fix: preserve verified ingress across automatic task ownership

Author: rockyshi1993

hooks/_runtime/evidence/codex-skill-route-pass.v1.json

@@ -5,24 +5,24 @@
   "hostVariant": "codex-cli/exec-user-global-local-stdio",
   "testedVersion": "codex-cli 0.145.0",
   "protocol": "MCP 2024-11-05",
-  "runtimeContractDigest": "711f86bf6394da14fda8a79fc1cb6ac9fcb3fe12824ccee9c26d05ed85fed285",
+  "runtimeContractDigest": "25526fef23e1ef540578679095e55f6c40377e47e8f65db73778bee85fd99809",
   "hostAdapterDigest": "845825776fc7a2f3e70ece637ab72f04157561c866f29bb331975163f0a758cc",
-  "sourceEvidenceDigest": "32cdb7a1c994516cf8aaa7f0faf1435f09846b1ab2a6ba086acf4ff39a2d1815",
+  "sourceEvidenceDigest": "6fa7c5963c5f14c7d21ee43c9f4d7407725fe6bcfed5b91e6ef7db4a56db089a",
   "sourceProbe": {
     "schemaVersion": "SkillRouteS15EvidenceV1",
-    "probeRunId": "s15-codex-probe-4f1cb2f2-3c79-4ea8-8602-4ac8900d59df",
+    "probeRunId": "s15-codex-probe-76a83fdc-692f-42af-8672-0db7930a19d9",
     "authorizationSource": "isolated-probe-authority",
     "contextSource": "host-hooks",
     "observationMode": "hook-post-history",
     "receiptStatus": "relevant-complete",
-    "completedAt": "2026-09-07T17:54:10.966Z"
+    "completedAt": "2026-09-07T18:57:30.766Z"
   },
   "runtimeBinding": {
     "source": "isolated-source-candidate",
-    "expectedDigest": "711f86bf6394da14fda8a79fc1cb6ac9fcb3fe12824ccee9c26d05ed85fed285",
-    "generationDigest": "711f86bf6394da14fda8a79fc1cb6ac9fcb3fe12824ccee9c26d05ed85fed285",
-    "modeReceiptDigest": "711f86bf6394da14fda8a79fc1cb6ac9fcb3fe12824ccee9c26d05ed85fed285",
-    "routeEnvelopeDigest": "711f86bf6394da14fda8a79fc1cb6ac9fcb3fe12824ccee9c26d05ed85fed285"
+    "expectedDigest": "25526fef23e1ef540578679095e55f6c40377e47e8f65db73778bee85fd99809",
+    "generationDigest": "25526fef23e1ef540578679095e55f6c40377e47e8f65db73778bee85fd99809",
+    "modeReceiptDigest": "25526fef23e1ef540578679095e55f6c40377e47e8f65db73778bee85fd99809",
+    "routeEnvelopeDigest": "25526fef23e1ef540578679095e55f6c40377e47e8f65db73778bee85fd99809"
   },
   "probe": {
     "schemaVersion": "SkillRouteProbeSummaryV1",

hooks/_runtime/host-skill-route-capabilities.v1.json

@@ -13,10 +13,10 @@
       "status": "PASS",
       "testedVersion": "codex-cli 0.145.0",
       "protocol": "MCP 2024-11-05",
-      "runtimeContractDigest": "711f86bf6394da14fda8a79fc1cb6ac9fcb3fe12824ccee9c26d05ed85fed285",
+      "runtimeContractDigest": "25526fef23e1ef540578679095e55f6c40377e47e8f65db73778bee85fd99809",
       "hostAdapterDigest": "845825776fc7a2f3e70ece637ab72f04157561c866f29bb331975163f0a758cc",
       "evidenceRef": "hooks/_runtime/evidence/codex-skill-route-pass.v1.json",
-      "evidenceDigest": "781474d583636cc9967ac67957497fe204d804dad887f94901cd384fa6a7927c",
+      "evidenceDigest": "2ef17ab9b6d27c2a98090b44399239cd677b31caba02aa6b00e3ba3f6418ef15",
       "entrySurface": "codex exec --ephemeral",
       "bootstrapDelivery": "stable user-global Hook launcher UserPromptSubmit or profile_context_plan fallback",
       "defaultEligible": true

mcp/memory-server.js

@@ -6135,6 +6135,9 @@ function handleMemoryTaskAdmitV2(args) {
       ingress = preparedResume.ingress
     }
   }
+  // Capture before admission/route binding switches the lifecycle projection
+  // to the newly created canonical task.
+  const ownerIngressState = taskOwnerIngressState(target, ingress)
   const admission = executeTaskAdmission({
     operation: args.operation,
     task: args.task,
@@ -6177,6 +6180,7 @@ function handleMemoryTaskAdmitV2(args) {
       operation: 'acquire',
       taskId: admission.taskId,
       admissionId: admission.admissionId,
+      ingressState: ownerIngressState,
       actualInstructionEnvelope: verifiedIngress.actualInstructionEnvelope,
       workItemSet: verifiedIngress.workItemSet,
       workflowRouteDecision: verifiedIngress.workflowRouteDecision,
@@ -6438,6 +6442,36 @@ function resolveCurrentTaskIngress(target, args, options = {}) {
   return ingress
 }
 
+function taskOwnerIngressState(target, ingress) {
+  let contextState = ingress.resumeStateHandoff || ingress.lifecycleState
+  const sameContext = state => {
+    const context = state?.contextAcquisition
+    return context?.contextEpoch === ingress.actualInstructionEnvelope.contextEpoch &&
+      context.hostSessionId && crypto.createHash('sha256').update(context.hostSessionId).digest('hex') === ingress.actualInstructionEnvelope.hostSessionDigest &&
+      comparableActiveRoot(context.activeRoot) === comparableActiveRoot(target.activeRoot)
+  }
+  // Immutable ingress snapshots intentionally omit the mutable ContextRead
+  // receipt. Reuse it only from the same observed instruction/route/session.
+  if (!sameContext(contextState)) {
+    contextState = null
+    try {
+      const { state } = readServerOwnedLifecycleProjection(target)
+      if (state.activeProject === target.project && state.activeScope === 'project' &&
+          state.actualInstructionEnvelope?.envelopeDigest === ingress.actualInstructionEnvelope.envelopeDigest &&
+          state.workflowRouteDecision?.decisionDigest === ingress.workflowRouteDecision.decisionDigest &&
+          sameContext(state)) contextState = state
+    } catch { }
+  }
+  return {
+    activeProject: target.project, activeScope: 'project',
+    actualInstructionEnvelope: ingress.actualInstructionEnvelope,
+    workItemSet: ingress.workItemSet, workflowRouteDecision: ingress.workflowRouteDecision,
+    stickyProject: ingress.projectTargetLease,
+    contextAcquisition: contextState?.contextAcquisition,
+    workflowRoutePlanBinding: contextState?.workflowRoutePlanBinding
+  }
+}
+
 function handleMemoryTaskWriteOwner(args) {
   const target = taskMemoryTransactionTarget(args)
   if (target.scope !== 'project' || !target.project) {
@@ -6457,14 +6491,7 @@ function handleMemoryTaskWriteOwner(args) {
     handoffRefDigest: args.handoffRefDigest,
     takeoverRefDigest: args.takeoverRefDigest,
     ...(serverObservation ? { serverObservation } : {}),
-    ingressState: {
-      activeProject: target.project, activeScope: 'project',
-      actualInstructionEnvelope: ingress.actualInstructionEnvelope,
-      workItemSet: ingress.workItemSet, workflowRouteDecision: ingress.workflowRouteDecision,
-      stickyProject: ingress.projectTargetLease,
-      contextAcquisition: ingress.resumeStateHandoff?.contextAcquisition || ingress.lifecycleState?.contextAcquisition,
-      workflowRoutePlanBinding: ingress.resumeStateHandoff?.workflowRoutePlanBinding || ingress.lifecycleState?.workflowRoutePlanBinding
-    },
+    ingressState: taskOwnerIngressState(target, ingress),
     expectedCommitFence: ingress.lifecycleState?.taskRecoveryCommitFence,
     actualInstructionEnvelope: ingress.actualInstructionEnvelope,
     workItemSet: ingress.workItemSet,

mcp/task-admission-authority.cjs

@@ -2950,6 +2950,7 @@ function executeTaskWriteOwner(rawInput = {}, options = {}) {
       expectedOwner: ownerRef(currentOwner),
       owner: nextOwner,
       transition: 'reacquire',
+      ingressState: input.ingressState,
       transaction,
       expectedAdmissionPhase: 'finalized',
       reason: 'owner-reacquire'
@@ -3022,6 +3023,7 @@ function executeTaskWriteOwner(rawInput = {}, options = {}) {
       expectedOwner: currentOwner ? ownerRef(currentOwner) : { mode: 'absent' },
       owner: nextOwner,
       transition: reopening ? 'reopen' : 'acquire',
+      ingressState: input.ingressState,
       transaction: ownerFenced,
       expectedAdmissionPhase: 'cp-state-written',
       reason: reopening ? 'owner-reopen' : 'owner-acquire'

scripts/test-mcp-servers.js

@@ -1293,7 +1293,13 @@ function testMemoryTaskAdmissionV2Contract() {
     actualInstructionEnvelope: envelope,
     workItemSet,
     workflowRouteDecision: route,
-    stickyProject: projectTargetLease
+    stickyProject: projectTargetLease,
+    contextAcquisition: {
+      contextEpoch: envelope.contextEpoch,
+      hostSessionId: 'mcp-admission-session',
+      activeRoot,
+      project
+    }
   }
   fs.writeFileSync(lifecycleStatePath, JSON.stringify(lifecycleState, null, 2) + '\n')
   const args = {
@@ -1421,6 +1427,20 @@ function testMemoryTaskAdmissionV2Contract() {
   assert.strictEqual(admitted.structuredContent.ownerAcquisition.cp1Confirmed, false)
   assert.strictEqual(admitted.structuredContent.continuationLease.status, 'consumed')
   assert.strictEqual(admitted.structuredContent.ownerAcquisition.finalized, true)
+  // The next Hook reads canonical task state, not the pre-admission projection.
+  // Automatic owner acquisition must carry the verified ingress across that
+  // boundary, just as an explicit owner renewal does.
+  const admittedState = readTaskRecoveryState({
+    metaDir: resolveTaskRecoveryMetaDir({ activeRoot, project }),
+    identity: { activeRoot, project, taskId: admitted.structuredContent.taskId, taskStatus: 'active' }
+  })
+  assert.strictEqual(admittedState.status, 'fresh')
+  assert.deepStrictEqual(admittedState.state.actualInstructionEnvelope, envelope)
+  assert.deepStrictEqual(admittedState.state.workflowRouteDecision, route)
+  assert.deepStrictEqual(admittedState.state.workItemSet, workItemSet)
+  assert.deepStrictEqual(admittedState.state.stickyProject, projectTargetLease)
+  assert.strictEqual(admittedState.state.contextAcquisition.contextEpoch, envelope.contextEpoch)
+  assert.strictEqual(admittedState.state.contextAcquisition.hostSessionId, 'mcp-admission-session')
   const replay = resultById(responses, 3)
   assert.strictEqual(replay.isError, false)
   assert.strictEqual(replay.structuredContent.admissionId, admitted.structuredContent.admissionId)
@@ -1459,6 +1479,29 @@ function testMemoryTaskAdmissionV2Contract() {
   })], TEMP_ROOT)
   assert.notStrictEqual(resultById(firstCp, 9).isError, true, resultById(firstCp, 9).content?.[0]?.text)
   assert.doesNotMatch(fs.readFileSync(path.join(taskRoot, '.memory', 'sessions.md'), 'utf8'), /\| CP1 \| ⏳ \|/u)
+  for (const [label, drift] of [
+    ['other-session', { hostSessionId: 'another-host-session' }],
+    ['other-root', { activeRoot: path.join(TEMP_ROOT, 'another-active-root') }]
+  ]) {
+    setupLegacyWorkspace()
+    fs.mkdirSync(path.dirname(lifecycleStatePath), { recursive: true })
+    fs.writeFileSync(lifecycleStatePath, JSON.stringify({ ...lifecycleState,
+      contextAcquisition: { ...lifecycleState.contextAcquisition, ...drift }
+    }) + '\n')
+    const observed = resultById(runServer('mcp/memory-server.js', [rpcRequest(10, 'tools/call', {
+      name: 'memory_task_admit_v2', arguments: { ...args,
+        task: { ...args.task, displayName: `MCP-context-${label}`, aliases: [] }
+      }
+    })], TEMP_ROOT), 10)
+    assert.notStrictEqual(observed.isError, true, observed.content?.[0]?.text)
+    const isolated = readTaskRecoveryState({
+      metaDir: resolveTaskRecoveryMetaDir({ activeRoot, project }),
+      identity: { activeRoot, project, taskId: observed.structuredContent.taskId, taskStatus: 'active' }
+    })
+    assert.strictEqual(isolated.status, 'fresh')
+    assert.deepStrictEqual(isolated.state.actualInstructionEnvelope, envelope)
+    assert(!isolated.state.contextAcquisition?.hostSessionId, `${label} context must not be inherited`)
+  }
 }
 
 function testMemoryFinalizedFreshResumeV3Contract() {