feat(workspace): add provenance-aware collaboration

[luokerenx4]

Outcome

Internal Workspace agents can ask who was responsible for an Inbox entry, Issue occurrence, report revision, or UTA decision through an embedded CLI. One resolver enforces three honest outcomes:

• exact: resume the attributable product Session
• reconstructed: recruit or continue a reconstruction analyst in the known Workspace without impersonating the author
• unavailable: preserve a known-but-unresumable attribution or reject a target with no safe Workspace

Design

• typed targets: resume, workspace, inbox, issue, report, trade-decision
• provenance lookup precedes every artifact follow-up
• exact Sessions use their registry-bound runtime and cannot be overridden
• fresh reconstruction uses the configured Workspace runtime unless explicitly selected
• first reconstruction appends a reconstructed provenance occurrence
• later questions reuse that reconstruction Session while keeping mode reconstructed
• asynchronous ask returns taskId; read returns normalized assistant text, compact tool/error activity, lineage, and the real runtime status
• no public HTTP loop and no native runtime session ids

Real workflow validation

Exact Issue creator follow-up:

• target provenance-visibility-smoke
• resolved resumeId=d13e11d5-2c84-4942-994a-c66e5e2c12eb
• child task linked to parent cfd5634b-3f08-4a28-8cbe-6d018c9b1fd2
• recovered the old-context answer RESUME_CHAIN_CODEX_1783761853101
• Codex suffered TLS reconnects and ended failed with usable assistantText; read preserved both answer and errors

Reconstruction continuity:

• missing-origin report created resume-simple-indigo-garden-h4ah4f
• the first prompt exposed overly broad evidence searching and timed out; reconstruction prompt was narrowed to inspect only evidence needed
• the second ask resolved reason=prior-reconstruction, reused the same resumeId, linked to the first task, and returned SECOND in 4.2s with no tools
• an unknown direct resume returned unavailable/missing-session without dispatch

Verification

• root and UI strict TypeScript checks
• full suite: 221 files passed, 1 skipped; 2586 tests passed, 6 skipped
• full pnpm build
• real embedded alice-workspace conversation ask/read exact, reconstructed, repeated-reconstruction, and unavailable paths

Scope

This supersedes the resolver assumptions in draft #528 while reusing its sound embedded dispatch/read shape. It does not change Quick Chat, broker execution, approval policy, or public API routing.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openalice-demo	Ready	Preview, Comment	Jul 11, 2026 3:38pm