feat(agent-org): enforce coordinator safety and certified delivery

[ShiboSheng]

Problem

Agent Org Coordinator turns inherited ordinary SDE work tools, could reread the same work revision instead of waiting for durable events, and could overlap old and replacement Task executions during cancellation or reassignment. Run completion was also inferred from text/quiescence rather than an authoritative evidence certificate, allowing either false success or a permanent Needs Attention state. During real-provider testing, TaskExecution members additionally used ordinary messages for routine progress narration; each accepted message could create an unnecessary Coordinator trigger and Provider turn.

This PR implements PR8S for #995 on the exact PR #991 head b96bd8b196e2c7fed6bcbcd05fd7261e3bf5e706.

Solution

• Give persisted Coordinator turns a direct orchestration-only tool registry and enforce the same typed authority at execute and side-effect boundaries.
• Claim bounded durable triggers atomically with the Coordinator task snapshot, return typed no-change for repeated observations, and finish no-progress turns as waiting_for_org_event.
• Fence in-progress Task cancellation/reassignment so the old Turn, lease, process group, and workspace writer release before a replacement can dispatch; persist timeout/unknown evidence and require explicit resolution.
• Make one completion owner validate current-generation Task closure and TaskOutput evidence, then write a RunCompletionCertificate before typed assistant publication, Turn terminal state, and Idle.
• Put completion-candidate assessment in the same atomic Coordinator snapshot so a ready run calls org_run_complete directly instead of deadlocking on a same-revision task_list refresh.
• Require actionable TaskExecution Member-to-Coordinator messages to bind the exact current Task and one closed purpose: blocker, decision_required, material_change, risk, or requested_reply. Routine progress stays in Task state and completion stays in TaskOutput. The Store validates only objective Task/Turn/Owner/run facts and never classifies message prose.
• Project persisted handoff, Coordinator activity, completion evidence, and needs-attention states in the packaged UI without deriving Delivered on the frontend.

No second runtime/dispatcher, new Task status, polling timer, Inbox schema, body classifier, or database migration is introduced. The rollout gate remains disabled by default.

Potential risks

• The LLM tool schema adds an optional purpose field, but TaskExecution Member-to-Coordinator plain messages now require it and an exact related_task_id. Other message directions and persisted Inbox payloads remain compatible.
• The backend deliberately does not judge whether prose is routine progress. A model may still mislabel narration as a valid purpose; metrics and provider regressions expose this without risking suppression of real blockers.
• Small TaskExecution assistant narration can remain visible in Member transcripts. The accepted boundary is that it does not itself write Inbox, register a Coordinator trigger, or start a Coordinator Provider turn.
• Handoff timeout/unknown paths are conservative and may require explicit user resolution instead of automatic continuation.
• FinalSummaryReceipt, final-report failure/Retry, and exact-once formal-trigger convergence remain PR8F / fix(agent-org): converge plans, formal events, and final reports #997 scope. A certificate proves delivery evidence but does not implement those later final-summary semantics.
• The latest long orlando / GPT 5.6 Luna chatter journey hit external HTTP 429/503, repeated model/file-edit errors, and one packaged-process exit. It was restored from durable state and Paused through the real UI; this run is not claimed as Delivered. A separate natural real-provider journey on the same final PR8S implementation already produced one delivered certificate with the required ordering.
• Rollback is to disable ORGII_AGENT_ORG_REDESIGN or revert this branch. There is no data migration to reverse.

Verification

Final automated checks:

• cd src-tauri && cargo test -p agent_core --lib --no-fail-fast -- --test-threads=1 — 3,313 passed, 0 failed, 2 ignored.
• cd src-tauri && cargo test -p session_persistence --lib --no-fail-fast — 46 passed, 0 failed.
• cd src-tauri && cargo clippy -p agent_core --all-targets -- -D warnings — passed.
• cd src-tauri && cargo fmt -p agent_core -- --check — passed.
• pnpm typecheck — passed.
• git diff --check — passed.
• cd tests/e2e && pnpm test -- --spec './specs/core/agent-org-group-chat-ui.spec.mjs' --mochaOpts.grep 'certifies completed work from the atomic snapshot without a task_list refresh' — 1 passed.

No TS/TSX file changed in the final Member-coordination commit, so changed-file TypeScript lint was not applicable to that supplement.

Packaged app and real Provider

Final chatter-regression artifact: ORG2 Instance 92.app, executable SHA-256 ec2c9e747e634039b605d094e8039d0f1bb53b5ba1bab81a16d062a2723a23bc, rollout gate enabled only for the isolated test home.

Computer Use drove model selection, workspace selection, Send, Overview, Session switching, Pause, Resume, and final Pause in the real packaged App using orlando / GPT 5.6 Luna. Visible Implementer narration produced zero successful Implementer org_send_message receipts and zero Implementer plain Inbox rows. Two Reviewer material_change messages bound to the exact review Task were written/read exactly twice and immediately processed by the Coordinator. Four invalid plain calls remained rejected and did not become accepted coordination messages.

The earlier final certificate journey used the same requested Provider and a clean packaged App: four formal Tasks and TaskOutputs completed; the last Coordinator turn called org_run_complete once without a completion-stage task_list; one delivered certificate was created before typed assistant publication binding, Coordinator Turn terminal, and Run Idle.

Scope and size

Final diff against the exact base is 12,230 review lines across 141 substantive files plus 13 locale files. This remains below the 12,250 early re-estimation gate and the 145-substantive-file P90 gate.

The PR is intentionally Draft while reviewers evaluate the PR8S safety boundary and the recorded external-provider limitations.