feat(orchestrator): supervise unfinished assignments with bounded continuation checks

[ddonathan]

Problem

Ordinary assignments can stop between turns while authorized work remains. The user must reopen threads and repeatedly ask the agent to keep going; a completed batch can also be mistaken for completing the assignment.

Change

Add durable, bounded supervision of an existing human request, with explicit whole-assignment disposition and verified task/PR waits. An environment setting, off by default, automatically enrolls accepted human root turns with three checks. A new assignment after completion gets a fresh generation; active, paused, blocked, exhausted, and opted-out records retain their limits. Queued human assignments enroll on promotion. Human controls own durable opt-out; MCP cannot clear it. Web and mobile expose the setting and per-thread controls, including the web sidebar.

The stack also exposes native goal state through MCP and preserves initial shared-session recovery state across restart. Optional wire fields retain older-client compatibility. No native goal is inferred or created.

Scope and approval

This is a draft in Dan's fork for review and local trials. Broader upstream execution-policy direction still requires maintainer approval; this draft does not establish upstream readiness. The focused native-goal MCP contribution is upstream PR18513. The hidden-child Input fix PR18493 is retained in runtime builds separately.

Verification

• Focused runtime, command provenance, real MCP-service, and contract tests: 219 passed on the feature checkout and the pinned Windows nightly adaptation.
• Actual MCP-preferences probe confirms it cannot enable the environment setting. A disposable negative control removing the human-source guard failed the intended assertion.
• Scoped server, web, and mobile types and targeted formatting/lint passed. Existing lint warnings remain.
• Isolated T3 browser: setting starts off, saves on, remains on after reload; sidebar Disable persists the opt-out on an unenrolled thread. Final sidebar authority selection waits for live data and fails closed on a bounded timeout.
• Source reviews found and resolved complete rearm, queued promotion, predecessor reporting, MCP opt-out, and sidebar entry-point gaps.

Native mobile/desktop runtime checks and GitHub-uploaded UI evidence remain pending. The updated automatic-enrollment version is not installed on SQL; its custom-build startup/update preservation is still being prepared. Capacity-error retry is a newly requested follow-up and is not implemented in this diff.

Implemented with GPT-6.1-Sol in the Codex harness; independent source reviews used Claude Opus 5.5 through T3 Code.

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for 6d29b51.

This comment will update automatically after the next completed run.