[sunrioa]

Summary

This completes Step 5B of the WorkHub plan in one PR, on top of merged #13.

• Approve an original path/network/client-capability request for its assigned task, inspect active grants and revoke them from the native inbox. The one-hour supplement does not change Session defaults, model or working directory; ordinary tool permissions retain their original reviewer.
• Commit each grant atomically with its original request outcome in the existing database. Execution checks use fixed Session/Turn/Run/invocation identity and canonical Message ownership. Authenticated child executions may use the supplement; unrelated/manual/queued work cannot inherit it.
• Durably close authority before cancelling its resources on revocation, expiry, completion, cancellation, retirement, replacement or changed boundary revisions. Background shell resources retain their grant fence after the foreground tool returns; client invocations retain their exact provider/capability/evidence scope. Recovery accepts only a still-valid original execution scope, never an approval replay.

Refs #8. Base: 8a905631e67d15f4682b81fb2ab6a54fce5656f9. Head: b8d4b2ce91475aadb942e7ee51c13ab7994fd8f9.

Migration and review focus

SQLite metadata schema 41 → 42 adds grant records to runtime.sqlite; existing execution defaults remain unchanged. Runtime Host protocol epoch 209 → 210 requires matching Host/Desktop builds. No second task database, model approval tool, permission override/restore scheme or Windows command/Grep backend is added.

Review the root/child ownership proof, atomic settlement, revoke/admit races and resource draining. Cancellation after client admission reports an unknown outcome rather than claiming external effects were undone; nothing automatically replays those effects. Cleanup failure drains the Host instead of restoring permission.

Verification

The committed tree is the tested tree (79a7ab5e0ff1b99354f857eb2d38578c264a5879). Final checks on macOS:

• Build, typecheck, lint, format, Desktop/UI knip, ASF headers, renderer architecture, E2E budget, Windows/Astryx inventories and theme checks: passed.
• Complete workspace regression: 14,382 Node tests passed / 0 failed / 38 existing skips. Python: 94 tests, 0 failures, 13 skips. Final full regression was rerun after the graph-claim and durable reopen assertions were added.
• Release contracts 214/214; protocol guard and its 17/17 tests passed.
• Real Host/SQLite native approval and revocation cover a production linked child, original request identity and unchanged parent/child defaults. Local/Memory conformance, schema migration/reopen, exact graph claims, stale/manual execution rejection, expiry/terminal/default-change invalidation, lost receipts and capability cancellation are covered.
• Real background-process cleanup keeps another task's process alive. Removing the compiled authority binding causes the intended running versus cancelled assertion failure; restoring it passes.
• WorkHub production Storybook/browser scenarios 33/33, including task allow/list/revoke, independent input, layout/focus and 420/800px light/dark variants. Existing native WorkHub Electron cases 5/5, with no added Electron cases, retries or increased timeouts.

Browser verification receipt:

{"passed":33,"failed":0,"retries":0,"playFunctions":"finished"}

Earlier verification exposed migration fixtures retaining the newly created table, one directory-alias candidate_set_stale rejection and stale local UI build output. The migration was made idempotent and exercised from a real v41 table layout; the UI output was rebuilt. Isolated and final full runs passed without weakening assertions or retry settings. The earlier candidate rejection is retained as a failed observation, not claimed to be a deterministically reproduced baseline defect.

Native Windows execution/packaging and live-provider calls were not run on this Mac. Inventory checks do not replace those; unsupported backends remain fail-closed. Step 6 is not included.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with source inspection, implementation, regression tests, verification and this description at the repository owner's request. Human review and merge remain with the owner; this PR is not automatically merged.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

本 PR 在已合并的 #13 上一次性交付完整 5B：原生待办可允许当前任务的路径、网络与客户端能力请求，查看有效授权并撤销。授权有效期为一小时，不改写 Session 默认权限、模型或工作目录；普通工具审批继续使用原 reviewer，模型不能通过新增工具代为批准。

授权与原请求结果在现有数据库中原子提交。执行时携带固定 Session/Turn/Run/invocation 身份，依据 Message-owned root 和被证明的子执行关系检查权限；排队任务、后续人工 Turn 与无关执行不继承授权。撤销、过期、完成、取消、归档／退休、替换或默认边界 revision 改变时，先持久失效，再取消相关资源并等待清理。后台 shell 进程在前台调用返回后仍受授权生命周期约束，不能继续沿用已撤销的权限。重启只接受仍有效的原执行范围，不自动重放审批或未知副作用。

数据库 schema 为 41 → 42，协议 epoch 为 209 → 210；不新增第二数据库，不使用覆盖权限后恢复旧快照的办法，不扩展 Windows 命令／Grep 后端。客户端调用在已经放行后被取消，结果标记为未知，不宣称能够撤回已经发生的外部效果。清理失败时停止 Host 服务，而不是重新开放权限。

精确提交 b8d4b2ce91475aadb942e7ee51c13ab7994fd8f9 的提交树与最终测试树相同。完整回归为 Node 14,382 通过／0 失败／38 个既有跳过，Python 94 项／0 失败／13 跳过；发布检查 214/214、协议守卫测试 17/17、WorkHub 浏览器 33/33、现有 Electron 5/5，构建与静态检查均通过。真实 Host/SQLite、关联子任务、图式 claim 正反身份、重启后的授权／撤销记录、scope 隔离、过期和真实后台进程清理均有覆盖；临时删除资源绑定时，回归会以“进程仍在运行”的行为错误失败，恢复后通过。没有增加 Electron 用例或放宽断言、超时、重试。

此前失败记录保留：数据库迁移夹具冲突已修正；UI 缓存重建后发布检查通过；另一次目录候选集过期拒绝不据此断言为稳定的 main 缺陷，最终完整复测通过。本 Mac 未运行 Windows 真机／打包或真实供应商调用，清单检查不能替代这些验收。录屏使用生产 Storybook 组件和隔离测试数据，不是实际供应商授权。

本 PR 等待所有者审查和合并，不自动合并，也不开始第 6 步。

[sunrioa]

Initial hosted-check status

Exact head: b8d4b2ce91475aadb942e7ee51c13ab7994fd8f9.

The test and packaging jobs are still running. Two completed checks are red:

• Dependency audit: the shipped dependency closure contains @modelcontextprotocol/client@2.1.0, flagged high by GHSA-6qxp-vccf-f47h. The lockfile blob is identical to the baseline (f9b0c49065db5b7fd56c17c7898be90d0037e065); Step 5B did not alter it. This needs separate dependency triage before treating hosted checks as green; it is not waived.
• Review request: COPILOT_REVIEW_TOKEN is not configured. No secrets or review workflow configuration were changed by this PR.

Local verification results in the description remain exact-head results; they do not imply that hosted CI has passed. The PR remains open for owner review, without auto-merge.

简体中文

远端测试和打包仍在运行。目前已有两项失败：依赖审计报告现有 @modelcontextprotocol/client@2.1.0 的 high 告警；自动请求审查缺少 COPILOT_REVIEW_TOKEN。本次依赖锁与基线完全相同，也未修改相关工作流或密钥，但这不能作为忽略安全审计的理由。依赖需要单独排查，配置需要由所有者处理。

PR 描述中的本地测试结果不代表远端 CI 已通过；等待人工审查，不自动合并。