Coordinate code work and guarded delivery

[Codename-11]

Summary

• add one shared WorkSession lease and delivery lifecycle for Forge agents, Codex Desktop, and contributors
• reconcile native GitHub PR/check/review facts into Forge and surface active delivery work on issues and the dashboard
• add agent/MCP coordination context, stale-action handling, timestamped migrations, and a serialized exact-ref production deploy path
• align repository and Obsidian engineering/release policies

Verification

• lint and typecheck passed
• focused coordination/MCP tests: 11/11
• Vitest: 1,297 passed concurrently; the one parallel DB timing failure passed in isolation (9/9)
• production docs and Next.js build passed
• Playwright: 37/39 concurrently; both affected specs passed serially (4/4)

[chatgpt-codex-connector]

💡 Codex Review

https://github.com/Codename-11/Forge/blob/66f08a2ea0392328e974a890219d622b67c0683d//tmp/forge-219/src/server/services/mcp.ts#L7880-L7881
Enforce narrowed scopes before listing work sessions

For MCP callers that use project/label/initiative-narrowed API keys, this new read tool bypasses assertKeyScope and goes straight to listIssueWorkSessions. A sub-agent with only READ_ISSUES for one lane can pass any issue id in the workspace and see that issue's owner, branch/worktree path, and linked PR metadata, which defeats the documented ApiKey narrowing boundary. Please assert the issue scope before returning sessions.

---

https://github.com/Codename-11/Forge/blob/66f08a2ea0392328e974a890219d622b67c0683d//tmp/forge-219/src/server/services/mcp.ts#L7914-L7916
Enforce narrowed scopes before claiming work

The explicit MCP policy check only validates engagement mode and linked-agent presence; it does not apply the ApiKey projectIds/labelIds/initiativeIds narrowing that other issue mutators enforce inside their tool bodies. With a linked agent key narrowed to one project, workSessions.claim can still create a lease on an issue from another project, blocking the legitimate owner from starting work there. Add the same issue-scope assertion before calling claimWorkSession.

---

https://github.com/Codename-11/Forge/blob/66f08a2ea0392328e974a890219d622b67c0683d//tmp/forge-219/src/server/services/work-session.ts#L516-L518
Recheck heartbeat state before marking stale

If the sweep reads a quiet session and the owner heartbeats it before this transaction runs, this unconditional update still overwrites the fresh heartbeat with STALE and creates a stale action request. This can falsely block resumed work during the normal race between the 5-minute worker sweep and lease heartbeats; reapply the lastHeartbeatAt < cutoff and staleable-status predicate in the update (or skip when no row matches).

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".