resolved.server.remote_runtime_sources[0].runtime_id, "arc");
         assert_eq!(
@@ -857,8 +508,6 @@ token = "secret"
 
     #[test]
     fn token_ref_fails_closed_until_secret_resolution_exists() {
-        let dir = tempfile::tempdir().unwrap();
-        let workspace_config = WorkspaceBackendConfigFile::parse_str("", "test").unwrap();
         let runtime_config = BackendRuntimesConfigFile::parse_str(
             r#"
 [[runtimes.remote]]
@@ -869,9 +518,10 @@ token_ref = "local:remote-token"
             "runtimes.toml",
         )
         .unwrap();
-        let error = match workspace_config.resolve_with_runtime_config(
-            dir.path(),
+        let error = match ResolvedWorkspaceBackendConfig::local_dev(
+            tempfile::tempdir().unwrap().path(),
             identity(),
+            &ServerHostConfigFile::default(),
             &runtime_config,
         ) {
             Ok(_) => panic!("token_ref should fail closed until secret resolution exists"),

crates/workspace-server/src/hosts.rs

@@ -25,8 +25,9 @@ use worker_runtime::auth::{CapabilityTokenSigner, capability_claims};
 use worker_runtime::catalog::{
     ConfigBundleRef, CreateWorkerRequest, ProfileSelector, ProfileSourceArchiveHttpRef,
     ProfileSourceArchiveSource, WorkerDetail as EmbeddedWorkerDetail,
-    WorkerStatus as EmbeddedWorkerStatus, WorkingDirectoryClaim, WorkingDirectoryRequest,
-    WorkingDirectoryStatus, WorkingDirectorySummary, WorkspaceApiRef,
+    WorkerStatus as EmbeddedWorkerStatus, WorkingDirectoryClaim,
+    WorkingDirectoryRepositoryAccessRequest, WorkingDirectoryRequest, WorkingDirectoryStatus,
+    WorkingDirectorySummary, WorkspaceApiRef,
 };
 use worker_runtime::config_bundle::{ConfigBundle, ConfigBundleAvailability, ConfigBundleSummary};
 #[cfg(test)]
@@ -39,11 +40,11 @@ use worker_runtime::execution::WorkerExecutionRunState;
 use worker_runtime::fs_store::FsRuntimeStoreOptions;
 use worker_runtime::http_server::{
     RuntimeHttpConfigBundleAvailabilityResponse, RuntimeHttpConfigBundleSyncRequest,
-    RuntimeHttpErrorResponse, RuntimeHttpSummaryResponse, RuntimeHttpWorkerCompletionsRequest,
-    RuntimeHttpWorkerCompletionsResponse, RuntimeHttpWorkerDeleteResponse,
-    RuntimeHttpWorkerInputResponse, RuntimeHttpWorkerLifecycleRequest,
-    RuntimeHttpWorkerLifecycleResponse, RuntimeHttpWorkerResponse,
-    RuntimeHttpWorkerWorkspaceApiRequest, RuntimeHttpWorkersResponse,
+    RuntimeHttpErrorResponse, RuntimeHttpRepositoryAccessResponse, RuntimeHttpSummaryResponse,
+    RuntimeHttpWorkerCompletionsRequest, RuntimeHttpWorkerCompletionsResponse,
+    RuntimeHttpWorkerDeleteResponse, RuntimeHttpWorkerInputResponse,
+    RuntimeHttpWorkerLifecycleRequest, RuntimeHttpWorkerLifecycleResponse,
+    RuntimeHttpWorkerResponse, RuntimeHttpWorkerWorkspaceApiRequest, RuntimeHttpWorkersResponse,
     RuntimeHttpWorkingDirectoriesResponse, RuntimeHttpWorkingDirectoryResponse,
     RuntimeHttpWorkspacePromptProjectionRequest, RuntimeHttpWorkspacePromptProjectionResponse,
 };
@@ -177,26 +178,6 @@ impl RuntimeSourceSummary {
     }
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct RuntimeCapabilitySummary {
-    pub can_list_hosts: bool,
-    pub can_list_workers: bool,
-    pub can_get_worker: bool,
-    pub can_spawn_worker: bool,
-    pub can_stop_worker: bool,
-    pub has_workspace_fs: bool,
-    pub has_shell: bool,
-    pub has_git: bool,
-    pub supports_worktrees: bool,
-    pub supports_backend_internal_tools: bool,
-    pub workspace_scope: String,
-    pub max_workers: usize,
-    pub os: String,
-    pub arch: String,
-}
-
-pub type HostCapabilitySummary = RuntimeCapabilitySummary;
-
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct RuntimeSummary {
     pub runtime_id: String,
@@ -205,7 +186,9 @@ pub struct RuntimeSummary {
     pub status: String,
     pub source: RuntimeSourceSummary,
     pub host_ids: Vec<String>,
-    pub capabilities: RuntimeCapabilitySummary,
+    pub worker_creation_available: bool,
+    pub os: String,
+    pub arch: String,
     pub diagnostics: Vec<RuntimeDiagnostic>,
 }
 
@@ -218,7 +201,8 @@ pub struct HostSummary {
     pub status: String,
     pub observed_at: String,
     pub last_seen_at: Option<String>,
-    pub capabilities: HostCapabilitySummary,
+    pub os: String,
+    pub arch: String,
     pub diagnostics: Vec<RuntimeDiagnostic>,
 }
 
@@ -310,27 +294,6 @@ impl From<RuntimeSourceSummary> for workspace_api::RuntimeSourceSummary {
     }
 }
 
-impl From<RuntimeCapabilitySummary> for workspace_api::RuntimeCapabilitySummary {
-    fn from(capabilities: RuntimeCapabilitySummary) -> Self {
-        Self {
-            can_list_hosts: capabilities.can_list_hosts,
-            can_list_workers: capabilities.can_list_workers,
-            can_get_worker: capabilities.can_get_worker,
-            can_spawn_worker: capabilities.can_spawn_worker,
-            can_stop_worker: capabilities.can_stop_worker,
-            has_workspace_fs: capabilities.has_workspace_fs,
-            has_shell: capabilities.has_shell,
-            has_git: capabilities.has_git,
-            supports_worktrees: capabilities.supports_worktrees,
-            supports_backend_internal_tools: capabilities.supports_backend_internal_tools,
-            workspace_scope: capabilities.workspace_scope,
-            max_workers: capabilities.max_workers,
-            os: capabilities.os,
-            arch: capabilities.arch,
-        }
-    }
-}
-
 impl From<RuntimeSummary> for workspace_api::RuntimeSummary {
     fn from(runtime: RuntimeSummary) -> Self {
         Self {
@@ -340,7 +303,9 @@ impl From<RuntimeSummary> for workspace_api::RuntimeSummary {
             status: runtime.status,
             source: runtime.source.into(),
             host_ids: runtime.host_ids,
-            capabilities: runtime.capabilities.into(),
+            worker_creation_available: runtime.worker_creation_available,
+            os: runtime.os,
+            arch: runtime.arch,
             diagnostics: runtime.diagnostics.into_iter().map(Into::into).collect(),
         }
     }
@@ -854,6 +819,16 @@ pub trait WorkspaceWorkerRuntime: Send + Sync {
         }
     }
 
+    fn authorize_working_directory_repository_access(
+        &self,
+        _request: WorkingDirectoryRepositoryAccessRequest,
+    ) -> std::result::Result<(), Error> {
+        Err(Error::InvalidInput(
+            "Runtime does not support working directory Repository access authorization"
+                .to_string(),
+        ))
+    }
+
     fn list_working_directories(&self) -> RuntimeList<WorkingDirectoryStatus> {
         RuntimeList::new(Vec::new(), Vec::new())
     }
@@ -1427,6 +1402,23 @@ impl RuntimeRegistry {
         Ok(runtime.create_working_directory(request))
     }
 
+    pub fn authorize_working_directory_repository_access(
+        &self,
+        runtime_id: &str,
+        request: WorkingDirectoryRepositoryAccessRequest,
+    ) -> Result<(), RuntimeRegistryError> {
+        validate_backend_identifier("runtime_id", runtime_id)?;
+        validate_backend_identifier("working_directory_id", &request.working_directory_id)?;
+        let runtime = self.runtime(runtime_id)?;
+        runtime
+            .authorize_working_directory_repository_access(request)
+            .map_err(|error| RuntimeRegistryError::RuntimeOperationFailed {
+                runtime_id: runtime_id.to_string(),
+                code: "working_directory_repository_access_failed".to_string(),
+                message: error.to_string(),
+            })
+    }
+
     pub fn list_working_directories(
         &self,
         runtime_id: &str,
@@ -1890,7 +1882,9 @@ impl WorkspaceWorkerRuntime for EmbeddedWorkerRuntime {
                     status: "unavailable".to_string(),
                     source: RuntimeSourceSummary::embedded_worker_runtime(),
                     host_ids: Vec::new(),
-                    capabilities: embedded_runtime_capabilities(limit, false, false),
+                    worker_creation_available: false,
+                    os: std::env::consts::OS.to_string(),
+                    arch: std::env::consts::ARCH.to_string(),
                     diagnostics,
                 };
             }
@@ -1910,7 +1904,9 @@ impl WorkspaceWorkerRuntime for EmbeddedWorkerRuntime {
             } else {
                 vec![self.host_id.clone()]
             },
-            capabilities: embedded_runtime_capabilities(limit, true, self.execution_enabled),
+            worker_creation_available: true,
+            os: std::env::consts::OS.to_string(),
+            arch: std::env::consts::ARCH.to_string(),
             diagnostics,
         }
     }
@@ -1928,7 +1924,8 @@ impl WorkspaceWorkerRuntime for EmbeddedWorkerRuntime {
                 status: "available".to_string(),
                 observed_at: Utc::now().to_rfc3339(),
                 last_seen_at: None,
-                capabilities: embedded_runtime_capabilities(limit, true, self.execution_enabled),
+                os: std::env::consts::OS.to_string(),
+                arch: std::env::consts::ARCH.to_string(),
                 diagnostics: vec![diagnostic(
                     "embedded_runtime_host_boundary",
                     DiagnosticSeverity::Info,
@@ -2576,7 +2573,9 @@ pub struct RemoteRuntimeConfig {
     pub base_url: String,
     pub bearer_token: Option<String>,
     pub auth: Option<RemoteRuntimeAuthConfig>,
-    pub cached_capabilities: RuntimeCapabilitySummary,
+    pub cached_worker_creation_available: bool,
+    pub cached_os: String,
+    pub cached_arch: String,
     pub cached_status: String,
     pub timeout: Duration,
 }
@@ -2598,7 +2597,12 @@ impl std::fmt::Debug for RemoteRuntimeConfig {
                 &self.bearer_token.as_ref().map(|_| "<redacted>"),
             )
             .field("auth", &self.auth.as_ref().map(|_| "<capability-signer>"))
-            .field("cached_capabilities", &self.cached_capabilities)
+            .field(
+                "cached_worker_creation_available",
+                &self.cached_worker_creation_available,
+            )
+            .field("cached_os", &self.cached_os)
+            .field("cached_arch", &self.cached_arch)
             .field("cached_status", &self.cached_status)
             .field("timeout", &self.timeout)
             .finish()
@@ -2619,9 +2623,9 @@ impl RemoteRuntimeConfig {
             base_url: base_url.into(),
             bearer_token,
             auth: None,
-            cached_capabilities: remote_runtime_capabilities(
-                200, false, false, "unknown", "unknown",
-            ),
+            cached_worker_creation_available: false,
+            cached_os: "unknown".to_string(),
+            cached_arch: "unknown".to_string(),
             cached_status: "configured".to_string(),
             timeout: Duration::from_secs(10),
         }
@@ -2632,11 +2636,6 @@ impl RemoteRuntimeConfig {
         self
     }
 
-    pub fn with_cached_capabilities(mut self, capabilities: RuntimeCapabilitySummary) -> Self {
-        self.cached_capabilities = capabilities;
-        self
-    }
-
     pub fn with_auth(mut self, auth: RemoteRuntimeAuthConfig) -> Self {
         self.auth = Some(auth);
         self
@@ -2708,7 +2707,9 @@ pub struct RemoteWorkerRuntime {
     workspace_id: String,
     bearer_token: Option<String>,
     auth: Option<RemoteRuntimeAuthConfig>,
-    cached_capabilities: RuntimeCapabilitySummary,
+    cached_worker_creation_available: bool,
+    cached_os: String,
+    cached_arch: String,
     cached_status: String,
     host_id: String,
     resource_broker: BackendResourceBroker,
@@ -2768,7 +2769,9 @@ impl RemoteWorkerRuntime {
             workspace_id,
             bearer_token: config.bearer_token,
             auth: config.auth,
-            cached_capabilities: config.cached_capabilities,
+            cached_worker_creation_available: config.cached_worker_creation_available,
+            cached_os: config.cached_os,
+            cached_arch: config.cached_arch,
             cached_status: config.cached_status,
             resource_broker: BackendResourceBroker::default(),
             http,
@@ -3045,13 +3048,9 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
                 } else {
                     vec![self.host_id.clone()]
                 },
-                capabilities: remote_runtime_capabilities(
-                    limit,
-                    true,
-                    response.runtime.worker_creation_available,
-                    response.runtime.os,
-                    response.runtime.arch,
-                ),
+                worker_creation_available: response.runtime.worker_creation_available,
+                os: response.runtime.os,
+                arch: response.runtime.arch,
                 diagnostics: Vec::new(),
             },
             Err(diagnostic) => RuntimeSummary {
@@ -3065,7 +3064,9 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
                 } else {
                     vec![self.host_id.clone()]
                 },
-                capabilities: self.cached_capabilities.clone(),
+                worker_creation_available: self.cached_worker_creation_available,
+                os: self.cached_os.clone(),
+                arch: self.cached_arch.clone(),
                 diagnostics: vec![diagnostic],
             },
         }
@@ -3084,7 +3085,8 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
                 status: "configured".to_string(),
                 observed_at: Utc::now().to_rfc3339(),
                 last_seen_at: None,
-                capabilities: remote_runtime_capabilities(limit, true, false, "unknown", "unknown"),
+                os: self.cached_os.clone(),
+                arch: self.cached_arch.clone(),
                 diagnostics: Vec::new(),
             }],
             Vec::new(),
@@ -3205,6 +3207,18 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
         }
     }
 
+    fn authorize_working_directory_repository_access(
+        &self,
+        request: WorkingDirectoryRepositoryAccessRequest,
+    ) -> std::result::Result<(), Error> {
+        self.post_json::<_, RuntimeHttpRepositoryAccessResponse>(
+            "/v1/working-directories/repository-access",
+            &request,
+        )
+        .map(|_| ())
+        .map_err(|diagnostic| Error::RegistryInconsistency(diagnostic.message))
+    }
+
     fn list_working_directories(&self) -> RuntimeList<WorkingDirectoryStatus> {
         match self.get_json::<RuntimeHttpWorkingDirectoriesResponse>("/v1/working-directories") {
             Ok(response) => RuntimeList::new(response.working_directories, Vec::new()),
@@ -3553,29 +3567,6 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
     }
 }
 
-fn embedded_runtime_capabilities(
-    limit: usize,
-    available: bool,
-    execution_enabled: bool,
-) -> RuntimeCapabilitySummary {
-    RuntimeCapabilitySummary {
-        can_list_hosts: true,
-        can_list_workers: available,
-        can_get_worker: available,
-        can_spawn_worker: available,
-        can_stop_worker: available && execution_enabled,
-        has_workspace_fs: false,
-        has_shell: false,
-        has_git: false,
-        supports_worktrees: false,
-        supports_backend_internal_tools: true,
-        workspace_scope: "backend_internal".to_string(),
-        max_workers: limit,
-        os: std::env::consts::OS.to_string(),
-        arch: std::env::consts::ARCH.to_string(),
-    }
-}
-
 fn embedded_runtime_status_label(status: RuntimeStatus) -> &'static str {
     match status {
         RuntimeStatus::Running => "running",
@@ -4122,31 +4113,6 @@ fn percent_encode(input: &str, keep: impl Fn(u8) -> bool) -> String {
     encoded
 }
 
-fn remote_runtime_capabilities(
-    limit: usize,
-    available: bool,
-    worker_creation_available: bool,
-    os: impl Into<String>,
-    arch: impl Into<String>,
-) -> RuntimeCapabilitySummary {
-    RuntimeCapabilitySummary {
-        can_list_hosts: true,
-        can_list_workers: available,
-        can_get_worker: available,
-        can_spawn_worker: available && worker_creation_available,
-        can_stop_worker: available,
-        has_workspace_fs: false,
-        has_shell: false,
-        has_git: false,
-        supports_worktrees: false,
-        supports_backend_internal_tools: false,
-        workspace_scope: "remote_runtime_backend_private".to_string(),
-        max_workers: limit,
-        os: os.into(),
-        arch: arch.into(),
-    }
-}
-
 fn remote_reqwest_diagnostic(runtime_id: &str, err: reqwest::Error) -> RuntimeDiagnostic {
     if err.is_timeout() {
         diagnostic(
@@ -4460,7 +4426,7 @@ mod tests {
         let handle = bundle.profile_source_archive_handle.as_ref().unwrap();
         assert!(bundle.profile_source_archive.is_none());
         let response = broker
-            .fetch_profile_source_archive(worker_runtime::resource::BackendResourceFetchRequest {
+            .fetch_resource(worker_runtime::resource::BackendResourceFetchRequest {
                 handle: handle.clone(),
                 runtime_id: runtime_id.to_string(),
                 worker_id: None,
@@ -4800,22 +4766,9 @@ mod tests {
                 status: "available".to_string(),
                 source: RuntimeSourceSummary::embedded_worker_runtime_reserved(),
                 host_ids: vec![self.host_id.clone()],
-                capabilities: RuntimeCapabilitySummary {
-                    can_list_hosts: true,
-                    can_list_workers: true,
-                    can_get_worker: true,
-                    can_spawn_worker: false,
-                    can_stop_worker: false,
-                    has_workspace_fs: false,
-                    has_shell: false,
-                    has_git: false,
-                    supports_worktrees: false,
-                    supports_backend_internal_tools: false,
-                    workspace_scope: "none".to_string(),
-                    max_workers: self.workers.len(),
-                    os: "test".to_string(),
-                    arch: "test".to_string(),
-                },
+                worker_creation_available: false,
+                os: "test".to_string(),
+                arch: "test".to_string(),
                 diagnostics: Vec::new(),
             }
         }
@@ -4830,7 +4783,8 @@ mod tests {
                     status: "available".to_string(),
                     observed_at: "unknown".to_string(),
                     last_seen_at: None,
-                    capabilities: self.runtime_summary(1).capabilities,
+                    os: "test".to_string(),
+                    arch: "test".to_string(),
                     diagnostics: Vec::new(),
                 }],
                 Vec::new(),
@@ -5234,7 +5188,7 @@ mod tests {
             RuntimeSourceKind::EmbeddedWorkerRuntime
         );
         assert_eq!(embedded_summary.source.status, RuntimeSourceStatus::Active);
-        assert!(embedded_summary.capabilities.can_spawn_worker);
+        assert!(embedded_summary.worker_creation_available);
 
         let spawned = registry
             .spawn_worker(

crates/workspace-server/src/identity.rs

@@ -46,8 +46,7 @@ impl WorkspaceIdentity {
             Ok(raw) => Self::parse_str(&raw, &path),
             Err(error) if error.kind() == ErrorKind::NotFound => {
                 Err(Error::WorkspaceIdentity(format!(
-                    "workspace is not initialized at {}; run `yoi-server init --workspace {}` first",
-                    workspace_root.as_ref().display(),
+                    "workspace identity is missing at {}; register the Workspace through the Server before using repository-local client routing",
                     workspace_root.as_ref().display()
                 )))
             }
@@ -219,7 +218,7 @@ mod tests {
         let error = WorkspaceIdentity::load_required(&workspace_root).unwrap_err();
 
         assert!(
-            error.to_string().contains("workspace is not initialized"),
+            error.to_string().contains("workspace identity is missing"),
             "unexpected error: {error}"
         );
         assert!(!WorkspaceIdentity::path(&workspace_root).exists());

crates/workspace-server/src/lib.rs

@@ -20,12 +20,16 @@ pub mod records;
 #[cfg(feature = "typescript")]
 pub use records::ticket_api_typescript;
 pub mod repositories;
+pub mod repository_access;
+pub mod repository_source;
 pub mod resource_broker;
 pub mod retention;
+pub mod runtime_settings;
 pub mod runtime_subscription;
 pub mod server;
 pub mod skills;
 pub mod store;
+pub mod workdir_create_operations;
 pub mod worker_source;
 pub mod workspace_catalog;
 mod workspace_subscription;
@@ -35,11 +39,7 @@ pub use authority::{
     ObjectiveAuthority, SqliteWorkspaceAuthority, TicketAuthority, TicketMergeRevisionSource,
     WorkspaceAuthority,
 };
-pub use config::{
-    BackendRuntimesConfigFile, ConfigDiff, ResolvedWorkspaceBackendConfig,
-    WORKSPACE_BACKEND_CONFIG_RELATIVE_PATH, WORKSPACE_BACKEND_CONFIG_TEMPLATE,
-    WorkspaceBackendConfigFile,
-};
+pub use config::{BackendRuntimesConfigFile, ResolvedWorkspaceBackendConfig, ServerHostConfigFile};
 pub use identity::{WORKSPACE_IDENTITY_RELATIVE_PATH, WorkspaceIdentity};
 pub use records::{ObjectiveDetail, ObjectiveSummary, TicketDetail, TicketSummary};
 pub use repositories::{
@@ -113,6 +113,8 @@ pub enum Error {
     TicketAssignmentConflict(String),
     #[error("Workdir attachment conflict: {0}")]
     WorkdirAttachmentConflict(String),
+    #[error("Workspace permission denied: {0}")]
+    WorkspacePermissionDenied(String),
     #[error("Workspace config update conflict: {0}")]
     WorkspaceConfigConflict(String),
     #[error("Registry inconsistency: {0}")]

crates/workspace-server/src/main.rs

@@ -11,17 +11,13 @@ use worker_runtime::auth::{RuntimeIdentityMaterial, decode_public_key};
 use yoi_workspace_server::hosts::{RemoteRuntimeAuthConfig, RemoteRuntimeConfig};
 use yoi_workspace_server::store::{SqliteWorkspaceStore, TrustedRuntimeRecord};
 use yoi_workspace_server::{
-    BackendRuntimesConfigFile, ControlPlaneStore, InitialRepositoryIntent, ServerConfig,
-    WORKSPACE_BACKEND_CONFIG_TEMPLATE, WorkspaceBackendConfigFile, WorkspaceCatalogService,
-    WorkspaceCreateRequest, WorkspaceIdentity, WorkspaceRecord, serve_workspace_catalog,
+    BackendRuntimesConfigFile, ControlPlaneStore, ResolvedWorkspaceBackendConfig, ServerConfig,
+    ServerHostConfigFile, WorkspaceIdentity, WorkspaceRecord, serve_workspace_catalog,
 };
 
 #[derive(Debug)]
 enum Command {
     Serve(ServeOptions),
-    Init(InitOptions),
-    ConfigDefault,
-    ConfigDiff(WorkspacePathOptions),
     Identity(Vec<String>),
     TrustRuntime(Vec<String>),
     MigrateDryRun { database: Option<PathBuf> },
@@ -32,16 +28,7 @@ enum Command {
 #[derive(Debug)]
 struct ServeOptions {
     listen: Option<SocketAddr>,
-}
-
-#[derive(Debug)]
-struct InitOptions {
-    workspace: PathBuf,
-}
-
-#[derive(Debug)]
-struct WorkspacePathOptions {
-    workspace: PathBuf,
+    config: Option<PathBuf>,
 }
 
 #[derive(Debug)]
@@ -82,9 +69,6 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
     let args = std::env::args().skip(1).collect::<Vec<_>>();
     match parse_command(&args)? {
         Command::Serve(options) => run_serve(options).await,
-        Command::Init(options) => run_init(options).await,
-        Command::ConfigDefault => run_config_default(),
-        Command::ConfigDiff(options) => run_config_diff(options),
         Command::Identity(args) => run_identity_command(args),
         Command::TrustRuntime(args) => run_trust_runtime_command(args),
         Command::MigrateDryRun { database } => {
@@ -110,14 +94,6 @@ fn parse_command(args: &[String]) -> Result<Command, CliError> {
     };
 
     match command.as_str() {
-        "init" => {
-            if rest.iter().any(|arg| arg == "--help" || arg == "-h") {
-                print_init_help();
-                return Ok(Command::Help);
-            }
-            Ok(Command::Init(parse_init_options(rest)?))
-        }
-        "config" => parse_config_command(rest),
         "identity" => Ok(Command::Identity(rest.to_vec())),
         "trust-runtime" => Ok(Command::TrustRuntime(rest.to_vec())),
         "migrate" => parse_migrate_command(rest),
@@ -134,61 +110,11 @@ fn parse_command(args: &[String]) -> Result<Command, CliError> {
             Ok(Command::Help)
         }
         other => Err(CliError(format!(
-            "unknown command `{other}`; expected `init`, `config`, `identity`, `trust-runtime`, `migrate`, `skills`, or `serve`"
+            "unknown command `{other}`; expected `identity`, `trust-runtime`, `migrate`, `skills`, or `serve`"
         ))),
     }
 }
 
-async fn run_init(options: InitOptions) -> Result<(), Box<dyn std::error::Error>> {
-    run_init_with_database_path(options, ServerConfig::default_server_database_path()).await
-}
-
-async fn run_init_with_database_path(
-    options: InitOptions,
-    database_path: PathBuf,
-) -> Result<(), Box<dyn std::error::Error>> {
-    let identity = WorkspaceIdentity::load_or_init(&options.workspace)?;
-    WorkspaceBackendConfigFile::ensure_local_config_for_workspace(&options.workspace)?;
-
-    if let Some(parent) = database_path.parent() {
-        tokio::fs::create_dir_all(parent).await?;
-    }
-    let store = Arc::new(SqliteWorkspaceStore::open(&database_path)?);
-    let service = WorkspaceCatalogService::new(store);
-    service.create_with_workspace_id(
-        WorkspaceCreateRequest {
-            operation_key: format!("cli-init:{}", identity.workspace_id),
-            display_name: identity.display_name.clone(),
-            repository: InitialRepositoryIntent {
-                uri: options.workspace.display().to_string(),
-                display_name: Some("Main repository".to_string()),
-                default_ref: Some("HEAD".to_string()),
-            },
-        },
-        None,
-        Some(identity.workspace_id.clone()),
-    )?;
-
-    eprintln!(
-        "yoi-server: initialized workspace `{}` ({}) in server DB `{}`",
-        options.workspace.display(),
-        identity.workspace_id,
-        database_path.display()
-    );
-    Ok(())
-}
-
-fn run_config_default() -> Result<(), Box<dyn std::error::Error>> {
-    print!("{WORKSPACE_BACKEND_CONFIG_TEMPLATE}");
-    Ok(())
-}
-
-fn run_config_diff(options: WorkspacePathOptions) -> Result<(), Box<dyn std::error::Error>> {
-    let diff = WorkspaceBackendConfigFile::local_config_diff_for_workspace(&options.workspace)?;
-    print!("{}", diff.text);
-    Ok(())
-}
-
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 struct ServerIdentityFile {
     identity: RuntimeIdentityMaterial,
@@ -626,10 +552,15 @@ async fn run_serve(options: ServeOptions) -> Result<(), Box<dyn std::error::Erro
                 .to_path_buf(),
         )
     };
+    let host_config = match options.config.as_ref() {
+        Some(path) => ServerHostConfigFile::load_from_path(path)?,
+        None => ServerHostConfigFile::load_default()?,
+    };
     let runtime_config = BackendRuntimesConfigFile::load_default()?;
-    let mut resolved = WorkspaceBackendConfigFile::default().resolve_with_runtime_config(
+    let mut resolved = ResolvedWorkspaceBackendConfig::local_dev(
         &workspace_root,
         identity,
+        &host_config,
         &runtime_config,
     )?;
     resolved.database_path = database_path.clone();
@@ -638,7 +569,6 @@ async fn run_serve(options: ServeOptions) -> Result<(), Box<dyn std::error::Erro
     if let Some(listen) = options.listen {
         resolved = resolved.with_listen(listen);
     }
-    resolved.server.allow_local_workspace_bootstrap = resolved.listen.ip().is_loopback();
 
     let listener = TcpListener::bind(resolved.listen).await?;
     let local_addr = listener.local_addr()?;
@@ -711,49 +641,15 @@ fn infer_workspace_root_from_repositories(
         )));
     };
 
-    let repository_path = PathBuf::from(&repository.uri);
-    if !repository_path.is_absolute() {
+    if repository.source.kind == workspace_api::RepositorySourceKind::Invalid {
         return Err(CliError(format!(
-            "repository `{}` has relative URI `{}`; repository records used by serve must be absolute paths",
-            repository.repository_id, repository.uri
+            "repository `{}` has an invalid migrated source and cannot be used by serve",
+            repository.repository_id
         )));
     }
-    Ok(repository_path)
-}
-
-fn parse_config_command(args: &[String]) -> Result<Command, CliError> {
-    let Some((subcommand, rest)) = args.split_first() else {
-        print_config_help();
-        return Ok(Command::Help);
-    };
-    match subcommand.as_str() {
-        "default" => {
-            if rest.iter().any(|arg| arg == "--help" || arg == "-h") {
-                print_config_help();
-                return Ok(Command::Help);
-            }
-            if !rest.is_empty() {
-                return Err(CliError(
-                    "config default does not accept options".to_string(),
-                ));
-            }
-            Ok(Command::ConfigDefault)
-        }
-        "diff" => {
-            if rest.iter().any(|arg| arg == "--help" || arg == "-h") {
-                print_config_help();
-                return Ok(Command::Help);
-            }
-            Ok(Command::ConfigDiff(parse_workspace_path_options(rest)?))
-        }
-        "--help" | "-h" => {
-            print_config_help();
-            Ok(Command::Help)
-        }
-        other => Err(CliError(format!(
-            "unknown config subcommand `{other}`; expected `default` or `diff`"
-        ))),
-    }
+    Ok(ServerConfig::default_workspace_backend_data_root(
+        &workspace.workspace_id,
+    ))
 }
 
 fn parse_migrate_command(args: &[String]) -> Result<Command, CliError> {
@@ -839,57 +735,9 @@ fn parse_skill_workspace_options(args: &[String]) -> Result<SkillWorkspaceOption
     Ok(SkillWorkspaceOptions { workspace_id })
 }
 
-fn parse_workspace_path_options(args: &[String]) -> Result<WorkspacePathOptions, CliError> {
-    let mut workspace = std::env::current_dir()
-        .map_err(|error| CliError(format!("failed to read current dir: {error}")))?;
-    let mut iter = args.iter();
-    while let Some(arg) = iter.next() {
-        match arg.as_str() {
-            "--workspace" => {
-                let value = iter
-                    .next()
-                    .ok_or_else(|| CliError("--workspace requires a path".to_string()))?;
-                workspace = PathBuf::from(value);
-            }
-            value if value.starts_with("--workspace=") => {
-                workspace = PathBuf::from(value_after_equals(arg, "--workspace")?);
-            }
-            other => return Err(CliError(format!("unknown workspace option `{other}`"))),
-        }
-    }
-    let workspace = workspace
-        .canonicalize()
-        .map_err(|error| CliError(format!("failed to canonicalize workspace: {error}")))?;
-    Ok(WorkspacePathOptions { workspace })
-}
-
-fn parse_init_options(args: &[String]) -> Result<InitOptions, CliError> {
-    let mut workspace = std::env::current_dir()
-        .map_err(|error| CliError(format!("failed to read current dir: {error}")))?;
-    let mut iter = args.iter();
-    while let Some(arg) = iter.next() {
-        match arg.as_str() {
-            "--workspace" => {
-                let value = iter
-                    .next()
-                    .ok_or_else(|| CliError("--workspace requires a path".to_string()))?;
-                workspace = PathBuf::from(value);
-            }
-            value if value.starts_with("--workspace=") => {
-                workspace = PathBuf::from(value_after_equals(arg, "--workspace")?);
-            }
-            other => return Err(CliError(format!("unknown init option `{other}`"))),
-        }
-    }
-
-    let workspace = workspace
-        .canonicalize()
-        .map_err(|error| CliError(format!("failed to canonicalize workspace: {error}")))?;
-    Ok(InitOptions { workspace })
-}
-
 fn parse_serve_options(args: &[String]) -> Result<ServeOptions, CliError> {
     let mut listen = None;
+    let mut config = None;
 
     let mut index = 0;
     while index < args.len() {
@@ -905,6 +753,16 @@ fn parse_serve_options(args: &[String]) -> Result<ServeOptions, CliError> {
             _ if arg.starts_with("--listen=") => {
                 listen = Some(parse_listen(value_after_equals(arg, "--listen")?)?);
             }
+            "--config" => {
+                index += 1;
+                let value = args
+                    .get(index)
+                    .ok_or_else(|| CliError("--config requires a path".to_string()))?;
+                config = Some(PathBuf::from(value));
+            }
+            _ if arg.starts_with("--config=") => {
+                config = Some(PathBuf::from(value_after_equals(arg, "--config")?));
+            }
             _ if arg.starts_with('-') => {
                 return Err(CliError(format!("unknown serve option `{arg}`")));
             }
@@ -917,7 +775,7 @@ fn parse_serve_options(args: &[String]) -> Result<ServeOptions, CliError> {
         index += 1;
     }
 
-    Ok(ServeOptions { listen })
+    Ok(ServeOptions { listen, config })
 }
 
 fn value_after_equals<'a>(arg: &'a str, flag: &str) -> Result<&'a str, CliError> {
@@ -939,23 +797,11 @@ fn parse_listen(value: &str) -> Result<SocketAddr, CliError> {
 
 fn print_help() {
     println!(
-        "yoi-server\n\nUsage:\n  yoi-server init [OPTIONS]\n  yoi-server config <COMMAND> [OPTIONS]\n  yoi-server identity init --server-id <SERVER_ID> [--replace]\n  yoi-server identity show [--json]\n  yoi-server trust-runtime add --runtime-id <RUNTIME_ID> --workspace-id <WORKSPACE_ID> --base-url <URL> --public-key <KEY> [--display-name <NAME>] [--replace]\n  yoi-server trust-runtime list [--json] [--include-revoked]\n  yoi-server trust-runtime revoke --runtime-id <RUNTIME_ID>\n  yoi-server skills <COMMAND> [OPTIONS]\n  yoi-server migrate --dry-run [--database <PATH>]
+        "yoi-server\n\nUsage:\n  yoi-server identity init --server-id <SERVER_ID> [--replace]\n  yoi-server identity show [--json]\n  yoi-server trust-runtime add --runtime-id <RUNTIME_ID> --workspace-id <WORKSPACE_ID> --base-url <URL> --public-key <KEY> [--display-name <NAME>] [--replace]\n  yoi-server trust-runtime list [--json] [--include-revoked]\n  yoi-server trust-runtime revoke --runtime-id <RUNTIME_ID>\n  yoi-server skills <COMMAND> [OPTIONS]\n  yoi-server migrate --dry-run [--database <PATH>]
   yoi-server serve [OPTIONS]\n\nOptions:\n  -h, --help    Print help"
     );
 }
 
-fn print_init_help() {
-    println!(
-        "yoi-server init\n\nUsage:\n  yoi-server init [OPTIONS]\n\nDescription:\n  Initializes a Workspace identity, copies the packaged Backend config template to .yoi/workspace-backend.local.toml, and registers the Workspace in the Yoi server DB.\n\nOptions:\n      --workspace <PATH>  Workspace root to initialize (defaults to cwd)\n  -h, --help              Print help"
-    );
-}
-
-fn print_config_help() {
-    println!(
-        "yoi-server config\n\nUsage:\n  yoi-server config default\n  yoi-server config diff [OPTIONS]\n\nDescription:\n  Prints the packaged Workspace Backend config template or compares it with the workspace-local config.\n\nOptions for diff:\n      --workspace <PATH>  Workspace root (defaults to cwd)\n  -h, --help              Print help"
-    );
-}
-
 fn print_skills_help() {
     println!(
         "yoi-server skills\n\nUsage:\n  yoi-server skills list --workspace <WORKSPACE_ID>\n  yoi-server skills lint --workspace <WORKSPACE_ID>\n  yoi-server skills show <NAME> --workspace <WORKSPACE_ID>\n\nDescription:\n  Reads the active Server DB virtual-config revision. Catalog output is lightweight and omits imported Markdown content; detail output includes that content. allowed-tools and scripts are diagnostics only.\n\nOptions:\n      --workspace <WORKSPACE_ID>  Workspace id in the Server DB (required)\n  -h, --help                      Print help"
@@ -965,24 +811,23 @@ fn print_skills_help() {
 fn print_serve_help() {
     println!(
         "yoi-server serve\n\nUsage:\n  yoi-server migrate --dry-run [--database <PATH>]
-  yoi-server serve [OPTIONS]\n\nDescription:\n  Serves the Workspace recorded in the Yoi server DB. Workspace records are stored in the XDG/Yoi data directory, and runtime sources are loaded from XDG runtimes.toml.\n\nOptions:\n      --listen <ADDR>     Listen address (default 127.0.0.1:8787)\n  -h, --help              Print help"
+  yoi-server serve [OPTIONS]\n\nDescription:\n  Serves Workspaces recorded in the Yoi server DB. Host-level deployment settings are loaded from the explicit --config path or the canonical XDG yoi/server.toml path, and runtime sources are loaded from XDG runtimes.toml.\n\nOptions:\n      --listen <ADDR>     Listen address (default 127.0.0.1:8787)\n      --config <PATH>     Host-level Server config path\n  -h, --help              Print help"
     );
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use yoi_workspace_server::{
-        WORKSPACE_BACKEND_CONFIG_RELATIVE_PATH, WORKSPACE_BACKEND_CONFIG_TEMPLATE,
-        WORKSPACE_IDENTITY_RELATIVE_PATH,
-    };
 
     #[test]
-    fn parse_init_defaults_workspace_to_cwd_or_flag() {
-        let temp = tempfile::tempdir().unwrap();
-        let args = vec!["--workspace".to_string(), temp.path().display().to_string()];
-        let options = parse_init_options(&args).unwrap();
-        assert_eq!(options.workspace, temp.path().canonicalize().unwrap());
+    fn removed_repository_local_commands_are_rejected() {
+        for command in ["init", "config"] {
+            let error = parse_command(&[command.to_string()]).unwrap_err();
+            assert!(
+                error.to_string().contains("unknown command"),
+                "unexpected error for {command}: {error}"
+            );
+        }
     }
 
     #[test]
@@ -1022,10 +867,18 @@ mod tests {
     }
 
     #[test]
-    fn parse_serve_accepts_listen_only() {
-        let args = vec!["--listen".to_string(), "127.0.0.1:0".to_string()];
+    fn parse_serve_accepts_listen_and_host_config() {
+        let args = vec![
+            "--listen".to_string(),
+            "127.0.0.1:0".to_string(),
+            "--config=/etc/yoi/server.toml".to_string(),
+        ];
         let options = parse_serve_options(&args).unwrap();
         assert_eq!(options.listen.unwrap(), "127.0.0.1:0".parse().unwrap());
+        assert_eq!(
+            options.config.unwrap(),
+            PathBuf::from("/etc/yoi/server.toml")
+        );
     }
 
     #[test]
@@ -1080,49 +933,4 @@ mod tests {
         );
         ensure_trusted_runtime_replace_allowed(&store, "runtime-a", true).unwrap();
     }
-
-    #[tokio::test]
-    async fn init_creates_identity_local_config_and_server_records() {
-        let temp = tempfile::tempdir().unwrap();
-        let database_path = temp.path().join("data").join("server").join("server.db");
-        std::fs::create_dir(temp.path().join(".git")).unwrap();
-        run_init_with_database_path(
-            InitOptions {
-                workspace: temp.path().canonicalize().unwrap(),
-            },
-            database_path.clone(),
-        )
-        .await
-        .unwrap();
-
-        assert!(temp.path().join(WORKSPACE_IDENTITY_RELATIVE_PATH).exists());
-        let local_config_path = temp.path().join(WORKSPACE_BACKEND_CONFIG_RELATIVE_PATH);
-        assert!(local_config_path.exists());
-        assert_eq!(
-            std::fs::read_to_string(local_config_path).unwrap(),
-            WORKSPACE_BACKEND_CONFIG_TEMPLATE
-        );
-        assert!(
-            !temp
-                .path()
-                .join(".yoi/workspace-backend.default.toml")
-                .exists()
-        );
-        assert!(!temp.path().join(".yoi/workspace.db").exists());
-        assert!(!temp.path().join(".yoi/embedded-runtime").exists());
-        assert!(database_path.exists());
-
-        let store = SqliteWorkspaceStore::open(&database_path).unwrap();
-        let workspaces = store.list_workspaces().unwrap();
-        assert_eq!(workspaces.len(), 1);
-        let repositories = store
-            .list_repositories(&workspaces[0].workspace_id)
-            .unwrap();
-        assert_eq!(repositories.len(), 1);
-        assert_eq!(repositories[0].repository_id, "main");
-        assert_eq!(
-            repositories[0].uri,
-            temp.path().canonicalize().unwrap().display().to_string()
-        );
-    }
 }

crates/workspace-server/src/records.rs

@@ -296,6 +296,7 @@ pub struct TicketActionEligibility {
     pub can_unassign_orchestrator: bool,
     pub can_queue: bool,
     pub can_start_manual_coder: bool,
+    pub queue_tickets: Vec<String>,
     pub blockers: Vec<String>,
 }
 

crates/workspace-server/src/repositories.rs

@@ -5,6 +5,7 @@ use std::{
 };
 
 use serde::{Deserialize, Serialize};
+use workspace_api::{RepositoryObservedStatus, RepositorySource};
 
 pub type RepositoryId = String;
 pub type RepositorySelector = String;
@@ -13,8 +14,12 @@ pub type RepositorySelector = String;
 pub struct ConfiguredRepository {
     pub id: RepositoryId,
     pub provider: String,
-    pub uri: String,
-    pub path: PathBuf,
+    pub source: RepositorySource,
+    pub source_revision: u64,
+    pub source_fingerprint: String,
+    pub observed_status: RepositoryObservedStatus,
+    pub observed_at: Option<String>,
+    pub path: Option<PathBuf>,
     pub display_name: Option<String>,
     pub default_selector: Option<RepositorySelector>,
 }
@@ -25,6 +30,12 @@ pub struct RepositorySummary {
     pub display_name: String,
     pub kind: String,
     pub provider: String,
+    pub source: RepositorySource,
+    pub source_revision: u64,
+    pub source_fingerprint: String,
+    pub observed_status: RepositoryObservedStatus,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub observed_at: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub default_selector: Option<RepositorySelector>,
     pub record_authority: String,
@@ -262,9 +273,17 @@ impl RepositoryRegistryReader {
         descendant: &str,
     ) -> Result<(), RepositoryLookupError> {
         let repository = self.merge_repository(id)?;
+        let repository_path =
+            repository
+                .path
+                .as_ref()
+                .ok_or_else(|| RepositoryLookupError::ProviderFailure {
+                    id: id.into(),
+                    operation: "repository source is not materialized for local Git access".into(),
+                })?;
         let status = Command::new("git")
             .arg("-C")
-            .arg(&repository.path)
+            .arg(repository_path)
             .args(["merge-base", "--is-ancestor", ancestor, descendant])
             .status()
             .map_err(|_| RepositoryLookupError::ProviderFailure {
@@ -306,7 +325,24 @@ impl RepositoryRegistryReader {
             .clone()
             .unwrap_or_else(|| repository.id.clone());
         let mut diagnostics = Vec::new();
+        if repository.source.kind == workspace_api::RepositorySourceKind::Http {
+            diagnostics.push(RepositoryDiagnostic {
+                severity: "warning".to_string(),
+                code: "repository_source_insecure_http".to_string(),
+                message:
+                    "HTTP Repository source is unencrypted; prefer HTTPS or SSH when available."
+                        .to_string(),
+            });
+        }
         let git = match repository.provider.as_str() {
+            "git" if repository.path.is_none() => {
+                diagnostics.push(RepositoryDiagnostic {
+                    severity: "info".to_string(),
+                    code: "repository_source_unverified".to_string(),
+                    message: "Remote Repository source is registered but is not materialized for server-local inspection.".to_string(),
+                });
+                None
+            }
             "git" => match self.inspect_git(repository) {
                 Ok(git) => Some(git),
                 Err(message) => {
@@ -335,6 +371,11 @@ impl RepositoryRegistryReader {
             display_name,
             kind: repository.provider.clone(),
             provider: repository.provider.clone(),
+            source: repository.source.clone(),
+            source_revision: repository.source_revision,
+            source_fingerprint: repository.source_fingerprint.clone(),
+            observed_status: repository.observed_status,
+            observed_at: repository.observed_at.clone(),
             default_selector: repository.default_selector.clone(),
             record_authority: "workspace-control-plane".to_string(),
             git,
@@ -346,12 +387,15 @@ impl RepositoryRegistryReader {
         &self,
         repository: &ConfiguredRepository,
     ) -> Result<GitRepositorySummary, String> {
-        let head = git_stdout(&repository.path, ["rev-parse", "HEAD"])?;
-        let branch = git_stdout(&repository.path, ["branch", "--show-current"])
+        let path = repository.path.as_ref().ok_or_else(|| {
+            "Repository source is not materialized for local Git inspection.".to_string()
+        })?;
+        let head = git_stdout(path, ["rev-parse", "HEAD"])?;
+        let branch = git_stdout(path, ["branch", "--show-current"])
             .ok()
             .and_then(|value| non_empty_string(value.trim()));
-        let status = git_stdout(&repository.path, ["status", "--porcelain"])?;
-        let remotes = git_stdout(&repository.path, ["remote", "-v"])
+        let status = git_stdout(path, ["status", "--porcelain"])?;
+        let remotes = git_stdout(path, ["remote", "-v"])
             .map(|raw| parse_remotes(&raw))
             .unwrap_or_default();
         Ok(GitRepositorySummary {
@@ -369,8 +413,11 @@ impl RepositoryRegistryReader {
         limit: usize,
     ) -> Result<Vec<GitCommitSummary>, String> {
         let limit_arg = format!("-{limit}");
+        let path = repository.path.as_ref().ok_or_else(|| {
+            "Repository source is not materialized for local Git log access.".to_string()
+        })?;
         let output = git_stdout(
-            &repository.path,
+            path,
             [
                 "log",
                 "--date=iso-strict",
@@ -419,11 +466,16 @@ fn merge_git_stdout(
     operation: &str,
     args: &[&str],
 ) -> Result<String, RepositoryLookupError> {
-    git_stdout(&repository.path, args.iter().copied()).map_err(|_| {
-        RepositoryLookupError::ProviderFailure {
+    let path = repository
+        .path
+        .as_ref()
+        .ok_or_else(|| RepositoryLookupError::ProviderFailure {
             id: repository.id.clone(),
-            operation: operation.into(),
-        }
+            operation: "repository source is not materialized for local Git access".into(),
+        })?;
+    git_stdout(path, args.iter().copied()).map_err(|_| RepositoryLookupError::ProviderFailure {
+        id: repository.id.clone(),
+        operation: operation.into(),
     })
 }
 
@@ -593,6 +645,47 @@ mod tests {
         assert_eq!(projection.diagnostics[0].code, "repository_config_empty");
     }
 
+    #[test]
+    fn remote_source_is_visible_but_local_provider_operations_fail_closed() {
+        let source = RepositorySource {
+            kind: workspace_api::RepositorySourceKind::Ssh,
+            uri: "git@example.test:org/repository.git".to_string(),
+        };
+        let reader = RepositoryRegistryReader::new(vec![ConfiguredRepository {
+            id: "remote".into(),
+            display_name: Some("Remote".into()),
+            provider: "git".into(),
+            source_fingerprint: crate::repository_source::repository_source_fingerprint(&source),
+            source,
+            source_revision: 1,
+            observed_status: RepositoryObservedStatus::Unverified,
+            observed_at: None,
+            path: None,
+            default_selector: Some("main".into()),
+        }]);
+
+        let projection = reader.list();
+        let summary = &projection.items[0];
+        assert_eq!(
+            summary.source.kind,
+            workspace_api::RepositorySourceKind::Ssh
+        );
+        assert_eq!(
+            summary.observed_status,
+            RepositoryObservedStatus::Unverified
+        );
+        assert!(summary.git.is_none());
+        assert_eq!(summary.diagnostics[0].code, "repository_source_unverified");
+
+        let repository = reader.merge_repository("remote").unwrap();
+        let error = merge_git_stdout(&repository, "inspect", &["rev-parse", "HEAD"]).unwrap_err();
+        assert!(matches!(
+            error,
+            RepositoryLookupError::ProviderFailure { operation, .. }
+                if operation.contains("not materialized")
+        ));
+    }
+
     #[test]
     fn merge_evidence_is_resolved_by_repository_identity() {
         let temp = tempfile::tempdir().unwrap();
@@ -675,12 +768,22 @@ mod tests {
                 .success()
         );
 
+        let source_descriptor = RepositorySource {
+            kind: workspace_api::RepositorySourceKind::LocalPath,
+            uri: path.display().to_string(),
+        };
         let reader = RepositoryRegistryReader::new(vec![ConfiguredRepository {
             id: "main".into(),
             display_name: Some("Main".into()),
             provider: "git".into(),
-            path: path.to_path_buf(),
-            uri: path.display().to_string(),
+            source_fingerprint: crate::repository_source::repository_source_fingerprint(
+                &source_descriptor,
+            ),
+            source: source_descriptor,
+            source_revision: 1,
+            observed_status: RepositoryObservedStatus::Unverified,
+            observed_at: None,
+            path: Some(path.to_path_buf()),
             default_selector: Some("main".into()),
         }]);
         let target = reader.observe_merge_target("main", Some("main")).unwrap();

crates/workspace-server/src/repository_source.rs

@@ -0,0 +1,230 @@
+use std::path::Path;
+
+use sha2::{Digest, Sha256};
+use url::Url;
+use workspace_api::{RepositorySource, RepositorySourceKind};
+
+use crate::{Error, Result};
+
+const MAX_REPOSITORY_SOURCE_BYTES: usize = 4096;
+
+/// Parse and canonicalize a user-authored Git source without accessing the
+/// filesystem or network.
+pub fn parse_repository_source(value: &str) -> Result<RepositorySource> {
+    let value = value.trim();
+    if value.is_empty() || value.len() > MAX_REPOSITORY_SOURCE_BYTES {
+        return Err(Error::InvalidInput(format!(
+            "initial repository source must be between 1 and {MAX_REPOSITORY_SOURCE_BYTES} bytes"
+        )));
+    }
+    if value.chars().any(char::is_control) {
+        return Err(Error::InvalidInput(
+            "initial repository source must not contain control characters".to_string(),
+        ));
+    }
+
+    if Path::new(value).is_absolute() {
+        return Ok(RepositorySource {
+            kind: RepositorySourceKind::LocalPath,
+            uri: value.to_string(),
+        });
+    }
+
+    if is_scp_like_ssh(value) {
+        validate_scp_like_ssh(value)?;
+        return Ok(RepositorySource {
+            kind: RepositorySourceKind::Ssh,
+            uri: value.to_string(),
+        });
+    }
+
+    let parsed = Url::parse(value).map_err(|_| {
+        Error::InvalidInput(
+            "initial repository source must be an absolute local path or a supported Git URI"
+                .to_string(),
+        )
+    })?;
+    if parsed.query().is_some() || parsed.fragment().is_some() {
+        return Err(Error::InvalidInput(
+            "initial repository source must not contain query parameters or fragments".to_string(),
+        ));
+    }
+    if parsed.password().is_some() {
+        return Err(Error::InvalidInput(
+            "initial repository source must not embed a password or token".to_string(),
+        ));
+    }
+
+    let kind = match parsed.scheme() {
+        "file" => {
+            if !parsed.username().is_empty() {
+                return Err(Error::InvalidInput(
+                    "file repository URI must not contain user information".to_string(),
+                ));
+            }
+            if parsed.host_str().is_some_and(|host| host != "localhost") {
+                return Err(Error::InvalidInput(
+                    "file repository URI host must be empty or localhost".to_string(),
+                ));
+            }
+            parsed.to_file_path().map_err(|_| {
+                Error::InvalidInput("file repository URI must contain an absolute path".to_string())
+            })?;
+            RepositorySourceKind::File
+        }
+        "ssh" => {
+            require_remote_host_and_path(&parsed)?;
+            RepositorySourceKind::Ssh
+        }
+        "http" | "https" => {
+            if !parsed.username().is_empty() {
+                return Err(Error::InvalidInput(
+                    "HTTP repository URI must not contain user information".to_string(),
+                ));
+            }
+            require_remote_host_and_path(&parsed)?;
+            if parsed.scheme() == "http" {
+                RepositorySourceKind::Http
+            } else {
+                RepositorySourceKind::Https
+            }
+        }
+        scheme => {
+            return Err(Error::InvalidInput(format!(
+                "unsupported initial repository source scheme `{scheme}`"
+            )));
+        }
+    };
+
+    Ok(RepositorySource {
+        kind,
+        uri: parsed.to_string(),
+    })
+}
+
+/// Classify persisted pre-source-contract rows without guessing a usable remote
+/// when the legacy value is malformed. No filesystem or network access occurs.
+pub fn classify_legacy_repository_source(value: &str) -> RepositorySource {
+    parse_repository_source(value).unwrap_or_else(|_| RepositorySource {
+        kind: RepositorySourceKind::Invalid,
+        uri: value.trim().to_string(),
+    })
+}
+
+pub fn repository_source_fingerprint(source: &RepositorySource) -> String {
+    let payload = serde_json::to_vec(source).expect("Repository source serializes");
+    let mut hasher = Sha256::new();
+    hasher.update(b"yoi.repository-source.v1\0");
+    hasher.update(payload);
+    let digest = hasher.finalize();
+    let mut encoded = String::with_capacity(digest.len() * 2);
+    for byte in digest {
+        use std::fmt::Write as _;
+        write!(&mut encoded, "{byte:02x}").expect("writing to String cannot fail");
+    }
+    format!("sha256:{encoded}")
+}
+
+fn require_remote_host_and_path(parsed: &Url) -> Result<()> {
+    if parsed.host_str().is_none() || parsed.path().is_empty() || parsed.path() == "/" {
+        return Err(Error::InvalidInput(
+            "remote repository URI must contain a host and repository path".to_string(),
+        ));
+    }
+    Ok(())
+}
+
+fn is_scp_like_ssh(value: &str) -> bool {
+    !value.contains("://")
+        && value
+            .split_once(':')
+            .is_some_and(|(identity, _)| identity.contains('@'))
+}
+
+fn validate_scp_like_ssh(value: &str) -> Result<()> {
+    let (identity, path) = value.split_once(':').ok_or_else(|| {
+        Error::InvalidInput("scp-like SSH source must contain `host:path`".to_string())
+    })?;
+    let (username, host) = identity.split_once('@').ok_or_else(|| {
+        Error::InvalidInput("scp-like SSH source must contain `user@host:path`".to_string())
+    })?;
+    if username.is_empty()
+        || host.is_empty()
+        || path.is_empty()
+        || username.contains('@')
+        || username.contains(':')
+        || host.contains('@')
+        || path.starts_with('-')
+        || value.contains('?')
+        || value.contains('#')
+        || value.chars().any(char::is_whitespace)
+    {
+        return Err(Error::InvalidInput(
+            "scp-like SSH source must use `user@host:path` without credentials or parameters"
+                .to_string(),
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_local_file_ssh_http_and_https_sources_without_io() {
+        let cases = [
+            ("/runtime/repos/project", RepositorySourceKind::LocalPath),
+            ("file:///runtime/repos/project", RepositorySourceKind::File),
+            (
+                "ssh://git@example.test/org/project.git",
+                RepositorySourceKind::Ssh,
+            ),
+            (
+                "git@example.test:org/project.git",
+                RepositorySourceKind::Ssh,
+            ),
+            (
+                "http://git.test/org/project.git",
+                RepositorySourceKind::Http,
+            ),
+            (
+                "https://git.test/org/project.git",
+                RepositorySourceKind::Https,
+            ),
+        ];
+        for (source, expected_kind) in cases {
+            assert_eq!(parse_repository_source(source).unwrap().kind, expected_kind);
+        }
+    }
+
+    #[test]
+    fn rejects_relative_unsupported_and_credential_bearing_sources() {
+        for source in [
+            "relative/project",
+            "ftp://git.test/project.git",
+            "https://user@git.test/project.git",
+            "https://git.test/project.git?token=secret",
+            "ssh://git:secret@git.test/project.git",
+            "git@example.test:",
+            "git:secret@example.test:org/project.git",
+            "https://git.test/project.git\nother",
+        ] {
+            assert!(
+                parse_repository_source(source).is_err(),
+                "accepted {source:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn fingerprint_uses_canonical_source_identity() {
+        let first = parse_repository_source(" https://EXAMPLE.test/a/../project.git ").unwrap();
+        let second = parse_repository_source("https://example.test/project.git").unwrap();
+        assert_eq!(first, second);
+        assert_eq!(
+            repository_source_fingerprint(&first),
+            repository_source_fingerprint(&second)
+        );
+    }
+}

crates/workspace-server/src/resource_broker.rs

@@ -9,7 +9,8 @@ use worker_runtime::resource::{
     BackendResourceClient, BackendResourceError, BackendResourceFetchRequest,
     BackendResourceFetchResponse, BackendResourceHandle, BackendResourceKind,
     BackendResourceOperation, DEFAULT_PROFILE_SOURCE_ARCHIVE_MAX_BYTES,
-    PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE, ResourceRedactionPolicy,
+    DEFAULT_REPOSITORY_SSH_ACCESS_MAX_BYTES, PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE,
+    REPOSITORY_SSH_ACCESS_CONTENT_TYPE, RepositorySshAccessSecret, ResourceRedactionPolicy,
 };
 
 #[derive(Clone, Default)]
@@ -29,7 +30,34 @@ struct StoredResource {
     runtime_id: Option<String>,
     worker: Option<RuntimeWorkerRef>,
     handle: BackendResourceHandle,
-    archive: ProfileSourceArchive,
+    bytes: Vec<u8>,
+    archive: Option<ProfileSourceArchive>,
+    one_shot: bool,
+}
+
+impl StoredResource {
+    fn byte_len(&self) -> usize {
+        self.archive
+            .as_ref()
+            .map(|archive| archive.content.len())
+            .unwrap_or_else(|| self.bytes.len())
+    }
+
+    fn take_bytes(&mut self) -> Vec<u8> {
+        self.archive
+            .as_mut()
+            .map(|archive| std::mem::take(&mut archive.content))
+            .unwrap_or_else(|| std::mem::take(&mut self.bytes))
+    }
+}
+
+impl Drop for StoredResource {
+    fn drop(&mut self) {
+        self.bytes.fill(0);
+        if let Some(archive) = self.archive.as_mut() {
+            archive.content.fill(0);
+        }
+    }
 }
 
 impl BackendResourceBroker {
@@ -73,7 +101,9 @@ impl BackendResourceBroker {
             runtime_id,
             worker,
             handle: handle.clone(),
-            archive,
+            bytes: Vec::new(),
+            archive: Some(archive),
+            one_shot: false,
         };
         if let Ok(mut resources) = self.resources.lock() {
             resources.insert(nonce, stored);
@@ -81,6 +111,84 @@ impl BackendResourceBroker {
         handle
     }
 
+    pub fn issue_repository_ssh_access_handle(
+        &self,
+        workspace_id: impl Into<String>,
+        runtime_id: &str,
+        resource_id: impl Into<String>,
+        revision: impl Into<String>,
+        expires_at_unix_seconds: i64,
+        secret: RepositorySshAccessSecret,
+    ) -> Result<BackendResourceHandle, BackendResourceError> {
+        let bytes =
+            serde_json::to_vec(&secret).map_err(|error| BackendResourceError::InvalidResponse {
+                message: error.to_string(),
+            })?;
+        if bytes.len() as u64 > DEFAULT_REPOSITORY_SSH_ACCESS_MAX_BYTES {
+            return Err(BackendResourceError::Oversized {
+                max_bytes: DEFAULT_REPOSITORY_SSH_ACCESS_MAX_BYTES,
+                actual_bytes: bytes.len() as u64,
+            });
+        }
+        let workspace_id = workspace_id.into();
+        let resource_id = resource_id.into();
+        let revision = revision.into();
+        let nonce = Uuid::now_v7().to_string();
+        let handle = BackendResourceHandle {
+            kind: BackendResourceKind::RepositorySshAccess,
+            workspace_id,
+            scope_id: Some("repository-ssh-access".to_string()),
+            runtime_id: Some(runtime_id.to_string()),
+            worker_id: None,
+            resource_id,
+            digest: format!("opaque:{nonce}"),
+            operation: BackendResourceOperation::FetchOnce,
+            expires_at_unix_seconds,
+            nonce: nonce.clone(),
+            revision,
+            generation: None,
+            max_bytes: DEFAULT_REPOSITORY_SSH_ACCESS_MAX_BYTES,
+            content_type: REPOSITORY_SSH_ACCESS_CONTENT_TYPE.to_string(),
+            redaction: ResourceRedactionPolicy::RuntimeInternalOnly,
+            audit_correlation_id: format!("repository-ssh-access-{nonce}"),
+            profile_source_graph: None,
+        };
+        let stored = StoredResource {
+            runtime_id: Some(runtime_id.to_string()),
+            worker: None,
+            handle: handle.clone(),
+            bytes,
+            archive: None,
+            one_shot: true,
+        };
+        let resource_key = nonce.clone();
+        self.resources
+            .lock()
+            .map_err(|_| BackendResourceError::Transport {
+                message: "resource broker lock poisoned".to_string(),
+            })?
+            .insert(resource_key.clone(), stored);
+        if expires_at_unix_seconds != i64::MAX {
+            let resources = self.resources.clone();
+            std::thread::spawn(move || {
+                let now = Utc::now().timestamp();
+                if expires_at_unix_seconds > now {
+                    std::thread::sleep(std::time::Duration::from_secs(
+                        (expires_at_unix_seconds - now) as u64,
+                    ));
+                }
+                if let Ok(mut resources) = resources.lock()
+                    && resources
+                        .get(&resource_key)
+                        .is_some_and(|stored| stored.handle.nonce == resource_key)
+                {
+                    resources.remove(&resource_key);
+                }
+            });
+        }
+        Ok(handle)
+    }
+
     pub fn profile_source_archive(
         &self,
         digest: &str,
@@ -90,20 +198,21 @@ impl BackendResourceBroker {
             .ok()?
             .values()
             .find(|resource| resource.handle.digest == digest)
-            .map(|resource| resource.archive.clone())
+            .and_then(|resource| resource.archive.clone())
     }
 
-    pub fn fetch_profile_source_archive(
+    pub fn fetch_resource(
         &self,
         request: BackendResourceFetchRequest,
     ) -> Result<BackendResourceFetchResponse, BackendResourceError> {
         verify_handle_shape(&request.handle)?;
-        let stored = self
+        let mut resources = self
             .resources
             .lock()
             .map_err(|_| BackendResourceError::Transport {
                 message: "resource broker lock poisoned".to_string(),
-            })?
+            })?;
+        let mut stored = resources
             .get(&request.handle.nonce)
             .cloned()
             .ok_or(BackendResourceError::MissingResource)?;
@@ -111,7 +220,7 @@ impl BackendResourceBroker {
         if stored.handle.expires_at_unix_seconds < Utc::now().timestamp() {
             return Err(BackendResourceError::Expired);
         }
-        let actual_bytes = stored.archive.content.len() as u64;
+        let actual_bytes = stored.byte_len() as u64;
         if actual_bytes > stored.handle.max_bytes {
             return Err(BackendResourceError::Oversized {
                 max_bytes: stored.handle.max_bytes,
@@ -139,12 +248,15 @@ impl BackendResourceBroker {
                 });
             }
         }
+        if stored.one_shot {
+            resources.remove(&request.handle.nonce);
+        }
         Ok(BackendResourceFetchResponse {
-            kind: BackendResourceKind::ProfileSourceArchive,
-            resource_id: stored.archive.reference.id,
-            digest: stored.archive.reference.digest,
-            content_type: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
-            bytes: stored.archive.content,
+            kind: stored.handle.kind.clone(),
+            resource_id: stored.handle.resource_id.clone(),
+            digest: stored.handle.digest.clone(),
+            content_type: stored.handle.content_type.clone(),
+            bytes: stored.take_bytes(),
             audit_correlation_id: request.audit_correlation_id,
         })
     }
@@ -156,24 +268,38 @@ impl BackendResourceClient for BackendResourceBroker {
         &self,
         request: BackendResourceFetchRequest,
     ) -> Result<BackendResourceFetchResponse, BackendResourceError> {
-        self.fetch_profile_source_archive(request)
+        self.fetch_resource(request)
     }
 }
 
 fn verify_handle_shape(handle: &BackendResourceHandle) -> Result<(), BackendResourceError> {
-    if handle.kind != BackendResourceKind::ProfileSourceArchive {
-        return Err(BackendResourceError::UnsupportedKind);
-    }
-    if handle.operation != BackendResourceOperation::FetchArchive {
-        return Err(BackendResourceError::Unauthorized {
-            message: "resource handle operation is not fetch_archive".to_string(),
-        });
-    }
-    if handle.content_type != PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE {
-        return Err(BackendResourceError::ContentTypeMismatch {
-            expected: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
-            actual: handle.content_type.clone(),
-        });
+    match handle.kind {
+        BackendResourceKind::ProfileSourceArchive => {
+            if handle.operation != BackendResourceOperation::FetchArchive {
+                return Err(BackendResourceError::Unauthorized {
+                    message: "resource handle operation is not fetch_archive".to_string(),
+                });
+            }
+            if handle.content_type != PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE {
+                return Err(BackendResourceError::ContentTypeMismatch {
+                    expected: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
+                    actual: handle.content_type.clone(),
+                });
+            }
+        }
+        BackendResourceKind::RepositorySshAccess => {
+            if handle.operation != BackendResourceOperation::FetchOnce {
+                return Err(BackendResourceError::Unauthorized {
+                    message: "resource handle operation is not fetch_once".to_string(),
+                });
+            }
+            if handle.content_type != REPOSITORY_SSH_ACCESS_CONTENT_TYPE {
+                return Err(BackendResourceError::ContentTypeMismatch {
+                    expected: REPOSITORY_SSH_ACCESS_CONTENT_TYPE.to_string(),
+                    actual: handle.content_type.clone(),
+                });
+            }
+        }
     }
     Ok(())
 }
@@ -249,7 +375,7 @@ mod tests {
             archive(),
         );
         let response = broker
-            .fetch_profile_source_archive(BackendResourceFetchRequest {
+            .fetch_resource(BackendResourceFetchRequest {
                 handle: handle.clone(),
                 runtime_id: runtime_id.to_string(),
                 worker_id: None,
@@ -260,6 +386,46 @@ mod tests {
         assert_eq!(response.content_type, PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE);
     }
 
+    #[test]
+    fn repository_ssh_access_resource_is_runtime_bound_and_one_shot() {
+        let broker = BackendResourceBroker::default();
+        let handle = broker
+            .issue_repository_ssh_access_handle(
+                "workspace-test",
+                "runtime-test",
+                "repository-access-test",
+                "1",
+                i64::MAX,
+                RepositorySshAccessSecret {
+                    private_key: "private-key-bytes".to_string(),
+                    known_hosts_entry: "known-hosts-entry".to_string(),
+                },
+            )
+            .unwrap();
+        let unauthorized = broker
+            .fetch_resource(request(handle.clone(), "runtime-other", None))
+            .unwrap_err();
+        assert!(matches!(
+            unauthorized,
+            BackendResourceError::Unauthorized { .. }
+        ));
+
+        let response = broker
+            .fetch_resource(request(handle.clone(), "runtime-test", None))
+            .unwrap();
+        assert_eq!(response.kind, BackendResourceKind::RepositorySshAccess);
+        assert_eq!(response.content_type, REPOSITORY_SSH_ACCESS_CONTENT_TYPE);
+        let debug = format!("{response:?}");
+        assert!(!debug.contains("private-key-bytes"));
+        assert!(debug.contains("REDACTED"));
+        let secret: RepositorySshAccessSecret = serde_json::from_slice(&response.bytes).unwrap();
+        assert_eq!(secret.private_key, "private-key-bytes");
+        assert!(matches!(
+            broker.fetch_resource(request(handle, "runtime-test", None)),
+            Err(BackendResourceError::MissingResource)
+        ));
+    }
+
     #[test]
     fn broker_rejects_runtime_mismatch() {
         let broker = BackendResourceBroker::default();
@@ -270,7 +436,7 @@ mod tests {
             archive(),
         );
         let err = broker
-            .fetch_profile_source_archive(request(handle, "runtime-b", None))
+            .fetch_resource(request(handle, "runtime-b", None))
             .unwrap_err();
         assert!(matches!(err, BackendResourceError::Unauthorized { .. }));
     }
@@ -287,7 +453,7 @@ mod tests {
             archive(),
         );
         let err = broker
-            .fetch_profile_source_archive(request(handle, runtime_id, Some(&worker_b.worker_id)))
+            .fetch_resource(request(handle, runtime_id, Some(&worker_b.worker_id)))
             .unwrap_err();
         assert!(matches!(err, BackendResourceError::Unauthorized { .. }));
     }
@@ -312,7 +478,7 @@ mod tests {
         let mut extended = handle;
         extended.expires_at_unix_seconds = 4_102_444_800;
         let err = broker
-            .fetch_profile_source_archive(request(extended, &runtime_id, None))
+            .fetch_resource(request(extended, &runtime_id, None))
             .unwrap_err();
         assert!(matches!(err, BackendResourceError::Expired));
     }
@@ -328,7 +494,7 @@ mod tests {
         );
         handle.scope_id = Some("tampered-scope".to_string());
         let err = broker
-            .fetch_profile_source_archive(request(handle, &runtime_id, None))
+            .fetch_resource(request(handle, &runtime_id, None))
             .unwrap_err();
         assert!(matches!(err, BackendResourceError::Unauthorized { .. }));
     }
@@ -345,7 +511,7 @@ mod tests {
         );
         handle.max_bytes = DEFAULT_PROFILE_SOURCE_ARCHIVE_MAX_BYTES + 1024;
         let err = broker
-            .fetch_profile_source_archive(request(handle, &runtime_id, None))
+            .fetch_resource(request(handle, &runtime_id, None))
             .unwrap_err();
         assert!(matches!(err, BackendResourceError::Oversized { .. }));
     }

crates/workspace-server/src/runtime_settings.rs

@@ -0,0 +1,229 @@
+use config_source::ConfigSchemaContribution;
+use serde::Deserialize;
+
+use crate::config_source::{
+    WorkspaceConfigSchemaProvider, WorkspaceConfigState, evaluate_workspace_config_state,
+};
+use crate::{Error, Result};
+
+const RUNTIME_SCHEMA_SOURCE: &str = r#"{
+    runtime = {
+        default_runtime_id = String default "";
+    };
+}"#;
+
+#[derive(Debug, Default)]
+pub struct RuntimeConfigSchemaProvider;
+
+impl WorkspaceConfigSchemaProvider for RuntimeConfigSchemaProvider {
+    fn contribution(&self) -> Result<ConfigSchemaContribution> {
+        ConfigSchemaContribution::new("builtin:runtime", "runtime", "1", RUNTIME_SCHEMA_SOURCE)
+            .map_err(|error| Error::Config(error.to_string()))
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RuntimeConfigProjection {
+    pub config_revision: u64,
+    pub projection_digest: String,
+    pub default_runtime_id: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct VirtualRuntimeConfig {
+    runtime: VirtualRuntimeSection,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct VirtualRuntimeSection {
+    default_runtime_id: String,
+}
+
+pub fn project_runtime_from_workspace_config(
+    workspace_id: &str,
+    state: &WorkspaceConfigState,
+) -> Result<RuntimeConfigProjection> {
+    let has_runtime_schema = state
+        .contract
+        .schema_bundle
+        .contributions
+        .iter()
+        .any(|entry| entry.provider_id == "builtin:runtime");
+    if !has_runtime_schema {
+        return Ok(RuntimeConfigProjection {
+            config_revision: state.snapshot.revision,
+            projection_digest: state.projection_digest.clone(),
+            default_runtime_id: None,
+        });
+    }
+
+    let evaluation = evaluate_workspace_config_state(state, state.contract.schema_bundle.clone())?;
+    if evaluation.projection_digest != state.projection_digest {
+        return Err(Error::RegistryInconsistency(format!(
+            "Runtime projection digest mismatch for Workspace {workspace_id}"
+        )));
+    }
+    let projected = evaluation.projections.first().ok_or_else(|| {
+        Error::RegistryInconsistency("Workspace config has no active projection".to_string())
+    })?;
+    let config: VirtualRuntimeConfig = serde_json::from_value(projected.data_json.clone())
+        .map_err(|error| Error::RegistryInconsistency(error.to_string()))?;
+    let default_runtime_id = normalize_runtime_id(&config.runtime.default_runtime_id)?;
+    Ok(RuntimeConfigProjection {
+        config_revision: state.snapshot.revision,
+        projection_digest: evaluation.projection_digest,
+        default_runtime_id,
+    })
+}
+
+fn normalize_runtime_id(value: &str) -> Result<Option<String>> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Ok(None);
+    }
+    if value.chars().any(char::is_control) {
+        return Err(Error::InvalidRuntimeIdentifier {
+            kind: "runtime_id".to_string(),
+            value: "[redacted invalid value]".to_string(),
+        });
+    }
+    Ok(Some(value.to_string()))
+}
+
+#[cfg(test)]
+mod tests {
+    use config_source::{ConfigContentType, ConfigEntry, ConfigTreeSnapshot, VirtualPath};
+
+    use super::*;
+
+    fn state(source: &str) -> WorkspaceConfigState {
+        let bundle =
+            config_source::WorkspaceConfigSchemaBundle::compose([RuntimeConfigSchemaProvider
+                .contribution()
+                .unwrap()])
+            .unwrap();
+        let snapshot = ConfigTreeSnapshot::from_entries(
+            7,
+            [ConfigEntry::new(
+                VirtualPath::parse("main.dcdl").unwrap(),
+                ConfigContentType::Decodal,
+                source,
+            )
+            .unwrap()],
+        )
+        .unwrap();
+        let contract = config_source::ToolchainContract::with_schema_bundle(
+            config_source::DEFAULT_SCHEMA_VERSION,
+            vec![VirtualPath::parse("main.dcdl").unwrap()],
+            config_source::DEFAULT_IMPORT_POLICY_VERSION,
+            bundle,
+        );
+        let projection_digest = config_source::SnapshotEnvironment::new(snapshot.clone())
+            .evaluate_contract(&contract)
+            .unwrap()
+            .projection_digest;
+        WorkspaceConfigState {
+            snapshot,
+            contract,
+            projection_digest,
+        }
+    }
+
+    #[test]
+    fn runtime_projection_reads_default_and_preserves_revision_evidence() {
+        let projection = project_runtime_from_workspace_config(
+            "workspace",
+            &state(
+                r#"{ runtime = { default_runtime_id = "arcadia"; }; } as WorkspaceConfigSchema"#,
+            ),
+        )
+        .unwrap();
+        assert_eq!(projection.default_runtime_id.as_deref(), Some("arcadia"));
+        assert_eq!(projection.config_revision, 7);
+        assert!(!projection.projection_digest.is_empty());
+    }
+
+    #[test]
+    fn runtime_projection_treats_missing_default_as_unconfigured() {
+        let projection = project_runtime_from_workspace_config(
+            "workspace",
+            &state("{} as WorkspaceConfigSchema"),
+        )
+        .unwrap();
+        assert_eq!(projection.default_runtime_id, None);
+    }
+
+    #[test]
+    fn runtime_projection_treats_pre_runtime_schema_bundle_as_unconfigured() {
+        let bundle =
+            config_source::WorkspaceConfigSchemaBundle::compose([ConfigSchemaContribution::new(
+                "builtin:legacy",
+                "legacy",
+                "1",
+                "{ legacy = { enabled = Bool default false; }; }",
+            )
+            .unwrap()])
+            .unwrap();
+        let snapshot = ConfigTreeSnapshot::from_entries(
+            6,
+            [ConfigEntry::new(
+                VirtualPath::parse("main.dcdl").unwrap(),
+                ConfigContentType::Decodal,
+                "{ legacy = { enabled = true; }; } as WorkspaceConfigSchema",
+            )
+            .unwrap()],
+        )
+        .unwrap();
+        let contract = config_source::ToolchainContract::with_schema_bundle(
+            config_source::DEFAULT_SCHEMA_VERSION,
+            vec![VirtualPath::parse("main.dcdl").unwrap()],
+            config_source::DEFAULT_IMPORT_POLICY_VERSION,
+            bundle,
+        );
+        let projection_digest = config_source::SnapshotEnvironment::new(snapshot.clone())
+            .evaluate_contract(&contract)
+            .unwrap()
+            .projection_digest;
+        let state = WorkspaceConfigState {
+            snapshot,
+            contract,
+            projection_digest: projection_digest.clone(),
+        };
+
+        let projection = project_runtime_from_workspace_config("workspace", &state).unwrap();
+        assert_eq!(projection.default_runtime_id, None);
+        assert_eq!(projection.config_revision, 6);
+        assert_eq!(projection.projection_digest, projection_digest);
+    }
+
+    #[test]
+    fn runtime_schema_rejects_non_string_default() {
+        let bundle =
+            config_source::WorkspaceConfigSchemaBundle::compose([RuntimeConfigSchemaProvider
+                .contribution()
+                .unwrap()])
+            .unwrap();
+        let snapshot = ConfigTreeSnapshot::from_entries(
+            1,
+            [ConfigEntry::new(
+                VirtualPath::parse("main.dcdl").unwrap(),
+                ConfigContentType::Decodal,
+                "{ runtime = { default_runtime_id = 42; }; } as WorkspaceConfigSchema",
+            )
+            .unwrap()],
+        )
+        .unwrap();
+        let contract = config_source::ToolchainContract::with_schema_bundle(
+            config_source::DEFAULT_SCHEMA_VERSION,
+            vec![VirtualPath::parse("main.dcdl").unwrap()],
+            config_source::DEFAULT_IMPORT_POLICY_VERSION,
+            bundle,
+        );
+        assert!(
+            config_source::SnapshotEnvironment::new(snapshot)
+                .evaluate_contract(&contract)
+                .is_err()
+        );
+    }
+}

crates/workspace-server/src/workdir_create_operations.rs

@@ -0,0 +1,426 @@
+use rusqlite::{OptionalExtension, params};
+use sha2::{Digest, Sha256};
+
+use crate::store::WorkdirCreateOperationRecord;
+use crate::{Error, Result, SqliteWorkspaceStore};
+
+pub fn selector_for_retry(
+    explicit_selector: Option<&str>,
+    persisted_selector: Option<&str>,
+    current_default_selector: Option<&str>,
+) -> Option<String> {
+    explicit_selector
+        .or(persisted_selector)
+        .or(current_default_selector)
+        .map(str::to_string)
+}
+
+pub fn request_fingerprint(
+    repository_id: &str,
+    selector: Option<&str>,
+    requested_runtime_id: Option<&str>,
+    repository_source_fingerprint: &str,
+    repository_source_revision: u64,
+) -> String {
+    let mut hasher = Sha256::new();
+    for value in [
+        Some(repository_id),
+        selector,
+        requested_runtime_id,
+        Some(repository_source_fingerprint),
+    ] {
+        match value {
+            Some(value) => {
+                hasher.update([1]);
+                hasher.update((value.len() as u64).to_be_bytes());
+                hasher.update(value.as_bytes());
+            }
+            None => hasher.update([0]),
+        }
+    }
+    hasher.update(repository_source_revision.to_be_bytes());
+    let digest = hasher.finalize();
+    let mut encoded = String::with_capacity(digest.len() * 2);
+    for byte in digest {
+        use std::fmt::Write as _;
+        write!(&mut encoded, "{byte:02x}").expect("writing to String cannot fail");
+    }
+    format!("sha256:{encoded}")
+}
+
+impl SqliteWorkspaceStore {
+    pub fn reserve_workdir_create_operation(
+        &self,
+        record: &WorkdirCreateOperationRecord,
+    ) -> Result<WorkdirCreateOperationRecord> {
+        self.with_conn_mut(|conn| {
+            let tx = conn.transaction()?;
+            tx.execute(
+                r#"INSERT OR IGNORE INTO workdir_create_operations (
+                    workspace_id, operation_id, request_fingerprint, repository_id, selector,
+                    requested_runtime_id, resolved_runtime_id, config_revision,
+                    config_projection_digest, source_kind, source_uri, source_revision,
+                    source_fingerprint, working_directory_id, state, failure,
+                    created_at, updated_at
+                ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18)"#,
+                params![
+                    record.workspace_id,
+                    record.operation_id,
+                    record.request_fingerprint,
+                    record.repository_id,
+                    record.selector,
+                    record.requested_runtime_id,
+                    record.resolved_runtime_id,
+                    record.config_revision as i64,
+                    record.config_projection_digest,
+                    record.source_kind,
+                    record.source_uri,
+                    record.source_revision.map(|revision| revision as i64),
+                    record.source_fingerprint,
+                    record.working_directory_id,
+                    record.state,
+                    record.failure,
+                    record.created_at,
+                    record.updated_at,
+                ],
+            )?;
+            let persisted =
+                read_workdir_create_operation(&tx, &record.workspace_id, &record.operation_id)?
+                    .ok_or_else(|| {
+                        Error::RegistryInconsistency(format!(
+                            "Workdir create operation `{}` was not persisted",
+                            record.operation_id
+                        ))
+                    })?;
+            if persisted.request_fingerprint != record.request_fingerprint {
+                return Err(Error::InvalidInput(format!(
+                    "Workdir create operation `{}` was reused with different input",
+                    record.operation_id
+                )));
+            }
+            tx.commit()?;
+            Ok(persisted)
+        })
+    }
+
+    pub fn bind_workdir_create_repository_access(
+        &self,
+        workspace_id: &str,
+        operation_id: &str,
+        request_fingerprint: &str,
+        credential_id: &str,
+        credential_revision: u64,
+        host_trust_id: &str,
+        host_trust_revision: u64,
+        repository_access_mode: &str,
+        cache_generation: u64,
+        now: &str,
+    ) -> Result<WorkdirCreateOperationRecord> {
+        self.with_conn_mut(|conn| {
+            let operation = read_workdir_create_operation(conn, workspace_id, operation_id)?
+                .ok_or_else(|| {
+                    Error::RegistryInconsistency(format!(
+                        "Workdir create operation `{operation_id}` disappeared before Repository access binding"
+                    ))
+                })?;
+            if operation.request_fingerprint != request_fingerprint {
+                return Err(Error::InvalidInput(format!(
+                    "Workdir create operation `{operation_id}` was reused with different input"
+                )));
+            }
+            if let Some(existing) = operation.credential_id.as_deref() {
+                if existing != credential_id
+                    || operation.credential_revision != Some(credential_revision)
+                    || operation.host_trust_id.as_deref() != Some(host_trust_id)
+                    || operation.host_trust_revision != Some(host_trust_revision)
+                    || operation.repository_access_mode.as_deref()
+                        != Some(repository_access_mode)
+                    || operation.cache_generation != cache_generation
+                {
+                    return Err(Error::InvalidInput(format!(
+                        "Workdir create operation `{operation_id}` Repository access evidence changed"
+                    )));
+                }
+                return Ok(operation);
+            }
+            conn.execute(
+                r#"UPDATE workdir_create_operations
+                   SET credential_id = ?4, credential_revision = ?5,
+                       host_trust_id = ?6, host_trust_revision = ?7,
+                       repository_access_mode = ?8, cache_generation = ?9,
+                       updated_at = ?10
+                   WHERE workspace_id = ?1 AND operation_id = ?2
+                     AND request_fingerprint = ?3 AND credential_id IS NULL"#,
+                params![
+                    workspace_id,
+                    operation_id,
+                    request_fingerprint,
+                    credential_id,
+                    i64::try_from(credential_revision).map_err(|_| Error::InvalidInput(
+                        "credential revision is out of range".to_string()
+                    ))?,
+                    host_trust_id,
+                    i64::try_from(host_trust_revision).map_err(|_| Error::InvalidInput(
+                        "host-trust revision is out of range".to_string()
+                    ))?,
+                    repository_access_mode,
+                    i64::try_from(cache_generation).map_err(|_| Error::InvalidInput(
+                        "cache generation is out of range".to_string()
+                    ))?,
+                    now,
+                ],
+            )?;
+            read_workdir_create_operation(conn, workspace_id, operation_id)?.ok_or_else(|| {
+                Error::RegistryInconsistency(format!(
+                    "Workdir create operation `{operation_id}` disappeared after Repository access binding"
+                ))
+            })
+        })
+    }
+
+    pub fn finish_workdir_create_operation(
+        &self,
+        workspace_id: &str,
+        operation_id: &str,
+        request_fingerprint: &str,
+        succeeded: bool,
+        failure: Option<&str>,
+        updated_at: &str,
+    ) -> Result<WorkdirCreateOperationRecord> {
+        self.with_conn_mut(|conn| {
+            let changed = conn.execute(
+                r#"UPDATE workdir_create_operations
+                   SET state = ?1, failure = ?2, updated_at = ?3
+                   WHERE workspace_id = ?4 AND operation_id = ?5
+                     AND request_fingerprint = ?6"#,
+                params![
+                    if succeeded { "succeeded" } else { "failed" },
+                    failure,
+                    updated_at,
+                    workspace_id,
+                    operation_id,
+                    request_fingerprint,
+                ],
+            )?;
+            if changed != 1 {
+                return Err(Error::RegistryInconsistency(format!(
+                    "Workdir create operation `{operation_id}` could not be finalized"
+                )));
+            }
+            read_workdir_create_operation(conn, workspace_id, operation_id)?.ok_or_else(|| {
+                Error::RegistryInconsistency(format!(
+                    "Workdir create operation `{operation_id}` disappeared"
+                ))
+            })
+        })
+    }
+
+    pub fn load_workdir_create_operation(
+        &self,
+        workspace_id: &str,
+        operation_id: &str,
+    ) -> Result<Option<WorkdirCreateOperationRecord>> {
+        self.with_conn(|conn| read_workdir_create_operation(conn, workspace_id, operation_id))
+    }
+}
+
+fn read_workdir_create_operation(
+    conn: &rusqlite::Connection,
+    workspace_id: &str,
+    operation_id: &str,
+) -> Result<Option<WorkdirCreateOperationRecord>> {
+    conn.query_row(
+        r#"SELECT workspace_id, operation_id, request_fingerprint, repository_id, selector,
+                  requested_runtime_id, resolved_runtime_id, config_revision,
+                  config_projection_digest, source_kind, source_uri, source_revision,
+                  source_fingerprint, credential_id, credential_revision,
+                  host_trust_id, host_trust_revision, repository_access_mode,
+                  cache_generation, working_directory_id, state, failure,
+                  created_at, updated_at
+           FROM workdir_create_operations
+           WHERE workspace_id = ?1 AND operation_id = ?2"#,
+        params![workspace_id, operation_id],
+        |row| {
+            Ok(WorkdirCreateOperationRecord {
+                workspace_id: row.get(0)?,
+                operation_id: row.get(1)?,
+                request_fingerprint: row.get(2)?,
+                repository_id: row.get(3)?,
+                selector: row.get(4)?,
+                requested_runtime_id: row.get(5)?,
+                resolved_runtime_id: row.get(6)?,
+                config_revision: row.get::<_, i64>(7)? as u64,
+                config_projection_digest: row.get(8)?,
+                source_kind: row.get(9)?,
+                source_uri: row.get(10)?,
+                source_revision: row.get::<_, Option<i64>>(11)?.map(|value| value as u64),
+                source_fingerprint: row.get(12)?,
+                credential_id: row.get(13)?,
+                credential_revision: row.get::<_, Option<i64>>(14)?.map(|value| value as u64),
+                host_trust_id: row.get(15)?,
+                host_trust_revision: row.get::<_, Option<i64>>(16)?.map(|value| value as u64),
+                repository_access_mode: row.get(17)?,
+                cache_generation: row.get::<_, i64>(18)? as u64,
+                working_directory_id: row.get(19)?,
+                state: row.get(20)?,
+                failure: row.get(21)?,
+                created_at: row.get(22)?,
+                updated_at: row.get(23)?,
+            })
+        },
+    )
+    .optional()
+    .map_err(Error::from)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::store::{ControlPlaneStore, RepositoryRecord, WorkspaceRecord};
+
+    #[test]
+    fn retry_selector_keeps_persisted_default_but_honors_explicit_input() {
+        assert_eq!(
+            selector_for_retry(None, Some("develop"), Some("main")),
+            Some("develop".to_string())
+        );
+        assert_eq!(
+            selector_for_retry(Some("release"), Some("develop"), Some("main")),
+            Some("release".to_string())
+        );
+        assert_eq!(
+            selector_for_retry(None, None, Some("main")),
+            Some("main".to_string())
+        );
+    }
+
+    #[test]
+    fn retry_keeps_resolved_config_evidence_and_rejects_changed_input() {
+        let store = SqliteWorkspaceStore::in_memory().unwrap();
+        futures::executor::block_on(store.upsert_workspace(&WorkspaceRecord {
+            workspace_id: "workspace".to_string(),
+            owner_account_id: None,
+            display_name: "Workspace".to_string(),
+            state: "active".to_string(),
+            created_at: "2026-08-24T00:00:00Z".to_string(),
+            updated_at: "2026-08-24T00:00:00Z".to_string(),
+        }))
+        .unwrap();
+        store
+            .upsert_repository(&RepositoryRecord {
+                workspace_id: "workspace".to_string(),
+                repository_id: "main".to_string(),
+                name: "main".to_string(),
+                kind: "git".to_string(),
+                provider: Some("git".to_string()),
+                source: workspace_api::RepositorySource {
+                    kind: workspace_api::RepositorySourceKind::LocalPath,
+                    uri: "/tmp/main".to_string(),
+                },
+                default_ref: Some("develop".to_string()),
+                source_revision: 1,
+                source_fingerprint: "sha256:test".to_string(),
+                observed_status: workspace_api::RepositoryObservedStatus::Unverified,
+                observed_at: None,
+                created_at: "2026-08-24T00:00:00Z".to_string(),
+                updated_at: "2026-08-24T00:00:00Z".to_string(),
+            })
+            .unwrap();
+        let record = WorkdirCreateOperationRecord {
+            workspace_id: "workspace".to_string(),
+            operation_id: "call-1".to_string(),
+            request_fingerprint: request_fingerprint(
+                "main",
+                Some("develop"),
+                None,
+                "sha256:test",
+                1,
+            ),
+            repository_id: "main".to_string(),
+            selector: Some("develop".to_string()),
+            requested_runtime_id: None,
+            resolved_runtime_id: "arcadia".to_string(),
+            config_revision: 7,
+            config_projection_digest: "sha256:projection".to_string(),
+            source_kind: Some("local_path".to_string()),
+            source_uri: Some("/tmp/repo".to_string()),
+            source_revision: Some(1),
+            source_fingerprint: Some("sha256:source".to_string()),
+            credential_id: None,
+            credential_revision: None,
+            host_trust_id: None,
+            host_trust_revision: None,
+            repository_access_mode: None,
+            cache_generation: 0,
+            working_directory_id: "wd-1".to_string(),
+            state: "pending".to_string(),
+            failure: None,
+            created_at: "2026-08-24T00:00:00Z".to_string(),
+            updated_at: "2026-08-24T00:00:00Z".to_string(),
+        };
+        assert_eq!(
+            store.reserve_workdir_create_operation(&record).unwrap(),
+            record
+        );
+        let bound = store
+            .bind_workdir_create_repository_access(
+                "workspace",
+                "call-1",
+                &record.request_fingerprint,
+                "credential-1",
+                3,
+                "trust-1",
+                5,
+                "read_only",
+                2,
+                "2026-08-24T00:00:01Z",
+            )
+            .unwrap();
+        assert_eq!(bound.credential_id.as_deref(), Some("credential-1"));
+        assert_eq!(bound.credential_revision, Some(3));
+        assert_eq!(bound.host_trust_revision, Some(5));
+        assert_eq!(bound.cache_generation, 2);
+        assert!(
+            store
+                .bind_workdir_create_repository_access(
+                    "workspace",
+                    "call-1",
+                    &record.request_fingerprint,
+                    "credential-1",
+                    4,
+                    "trust-1",
+                    5,
+                    "read_only",
+                    2,
+                    "2026-08-24T00:00:02Z",
+                )
+                .is_err()
+        );
+        let mut changed_resolution = record.clone();
+        changed_resolution.resolved_runtime_id = "other".to_string();
+        changed_resolution.config_revision = 8;
+        changed_resolution.source_uri = Some("ssh://git@other.test/repo.git".to_string());
+        changed_resolution.source_revision = Some(9);
+        let replayed = store
+            .reserve_workdir_create_operation(&changed_resolution)
+            .unwrap();
+        assert_eq!(replayed, bound);
+        assert_eq!(replayed.source_uri.as_deref(), Some("/tmp/repo"));
+        assert_eq!(
+            store
+                .load_workdir_create_operation("workspace", "call-1")
+                .unwrap(),
+            Some(bound.clone())
+        );
+        let mut changed_input = record.clone();
+        changed_input.request_fingerprint =
+            request_fingerprint("main", Some("main"), None, "sha256:test", 1);
+        assert!(
+            store
+                .reserve_workdir_create_operation(&changed_input)
+                .unwrap_err()
+                .to_string()
+                .contains("reused with different input")
+        );
+    }
+}

crates/workspace-server/src/worker_source.rs

@@ -3,14 +3,121 @@ use std::time::{SystemTime, UNIX_EPOCH};
 
 use axum::http::HeaderMap;
 use worker_runtime::auth::{
-    WorkerMutationActorKind, WorkerMutationOperation, WorkerMutationSourceClaims,
-    WorkerMutationSourceExpectation, decode_worker_mutation_source_claims,
-    verify_worker_mutation_source_proof,
+    RuntimeRequestSourceExpectation, WorkerMutationActorKind, WorkerMutationOperation,
+    WorkerMutationSourceClaims, WorkerMutationSourceExpectation,
+    decode_runtime_request_source_claims, decode_worker_mutation_source_claims,
+    verify_runtime_request_source, verify_worker_mutation_source_proof,
 };
 use worker_runtime::worker_source::InProcessWorkerMutationProof;
 
 use crate::hosts::RemoteRuntimeConfig;
-use crate::server::WorkspaceApi;
+use crate::server::{ServerConfig, WorkspaceApi};
+use crate::store::ControlPlaneStore;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct VerifiedRuntimeRequestSource {
+    pub runtime_id: String,
+    pub worker_id: Option<String>,
+}
+
+pub async fn verify_runtime_request_source_proof(
+    api: &WorkspaceApi,
+    proof: &str,
+    workspace_id: &str,
+    permission: &str,
+    method: &str,
+    path: &str,
+    body_digest: &str,
+) -> Result<VerifiedRuntimeRequestSource, WorkerMutationSourceProofError> {
+    verify_runtime_request_source_proof_with_store(
+        api.store.as_ref(),
+        &api.config,
+        proof,
+        workspace_id,
+        permission,
+        method,
+        path,
+        body_digest,
+    )
+    .await
+}
+
+#[allow(clippy::too_many_arguments)]
+pub async fn verify_runtime_request_source_proof_with_store(
+    store: &dyn ControlPlaneStore,
+    config: &ServerConfig,
+    proof: &str,
+    workspace_id: &str,
+    permission: &str,
+    method: &str,
+    path: &str,
+    body_digest: &str,
+) -> Result<VerifiedRuntimeRequestSource, WorkerMutationSourceProofError> {
+    let unverified = decode_runtime_request_source_claims(proof)
+        .map_err(|_| WorkerMutationSourceProofError::Invalid)?;
+    let audience = remote_audience(config, &unverified.iss, workspace_id)?;
+    let trusted = store
+        .get_trusted_runtime(&unverified.iss)
+        .await
+        .map_err(|error| WorkerMutationSourceProofError::Authority(error.to_string()))?
+        .filter(|record| record.revoked_at.is_none())
+        .ok_or(WorkerMutationSourceProofError::RevokedRuntimeTrust)?;
+    let trusted_for_workspace = trusted.workspace_id.as_deref() == Some(workspace_id)
+        || (unverified.iss == crate::hosts::EMBEDDED_RUNTIME_ID && trusted.workspace_id.is_none());
+    if !trusted_for_workspace {
+        return Err(WorkerMutationSourceProofError::WrongWorkspace);
+    }
+    let expected = RuntimeRequestSourceExpectation {
+        identity_id: &unverified.iss,
+        audience: audience.as_ref(),
+        workspace_id,
+        worker_id: unverified.worker_id.as_deref(),
+        permission,
+        method,
+        path,
+        body_digest,
+        now_unix: i64::try_from(unix_now_seconds()).unwrap_or(i64::MAX),
+    };
+    let claims = verify_runtime_request_source(proof, &trusted.public_key, &expected)
+        .map_err(map_auth_error)?;
+    let now_seconds = u64::try_from(expected.now_unix).unwrap_or(u64::MAX);
+    let expires_at = u64::try_from(claims.exp).unwrap_or(0);
+    let consumed_at = chrono::DateTime::from_timestamp(expected.now_unix, 0)
+        .ok_or(WorkerMutationSourceProofError::Expired)?
+        .to_rfc3339();
+    if !store
+        .consume_worker_mutation_source_jti(
+            &claims.iss,
+            &claims.jti,
+            expires_at,
+            now_seconds,
+            &consumed_at,
+        )
+        .await
+        .map_err(|error| WorkerMutationSourceProofError::Authority(error.to_string()))?
+    {
+        return Err(WorkerMutationSourceProofError::Replay);
+    }
+    if let Some(worker_id) = claims.worker_id.as_deref() {
+        let worker = worker_runtime::identity::RuntimeWorkerRef {
+            runtime_id: claims.iss.clone(),
+            worker_id: worker_id.to_owned(),
+        };
+        let member = store
+            .get_worker_registry(workspace_id, &worker)
+            .map_err(|error| WorkerMutationSourceProofError::Authority(error.to_string()))?;
+        let reserved = store
+            .has_active_worker_create_reservation(workspace_id, &worker)
+            .map_err(|error| WorkerMutationSourceProofError::Authority(error.to_string()))?;
+        if member.is_none() && !reserved {
+            return Err(WorkerMutationSourceProofError::WorkerCatalogMembership);
+        }
+    }
+    Ok(VerifiedRuntimeRequestSource {
+        runtime_id: claims.iss,
+        worker_id: claims.worker_id,
+    })
+}
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum PresentedWorkerMutationSourceProof<'a> {
@@ -97,16 +204,19 @@ async fn verify_worker_remove_source_with(
         PresentedWorkerMutationSourceProof::Remote(token) => {
             let unverified = decode_worker_mutation_source_claims(token)
                 .map_err(|_| WorkerMutationSourceProofError::Invalid)?;
-            let audience = remote_audience(config, &unverified.iss)?;
+            let audience = remote_audience(config, &unverified.iss, &config.workspace_id)?;
             let trusted = store
                 .get_trusted_runtime(&unverified.iss)
                 .await
                 .map_err(|error| WorkerMutationSourceProofError::Authority(error.to_string()))?
                 .filter(|record| record.revoked_at.is_none())
                 .ok_or(WorkerMutationSourceProofError::RevokedRuntimeTrust)?;
+            if trusted.workspace_id.as_deref() != Some(config.workspace_id.as_str()) {
+                return Err(WorkerMutationSourceProofError::WrongWorkspace);
+            }
             let expected = WorkerMutationSourceExpectation {
                 runtime_id: &unverified.iss,
-                audience,
+                audience: audience.as_ref(),
                 workspace_id: &config.workspace_id,
                 worker_id: None,
                 actor_kind: WorkerMutationActorKind::Worker,
@@ -247,13 +357,17 @@ impl worker_runtime::worker_source::EmbeddedWorkerMutationDispatcher
 fn remote_audience<'a>(
     config: &'a crate::server::ServerConfig,
     runtime_id: &str,
-) -> Result<&'a str, WorkerMutationSourceProofError> {
+    workspace_id: &str,
+) -> Result<std::borrow::Cow<'a, str>, WorkerMutationSourceProofError> {
+    if runtime_id == crate::hosts::EMBEDDED_RUNTIME_ID {
+        return Ok(std::borrow::Cow::Owned(format!("embedded:{workspace_id}")));
+    }
     config
         .remote_runtime_sources
         .iter()
         .find(|runtime| runtime.runtime_id == runtime_id)
         .and_then(|runtime: &RemoteRuntimeConfig| runtime.auth.as_ref())
-        .map(|auth| auth.server_id.as_str())
+        .map(|auth| std::borrow::Cow::Borrowed(auth.server_id.as_str()))
         .ok_or(WorkerMutationSourceProofError::RevokedRuntimeTrust)
 }
 

crates/workspace-server/src/workspace_catalog.rs

@@ -1,4 +1,3 @@
-use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use chrono::{SecondsFormat, Utc};
@@ -6,6 +5,9 @@ use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use uuid::Uuid;
 
+use workspace_api::{RepositoryObservedStatus, RepositorySource};
+
+use crate::repository_source::{parse_repository_source, repository_source_fingerprint};
 use crate::store::{
     ControlPlaneStore, RepositoryRecord, WorkspaceBootstrapRecord, WorkspaceRecord,
 };
@@ -52,6 +54,10 @@ impl WorkspaceCatalogService {
         Self { store }
     }
 
+    pub fn is_empty(&self) -> Result<bool> {
+        Ok(self.store.list_workspaces()?.is_empty())
+    }
+
     pub fn list(
         &self,
         owner_account_id: Option<&str>,
@@ -74,33 +80,16 @@ impl WorkspaceCatalogService {
     pub fn create(
         &self,
         request: WorkspaceCreateRequest,
-        owner_account_id: Option<String>,
+        owner_account_id: String,
     ) -> Result<WorkspaceCreateResponse> {
-        self.create_internal(request, owner_account_id, None, false)
-    }
-
-    pub fn create_first_ownerless(
-        &self,
-        request: WorkspaceCreateRequest,
-    ) -> Result<WorkspaceCreateResponse> {
-        self.create_internal(request, None, None, true)
-    }
-
-    pub fn create_with_workspace_id(
-        &self,
-        request: WorkspaceCreateRequest,
-        owner_account_id: Option<String>,
-        requested_workspace_id: Option<String>,
-    ) -> Result<WorkspaceCreateResponse> {
-        self.create_internal(request, owner_account_id, requested_workspace_id, false)
+        self.create_internal(request, owner_account_id, None)
     }
 
     fn create_internal(
         &self,
         request: WorkspaceCreateRequest,
-        owner_account_id: Option<String>,
+        owner_account_id: String,
         requested_workspace_id: Option<String>,
-        require_empty_catalog: bool,
     ) -> Result<WorkspaceCreateResponse> {
         let operation_key = normalize_required(
             "operation_key",
@@ -109,8 +98,8 @@ impl WorkspaceCatalogService {
         )?;
         let display_name =
             normalize_required("display_name", request.display_name, MAX_DISPLAY_NAME_BYTES)?;
-        let repository_path = validate_repository_uri(&request.repository.uri)?;
-        let repository_uri = repository_path.to_string_lossy().into_owned();
+        let repository_source = validate_repository_source(&request.repository.uri)?;
+        let repository_uri = repository_source.uri.clone();
         let repository_name = request
             .repository
             .display_name
@@ -140,7 +129,7 @@ impl WorkspaceCatalogService {
         let fingerprint = workspace_create_fingerprint(
             requested_workspace_id.as_deref(),
             &display_name,
-            owner_account_id.as_deref(),
+            Some(&owner_account_id),
             &repository_uri,
             &repository_name,
             &default_ref,
@@ -151,10 +140,10 @@ impl WorkspaceCatalogService {
             .create_workspace_bootstrap(&WorkspaceBootstrapRecord {
                 operation_key,
                 request_fingerprint: fingerprint.clone(),
-                require_empty_catalog,
+                require_empty_catalog: false,
                 workspace: WorkspaceRecord {
                     workspace_id: workspace_id.clone(),
-                    owner_account_id,
+                    owner_account_id: Some(owner_account_id),
                     display_name,
                     state: "active".to_string(),
                     created_at: now.clone(),
@@ -166,10 +155,12 @@ impl WorkspaceCatalogService {
                     name: repository_name,
                     kind: "git".to_string(),
                     provider: Some("git".to_string()),
-                    uri: repository_uri,
+                    source: repository_source.clone(),
                     default_ref: Some(default_ref),
-                    auth_ref_kind: None,
-                    auth_ref_key: None,
+                    source_revision: 1,
+                    source_fingerprint: repository_source_fingerprint(&repository_source),
+                    observed_status: RepositoryObservedStatus::Unverified,
+                    observed_at: None,
                     created_at: now.clone(),
                     updated_at: now,
                 },
@@ -194,35 +185,8 @@ fn normalize_required(field: &str, value: String, max_bytes: usize) -> Result<St
     Ok(value.to_string())
 }
 
-fn validate_repository_uri(uri: &str) -> Result<PathBuf> {
-    let uri = uri.trim();
-    if uri.is_empty() || uri.contains("://") {
-        return Err(Error::InvalidInput(
-            "initial repository uri must be an absolute server-local path".to_string(),
-        ));
-    }
-    let path = Path::new(uri);
-    if !path.is_absolute() {
-        return Err(Error::InvalidInput(
-            "initial repository uri must be an absolute server-local path".to_string(),
-        ));
-    }
-    let path = path.canonicalize().map_err(|error| {
-        Error::InvalidInput(format!("initial repository path is unavailable: {error}"))
-    })?;
-    if !path.is_dir() {
-        return Err(Error::InvalidInput(
-            "initial repository path must be a directory".to_string(),
-        ));
-    }
-    let normal_git = path.join(".git").exists();
-    let bare_git = path.join("HEAD").is_file() && path.join("objects").is_dir();
-    if !normal_git && !bare_git {
-        return Err(Error::InvalidInput(
-            "initial repository path is not a Git repository".to_string(),
-        ));
-    }
-    Ok(path)
+fn validate_repository_source(uri: &str) -> Result<RepositorySource> {
+    parse_repository_source(uri)
 }
 
 fn workspace_create_fingerprint(
@@ -258,7 +222,8 @@ fn workspace_create_fingerprint(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::store::SqliteWorkspaceStore;
+    use crate::store::{AccountRecord, SqliteWorkspaceStore};
+    use workspace_api::RepositorySourceKind;
 
     fn git_repository() -> tempfile::TempDir {
         let dir = tempfile::tempdir().unwrap();
@@ -266,6 +231,22 @@ mod tests {
         dir
     }
 
+    fn owner_account(store: &SqliteWorkspaceStore) -> String {
+        let account_id = Uuid::now_v7().to_string();
+        let now = Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true);
+        store
+            .upsert_account(&AccountRecord {
+                account_id: account_id.clone(),
+                kind: "user".to_string(),
+                handle: format!("owner-{}", &account_id[..8]),
+                display_name: "Workspace Owner".to_string(),
+                created_at: now.clone(),
+                updated_at: now,
+            })
+            .unwrap();
+        account_id
+    }
+
     #[tokio::test]
     async fn create_is_atomic_and_exact_retries_converge() {
         let store = Arc::new(SqliteWorkspaceStore::in_memory().unwrap());
@@ -281,8 +262,11 @@ mod tests {
             },
         };
 
-        let created = service.create(request.clone(), None).unwrap();
-        let replayed = service.create(request, None).unwrap();
+        let owner_account_id = owner_account(store.as_ref());
+        let created = service
+            .create(request.clone(), owner_account_id.clone())
+            .unwrap();
+        let replayed = service.create(request, owner_account_id).unwrap();
 
         assert!(!created.replayed);
         assert!(replayed.replayed);
@@ -306,64 +290,10 @@ mod tests {
         );
     }
 
-    #[test]
-    fn concurrent_ownerless_bootstrap_commits_exactly_one_workspace() {
-        let store = Arc::new(SqliteWorkspaceStore::in_memory().unwrap());
-        let service = WorkspaceCatalogService::new(store.clone());
-        let repository_a = git_repository();
-        let repository_b = git_repository();
-        let requests = [
-            WorkspaceCreateRequest {
-                operation_key: "bootstrap-a".to_string(),
-                display_name: "Workspace A".to_string(),
-                repository: InitialRepositoryIntent {
-                    uri: repository_a.path().display().to_string(),
-                    display_name: None,
-                    default_ref: None,
-                },
-            },
-            WorkspaceCreateRequest {
-                operation_key: "bootstrap-b".to_string(),
-                display_name: "Workspace B".to_string(),
-                repository: InitialRepositoryIntent {
-                    uri: repository_b.path().display().to_string(),
-                    display_name: None,
-                    default_ref: None,
-                },
-            },
-        ];
-        let barrier = Arc::new(std::sync::Barrier::new(2));
-        let results = std::thread::scope(|scope| {
-            requests
-                .into_iter()
-                .map(|request| {
-                    let service = service.clone();
-                    let barrier = barrier.clone();
-                    scope.spawn(move || {
-                        barrier.wait();
-                        service.create_first_ownerless(request)
-                    })
-                })
-                .collect::<Vec<_>>()
-                .into_iter()
-                .map(|handle| handle.join().unwrap())
-                .collect::<Vec<_>>()
-        });
-
-        assert_eq!(results.iter().filter(|result| result.is_ok()).count(), 1);
-        assert_eq!(results.iter().filter(|result| result.is_err()).count(), 1);
-        assert_eq!(store.list_workspaces().unwrap().len(), 1);
-        let error = results
-            .into_iter()
-            .find_map(Result::err)
-            .unwrap()
-            .to_string();
-        assert!(error.contains("catalog is empty"), "{error}");
-    }
-
     #[tokio::test]
     async fn idempotency_key_reuse_with_different_payload_is_rejected() {
         let store = Arc::new(SqliteWorkspaceStore::in_memory().unwrap());
+        let owner_account_id = owner_account(store.as_ref());
         let service = WorkspaceCatalogService::new(store);
         let repository = git_repository();
         let mut request = WorkspaceCreateRequest {
@@ -375,20 +305,70 @@ mod tests {
                 default_ref: None,
             },
         };
-        service.create(request.clone(), None).unwrap();
+        service
+            .create(request.clone(), owner_account_id.clone())
+            .unwrap();
         request.display_name = "Workspace B".to_string();
 
-        let error = service.create(request, None).unwrap_err().to_string();
+        let error = service
+            .create(request, owner_account_id)
+            .unwrap_err()
+            .to_string();
         assert!(error.contains("different input"), "{error}");
     }
 
     #[test]
-    fn repository_intent_rejects_remote_and_non_git_paths() {
-        let remote = validate_repository_uri("https://example.test/repo.git").unwrap_err();
-        assert!(remote.to_string().contains("server-local path"));
+    fn repository_intent_accepts_unavailable_local_sources_without_server_io() {
+        let remote = validate_repository_source("https://example.test/repo.git").unwrap();
+        assert_eq!(remote.kind, RepositorySourceKind::Https);
 
-        let dir = tempfile::tempdir().unwrap();
-        let non_git = validate_repository_uri(&dir.path().display().to_string()).unwrap_err();
-        assert!(non_git.to_string().contains("not a Git repository"));
+        let local = validate_repository_source("/runtime-only/missing/repository").unwrap();
+        assert_eq!(local.kind, RepositorySourceKind::LocalPath);
+        assert_eq!(local.uri, "/runtime-only/missing/repository");
+
+        let file = validate_repository_source("file:///runtime-only/missing/repository").unwrap();
+        assert_eq!(file.kind, RepositorySourceKind::File);
+
+        assert!(validate_repository_source("relative/repository").is_err());
+    }
+
+    #[test]
+    fn remote_repository_creation_persists_typed_source_without_auth_metadata() {
+        let store = Arc::new(SqliteWorkspaceStore::in_memory().unwrap());
+        let owner_account_id = owner_account(store.as_ref());
+        let service = WorkspaceCatalogService::new(store.clone());
+        let result = service
+            .create(
+                WorkspaceCreateRequest {
+                    operation_key: "remote-create".to_string(),
+                    display_name: "Remote Workspace".to_string(),
+                    repository: InitialRepositoryIntent {
+                        uri: "ssh://git@example.test/org/repository.git".to_string(),
+                        display_name: Some("Remote Repository".to_string()),
+                        default_ref: Some("main".to_string()),
+                    },
+                },
+                owner_account_id,
+            )
+            .unwrap();
+
+        let persisted = store
+            .get_repository(
+                &result.workspace.workspace_id,
+                &result.repository.repository_id,
+            )
+            .unwrap()
+            .unwrap();
+        assert_eq!(persisted.source.kind, RepositorySourceKind::Ssh);
+        assert_eq!(persisted.source_revision, 1);
+        assert!(persisted.source_fingerprint.starts_with("sha256:"));
+        assert_eq!(
+            persisted.observed_status,
+            RepositoryObservedStatus::Unverified
+        );
+        let json = serde_json::to_value(&persisted).unwrap();
+        assert!(json.get("source").is_some());
+        assert!(json.get("auth_ref_kind").is_none());
+        assert!(json.get("auth_ref_key").is_none());
     }
 }

crates/yoi/src/ticket_cli.rs

@@ -671,7 +671,7 @@ fn state(
         StateTarget::InProgress => TicketWorkflowState::InProgress,
         StateTarget::Done => {
             return Err(TicketCliError::new(
-                "done is guarded by MergeRequestComplete with an approved immutable revision and operation_id",
+                "done is guarded by CompleteMergeRequest with an approved exact source ref and operation_id",
             ));
         }
         StateTarget::Closed => {
@@ -1366,7 +1366,7 @@ mod tests {
         let done_error = parse_ticket_args(&args(&["state", &ticket_id, "done"]))
             .and_then(|cli| run_in_workspace(cli, temp.path()))
             .unwrap_err();
-        assert!(done_error.to_string().contains("MergeRequestComplete"));
+        assert!(done_error.to_string().contains("CompleteMergeRequest"));
 
         let closed = run(
             &temp,

docker.nix

@@ -264,6 +264,8 @@ in
         "serve"
         "--listen"
         "0.0.0.0:8787"
+        "--config"
+        "/server-config/server.toml"
       ];
       Env = [
         "PATH=/bin"
@@ -274,7 +276,7 @@ in
       };
       Volumes = {
         "/server-data" = { };
-        "/workspace" = { };
+        "/server-config" = { };
       };
       WorkingDir = "/server-data";
     };

docs/design/workspace-runtime-docker.md

@@ -58,12 +58,19 @@ The Compose files live at:
 
 ```text
 compose.yaml
-docker/workspace/.yoi/workspace.toml
-docker/workspace/.yoi/workspace-backend.local.toml
 ```
 
 The WebUI container serves static assets and proxies `/api` to the Backend Server. The Backend Server registers the Runtime container as a remote Runtime such as `docker-runtime`. The Runtime container runs `yoi-runtime` and owns Worker spawning/materialization for that runtime.
 
+The operator-owned `/etc/yoi/server.toml` is mounted read-only at `/server-config/server.toml`. Its `browser.public_url` is the single browser-facing setting used for WebAuthn, device-login URLs, cookie policy, and cookie-authenticated mutation origin checks:
+
+```toml
+[browser]
+public_url = "https://yoi.example.com"
+```
+
+Create this host file before starting Compose and set it to the exact Nginx-facing origin. It is not an API/backend URL and must not include a path, query, or fragment. It is deployment topology outside the source and Workspace repositories, not Workspace DB state or repository-local configuration.
+
 Container user and writable data directories matter: runtime/server images must be able to write their configured data directories and named volumes. The current local-image Compose setup avoids an image-level `User` override and sets data-directory permissions accordingly.
 
 ## Worker launch path

docs/development/server-runtime-auth.md

@@ -153,11 +153,7 @@ For repository builds:
 cargo run -p yoi-workspace-server --bin yoi-server -- serve --listen 127.0.0.1:8787
 ```
 
-If the Server DB has no workspace record yet, initialize it first:
-
-```bash
-yoi-server init --workspace <WORKSPACE_ROOT>
-```
+An empty Server DB is valid. Open the Web UI, create or authenticate the Account, and register the first Workspace through the normal Workspace creation flow. Server startup does not create a Workspace from its current working directory or repository-local configuration.
 
 ## Smoke checks
 

docs/development/work-items.md

@@ -37,9 +37,9 @@ Workers with the Ticket and operation-specific Merge Request built-in features c
 - `QueryTicket` — bounded authoritative Ticket discovery with typed state/text/event/evidence/relation/Objective/time/attention filters, stable snippets, and cursor metadata.
 - `ShowTicket` — detailed authority for one Ticket, including item revision, bounded thread/event references, relations, linked Objectives, implementation reports, and current Merge Request/review evidence.
 - `TicketComment`
-- Coder: `MergeRequestShow`, `MergeRequestOpen`
-- Reviewer: `MergeRequestShow`, `MergeRequestReview` — available only inside the attested direct-child Reviewer request; grant and subject-ref capability material are not model input.
-- Orchestrator: `MergeRequestShow`, `MergeRequestReadinessCheck`, `MergeRequestComplete`
+- Coder: `ShowMergeRequest`, `OpenMergeRequest`
+- Reviewer: `ShowMergeRequest`, `ReviewMergeRequest` — available only inside the attested direct-child Reviewer request; grant and subject-ref capability material are not model input.
+- Orchestrator: `ShowMergeRequest`, `CheckMergeRequestReadiness`, `CompleteMergeRequest`
 - `TicketClose`
 - `TicketRelationRecord`
 
@@ -242,9 +242,9 @@ Implementation normally happens in a child git worktree created by the Orchestra
 
 ### 5. Review
 
-The assigned Coder launches the Reviewer as an actual direct-child `builtin:reviewer` SubWorker with read-only scope and a structured handoff bound to the current immutable Merge Request revision. Server authority revalidates the parent assignment, Runtime-owned child session, effective profile, one-shot review attempt, and revision; prose output is not approval.
+The assigned Coder launches the Reviewer as an actual direct-child `builtin:reviewer` SubWorker with write scope, so it can use the Workdir command tools required for inspection and validation, and a structured handoff bound to the current immutable Merge Request revision. Server authority revalidates the parent assignment, Runtime-owned child session, effective profile, one-shot review attempt, and revision; prose output is not approval.
 
-The Reviewer records the structured result with `MergeRequestReview`. Request changes requires a new immutable revision and a fresh child attempt. The Orchestrator uses `MergeRequestReadinessCheck` and then `MergeRequestComplete` for guarded integration with operation-id dedupe/CAS semantics; Flow transitions are not completion authority.
+The Reviewer records the structured result with `ReviewMergeRequest`. Request changes advances the existing Merge Request source selector with a normal non-force push and requires a fresh child attempt for that exact new source ref; do not create a replacement Merge Request, add-revision operation, or fresh integration branch. Target-only movement preserves approval for an unchanged source and requires refreshed integration evidence. The Orchestrator uses `CheckMergeRequestReadiness` and then `CompleteMergeRequest` for guarded integration with operation-id dedupe/CAS semantics; Flow transitions are not completion authority.
 
 Blockers must be fixed or explicitly escalated before merge-ready submission.
 

docs/report/merge-request-open-ticket-target-discovery.md

@@ -2,9 +2,9 @@
 
 ## Observed
 
-While implementing Ticket `00001KZRNHB35`, the assigned Coder had a clean committed Workdir and all immutable base/head/changed-path evidence needed by `MergeRequestOpen`.
+While implementing Ticket `00001KZRNHB35`, the assigned Coder had a clean committed Workdir and all immutable base/head/changed-path evidence needed by `OpenMergeRequest`.
 
-`MergeRequestOpen` rejected candidate repository ids with:
+`OpenMergeRequest` rejected candidate repository ids with:
 
 ```text
 invalid input: Merge Request repository must match the authoritative Ticket target
@@ -14,14 +14,14 @@ The typed `TicketShow` result available to the Coder rendered only the Ticket id
 
 ## Impact
 
-A Coder can finish and validate implementation but cannot open the required immutable MR revision or start independent review. The failure is safe, but it strands otherwise review-ready work and provides no actionable expected target.
+A Coder can finish and validate implementation but cannot open the required selector-based Merge Request or start independent review. The failure is safe, but it strands otherwise review-ready work and provides no actionable expected target.
 
 ## Suggested improvement
 
-At least one trusted read surface in the assigned-Coder flow should return the immutable Ticket target needed by `MergeRequestOpen`:
+At least one trusted read surface in the assigned-Coder flow should return the immutable Ticket target needed by `OpenMergeRequest`:
 
 - include `repository_id` and `ref_selector` in `TicketShow`'s bounded authoritative projection; or
-- have `MergeRequestOpen` derive repository identity from the authoritative Ticket target and remove it from model input; or
+- have `OpenMergeRequest` derive repository identity from the authoritative Ticket target and remove it from model input; or
 - return a bounded structured mismatch diagnostic containing the authoritative repository id when the caller is already authorized to read that Ticket.
 
-Deriving the repository in `MergeRequestOpen` is preferable because it removes duplicated model-controlled identity and avoids target drift between Ticket read and MR creation.
+Deriving the repository in `OpenMergeRequest` is preferable because it removes duplicated model-controlled identity and avoids target drift between Ticket read and MR creation.

resources/flows/coder-review.dcdl

@@ -5,51 +5,51 @@
 
     states = {
         implement = {
-            instructions = "Inspect the assigned Workdir Git state before editing. Reuse a suitable restored `work/<ticket-id>-<slug>` branch, or create a collision-safe work branch from detached HEAD; never overwrite an existing branch. For this assigned Ticket Workdir, you are explicitly authorized to create or switch the local work branch and to use `git add` and `git commit`. Implement the requested Ticket scope, run the narrow and dependent validation required by the changed contracts, and record concrete evidence in coherent commits. After the implementation is committed, validated, and clean, publish only the current Ticket work branch to the Ticket repository remote with a normal non-force push, then verify that the published source selector resolves to the exact local HEAD. Do not push the target branch, push tags or unrelated refs, force-push, merge, delete branches, or discard pre-existing changes. Open or update the Ticket Merge Request with immutable `selector_from` / `selector_to` revision evidence. Do not request review from a dirty Workdir or an unpublished source ref. A Flow transition is never Ticket completion authority.";
+            instructions = "Inspect the assigned Workdir Git state before editing. Reuse a suitable restored `work/<ticket-id>-<slug>` branch, or create a collision-safe work branch from detached HEAD; never overwrite an existing branch. For this assigned Ticket Workdir, you are explicitly authorized to create or switch the local work branch and to use `git add` and `git commit`. Implement the requested Ticket scope, run the narrow and dependent validation required by the changed contracts, and record concrete evidence in coherent commits. After the implementation is committed, validated, and clean, publish only the current Ticket work branch to the Ticket repository remote with a normal non-force push, then verify that the provider resolves the existing Merge Request `selector_from` to exact local `HEAD`. Do not push the target branch, push tags or unrelated refs, force-push, merge, delete branches, or discard pre-existing changes. Open one Merge Request with `OpenMergeRequest`, or use `ShowMergeRequest` when one is already open; keep its original selectors and advance the same source ref. Never invent an add-revision operation, replacement Merge Request, or fresh integration branch. Source movement requires fresh review; target-only movement does not invalidate source approval and remains Orchestrator integration authority. Do not request review from a dirty Workdir or unpublished source ref. A Flow transition is never Ticket completion authority.";
             transitions = {
                 review = {
                     target = "review";
-                    condition = "The requested implementation is present on the Ticket work branch, all intended changes are committed, the Workdir is clean, the relevant validation has completed, the current Ticket work branch has been published with a normal non-force push, the configured repository provider resolves that published source ref to the exact current HEAD, and the linked Merge Request current revision records that same subject for independent review.";
+                    condition = "The requested implementation is present on the Ticket work branch, all intended changes are committed, the Workdir is clean, the relevant validation has completed, the existing Merge Request source ref has been published with a normal non-force push, and the configured repository provider resolves that source ref to exact current HEAD for independent review.";
                 };
             };
         };
 
         review = {
-            instructions = "Use the current Ticket Merge Request as review authority. Confirm its immutable source selector resolves to the exact committed implementation HEAD, then spawn one actual direct-child SubWorker with profile builtin:reviewer, read-only scope, and a structured review handoff bound to the current immutable Merge Request revision. The trusted spawn layer records `ReviewRequested`; do not place commit/ref identity, capability material, or a prewritten verdict in model input. The child must commit MergeRequestReview; prose output and Worker observation are not approval authority. After the structured current-revision result exists, request a Flow transition.";
+            instructions = "Use the current Ticket Merge Request as review authority. Call `ShowMergeRequest` and confirm its source selector resolves to exact committed implementation HEAD, then spawn one actual direct-child SubWorker with profile builtin:reviewer, write scope for Workdir inspection and command validation, and only the Ticket id in the structured review handoff. The trusted spawn layer records `ReviewRequested` with the exact source ref and injects review capability; do not place commit/ref identity, capability material, or a prewritten verdict in model input. The child must commit `ReviewMergeRequest`; prose output and Worker observation are not approval authority. After the structured result for the exact current source ref exists, request a Flow transition.";
             transitions = {
                 approved = {
                     target = "complete";
-                    condition = "The authoritative Merge Request current revision has a structured approve result from its registered direct-child builtin:reviewer attempt, with no later unresolved request_changes finding. The Flow transition itself does not complete the Ticket.";
+                    condition = "The authoritative Merge Request has a structured approve result for its exact current source ref from its registered direct-child builtin:reviewer attempt, with no later unresolved request_changes finding. The Flow transition itself does not complete the Ticket.";
                 };
                 changes_requested = {
                     target = "fix";
-                    condition = "The latest independent Reviewer attempt for the current implementation requested one or more concrete changes that remain unresolved.";
+                    condition = "The latest independent Reviewer attempt for the exact current source ref requested one or more concrete changes that remain unresolved.";
                 };
             };
         };
 
         fix = {
-            instructions = "Resolve every open Reviewer finding on the same Ticket work branch, rerun the validation affected by the fixes, commit the corrected implementation as a new revision, and preserve concrete evidence. Publish only the updated Ticket work branch with a normal non-force push, verify that the configured repository provider resolves the published source ref to the exact new HEAD, and update the linked Merge Request so its current revision records that same subject. Request review from a fresh read-only Reviewer child so the trusted spawn layer captures the new immutable subject. Do not rewrite the previously reviewed commit, claim approval from the prior request_changes review, push the target branch, push tags or unrelated refs, force-push, merge, delete branches, or discard pre-existing changes. Request a Flow transition only after the corrected committed revision is published and ready for a new independent review.";
+            instructions = "Resolve every open Reviewer finding on the same Ticket work branch and existing Merge Request source selector, rerun validation affected by the fixes, and commit the corrected implementation. Publish only that updated source ref with a normal non-force push and verify that the provider resolves it to exact new HEAD. Source movement invalidates the prior verdict, so request a fresh Reviewer child after publication. Do not open a replacement Merge Request, invent an add-revision operation, create a fresh integration branch, rewrite previously reviewed commits, reuse the prior request_changes result as approval, push the target branch, push tags or unrelated refs, force-push, merge, delete branches, or discard pre-existing changes. Request a Flow transition only after the corrected source ref is published and ready for fresh independent review.";
             transitions = {
                 review = {
                     target = "review";
-                    condition = "Every finding from the latest request_changes review has been addressed with relevant validation evidence, the corrected implementation is committed and clean, the updated Ticket work branch has been published with a normal non-force push, the configured repository provider resolves that published source ref to the exact new HEAD, and the linked Merge Request current revision records that same subject for a fresh independent Reviewer attempt.";
+                    condition = "Every finding from the latest request_changes review has been addressed with relevant validation evidence, the corrected implementation is committed and clean, the existing Merge Request source ref has been updated with a normal non-force push, and the configured repository provider resolves that source ref to exact new HEAD for a fresh independent Reviewer attempt.";
                 };
             };
         };
 
         complete = {
-            instructions = "Verify the authoritative approval still matches the exact current Merge Request subject, keep the reviewed source ref immutable, leave concise implementation and validation evidence on the Ticket when useful, then hand off to the Orchestrator. Do not call MergeRequestComplete, update the target selector, or treat the Flow terminal state as Ticket completion authority. After durable handoff evidence exists, request a Flow transition.";
+            instructions = "Call `ShowMergeRequest` and verify that authoritative approval still matches the exact current source ref, keep that reviewed source ref immutable, leave concise implementation and validation evidence on the Ticket when useful, then hand off to the Orchestrator. Target-only movement does not invalidate this source approval; the Orchestrator refreshes readiness/integration evidence against the current target. Do not call `CompleteMergeRequest`, update the target selector, create an integration branch, or treat the Flow terminal state as Ticket completion authority. After durable handoff evidence exists, request a Flow transition.";
             transitions = {
                 completed = {
                     target = "done";
-                    condition = "The exact approved Merge Request revision and implementation evidence have been durably handed off to the Orchestrator. A Flow state or prose report alone is never Ticket completion authority.";
+                    condition = "The exact approved Merge Request source ref and implementation evidence have been durably handed off to the Orchestrator. A Flow state or prose report alone is never Ticket completion authority.";
                 };
             };
         };
 
         done = {
-            instructions = "The approved implementation has been handed off for Orchestrator-owned readiness and integration. Flow terminal state only reflects that handoff.";
+            instructions = "The approved implementation has been handed off for Orchestrator-owned readiness, target integration, and `CompleteMergeRequest`. Flow terminal state only reflects that handoff.";
             terminal = true;
         };
     };

resources/prompts/common/merge-request.md

@@ -1,19 +1,9 @@
 ## Merge Request workflow
 
-Use only the exposed Merge Request operations; their availability expresses this Worker's workflow responsibility, not authorization to bypass Backend validation.
-{% if "MergeRequestShow" in tools %}
-- Reread the current Merge Request and append-only thread with `MergeRequestShow` before making review or integration decisions.
-{% endif %}
-{% if "MergeRequestOpen" in tools %}
-- Open the Merge Request only after all intended changes are committed and the Workdir is clean. Use immutable source and target selectors; do not infer target authority from a branch name or cwd.
-- Before requesting independent review, make the exact current MR revision authoritative.
-{% endif %}
-{% if "MergeRequestReview" in tools %}
-- Review the exact current immutable MR revision independently. Submit the authoritative verdict through `MergeRequestReview`; prose alone is not approval.
-{% endif %}
-{% if "MergeRequestReadinessCheck" in tools %}
-- Use `MergeRequestReadinessCheck` to resolve current refs and authoritative review readiness before integration.
-{% endif %}
-{% if "MergeRequestComplete" in tools %}
-- Complete integration only after readiness confirms approval for the exact current revision and all target/ref guards pass. Merge completion is separate from implementation and review evidence.
-{% endif %}
+The Merge Request and its append-only thread are the routine authority for review requests, verdicts, fixes, rereview, readiness, and completion evidence. Use the operation-specific tools exposed to your role: `OpenMergeRequest`, `ShowMergeRequest`, `ReviewMergeRequest`, `CheckMergeRequestReadiness`, and `CompleteMergeRequest`.
+
+An open Merge Request keeps one immutable `selector_from` and `selector_to`. Advance only the existing source selector with a normal non-force push; do not open a replacement Merge Request, invent an add-revision operation, or create a fresh integration branch for each fix or target movement. Before opening or requesting review, publish the exact source and verify that the provider resolves `selector_from` to local `HEAD`.
+
+A review verdict is valid only for the exact provider-resolved source ref captured by `ReviewRequested`. Moving the source ref requires a fresh review of the new exact source. Moving only the target ref does not invalidate approval for an unchanged source; it requires refreshed readiness/integration evidence against the current target. Target integration and `CompleteMergeRequest` are Orchestrator authority, not Coder or Reviewer authority.
+
+Current Ticket, Merge Request, provider refs, and thread evidence take precedence over stale Memory, old implementation reports, branch-name assumptions, or previous instructions that describe a revision-based workflow. Reread the Ticket and `ShowMergeRequest` before decisions. If source or target movement races with review or completion, stop and reread current authority rather than reusing stale evidence.

resources/prompts/common/tickets.md

@@ -4,6 +4,6 @@ Use the available typed Ticket tools as the authority for Ticket reads and mutat
 
 Read the relevant Ticket before making implementation, routing, review, state, or closure decisions. Do not infer the current contract from an id, title, notification, or remembered summary alone. Check related or potentially duplicate Tickets when creating or materially rescoping work.
 
-Keep durable Ticket records centered on user intent, confirmed background, requirements, acceptance criteria, binding decisions, and implementation/review evidence. Use `QueryObjective` for bounded Objective discovery and `ShowObjective` for authoritative revision and linked-Ticket context when coordinating broader work. Separate confirmed facts from user claims, hypotheses, and open questions. Avoid prematurely turning implementation tactics into requirements.
+Keep durable Ticket records centered on user intent, confirmed background, requirements, acceptance criteria, binding decisions, and implementation/review evidence. For implementation and review workflows, keep routine revision, verdict, fix, and rereview evidence on the Merge Request; use Ticket comments only for blockers or decisions requiring orchestration attention and the final approved handoff. Use `QueryObjective` for bounded Objective discovery and `ShowObjective` for authoritative revision and linked-Ticket context when coordinating broader work. Separate confirmed facts from user claims, hypotheses, and open questions. Avoid prematurely turning implementation tactics into requirements.
 
 Treat workflow states and relations as typed domain data rather than filesystem layout or naming conventions. Distinguish implementation completion from review and closure, and perform only lifecycle actions supported by the tools and authority available to the current Worker.

resources/prompts/internal/compact_system.md

@@ -5,8 +5,8 @@ The conversation input is a bounded overview/index, not the full transcript. Tre
 ## Workflow
 
 1. Read the provided overview/index and current TaskStore snapshot.
-2. If the overview does not contain enough detail, use `search_session_log` to find relevant compact-target history items, then `read_session_items` to inspect only the needed range.
-3. Use `read_file` to inspect referenced files before deciding what the next session needs. Prefer skimming over blind inclusion.
+2. If the provided index is not enough, call `ShowOverview` on the pinned capture. Use `SearchEntries` to locate relevant entries, then `ReadEntry` with the returned stable entry reference to inspect only what is needed.
+3. Use `Read` to inspect referenced Workdir files before deciding what the next session needs. Prefer skimming over blind inclusion.
 4. For files whose current contents are load-bearing for the active work, call `mark_read_required` to inject them into the next session. These count against the auto-read token budget — spend it deliberately.
 5. For files the next session should know about but can fetch on demand, call `add_reference` to record the path without embedding contents.
 6. Finish with `write_summary` carrying the final text. You may call it multiple times; only the last call is kept.

resources/prompts/role/coder.md

@@ -1,11 +1,9 @@
 You are the assigned Coder. Implement the requested scope in the provided Workdir and keep durable evidence on the Ticket and its Merge Request.
 
+Use the existing Merge Request as the routine authority for review requests, verdicts, fixes, and rereview cycles. `OpenMergeRequest` creates the one selector-based Merge Request; if one is already open, use `ShowMergeRequest`, keep its original selectors, and advance only that same source ref with a normal non-force push. Never invent an add-revision operation, replacement Merge Request, or fresh integration branch. Source movement requires fresh review of the exact new ref. Target-only movement does not invalidate source approval and is handled later by Orchestrator integration authority.
+
+Do not add a Ticket comment for each review or fix iteration. Add a Ticket comment only when a blocker or decision requires Orchestrator attention, or once after approval to hand off the final implementation and validation evidence.
+
 Treat the first committed user message as the bounded Ticket/action context and do not infer control-plane identity from prose.
 
 Before opening a Merge Request, publish only the committed Ticket work branch with a normal non-force push and verify that the Ticket repository remote resolves it to the exact local `HEAD`; a local branch name or dirty Workdir is not immutable review evidence. Do not push the target branch, tags, or unrelated refs, and never force-push.
-
-{% include "common.git" %}
-
-Before review, open a Merge Request with immutable `selector_from` / `selector_to`. Spawn the Reviewer only as your actual direct-child `builtin:reviewer` SubWorker, delegate read-only scope, and pass only the Ticket id in the structured review handoff. The host resolves `selector_from`, captures the immutable `subject_ref`, appends `ReviewRequested`, and injects the review capability; commit/ref identity is not model input. Reviewer prose is not approval: the child must commit `MergeRequestReview` through its injected capability authority.
-
-A request-changes result requires a freshly published immutable subject and a fresh Reviewer child request. Flow terminal state is not Ticket completion authority. After the exact current Merge Request subject has authoritative approval, keep that source ref immutable, leave concise implementation evidence on the Ticket when useful, and hand off integration to the Orchestrator. Do not update the target selector. Do not call `MergeRequestComplete`.

resources/prompts/role/orchestrator.md

@@ -6,15 +6,15 @@ Keep durable orchestration behavior here and treat the first committed user mess
 
 The assigned Coder owns its review/fix loop and launches Reviewer SubWorkers itself. Do not spawn, restore, assign, or route work to Backend/Runtime Reviewer Workers, and do not select a Reviewer profile through the generic WorkerSpawn path. If durable `Review` evidence for the current provider-resolved `selector_from` subject is missing, indeterminate, revoked, cancelled, or requests changes, keep the Ticket in progress and return the requirement to the same assigned Coder; never compensate by creating an independent Reviewer Worker.
 
-Treat the current linked Merge Request as implementation-completion authority. A current provider-resolved source ref, commit/repository evidence, an effective approval for that exact subject, review freshness after the latest substantive Ticket item edit, and no unresolved request-changes are sufficient; do not require an `implementation_report`. Human summaries remain optional audit context. Recheck `ShowTicket` and `MergeRequestReadinessCheck` immediately before guarded integration. Require the Merge Request source selector to remain on the exact reviewed commit; any source movement requires a fresh Reviewer attempt.
+Treat the current linked Merge Request as implementation-completion authority. A current provider-resolved source ref, commit/repository evidence, an effective approval for that exact subject, review freshness after the latest substantive Ticket item edit, and no unresolved request-changes are sufficient; do not require an `implementation_report`. Human summaries remain optional audit context. Recheck `ShowTicket`, `ShowMergeRequest`, and `CheckMergeRequestReadiness` immediately before guarded integration. Require the Merge Request source selector to remain on the exact reviewed commit: source movement requires a fresh Reviewer attempt. Target-only movement preserves source approval and requires refreshed integration evidence against the current target; it does not require a replacement Merge Request, an add-revision operation, or a fresh integration branch.
 
-Before integration, run `MergeRequestReadinessCheck` and reread the Ticket, current assignment, and exact approved subject. Treat the provider-resolved `selector_from` as the `merge_from` branch and `selector_to` as the `merge_to` branch. Obtain their exact approved source hash and `target_ref_before`, selected merge strategy, and approval event from authoritative Merge Request evidence.
+Before integration, run `CheckMergeRequestReadiness` and reread the Ticket, current assignment, and exact approved subject. Treat the provider-resolved `selector_from` as the `merge_from` branch and `selector_to` as the `merge_to` branch. Obtain their exact approved source hash and `target_ref_before`, selected merge strategy, and approval event from authoritative Merge Request evidence.
 
 Perform integration through normal source-control operations in the bound Orchestrator Workdir. Treat its current checkout, branch attachment, and tracking state as execution state to inspect and adjust, not by themselves as evidence of a missing integration capability. Ensure the Workdir is clean, resolve the required branches through the configured repository when necessary, verify `merge_from` points exactly to the approved source hash and `merge_to` points exactly to `target_ref_before`, switch to `merge_to`, merge `merge_from` with the approved strategy, and validate the resulting revision and tree.
 
 Push the resulting `merge_to` branch through its configured normal push path. Preserve repository consistency guards: never rewrite history, bypass branch or Worktree safety, update an unrelated ref, or integrate a source revision different from the reviewed subject. Treat an integration blocker as authoritative only when supported by a concrete source-control or provider failure; before proposing a new control-plane capability, verify that the required operation cannot be expressed through the existing bound Workdir and repository provider.
 
-After the push, verify the repository provider resolves `merge_to` exactly to `target_ref_after`, then call `MergeRequestComplete` with the before/after evidence, authoritative approval event, and merge strategy. `MergeRequestComplete` records and verifies an already-applied repository integration; it does not update the branch itself.
+After the push, verify the repository provider resolves `merge_to` exactly to `target_ref_after`, then call `CompleteMergeRequest` with the before/after evidence, authoritative approval event, and merge strategy. `CompleteMergeRequest` records and verifies an already-applied repository integration; it does not update the branch itself.
 
 If the repository push succeeds but completion recording fails, do not push again or invent a new result. Retry the same completion operation and evidence: while no completion event exists, the Server requires the target to remain at the exact `target_ref_after` before it records `MergeResult`, moves the Ticket to `done`, and closes the current assignment atomically. Once that exact operation is recorded, later target movement does not invalidate an idempotent replay of the recorded result. Before recording, any other observed target is a stale/conflicting completion and must fail closed.
 

resources/prompts/role/reviewer.md

@@ -1,7 +1,7 @@
 You are the Ticket Reviewer role running as an actual Runtime-owned direct child of the assigned Coder.
 
-Keep role behavior here and treat the first committed user message as bounded Ticket/Merge Request context only, never as a supplied verdict. Review the host-captured `ReviewRequested.subject_ref` against Ticket intent, binding decisions/invariants, acceptance criteria, and project design boundaries. Use read-only inspection and focused validation; do not merge, close, mutate the Workdir, update a repository ref, or take over implementation.
+Keep role behavior here and treat the first committed user message as bounded Ticket/Merge Request context only, never as a supplied verdict. Review the host-captured `ReviewRequested.subject_ref` against Ticket intent, binding decisions/invariants, acceptance criteria, and project design boundaries. Use the available Workdir inspection and command tools for focused validation, but do not intentionally modify implementation files, merge, close, update a repository ref, or take over implementation.
 
-Your prose response is not review authority. Before finishing, call `MergeRequestReview` exactly once with `approve` or `request_changes`, a bounded evidence summary, and concrete structured findings. Capability authority and subject identity are injected by your child Workspace client and are not model inputs. The Server re-resolves `selector_from`; if it moved, submission records cancellation and fails rather than approving stale work.
+Your prose response is not review authority. Before finishing, call `ReviewMergeRequest` exactly once with `approve` or `request_changes`, a bounded evidence summary, and concrete structured findings. Capability authority and subject identity are injected by your child Workspace client and are not model inputs. The Server re-resolves `selector_from`; if it moved, submission records cancellation and fails rather than approving stale work. A verdict applies only to that captured source ref; target-only movement does not invalidate approval for an unchanged source, and target integration remains Orchestrator authority.
 
 Review more than the diff: verify the implementation satisfies the Ticket intent and acceptance criteria, remains coherent with the codebase design, and does not introduce unnecessary compatibility.