[sunrioa]

Summary

Refs #8 and the Phase C plan.

Reviewed exact head: c7f6eb7285ccec838bbab4113a696b37c5fcf491. Independent re-review and exact-head CI passed.

Merged normally as 38ee1ac0c03b5738eef7fd5cdcfd8c0b87fb95ce after checking the unchanged head/base, actual protection/rule state and all hosted checks. No admin/force merge or human-approval substitution was used.

Add the complete native Host path for sending user input to a fixed WorkHub task, without another coordinator-model selection or waiting for its conversation to finish.

• workhub.tasks.send accepts an input ID, work/generation, source action/delegation and text. The Host derives the Session from the canonical source and revalidates ownership under the existing admission gates.
• Owned active native execution uses current-Turn steering. Queued work is supplemented in place, preserving the unrelated root and FIFO. Ended/shared work continues through the existing atomic assignment path in the same work; an unrelated busy root still queues the continuation for the next Turn.
• Commit a source-bound task_input record with the admission, queue update or continuation in the existing coordination ledger. Exact retries return the accepted input; changed text or source under the same ID conflicts. No new task database, scheduler or queue.
• workhub.tasks.input.read derives delivery from canonical admission/immutable execution facts. Missing queue rows are not consumption proof; delivered means delivery into execution, not model compliance. Unknown post-commit outcomes retain the same input ID and use Host recovery.
• Preserve Session model, working directory, permission mode and grant lifetime. Reject retired/stale/archived sources and explicitly report plugin-executor steering as unsupported. Add the two remote-owner operation grants; epoch 217 → 218.
• If steering misses the final provider boundary, preserve its accepted work binding into the folded successor using the existing root-source proofs. Worker budgeting, task history/status and Stop follow that same-work successor; mixed/manual batches do not become exclusively owned by a task. No new schema, queue or grant inheritance.

This is C's backend PR. The existing task composer remains read-only; the task-bound composer and transport integration follow in a separate PR. C–E are not complete and this does not close #8.

Verification

• Clean test build and production build; typecheck, lint, format, ASF headers and staged diff check passed.
• Core 923 passed; Storage 1564 passed / 8 existing skips; Runtime Host 2327 passed / 12 existing skips; Runtime 3722 passed / 14 existing skips; Desktop 3285 passed; CLI 1335 passed / 3 existing skips; UI 713 passed. The other workspace suites also passed, including Eval with Python 3.12. After the cursor-only follow-up, the full Host suite and the Desktop task-view-model suite (8/8) were rerun and passed; the other workspace implementation trees are unchanged.
• Real local HTTP provider test: correction absent from the already-sent request, present exactly once in the next supported request, with no extra coordinator request. A targeted queue-hydration mutation is rejected by the same assertions; restored implementation passes.
• Real Host journey verifies B → supplemented A → independent C, exact retry, restart replay and continuation while the coordinator is busy. Existing physical-handoff/Stop and work-generation replacement journeys cover the new input path without changing their old assertions.
• The real native-provider terminal-boundary regression fails on the initial PR head and passes after the ownership fix: the successor remains visible in the same work, consumes the single configured worker slot, and Stop cancels it before B starts. Mixed/manual and foreign-source ownership tests remain fail-closed. Existing leased storage tests also verify chunked input facts and successor lookup after close/reopen.
• A production Host regression creates 17 successive roots via ordinary native-input admissions, then requests both history pages. It rejects the old cursor bug and passes with the successor projected to the strict {turnId, runId} cursor shape; no private cursor decoder or fabricated stream sequence is used.
• Real leased SQLite tests cover atomic rollback of all three input modes, source conflicts, duplicate input, restart persistence, FIFO and unchanged Session configuration. Runtime tests cover unsupported/unavailable ownership, post-commit hydration failure, commit-outcome-unknown and read-only receipt behavior.
• Windows/Astryx inventories, renderer architecture, Electron test budget and release checks (217/217) passed. No new Electron test or relaxed deadline/retry/assertion.
• Hosted test and dependency audit passed on the exact head above. The affected-surface planner did not select Desktop E2E/browser/Storybook lanes for this backend-only change; they are skipped, not claimed as executed. The optional Copilot lane uses the existing opt-out label; the separate independent Codex review below was completed.

An initial parallel run failed the unchanged Code Mode test still preempts compute while a host tool is pending (its cancellation flag was false). One unchanged isolated Runtime full-suite run passed 3722 / 0 / 14 skips; the clean exact current main Runtime full suite also passed. The initial failure is retained, not claimed as a stable main reproduction or hidden by a test change.

The fixed-tree parallel run passed Runtime and the other workspaces but timed out in the unchanged one WorkHub Turn admits independent goals in private or registered workspaces and remains responsive queue-continuation wait. Its unchanged isolated run and the same test on clean exact main passed; the fixed Host full suite then passed 2326 / 0 / 12 skips. That first failure is retained too; no test deadline, retry or assertion was relaxed.

Independent review follow-up

The fresh independent review found one P2 on initial head 53ba0ea8604592d26c4c899b71f0cb3ac59a9580: late steering could execute in an untracked successor, bypass worker budgeting and evade WorkHub Stop. The initial head's CI passed, but it was not merged because of this finding. Commit f721223593368047e9ce7a6f88eb9536ed39108f and the regression above address that production path. Independent re-review and required CI must pass on the updated exact head before normal merge.

Re-review confirmed that fix using the independent native-provider probe and mixed/queue-edit/multiple/nested-input probes, then found a second P2 at the 16-item history boundary: the native reference's extra sessionId was serialized into a strict two-field cursor. Commit c7f6eb7285ccec838bbab4113a696b37c5fcf491 narrows that reference before encoding and adds the real 17-root regression above. No failing head was merged; the same independent reviewer and new exact-head CI have now passed the final follow-up.

Final independent review on c7f6eb7285ccec838bbab4113a696b37c5fcf491 passed 42 existing targeted tests and 6 independent temporary probes (48/48). Both P2 findings are resolved; the reviewer reported no remaining actionable P0/P1/P2 or separate P3. This is not a guarantee that no bug exists and is not human approval. Required exact-head hosted checks passed.

No Windows machine run, installed-app acceptance or real-provider semantic compliance is claimed by this backend PR.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

OpenAI Codex assisted with implementation and tests under the owner's reviewed design and standing authorization. A fresh independent Codex session reviews this PR; AI review is not human approval. The substantive commit carries Generated-by: OpenAI Codex.

Checklist

• Tests cover the change and detect missing delivery behavior
• Lint, format, typecheck and the affected suites pass locally (initial parallel timing failure disclosed above)

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

这是 #8 的 C 阶段后端 PR：给指定 WorkHub 工作直接发送用户输入，不再经过协调模型选目标，也不必等待协调模型的当前对话结束。

输入携带固定 work／generation／来源 action、delegation 和幂等 ID，Session 从真实派发记录解析。当前任务拥有活跃原生执行时复用 current-Turn steering；原消息排队时在原项上补充，保留无关执行与 FIFO；任务结束或共享执行时走已有原子派发续接，同一 Session 忙于无关工作仍按 next-Turn 排队。

来源绑定的输入事实与消息效果在现有 WorkHub 账本中原子提交。同一 ID、同一正文和来源只返回原受理记录，改变内容或来源会冲突；不新增任务库、调度器或队列。投递回执仅依据真实 admission／不可变执行事实；队列项消失不等于模型消费，已投递更不等于模型遵从。提交结果未知保留原 ID，并使用 Host 恢复。

Session 自己的模型、cwd、权限及授权有效期不变；拒绝停止／替换／旧阶段／归档来源，插件执行器如实返回不支持。本次新增两个 remote-owner 操作授权，epoch 从 217 前进至 218。任务输入框仍只读，下一 PR 再接前端与传输；C–E 尚未完成，不关闭追踪 issue。

本地构建、类型、lint、格式、ASF、受影响全套、清单和发布合约均已验证。真实本地 HTTP 模型请求测试确认纠正只进入下一次支持的请求、无需额外协调调用；反向 mutation 会被同一断言检出。真实 Host 验证 B→补充后的 A→独立 C、协调器忙碌、重启与不重复执行；真实 SQLite 验证三条路径的原子回滚、chunked 记录的续接／重启查询和配置／FIFO 不变。现有 handoff／Stop／阶段替换用例也覆盖了直接输入。

独立审查在最初提交中发现 P2：错过最后 steering 边界的纠正进入下一轮后丢失工作归属、绕过并发名额，Stop 也无法停掉它。尽管旧提交 CI 通过，仍未合并。现已让受理身份和真实 root-source 证明衔接到同一工作，供并发计数、历史／状态和 Stop 共同读取；混合／无关消息不强行认领，不改变授权继承，不新增 schema、队列或任务库。真实模型回归在旧提交失败、修复后通过：名额为 1 时 B 等待，Stop 停掉纠正后续执行后 B 才开始。最终精确提交的独立复审与新 CI 已通过。

复审已通过原问题及共享／编辑／多次／链式输入检查，又发现超过 16 项历史后的游标带入多余 sessionId、被自己的严格解码拒绝。后续仅将续接引用规范化为 {turnId, runId}，并通过实际 Host 连续产生 17 个执行、原样请求两页的回归：旧实现失败，修复后通过。最终 Host 全套 2327 通过 / 0 失败 / 12 跳过，Desktop 任务视图模型 8/8；其他工作区实现树未改变。同一独立会话已复审最终精确提交，42 项现有定向测试与 6 项独立临时复现共 48/48 通过，两个 P2 均解决，未报告剩余可操作 P0/P1/P2 或单列 P3；这不是零缺陷保证，也不是人类批准。

首次并行全量中的既有 Code Mode 取消标记用例失败已保留；未改断言的 Runtime 单独全套和干净当前 main 全套均通过。修复树并行全量另遇到原有 WorkHub 协调队列续接等待超时；该用例单独复跑、干净当前 main 同用例均通过，随后修复树 Host 全套 2326 通过 / 0 失败 / 12 跳过。没有放宽期限、重试或断言，也未声称这两项已在 main 稳定复现。最终精确提交的 hosted test／audit 已通过；此后端改动的 CI 规划未选中 Desktop E2E／浏览器／Storybook，这些是跳过而非已运行。后端 PR 不宣称已完成 Windows 本机、安装版验收或真实供应商语义遵从验证。

OpenAI Codex 在仓库所有者已审核的设计及持续授权下协助实现和测试；独立 AI 审查不冒充人工批准。