Orchestration v2: Pi steering, completion notices, limited chats, native forks

.github/workflows/ui-tests.yml

@@ -53,15 +53,32 @@ jobs:
         run: |
           cargo test --locked -p roboco-harness --lib opencode::
           cargo test --locked -p roboco-harness --test opencode
+      - name: Codex native driver integration tests
+        # t3-orchestration-v2 ticket 17: the fake app-server suite covers
+        # the native fork (thread/fork + fallback paste) and provider turn
+        # refs; it was previously not run by any workflow.
+        run: cargo test --locked -p roboco-harness --test codex
+      - name: Claude native driver integration tests
+        # t3-orchestration-v2 ticket 18: the fake-CLI suite covers the
+        # native fork (--resume + --fork-session + --resume-session-at, the
+        # refused-flag and missing-session budgeted pastes) and provider
+        # turn refs (message uuids); it was previously not run by any
+        # workflow (unix-gated like the fake CLI itself).
+        run: cargo test --locked -p roboco-harness --test claude
       - name: Pi native driver integration tests
         run: |
           cargo test --locked -p roboco-harness --test pi
-          cargo test --locked -p roboco-engine --test pi_resume
+          cargo test --locked -p roboco-engine --test pi_resume --test pi_steering --test pi_forks
       - name: Engine-local storage and recovery
         run: |
           cargo test --locked -p roboco-sync --lib
           cargo test --locked -p roboco-update --lib
-          cargo test --locked -p roboco-engine --lib --test engine_local --test restart_resume --test codex_subagents --test local_profiles --test project_actions_rpc --test project_action_commands --test project_actions_remote --test remote_settings
+          # t3-orchestration-v2 ticket 23: the Roboco MCP tool tests (the
+          # fork_chat seam). The crate's unit tests were previously not run
+          # by any workflow.
+          cargo test --locked -p roboco-mcp
+          cargo test --locked -p roboco-engine --lib --test account_failover --test account_sign_in_state --test agent_origin --test codex_subagents --test completion_notices --test continue_on_harness --test engine_local --test harness_switch --test limited_chats --test local_profiles --test project_action_commands --test project_actions_remote --test project_actions_rpc --test remote_settings --test restart_resume --test resume_at_reset --test side_chats
+
 
   # Mobile Rust core (spec D1, android-app#02): the crates the Android app's
   # Kotlin painter leans on. Pure Rust, no GPUI system deps.

.scratch/upstream-ports-2026-10-wave4/issues/30-pi-native-driver-parity-review.md

@@ -167,6 +167,20 @@ Verification: reading + `git show` only (ticket 30's budget); no code
 changed, no cargo. Test execution deferred to the wave-final batched pass
 (user directive) — nothing here to execute.
 
+- **Reversal (2026-10-16, orchestration v2 ticket 03 —
+  `.scratch/t3-orchestration-v2/issues/03-pi-steers-mid-turn.md`):** items
+  8 and 9 above are superseded. The T3 study measured that our
+  TurnBoundary classification held every message sent to a working Pi chat
+  in the engine queue until `agent_settled` — "our steering rides pi's own
+  steer queue" was true on the wire and false in delivery. Ticket 02
+  already moved the driver to upstream's `prompt` +
+  `streamingBehavior: "steer"` shape; ticket 03 flips the declaration and
+  the registry descriptor to `StepBoundary` together, selects steering
+  mode `"all"` at session start unless the user configured one (upstream
+  #630's overwrite guard now fully applies), and covers both with tests
+  (fixture `set_steering_mode` handling, an engine-level pi steering test
+  driving the real queue/steer flow).
+
 - Wave-final batched verification (2026-10-03, merged main `cf94f415`): one
   batched pass over all lanes — ui lib 1521/1521; engine 529/530 (the one
   failure is the documented pre-existing

CONTEXT.md

@@ -44,10 +44,27 @@ _Avoid_: API version, app version (that is `version`)
 The durable conversation and work history with a harness. Owns its transcript, configuration, and message queue; survives harness restarts.
 _Avoid_: Conversation, thread, session (when it means the chat)
 
+**Side chat**:
+A chat with a parent chat: forked from it in the UI, opened blank next to it, or created by its agent through the Roboco MCP tools. Agent-created side chats record their creator; user-created ones never notify it. Lists under the parent instead of the sidebar's main list.
+_Avoid_: Child chat, subagent (that is a harness-spawned agent inside a run)
+
+**Completion notice**:
+The engine-authored system message that tells an agent-created side chat's creator how a turn it started ended: finished, failed (one-line reason), stopped, interrupted (lost to an engine restart without auto-resume), or waiting for input. One merged notice per delivery; it points the parent at `read_chat` rather than carrying the side chat's output. Outcomes the parent already observed (through `wait_for_turn`, a send with wait, `read_chat` or `get_chat`) owe no notice; stopping the parent drops the notices owed to it; at most 25 consecutive notice-started turns may run without a user message in between — past the cap, notices park in the parent's queue, paused, until the user acts.
+_Avoid_: Report, callback, acknowledgement
+
 **Chat status**:
 A chat's live run state: idle, working, awaiting input, or errored.
 _Avoid_: Session, state (when it means chat status)
 
+**Limited**:
+An errored chat whose last run ended on a harness usage limit — the additive limit record (harness, window, reset time, account) on its status row. Offers Resume, Resume at reset, Resume on another account, and Continue on another harness (a one-way harness switch followed by the same continue prompt); queued messages wait behind the continuation. Not a separate wire status: the chat stays errored.
+
+_Avoid_: Rate-limited (that is the harness event), throttled, capped
+
+**Resume at reset**:
+A pending continuation the engine owns for a Limited chat: at the limit's reset time it sends the continue prompt like a manual Resume. Durable across engine restarts (an overdue one fires after boot); cancelled by a new message, archive, or delete. Armed by the banner action or the "Auto-resume limited chats" engine setting.
+_Avoid_: Scheduled task, retry, snooze
+
 **Chat doc**:
 The chat's durable document — transcript, command ledger, and message queue in one doc, owned by the engine.
 _Avoid_: Session doc
@@ -80,6 +97,10 @@ _Avoid_: Message (a command is not a message), request
 A user message waiting in the chat's queue, optionally held until the turn ends, delivered in order.
 _Avoid_: Draft, pending message
 
+**Harness switch**:
+A one-way switch of an existing chat to another harness between turns: the engine records a "Switched to <harness>" seam in the transcript, drops the chat's harness session, and the next send starts a fresh session carrying the budgeted history of everything above the seam. Switching back is another switch, never a resume.
+_Avoid_: Harness handoff, migration, resume (the old session is dropped, not resumed)
+
 ## Harnesses
 
 **Harness**:

crates/doc/src/commands.rs

@@ -91,6 +91,12 @@ pub struct SessionCommandEntry {
     pub status: SessionCommandStatus,
     #[serde(default)]
     pub resolution: Option<String>,
+    /// The chat this Run/Steer was sent BY through the Roboco MCP server —
+    /// structured attribution (additive; ADR 0005). None for user-typed
+    /// sends and for rows written before the field existed. Executing it
+    /// stamps the same origin on the user message entry it writes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub origin_chat_id: Option<String>,
 }
 
 impl SessionCommandEntry {
@@ -187,6 +193,7 @@ mod tests {
             expires_at: None,
             status: SessionCommandStatus::Pending,
             resolution: None,
+            origin_chat_id: None,
         }
     }
 
@@ -348,6 +355,39 @@ mod tests {
         assert!(!can_composer_cancel(&applied, "device-a"));
     }
 
+    #[test]
+    fn run_and_steer_entries_carry_their_origin_chat_additively() {
+        for payload in [
+            SessionCommandPayload::Run {
+                request: run_request(),
+                message_id: "m1".into(),
+            },
+            SessionCommandPayload::Steer {
+                prompt: "go".into(),
+                message_id: Some("m2".into()),
+            },
+        ] {
+            let sent = SessionCommandEntry {
+                origin_chat_id: Some("chat-origin-1".into()),
+                ..entry("c1", payload, 1_000)
+            };
+            let value = serde_json::to_value(&sent).unwrap();
+            assert_eq!(value["originChatId"], "chat-origin-1", "{value}");
+            assert_eq!(
+                serde_json::from_value::<SessionCommandEntry>(value).unwrap(),
+                sent
+            );
+        }
+        // Rows from older writers (and user-typed sends) carry no origin.
+        let plain = steer("c1", 1_000);
+        let value = serde_json::to_value(&plain).unwrap();
+        assert!(value.get("originChatId").is_none());
+        assert_eq!(
+            serde_json::from_value::<SessionCommandEntry>(value).unwrap(),
+            plain
+        );
+    }
+
     fn run_request() -> RunRequest {
         RunRequest {
             prompt: "hello".into(),
@@ -362,6 +402,8 @@ mod tests {
             worktree: None,
             mcp: None,
             resume: None,
+            provider_fork: None,
+            resume_fallback_history: None,
         }
     }
 }

crates/doc/src/parts.rs

@@ -6,7 +6,7 @@
 use serde::{Deserialize, Serialize};
 use ts_rs::TS;
 
-use roboco_proto::{AgentEvent, SUBAGENT_INPUT_KEEP, ToolCall, ToolDiff, UserInputQuestion};
+use roboco_proto::{AgentEvent, HarnessId, SUBAGENT_INPUT_KEEP, ToolCall, ToolDiff, UserInputQuestion};
 
 use crate::constants::MSG_INLINE_MAX;
 
@@ -120,6 +120,57 @@ pub enum SubagentStatus {
     Failed,
 }
 
+/// What the engine recorded when a notifiable side-chat turn came to rest
+/// (orchestration v2). The outcome of one row of a completion notice.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum NoticeOutcome {
+    Completed,
+    Errored,
+    Stopped,
+    /// The run was lost to an engine restart without auto-resume (ticket
+    /// 13): the work never finished — distinct from a stop, which the
+    /// user chose.
+    Interrupted,
+    WaitingForInput,
+}
+
+impl NoticeOutcome {
+    /// The outcome's verb phrase — the ONE vocabulary the engine's notice
+    /// text (`"title" (id) <verb>`) and every client's notice card share, so
+    /// the card and the prose an agent reads never drift (the web mirrors
+    /// it in `noticeOutcomeVerb`).
+    pub fn verb(self) -> &'static str {
+        match self {
+            Self::Completed => "finished",
+            Self::Errored => "failed",
+            Self::Stopped => "was stopped",
+            Self::Interrupted => "was interrupted",
+            Self::WaitingForInput => "is waiting for input",
+        }
+    }
+}
+
+/// One side chat a completion notice reports: its id and title, the
+/// recorded outcome, and the one-line reason (error text, restart reason or
+/// question summary) when the outcome carries one.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct NoticeSide {
+    /// The side chat's full id — clients open the chat with it; the notice's
+    /// text names the short form.
+    pub chat_id: String,
+    /// The side chat's title as of the notice, so the transcript reads it
+    /// without a registry lookup (a later rename never rewrites history).
+    pub title: String,
+    pub outcome: NoticeOutcome,
+    /// The one-line detail for errored (reason), interrupted (restart
+    /// reason) and waiting-for-input (question summary) rows; absent
+    /// otherwise.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub detail: Option<String>,
+}
+
 /// One rendered part of an assistant message.
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
 #[serde(tag = "kind", rename_all = "camelCase")]
@@ -219,6 +270,39 @@ pub enum MessagePart {
         /// source does not rewrite history.
         source_title: String,
     },
+    /// The seam a one-way harness switch leaves in a chat's transcript
+    /// (t3-orchestration-v2 ticket 24): everything above ran on another
+    /// harness whose provider session the switch dropped; the next send on
+    /// `harness` carries the budgeted history of everything above. Written
+    /// once per switch by the engine; renders as a "Switched to <harness>"
+    /// divider. Old desktop builds' unknown-kind fallback yields an empty
+    /// text part (invisible). There is no switch BACK: returning to the old
+    /// harness is just another one-way switch.
+    #[serde(rename_all = "camelCase")]
+    HarnessSwitch {
+        id: String,
+        /// The harness the chat switched TO (wire name, e.g. "codex").
+        harness: HarnessId,
+    },
+    /// The engine's completion notice (orchestration v2): an engine-authored
+    /// SYSTEM entry in a parent chat reporting the recorded outcomes of its
+    /// agent-created side chats' turns — finished, failed (one-line reason),
+    /// stopped, interrupted by an engine restart without auto-resume, or
+    /// waiting for input (one-line summary). The entry's sibling
+    /// text part carries the same notice as plain text, so older layouts —
+    /// whose unknown-kind fallback yields an empty part — stay readable.
+    /// Written only by the engine when it delivers a notice; never a user
+    /// message, never agent content.
+    #[serde(rename_all = "camelCase")]
+    CompletionNotice {
+        id: String,
+        /// One row per side chat the notice reports (a single outcome when
+        /// one side chat finished; several when outcomes merged — ticket 13).
+        /// Defaults for leniency: a partial row reads as an empty notice
+        /// rather than a decode failure.
+        #[serde(default)]
+        sides: Vec<NoticeSide>,
+    },
 }
 
 impl MessagePart {
@@ -230,7 +314,9 @@ impl MessagePart {
             | MessagePart::Tool { id, .. }
             | MessagePart::Input { id, .. }
             | MessagePart::Error { id, .. }
-            | MessagePart::Fork { id, .. } => id,
+            | MessagePart::Fork { id, .. }
+            | MessagePart::HarnessSwitch { id, .. }
+            | MessagePart::CompletionNotice { id, .. } => id,
         }
     }
 
@@ -268,6 +354,19 @@ impl MessagePart {
                 source_title,
                 ..
             } => source_chat_id.len() + source_title.len(),
+            MessagePart::HarnessSwitch { harness, .. } => {
+                // Fixed-size structure (the wire name): never grows, so it
+                // never drives a continuation split.
+                serde_json::to_vec(harness).map_or(0, |v| v.len())
+            }
+            MessagePart::CompletionNotice { sides, .. } => sides
+                .iter()
+                .map(|side| {
+                    side.chat_id.len()
+                        + side.title.len()
+                        + side.detail.as_ref().map_or(0, String::len)
+                })
+                .sum(),
         }
     }
 }
@@ -424,7 +523,7 @@ pub fn fold_event_into_parts(out: &mut Vec<MessagePart>, event: &AgentEvent) {
                 }
             }
         }
-        AgentEvent::Error { message } => {
+        AgentEvent::Error { message, .. } => {
             let id = format!("e{}", out.len());
             out.push(MessagePart::Error {
                 id,
@@ -496,11 +595,15 @@ pub fn fold_event_into_parts(out: &mut Vec<MessagePart>, event: &AgentEvent) {
         // AvailableCommands feeds the engine's per-harness command cache, not
         // the transcript. UserMessage becomes its own doc ENTRY (the engine's
         // subagent sink writes it), never a part of the assistant message.
+        // TurnRef names the provider turn the streaming entry belongs to —
+        // engine bookkeeping (stamped when the segment finishes), never a
+        // rendered part.
         AgentEvent::AssistantMessageCompleted { .. }
         | AgentEvent::Usage { .. }
         | AgentEvent::ContextUsage { .. }
         | AgentEvent::AvailableCommands { .. }
-        | AgentEvent::UserMessage { .. } => {}
+        | AgentEvent::UserMessage { .. }
+        | AgentEvent::TurnRef { .. } => {}
     }
 }