[ITSGJY]

Summary

Fixes #1362.

A Workflow Session bound to a Runner Project could become impossible for its authorized owner to inspect or close once that Project was unregistered. This change permits historical summary and closeout only after authoritative evidence of unregistration, without restoring execution privileges or allowing a new registration with the same textual Project ID to inherit an old Session.

Implementation

• Assign a persistent, unique registration_incarnation to each Project registration. Reconnect/restart retains the same identity; unregister and re-register produces a new one.
• Upgrade valid legacy Project TOML records atomically before advertising them in the Runner inventory, preserving existing configuration (including table scopes and hooks) and Unix file permissions.
• Carry and validate the registration identity through Runner inventory and lifecycle enable/disable receipts; reject missing or malformed identities before Server Registry projection.
• Bind Project-scoped Sessions to their creation-time owner authority, Project registration identity, and root witness. Authorize retired-Project read/close only when the same owner remains authorized and a complete, current Runner inventory proves the Project is absent. Keep live/mutating operations fail-closed.
• Preserve session closeout, persistent-shell handling, and SQLite persistence/reopen behavior.

Regression evidence

• Fail-first tests: reproduced the reused-ID historical authorization bug and the missing registration identity in lifecycle receipts/Server projection, then verified the tests passed with the fixes.
• Server: 3,903 passed, 0 failed, 14 ignored.
• Runner + Runner Registry: 1,623 passed, 0 failed, 12 ignored. Total: 5,526 passed, 0 failed, 26 ignored.
• A real Server unregister → Runner receipt → Registry removal regression confirms authorized historical summary/close and rejection of subsequent live mutation.
• Rust formatting and whitespace checks passed; independent Codex read-only review of the final incremental fix found no confirmed issues.
• Fork CI for exact head b3c712487a78bd8dfda4b0b300afa941b8514203: 18/18 checks succeeded across Linux, Windows, macOS, Docker, MCP conformance, and contracts: https://github.com/ITSGJY/webcodex/actions/runs/42355340300 . This was a push-triggered CI run from a temporary branch pointing at the exact PR head; the temporary branch was deleted after verification. The same 18 successful checks are attached to the commit.

Review focus

Please pay particular attention to distributed request-lifetime and Runner inventory-propagation timing when checking the identity fence. Local authorization and lifecycle tests do not by themselves prove all possible dispatch-time races are excluded.

Existing Sessions that predate registration-witness persistence are not implicitly upgraded into live execution rights. No production deployment or migration is part of this PR.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[swjnxyf]

Reviewed PR #1386 on special's primary checkout (/root/git/webcodex), including Runner registration incarnation migration/receipts, Registry inventory reconciliation, Session owner/root identity persistence, historical closeout, and mutating dispatch fences. Found and reproduced a blocking edge in local/dev (auth=None): authorize_session_target skipped live Project registration identity comparison, allowing an old Project-bound Session to pass the core admission after unregister and same-ID/same-root re-registration. Follow-up commit 2f91661 applies the same incarnation check to trusted local/dev calls; it also retains history-only read/close after authoritative unregistration while preserving complete online inventory and original Session-owner evidence. Two new regressions prove the false-accept before fix and the correct denial/positive historical behavior afterward. Verified six relevant test groups on special: sessions_retired_projects (11), sessions_resolver (12), sessions_guards (15), session_shells (14), work_on_project (78), kernel_pipeline (2): 132 passed, 0 failed. Full workspace dogfood production check: 0 warnings, Cargo exit 0; fmt and diff checks passed. Original PR-head CI was successful (18/18); new-head hosted CI is currently queued and should finish before a normal merge. Remaining distributed dispatch-time concurrency beyond these tests is not asserted as exhaustively proven. No remaining confirmed blockers; approve this exact new head. Do not merge or deploy.