[Bindy-lbb]

Project tasks can now declare collaborators with responsibilities and direct predecessor tasks. Run stays blocked until each executed predecessor has current human acceptance (or an explicitly completed manual predecessor). Every launch saves the exact scoped collaboration data supplied to the employee; later updates remain visible separately during review.

Closes #621. Stacked on #620, base feat/619-project-task-briefings; #618 → #620 → this PR is the merge order. Retarget after the preceding PR merges. This diff contains phase three only.

Changes and acceptance

• Optional participants and dependsOn on project work items: max eight of each, explicit contributor/reviewer responsibility, existing employees, no duplicate primary assignee, same-project references, no self edges/cycles. The complete merged graph validates under the goal edit lock. Older writers preserve omitted relationships; explicit empty arrays clear them. Referenced tasks cannot disappear silently.
• Readiness comes from authoritative current task/execution/delivery/acceptance evidence. Execution completion alone is insufficient. New failed/running attempts and changed criteria invalidate the prior readiness; failed evidence reads cannot become manual completion. Bare/session/group routes cannot bypass configured task bindings; group rejection precedes durable message acceptance.
• The canonical task-briefing.v1 payload includes optional task-collaboration.v1: explicit collaborators, direct upstream state and filtered public deliveries with source IDs/digests/acceptance facts, plus bounded downstream references. No private history or implicit employee dispatch. Dependency excerpts are labeled untrusted data. Eight dependencies, 2-KiB excerpts and eight downstream references with explicit omission count stay within the existing 48-KiB required briefing / 64-KiB context / 256-KiB input budgets. Dependency sources share and deduplicate the existing 12-source allowance.
• The running record is saved before the model call. Terminal/restarted records retain exactly the injected canonical payload. Strict readers verify linkage, shape, bounds, source budget and excerpt digests. Retry/approval recovery retains existing plan binding and rechecks current dependencies.
• The editor captures roles/responsibilities/dependencies. Cards and schedule rows expose readiness and source navigation; current views refresh through existing events/reconnect/periodic refresh. Personal delivery and acceptance inspection retain immutable execution context, with a separate current-state view and change notice. Human acceptance remains explicit.
• Shared API types, locale strings, desktop runtime inventory, changelog and technical design are included.

Scope: executable project work items. Phase 2b reviewer dispatch, live negotiation (#452), automatic scheduling and other task stores are separate work. Recording a reviewer does not run them or grant acceptance authority.

Validation ledger

Check	Actual result
Clean dependency install, TypeScript build, updater preparation, UI/renderer type checks	Passed.
Scripts/runtime inventory	233 passed.
UI tests	53 passed.
Complete server suite	Final run: 987 passed, 4 skipped (991 tests). One earlier run hit an existing Qoder probe wall-clock bound under load; the complete final run passed without changing that test.
Complete renderer suite	Final run: all 1,262 tests across 89 files passed with the parent CI fixes. The earlier delivery-refresh assertion race is fixed in #620 by waiting for the controls to finish refreshing.
Desktop main / renderer production build	Final Vite 6.4.4 production build passed; all 570 desktop tests passed.
Security audit	Passed, 0 vulnerabilities; inherits Vite 6.4.4 fix from #620.
Patch whitespace	git diff --check passed.
Native macOS/Windows staging and installers	Repository CI pending, not claimed locally.

Local checks use Node 22.23.2 (supported by this repository); GitHub CI uses Node 24. Reproducible required stages are npm run check; local server checks use the isolated environment below because this shared root container has a narrow ephemeral-port range and DAC overrides. No host sysctls or production/test assertions were changed to accommodate it:

unshare --net sh -c 'ip link set lo up && setpriv --bounding-set=-dac_override,-dac_read_search node --test --test-concurrency=2 --test-timeout=120000 apps/server/dist/test/*.test.js'

Behavior coverage includes API/DAG rejection, old-writer omission/explicit clearing, authoritative readiness, no group/bare bypass, failed evidence reads, running/saved/injected equality, restart, newer upstream attempt blocking retry, excerpt privacy/digest checks, shared source dedup/budgets, editor persistence, source navigation, immutable-vs-current review, events and reconnect. No coverage percentage is claimed.

Browser QA

Browser plugin unavailable; used installed Playwright/Chromium with real project components and real local HTTP/SSE control-plane routes plus a deterministic driver at 1440×1050 and 480×900. Passed edit responsibilities/dependencies → complete upstream (still blocked) → human accept (unlocks via SSE) → run downstream → verify saved payload equals actual model input → navigate exact source → disconnect/reconnect after newer failed upstream → reject API bypass → inspect original/current context during human review. Exactly the two explicitly launched employees ran; recording the reviewer triggered no execution. Narrow drawer content and scroll widths both 456 px, no horizontal overflow. No unexpected browser errors; one expected 409 and the pre-existing Ant Drawer width-deprecation warning. Screenshots captured and visually inspected for desktop/narrow editor, source conversation and changed-context review. Repeated the complete browser flow against final Vite 6.4.4 after correcting the task form's inherited checkbox-label layout; passed again. This verifies product flow, not live-provider output quality.

Compatibility and rollback

Deploy matching server/renderer/IPC. Current readers retain legacy records with no collaboration snapshot; execution-time snapshots never refresh silently. Older strict readers may reject newly extended records: use pre-upgrade backups or separate workspaces when downgrading rather than deleting history. Revert code to roll back. Filtering is best-effort; digests establish consistency, not authenticity or human approval. Independent review and passing required CI are needed before merge.

Review handoff: notified 胡奕舟 on DingTalk with the PR, dependency order, review focus and validation ledger; the send-status API confirmed SUCCESS. Independent approval remains outstanding.