Land the server-side half of the git-derived host-repo binding (#348)

docs/ide-setup.md

@@ -49,7 +49,7 @@ Pass `session_index` from `start_session` on every authenticated workflow-server
 
 That is enough. `discover` returns the live bootstrap steps (schema fetch → bind `repo` → `start_session` → `get_workflow`). Do not copy the protocol into IDE rules.
 
-Always pass `repo: "owner/repo"` on `start_session` (from the user or workspace `AGENTS.md` / `CLAUDE.md`). Agents do not special-case server topology.
+Always pass `repo: "owner/repo"` on `start_session`, derived from git via `version-control::resolve-host-repo` — the origin remote of the outermost superproject that claims the workspace checkout. The user and the workspace `AGENTS.md` / `CLAUDE.md` are fallback sources only where that derivation yields nothing: a workspace that is not a git repo, or a host with no origin remote. Agents do not special-case server topology.
 
 ## Verify
 

scripts/binding-fidelity-triage.json

@@ -1315,6 +1315,13 @@
       "verdict": "harmless",
       "rationale": "artifact-template-placeholder"
     },
+    {
+      "check": "read-resolution",
+      "site": "substrate-node-security-audit/techniques/write-report.md:90",
+      "detail": "{target_path} has no producer (declared id / $-local / workflow var / set-target)",
+      "verdict": "fix-later",
+      "rationale": "undeclared-seed"
+    },
     {
       "check": "read-resolution",
       "site": "work-package/techniques/manage-git/TECHNIQUE.md:25",

src/tools/resource-tools.ts

@@ -103,7 +103,7 @@ export function registerResourceTools(server: McpServer, config: ServerConfig):
       description:
         'Start or resume the top-level workflow session. Returns `session_index`, workflow metadata, and canonical `planning_folder_path`. ' +
         'Pass `planning_folder` as an absolute path (basename = slug). ' +
-        'Always pass `repo` as owner/repo (from the user or workspace AGENTS.md) — stored on session.json#repo. ' +
+        'Always pass `repo` as owner/repo, derived from git via `version-control::resolve-host-repo` (origin remote of the outermost claiming superproject); the user or workspace AGENTS.md is a fallback only when the workspace is not a git repo or has no origin remote. Stored on session.json#repo. ' +
         'Omit planning_folder for a transient meta bootstrap. Children use `dispatch_child`, not this tool. ' +
         '`context_mode: "persistent"` is ONLY for solo (same agent context; no worker spawn); omit/`"fresh"` for disposable workers.',
       inputSchema: z

src/tools/workflow-tools.ts

@@ -323,7 +323,7 @@ export function registerWorkflowTools(server: McpServer, config: ServerConfig):
       const lines = [
         `server: ${config.serverName}`,
         `version: ${config.serverVersion}`,
-        'repo_binding: required — pass repo: "owner/repo" on start_session (from user or workspace AGENTS.md)',
+        'repo_binding: required — pass repo: "owner/repo" on start_session, derived from git via version-control::resolve-host-repo (the origin remote of the outermost superproject that claims the workspace checkout). The user or workspace AGENTS.md is a fallback only where that derivation yields nothing: a workspace that is not a git repo, or a host with no origin remote.',
       ];
       if (bootstrapResult.success) {
         lines.push('', bootstrapResult.value.content);

src/utils/session/scope.ts

@@ -236,7 +236,9 @@ export function resolveSessionRoot(
   if (scope.mode === 'multi') {
     throw new Error(
       'start_session: repo is required when the server is bound to a projects multi-root ' +
-        '(HOST_PROJECTS_ROOT). Pass repo: "owner/repo" (from the user or workspace AGENTS.md). ' +
+        '(HOST_PROJECTS_ROOT). Pass repo: "owner/repo" derived from git via version-control::resolve-host-repo ' +
+        '(origin remote of the outermost claiming superproject); the user or workspace AGENTS.md is a fallback ' +
+        'only when the workspace is not a git repo or has no origin remote. ' +
         'Planning lives at <repo>/.engineering/artifacts/planning/ under that root.',
     );
   }

tests/e2e/__snapshots__/corpus-sha.json

@@ -1,4 +1,4 @@
 {
-  "corpusSha": "f84fe02b12f9617f401767b9b96f329d8c13225c",
+  "corpusSha": "bd9c03dfd549aa442047aae0488f7188338feb90",
   "note": "Corpus commit the committed walk snapshots were generated against. Update it in the same commit that bumps the workflows submodule and re-baselines the walk (npm run baseline:stamp)."
 }

tests/e2e/__snapshots__/snapshot.test.ts.snap

@@ -53,6 +53,7 @@ exports[`work-package walk snapshots (baseline) > [default] matches committed ba
       "stepsExecuted": [
         "announce-start",
         "detect-review-mode",
+        "derive-host-repo",
         "resolve-repo-root",
         "analyze-repo-with-gitnexus",
         "verify-signing-precondition",
@@ -484,6 +485,7 @@ exports[`work-package walk snapshots (baseline) > [elicitation-only] matches com
       "stepsExecuted": [
         "announce-start",
         "detect-review-mode",
+        "derive-host-repo",
         "resolve-repo-root",
         "analyze-repo-with-gitnexus",
         "verify-signing-precondition",
@@ -982,6 +984,7 @@ exports[`work-package walk snapshots (baseline) > [full-workflow] matches commit
       "stepsExecuted": [
         "announce-start",
         "detect-review-mode",
+        "derive-host-repo",
         "resolve-repo-root",
         "analyze-repo-with-gitnexus",
         "verify-signing-precondition",
@@ -1507,6 +1510,7 @@ exports[`work-package walk snapshots (baseline) > [research-only] matches commit
       "stepsExecuted": [
         "announce-start",
         "detect-review-mode",
+        "derive-host-repo",
         "resolve-repo-root",
         "analyze-repo-with-gitnexus",
         "verify-signing-precondition",
@@ -1978,6 +1982,7 @@ exports[`work-package walk snapshots (baseline) > [review-mode] matches committe
         "announce-derived-review-mode",
         "ingest-prior-feedback",
         "seed-review-mode-outcomes",
+        "derive-host-repo",
         "resolve-repo-root",
         "analyze-repo-with-gitnexus",
         "verify-signing-precondition",
@@ -2353,6 +2358,7 @@ exports[`work-package walk snapshots (baseline) > [skip-optional] matches commit
       "stepsExecuted": [
         "announce-start",
         "detect-review-mode",
+        "derive-host-repo",
         "resolve-repo-root",
         "analyze-repo-with-gitnexus",
         "verify-signing-precondition",

tests/reference-delivery.test.ts

@@ -219,11 +219,12 @@ describe('reference-not-repeat delivery (B1)', () => {
         expect(isUnchangedMarker(value), `expected marker for ${key}`).toBe(true);
       }
       expect(isUnchangedMarker(second.bundle['rules'])).toBe(true);
-      // The activity body itself is still delivered. (`work-package` declares only
-      // orchestrator-scoped `rules.workflow`, so it carries no inherited `activity_rules`
-      // block — that collapse is covered below against a workflow that declares them.)
+      // The activity body itself is still delivered. (`work-package` declares an
+      // activity-scoped rules bucket alongside its orchestrator-scoped `rules.workflow`, so
+      // `start-work-package` carries an inherited `activity_rules` block; on a byte-identical
+      // refetch that block collapses to a marker just like the technique bundle above.)
       const secondBody = parse(second.bodyText) as Record<string, unknown>;
-      expect(secondBody['activity_rules']).toBeUndefined();
+      expect(isUnchangedMarker(secondBody['activity_rules'])).toBe(true);
       expect(secondBody['id']).toBe('start-work-package');
       expect(secondBody['steps']).toBeDefined();