fix: prevent tasks from being associated with the wrong PR

[genisd]

Summary

Prod incident (2026-07-08, task 347c7c88): a task was associated with the wrong PR (gynzy/backend-python#453 instead of jonwiggins#506) and instantly auto-completed. The task's prompt contained a literal example PR URL; when the exec stream dropped mid-run, the worker regex-scanned the log, took the first PR-URL match (the prompt's example), and since that PR was merged weeks earlier the reconciler completed the task 2 seconds later — while the agent was still working and opened the real PR 90 seconds after that.

This PR adds three independent defenses so a PR URL merely appearing in agent logs can no longer hijack a task's PR association.

Changes

• Agent adapters (packages/agent-adapters): all six adapters now take the last PR-URL match in the log instead of the first — prompts and examples come first, PR-creation output comes last.
• Branch validation before pr_opened (apps/api): new validateTaskPrUrl fetches the candidate PR and requires its head branch to be the task's deterministic branch optio/task-<taskId>. Invalid candidates are discarded so the existing branch-based checkExistingPr fallback finds the real PR or escalates to needs_attention. Fails open when the platform API is unavailable, so an outage can't make detection worse than before. Supporting this, the shared PullRequest type gains a headBranch field (GitHub head.ref, GitLab source_branch).
• Reconciler guard (packages/shared/src/reconcile): decideFromPrStatus now refuses to act on a PR created before the task existed — routes to needs_attention (pr_predates_task) instead of auto-completing/failing. Only coding tasks are guarded: review and pr_review tasks legitimately point at PRs that predate them; missing PR timestamps skip the guard; failed tasks noop (invalid transition).

flowchart LR
    A[agent log scan] -->|candidate URL| B{head branch ==\noptio/task-id?}
    B -->|valid| C[pr_opened]
    B -->|invalid| D[checkExistingPr\nby branch]
    B -->|API unavailable| C
    D -->|found| C
    D -->|none| E[needs_attention]
    C --> F{reconciler:\nPR predates task?}
    F -->|no| G[normal PR watching]
    F -->|yes| E

Loading

Known follow-ups (out of scope): the mid-stream log scanner is still first-match and unvalidated (the reconciler guard neutralizes the dangerous outcome), a discarded bogus URL can remain visible in tasks.prUrl on escalated tasks, and the exec-stream drop that triggered the incident is a separate reliability issue.

Testing

Incident-shaped scenarios covered by new unit tests: last-match selection in every adapter, all three validateTaskPrUrl verdicts, and the reconciler guard incl. exemptions (review/pr_review, missing timestamp, failed noop).

• Tests pass (pnpm turbo test)
• Typechecks pass (pnpm turbo typecheck)

Related

Plan with full incident analysis: docs/superpowers/plans/2026-07-08-pr-association-validation.md

Screenshots

n/a