Bind active role-profile revisions to sessions, workers, cache, and audit provenance

[Punisheroot]

Context

Sessions already freeze a prompt-profile digest, route set, transport and
semantic definition digests, model, repository, and multi-need policy in the
sessions table. RuntimeEngine derives a WorkerConfig from global settings,
and NeedCacheIdentity includes a worker-configuration digest. Codex worker
runs record model/usage/session cleanup, while change attempts record patcher
or verifier usage. None of those records says which named role-profile
revision supplied the policy. Updating a global model policy can therefore
leave provenance ambiguous and can make two semantically different role
revisions appear cache-compatible.

Expected outcome

At session start, the parent resolves one active Codex role-profile revision and
freezes its identity. Every worker, patcher, verifier, cache identity, change
attempt, and audit event carries that revision digest. Historical sessions keep
their original revision; later activation affects only new sessions. Missing,
stale, or incompatible profile provenance bypasses or rejects safely rather
than silently reinterpreting old work.

Scope

• Extend the session record/read model to store profile identity, revision, and
  definition digest at session start. The write is idempotent for the same
  session and rejects a conflicting second profile.
• Resolve the session's frozen revision when RuntimeEngine builds a worker
  configuration. Remove implicit dependence on the mutable global setting for
  an existing session while preserving the current Codex-only WorkerConfig
  execution boundary.
• Include the profile revision digest (and a bounded profile identity) in
  NeedCacheIdentity/logical cache identity and artifact/attempt provenance.
  A new revision must never hit or overwrite a result produced under another
  revision unless an explicit, validated compatibility rule says so.
• Add profile provenance to Codex worker runs, App Server session diagnostics,
  patcher/verifier attempts, and lifecycle/audit payloads. Redact credentials,
  absolute paths, raw prompts, and unbounded transcripts.
• Add migration/backfill behavior for existing databases: legacy rows are
  marked unknown and bypass profile-dependent reuse until a new session records
  a valid revision; no historical row is rewritten as if it used the active
  revision.
• Add tests for session immutability, cache separation, legacy bypass, worker
  and change-attempt serialization, and audit redaction.

Non-goals

• Defining or editing role profiles ("Canonical revisioned Codex role-profile
  domain and SQLite persistence") or building their editor ("Add digest-bound
  role-profile HTTP API and web editor") beyond the read APIs required to
  resolve an active revision.
• Enabling non-Codex execution, host fallback, automatic profile migration, or
  profile changes in a live session.
• Reworking prompt-profile canonicalization, artifact validation, or cache
  economics unrelated to role provenance.
• Returning credentials, raw App Server transcripts, or unrestricted audit
  history through the web/API.

Acceptance criteria

• A newly recorded session contains exactly one profile identity, revision,
  and definition digest; repeated start with the same values is idempotent,
  and a conflicting value is rejected.
• RuntimeEngine resolves the frozen session revision and produces a
  deterministic Codex WorkerConfig; changing the active profile after
  session start does not change that session's config.
• NeedCacheIdentity (including logical identity) and every persisted
  worker/patcher/verifier attempt include the profile revision digest; two
  otherwise identical requests under different revisions do not share a
  cache entry.
• A legacy session or row without valid profile provenance is marked
  unknown and returns a bounded bypass/inconclusive result; it is never
  attributed to the current active profile.
• Worker cleanup/recovery and change/apply behavior remain intact, with
  provenance present in success, failure, cancellation, and recovery paths.
• Serialization tests prove no credentials, absolute paths, raw prompts, or
  unbounded transcript text can enter profile provenance or audit payloads.
• Existing cache identity, session immutability, worker accounting, and
  verified-change tests continue to pass with the new digest field.

Validation

cd crates/needle-app/web
npm ci
npm run build
cd ../../..

cargo test --locked -p needle-core
cargo test --locked -p needle-runtime
cargo test --locked -p needle-platform-codex --test offline_n1
cargo test --locked -p needle-platform-codex --test patcher_offline
cargo test --locked --workspace

Use the existing offline fixtures only; no Codex/provider call is authorized by
this issue. If web serialization changes, also run:

cd crates/needle-app/web
npm run test:e2e:local
cd ../../..

Starting points

• crates/needle-runtime/src/store.rs:52-84, 1901-2065 - session schema,
  record_session_start_for_transport, and frozen SessionRecord fields.
• crates/needle-runtime/src/orchestrator.rs:132-310 - RuntimeEngine
  resolution, settings-derived worker config, and cache identity construction.
• crates/needle-core/src/domain.rs:98-123 - WorkerConfig::digest;
  :329-372 - NeedCacheIdentity and logical digest.
• crates/needle-platform-codex/src/worker.rs:258-540 - Codex worker session,
  usage, cleanup, and worker_runs accounting.
• crates/needle-runtime/src/store.rs:3762-4090 - worker-run persistence and
  pending-session recovery.
• crates/needle-runtime/src/store/changes.rs:430-620 - patcher/verifier
  attempt persistence and latest verification records.
• docs/CONFIGURATION.md (Session immutability) and
  docs/RUNTIME_AND_WEB_CONTROL_PLANE.md (operational provenance) - required
  compatibility and visibility boundaries.

Dependencies

#1, Canonical revisioned Codex role-profile domain and SQLite
persistence supplies the
canonical profile/revision store. The active revision may be provisioned by
tests or a future CLI; this runtime slice must remain correct without the
editor. #4, Add the parent-owned depth-one Codex development lifecycle state
machine,
"Wire the parent-owned lifecycle executor to the current Codex primitives", and
"Add lifecycle read API and run-timeline control-plane UI" consume the provenance
fields and must not invent a parallel identity.

Ownership and risk

The runtime/platform maintainer owns this boundary. Cache identity and session
immutability are correctness properties: under-binding can serve stale or
policy-incompatible work, while over-binding only loses reuse. Expected blast
radius is needle-core identity types, needle-runtime sessions/orchestrator/
store, Codex worker accounting, and verified-change attempt payloads. Treat
legacy backfill and redaction as fail-closed security work.