refactor(mcp): route workflow controls through services

[Shooksie]

What changed

• routes workflow pause, cancel, resume, approve, and reject MCP tools through typed in-process application services
• authorizes the exact persisted workflow owner before confirmation, validation, teardown, or mutation
• rehydrates the persisted actor for detached resume and post-approval continuations, including actor-partitioned task projections
• exposes the now-enforced controls on actor-bound MCP servers and updates the application-contract documentation

Why

These lifecycle tools still crossed a child-CLI/argv boundary and could not safely be exposed to a user-scoped Portal application host. Workflow continuations also needed to retain their original user and tenant instead of falling back to global scope.

Impact

The Portal can control an authenticated user's workflows in process without identity downgrade. Cross-user, cross-tenant, unowned, and unknown workflow IDs remain concealed as not_found.

Validation

• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo animus-lint
• cargo test -p orchestrator-cli --locked -- --test-threads=1 (1,428 unit tests plus binary/integration targets)
• focused owner mutation, cross-actor concealment, and lifecycle actor-rehydration tests
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
animus-docs	Ready	Preview, Comment	Jul 29, 2026 3:38pm

[animus-launchapp-gitprovider]

VERDICT: CHANGES REQUESTED

1. crates/orchestrator-cli/src/services/operations/ops_workflow/phases.rs:approve_manual_phase — approved_by: lifecycle_actor.as_ref().map(|actor| actor.user_id.clone()).unwrap_or_else(|| protocol::ACTOR_CLI.to_string()) records the workflow owner as the approver, even when the documented local-operator path approves an actor-owned workflow. That makes the approval audit claim Alice approved her own gate when a global CLI operator actually did it. REQUIRED CHANGE: keep the persisted lifecycle_actor exclusively for continuation and task-projection partitioning, and pass the actual approving principal into approve_manual_phase from workflow_phase_approve_application; write approved_by from the authenticated caller when present and protocol::ACTOR_CLI for the actor-less local CLI path. Verify with tests that (a) an actor-bound approval records the authenticated owner's user_id, and (b) a local actor-less approval of an actor-owned workflow records ACTOR_CLI while the continuation request and task projection still retain the persisted workflow actor.

The typed in-process routing, pre-mutation owner concealment, persisted-actor rehydration for detached continuations, and focused cross-user/cross-tenant tests are otherwise well structured and directly advance TASK-971. CI is currently still pending, with completed checks green so far.