[Bindy-lbb]

Project task runs now receive a server-owned statement of the goal, task, acceptance criteria and declared collaboration context. Tasks with predecessors stay blocked until current execution/delivery evidence supports human acceptance or explicit manual completion. Reviewers can inspect the exact saved model requirements separately from current project state.

Closes #619. Closes #621. Includes the collaboration implementation merged through #622. #618 has merged into main. This PR now targets main and delivers phases 2a and 3 together.

Behavior and acceptance

• Project launch passes expected workspace/plan revision. The server resolves the assigned work item, rejects stale/missing/foreign requirements and saves the canonical task-briefing.v1 payload before invoking the model. Terminal/reopened records retain exactly the injected requirements, byte count, digest and execution identities.
• Explicit participants have contributor/reviewer roles and responsibilities. Same-project predecessor references are bounded and validate missing/self edges and cycles. Whole-plan validation runs under the existing edit lock; omitted relationship fields preserve existing configuration, and explicit empty arrays clear it.
• Upstream completion alone cannot unlock a task. Current human acceptance must bind the latest eligible delivery and current criteria. New running/failed attempts or unavailable evidence block new launches. Manual completion requires no bound execution/acceptance history. Bare/session/group dispatch cannot bypass configured tasks.
• Scoped collaboration records contain declared collaborators, direct predecessor evidence and filtered public delivery references/excerpts, plus bounded downstream references and explicit omissions. They grant no permissions or budget and do not dispatch participants automatically. Required sources share and deduplicate the existing 12-source allowance.
• Required briefings retain the 48-KiB cap and share the 64-KiB context / 256-KiB input budgets. Oversized requirements fail explicitly rather than silently losing criteria or responsibilities. Strict storage readers enforce shape, identities, timestamps, hashes, excerpt digests and parent source-count linkage.
• Retry and single/batch approval resumes retain their task/plan binding and refresh dependencies. Personal conversations and the acceptance drawer show saved requirements lazily. Current state refreshes through existing events/reconnect; changes never rewrite historical input. Final human verdict, delivery digest, criteria and idempotency checks remain authoritative.
• Task editor, cards/schedule views, source-session navigation, current-vs-execution comparison, runtime packaging inventory, localization, changelog and technical designs are included. Vite 6.4.4 fixes the dependency audit; bounded App integration deadlines and an explicit delivery-refresh wait preserve the original behavior assertions.

Scope is executable project work items. Employee reviewer dispatch (phase 2b), live negotiation, automatic scheduling and other task stores remain separate work. Recording a reviewer does not execute an employee review or confer acceptance authority.

Validation

The reviewed integration head f1fe7c3d59889dc9771f972627b1629b621b2579 has the same complete source tree as #622's tested head bc7950c8c8e89647bb24979eba45bbd5c2830729. PeterGuy326 approved that integrated feature head. Retargeting from the phase-one branch to main dismissed the earlier approval. PeterGuy326 renewed approval on final head d2d42b303578904b3f58caf7208db01caddc25bd at 2026-10-21 06:37:23 UTC, and all current-base checks passed before merge.

Feature validation already completed: TypeScript build, updater preparation, UI/renderer type checks; 233 script/runtime tests; 53 UI tests; complete server suite 987 passed/4 skipped; all 1,262 renderer tests across 89 files; Vite 6.4.4 production build and 570 desktop-main tests; dependency audit with 0 vulnerabilities; git diff --check. Native macOS/Windows staging, unsigned installers, layout parity and security checks passed for that reviewed integration head. Final integration head d2d42b303578904b3f58caf7208db01caddc25bd: all fresh GitHub checks passed against current main, including both Node 24 full suites, CodeQL, dependency review, OpenSSF Scorecard, both platform staging/installer checks and layout parity. Fresh independent approval by PeterGuy326 was received on that exact final head after retargeting. The main-merge conflict resolution preserves the independently precomputed combined source tree; the sole additional cleanup removes an existing conflict-marker line from main's CHANGELOG. No feature behavior was changed by integration.

Tests cover authoritative readiness, old-writer preservation/clearing, DAG/API rejection, group/bare bypass prevention, failed evidence reads, running/saved/injected equality, restart/retry/approval binding, filtering, snapshot tampering, budgets/source deduplication, editor persistence, current-vs-saved review and reconnect refresh. No coverage percentage is claimed.

Local checks used supported Node 22.23.2; repository CI uses Node 24. The shared root container's narrow ephemeral-port range and DAC overrides require this isolated server-test invocation, without changing host sysctls or assertions:

unshare --net sh -c 'ip link set lo up && setpriv --bounding-set=-dac_override,-dac_read_search node --test --test-concurrency=2 --test-timeout=120000 apps/server/dist/test/*.test.js'

Browser plugin unavailable; installed Playwright/Chromium exercised real project components and local HTTP/SSE routes with a deterministic driver at desktop and 480-px narrow widths. Passed upstream completion-still-blocked → human acceptance → downstream execution; saved payload vs actual model input; source navigation; disconnect/reconnect after a new failed upstream; rejected bypass; immutable/current-state human review. Narrow drawer content/scroll widths were both 456 px. No unexpected browser errors; one expected 409 and a pre-existing Ant Drawer deprecation warning. Screenshots were inspected, and the complete flow passed again after the dependency-checkbox layout correction. This is product-flow evidence, not live-provider quality evidence. Full original ledgers remain in #622 and the linked design documents.

Compatibility and rollback

Deploy matching server, IPC and renderer. Existing records without briefing/collaboration snapshots remain readable, while configured collaborative tasks require the explicit current launch contract. Older strict readers may reject newly extended records: retain pre-upgrade backups or separate workspace data for downgrades. Do not erase historical snapshots or silently drop briefing fields to fabricate compatibility. Revert code to roll back. Filtering is best-effort; digests establish consistency, not authenticity or human approval.

Designs: project task briefings, task collaboration context.

Merged into main at 2026-10-21 06:40:03 UTC as b69b9d8a2a0271b0084e38670e1add22b1454640. The merge source tree exactly matches the verified final integration tree 25e1b4831c0421b56d28ba1b32e4008db303104a. Issues #619 and #621 close with this merge.

The base branch was changed.