[hsliuustc0106]

Why

A request was only chat text: nothing recorded whether work was claimed, running, blocked on an approval, finished, or accepted, and nothing refused one member from moving another's work along. #54's acceptance — created, claimed, worked, blocked on approval, resumed, returned, accepted by the requester; wrong-owner moves refused; a failed/cancelled task can never display as accepted — is enforced here structurally.

Stacked on #101 (fix-53-context-sharing, d464235 → PASS). Retarget to main after the stack merges. Team mode stays disabled: in the single-human product every transition is the requester's own; with member sessions the record's server-derived requesterId decides (bot/forbidden otherwise) — the #52 rule.

What

• core/src/host/tasks.js (new host module, installed after reach): owns state.tasks (additive — corrupt values reset in the store's adopt clause; 200 terminal records kept, active never pruned). State machine: open → claimed → working → blocked ⇄ working → result-ready → accepted; cancelled/failed terminal; accepted reachable only from result-ready. Every transition appends a per-status actor entry; ids are task-<hex>.
• Block/resume wiring (three guarded hooks in src/host/hooks.js): a held send from the responsible Bot blocks the working task with the approval id; the owner's flybot/decide resumes (approve) or cancels (reject) it; deleting the responsible Bot fails its open tasks.
• Endpoints (src/host/channel.js): tasks, task-create, task-accept, task-start, task-return, task-accept-result, task-cancel — authz passes any signed-in actor; the record's requester check lives in tasks.js. Records store pointers and a copied summary, never private transcripts.
• Store: tasks: {} literal + JSDoc + adopt clause (src/host/store.js).
• Deferred honestly: chat task cards / activity view are [Team] Add a human-readable authorization and task audit trail #57's scope; auto-detection of result-ready from round replies and exchange threads lands with [Team] Recover task handoffs without duplicate work #55's recovery work (the state machine already has the result-ready gate; task-return carries the summary today). Team mode stays disabled.

Fixes #54

Verification

Tip SHA: a76230c67ea7f72cb880526663926bd450b7394a (base d464235).

• Fail-without-change: core/test/tasks.test.js written first — 7/7 fail at base d464235 (mechanically re-verified: fresh worktree at the base, only the test copied in, 0 pass), all green at the tip. Matrix: happy path (open→claimed→working→result-ready→accepted, then stale), wrong-member accept/claim/cancel forbidden, accept-before-result + post-terminal moves stale, held-send block → owner approve resumes, responsible-Bot deletion fails the task, restart persistence, corrupt state.tasks resets.
• npm run verify — exit 0 (core 704/704, social, tree, client --check, patches check, arch-docs OK 40 files; core-host.md/core-client.md + team.md updated in-commit).
• Smoke (index.js/src/host/ changed): ports 3091/8791 — all 40 steps passed; bench stopped, data removed.

Not run: DSH Desktop, real-model steward, Windows.

Reviewer notes

• New patches format: new files are stored whole in patches/ds-bot/files/ (files/src/host/tasks.js, files/test/tasks.test.js) — no topics.json entry.
• The rewritten generate crashes if an untracked directory sits under core/ (it copies the tree into files/) — keep the harness symlink out of the tree while running it. check is tracked-files-only and tolerates it.
• Red-at-base re-check: worktree at d464235, copy only core/test/tasks.test.js in, run — expect 0 pass / 7 fail on Unknown endpoint task-create.

[hsliuustc0106]

Review round 1 (independent Verifier) — verdict PASS on a76230c; all gates re-run by the Verifier (verify exit 0, 704/704, red-at-base reproduced 0/7), item-by-item acceptance table in the report. Follow-ups addressed before the push:

• Reject path now tested (blocked → owner rejects → task cancelled, terminal), and the restart test's final move is asserted (finding 2 + 5). New tip: 31fcabcd79a6378f191e230d28511ffb7e739b48.
• CHANGELOG entry committed — it had been written but left uncommitted at the repo root, outside the staged paths (finding 7).
• Findings 1/3/4/6 filed as Task lifecycle: stamp meta.taskId on held sends; clarification state + workBotId (remainder of #111, needs #55) #111 (per-task hold linkage, prune window, authz prefix set, clarification + workBotId) — to land before [Team] Recover task handoffs without duplicate work #55/[Team] Add a human-readable authorization and task audit trail #57 build on the machine.

Delta re-review requested at the new tip (delta: one new test + one strengthened assertion + the CHANGELOG entry).

[hsliuustc0106]

Correction: the follow-up commit initially landed as 31fcabc/3a9a27f with two packaging mistakes (patches stale after the test edit; the harness symlink swept back into the commit). Final tip: 588fa9d — patches check ok, arch-docs OK, npm run verify exit 0, no symlink in the tree. Delta vs the PASSed a76230c: one new test (reject → cancelled, terminal), a strengthened restart assertion, and the CHANGELOG entry. Re-review of that delta requested at 588fa9d.

[hsliuustc0106]

Delta re-review — verdict PASS on 588fa9d (supersedes the round-1 PASS at a76230c).

• Delta verified as claimed: 3 files (reject test, restart assertion, CHANGELOG); src/ byte-identical; npm run verify exit 0 (705/705 core incl. the new test); patches ok; no harness leak in the tree.
• The reject test exercises taskDecided's cancel branch through the real channel (decide reject → cancelled → further moves bot/stale).
• Reviewer's corrections accepted: the new test is carried whole in patches/ds-bot/files/test/tasks.test.js (new format), and a test-only delta carries no new fail-without-change obligation (the original feature red run at d464235 stands).
• Carry-overs remain ledgered in Task lifecycle: stamp meta.taskId on held sends; clarification state + workBotId (remainder of #111, needs #55) #111 (per-Bot hold linkage, prune window, authz prefix set, clarification + workBotId).

Implementer agrees on 588fa9d. Ready for maintainer review; no merge action from my side.

[Birfy]

Rebased onto current main with grant-model review fixes as #121 (Birfy:cursor/rebase-110-task-lifecycle-dae8). Please prefer that PR; this one can be closed once #121 is the path forward. Credit remains yours for the original work. Deferred from review: grant-tied briefAllowed (noted in team.md); in-chat task cards stay #57 / #111.