Sub-roadmap: DAG runtime phase 2 — claim, lease, and stale ownership

[devkade]

Sub-roadmap: DAG runtime phase 2 — claim, lease, and stale ownership

Parent roadmap: #167
Related: #168, #185, #186
Runtime-first sequence: phase 2 of 4
MVP inclusion: yes

Summary

Define and implement task ownership semantics: ready tasks can be claimed by workers, active claims have leases, duplicate active ownership is rejected, and stale claims become recoverable.

Goal

Ilchul should behave like a runtime, not a task list. It must prevent duplicate execution and make abandoned work recoverable.

Scope

• ClaimLease model.
• ClaimLease token generation.
• Claim validity checks.
• Lease expiry and renewal behavior.
• Duplicate active claim rejection.
• Task completion requires valid claim token.
• Recovery behavior for expired leases.
• Events for claim-created, lease-renewed, lease-expired, claim-released, claim-recovered.

Non-goals

• No automatic worker launch yet.
• No tmux/worktree dispatch yet.
• No IntegrationCandidate records yet.
• No destructive cleanup.

Acceptance criteria

• Ready tasks can be claimed by one worker.
• Pending/blocked/completed tasks cannot be claimed.
• Duplicate active claims are rejected.
• Completion without valid claim token is rejected.
• Expired lease prevents normal completion.
• Expired lease can be recovered through explicit recovery path.
• Claim/lease events are recorded.

Verification

• Unit tests for claim success/failure.
• Unit tests for duplicate claim race behavior.
• Unit tests for lease expiry.
• Unit tests for recovery after stale lease.
• Fixture showing claim lifecycle through normal completion and stale recovery.

[devkade]

Design decision

needs-design is resolved by #167's Development Order.

Decisions:

• ClaimLease is the canonical operational ownership index for MVP. RuntimeTask should store at most claimRef/worker refs, not become the authoritative lease ledger.
• A ready task can have only one active claim.
• Pending, blocked, failed, completed, and already-actively-claimed tasks cannot be claimed normally.
• Completion requires a matching, unexpired claim token.
• Expired leases deny normal completion and require an explicit recovery transition.
• Lease renewal, release, expiry, and recovery must be represented as events.
• Recovery is non-destructive and inspectable; it does not silently kill worker sessions or delete worktrees.

Implementation can proceed as Step 4 of #167. Existing task-local claim helpers may be kept as a compatibility/projection layer only if the canonical ClaimLease index remains clear.