Use one authoritative workflow ID across dispatch

[Shooksie]

What changed

• Preallocate workflow IDs before the atomic queue lease.
• Carry each leased ID through dispatch planning and runner spawn.
• Pass fresh IDs with --new-workflow-id and keep resume IDs distinct.
• Correlate environment acquisition and completion fallback with the same authoritative ID.
• Fail closed when an assigned queue entry lacks a workflow ID.

Why

TASK-1072 reproduced a production queue UUID / journal UUID mismatch. The daemon leased without supplying IDs while the runner independently minted its own, so queue lookup could report not_found for a live workflow and node.

Impact

Queue, journal, runner events, environment broker, and completion reconciliation use one identity. This PR requires a runner release that supports --new-workflow-id and the corrected consolidated Postgres backend.

Validation

• cargo check -p orchestrator-cli
• Animus dispatch suite: 145/145 passed serially
• Five-slot backend assignment/reclaim regression in companion Postgres PR
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
animus-docs	Ready	Preview, Comment	Jul 28, 2026 8:05am

[animus-launchapp-gitprovider]

VERDICT: CHANGES REQUESTED

1. crates/orchestrator-daemon-runtime/src/dispatch/process_manager.rs:ProcessManager::poll_completed — let workflow_id = latest_runner_workflow_id(&events).or_else(|| workflow_target.clone()); still lets a divergent runner-emitted ID override the kernel-selected/queue-stored authoritative ID. That is the same identity-split failure mode TASK-1072 is intended to eliminate: completion and environment cleanup can be correlated to the runner ID while the queue remains assigned to workflow_target. REQUIRED CHANGE: when workflow_target is present, make it the workflow ID used for reconciliation; compare any latest_runner_workflow_id(&events) against it, emit an explicit mismatch diagnostic containing both IDs, and fail the completion rather than switching identities. Only use the runner-emitted ID when there is no kernel target (the legacy ad-hoc path). Add this as a small helper if needed so timeout, signal, and normal-exit paths retain the same invariant. Verification: add a unit test in process_manager.rs (or the completion-reconciliation test module) that supplies target queue-id plus a runner event for runner-id and asserts the completed process is failed/reconciled under queue-id while diagnostics contain both values; run cargo test -p orchestrator-daemon-runtime and expect all tests to pass.

The pre-lease UUID allocation, propagation through --new-workflow-id, and use of that ID for the environment broker are well-scoped and directly address the primary dispatch-path split. The fresh-vs-resume command separation is also clear.

[animus-launchapp-gitprovider]

VERDICT: APPROVE

No blocking findings. The change preallocates workflow IDs before the atomic queue lease, propagates the leased ID through dispatch planning and fresh runner bootstrap (--new-workflow-id), keeps resume semantics distinct, and makes completion reconciliation fail closed while retaining the authoritative ID on mismatch. The environment broker and early-exit fallback now use the same durable identity, matching TASK-1072 without unrelated changes.

Verification: GitHub reports all configured checks green for head 601b857f6fd21db200d4275473d01b592e828c40, including workspace cargo-check, clippy, rustfmt, docs-sync, dependency guardrail, smoke-help, and Vercel. I also inspected all six changed files against TASK-1072; the focused tests cover fresh-ID CLI propagation and mismatch reconciliation. The implementation is cohesive, minimal, and preserves the legacy ad-hoc and explicit resume paths.