Add sub-task self-landing coordinator flow

[brooksc]

Dependency

This PR is based on #138 (terminal-hmr-lifecycle). PR138 preserves task PTYs across renderer remounts; this PR builds on that terminal lifecycle work and does not reimplement it. Until #138 lands, this PR is stacked on top of that branch.

Problem

Coordinator mode was spending too much attention on successful sub-tasks. The OpenSpec goal is to let one coordinator manage larger batches of routine sub-tasks without one coordinator interaction per completed task. Before this change, the coordinator had to inspect completion, decide whether verification was real, merge the branch, close the task, and keep track of interleaved task state.

That led to several concrete failures during testing:

• Sub-tasks could finish work but still require coordinator-side merge/close chatter.
• Coordinators sometimes treated a "completed" message as ownership transfer even when get_task_status still reported running.
• A coordinator manually edited or verified an active sub-task worktree instead of sending focused findings back to the owning sub-agent.
• A successful self-landed task could remain visible, making it look unfinished even though no user action should be required.
• Codex sub-tasks could lose visible land_self / signal_done tools after restore/hydration because MCP launch args were not rebuilt correctly.
• A stale terminal placeholder could make the coordinator think the original assignment had not been delivered, causing duplicate prompts.
• Desktop notifications could fire after the task had recovered or been closed.
• Sub-tasks were still being created from main in one run, despite the spec requiring the coordinator branch as the default base.

Design Principle

The core architecture is the OpenSpec split:

• Sub-tasks own landing decisions.
• Backend owns landing mechanics.

The sub-task knows what it changed and what verification it ran. The backend knows how to merge safely in the coordinator worktree under the existing repo lock, clean up the child task, and update renderer state. The sub-task should not run raw git merge; the backend should.

Fix

Added the land_self happy path for sub-tasks. A sub-task can now commit its work, report structured verification, and ask the backend to land it. On success, the backend merges into the coordinator branch, records landed metadata, strips backend-owned injected artifacts, removes the sub-task worktree/branch/MCP config, and closes the child task.

Made land_self terminal from the sub-task agent’s perspective. A successful land_self does not require signal_done, merge_task, or close_task. The completed child disappears from the active task list unless cleanup failed.

Added guarded automerge checks. land_self rejects missing, blocked, failed, or unknown verification; dirty worktrees; orphaned tasks; invalid ownership; branch/worktree mismatch; merge conflicts; and cleanup failures. Cleanup failures stay visible because they still need attention.

Preserved manual coordinator landing. merge_task remains available for manual-review/escalated paths, but backend rejects normal coordinator merges for still-running tasks unless they are in an allowed manual-review or landing-escalation state.

Tightened active-task ownership guidance. Coordinator instructions now say get_task_status is authoritative: if a sub-task is still running, route fixes through send_prompt and let the sub-agent fix, test, commit, and land. Manual takeover requires a stated reason and evidence.

Fixed MCP restore for Codex sub-tasks. Hydrated/restored Codex tasks now rebuild inline MCP launch args so land_self and signal_done remain available. Claude/Docker .mcp.json flows are still allowed to rely on config-file discovery.

Fixed prompt/control handoff. Coordinator-created sub-tasks start in coordinator control, and automatic handoff to human control is suppressed during startup/auto-trust/recent prompt echo cases. The coordinator instructions/tool descriptions also warn not to resend assignments just because a stale placeholder like Improve documentation in @filename is visible.

Fixed stale desktop notifications. Pending task-error/needs-input notifications are reconciled against current task state and removed if the task recovers or is removed before the notification fires.

Fixed base-branch behavior. Coordinator MCP registration now carries the coordinator task branch, and backend create_task defaults child baseBranch to that coordinator branch when the tool omits an override. The coordinator prompt and create_task tool docs now describe that default explicitly.

Verification

• nice git diff --check origin/terminal-hmr-lifecycle..HEAD
• nice /Users/brooksc/.codex/skills/parallel-code-pr/scripts/run-pr-verification.sh
  • npm run check
  • npm test: 64 test files, 1086 passed, 12 skipped
• Push hook also reran npm run check and npm test successfully.

Notes

Known unrelated static checks are unchanged:

• lint:dead reports existing Knip findings.
• lint:arch reports existing store dependency cycles.

Runtime log review of /tmp/parallel-code-20260524-222023.out found no new unfixed Parallel Code issue beyond the already-fixed baseBranch=main behavior.