Preserve chat recovery and unify cancellation

[mzxchandra]

Summary

An admitted chat execution must retain its original identity and payer when the chat's current ownership representation changes. Bind authenticated callbacks to the exact actor, chat and original run, then separately authorize current chat and target access. Recovery uses the saved original billing admission. Personal chat authority is narrowly available to internal execution operations.

Add copilot_run_stops keyed only by user and stream. Stop/admission and orphan handling read unified plus applicable legacy intent; writes preserve legacy readers atomically. Remove only the run's workflow/workspace source foreign keys while retaining source IDs/indexes and chat/user/organization ownership cascades.

This PR provides chat recovery and cancellation compatibility. Existing canonical creation/new-turn activation, attachments, retention, ownership conversion and historical backfill are outside this PR. Companion worker compatibility: simstudioai/mothership#735.

Merge prerequisite: human-subject delegation unification must land first. Preserve this execution/Stop slice, then rebase its own changes onto refreshed staging, adapt to the settled principal contract, and rerun focused validation and hosted CI. Current evidence applies to the present commit; it does not validate the future integration.

Review order

Topic	Invariant
Schema and Stop	Actor/stream intent survives owner representation changes; early Stop closes later admission; applicable legacy readers remain supported.
Callback authority	Optional execution correlation identifies original admission; current membership and explicit targets remain separately authorized. The original scope bounds discovery, target grants, catalogs and workflow status; current access can narrow it. Conflicting identity is rejected.
Recovery and billing	Controller recovery preserves saved scope, billing request and attribution; missing or inconsistent admission fails before takeover.
Internal personal plumbing	Narrow chat authority cannot become a generic workspace upload/workflow grant. Public activation is deferred.

The migration is schema-only: one empty table plus two source-FK removals, with native user FK/PK and the existing migration runner. No row backfill or redundant preflight scan. Source deletion still follows owning chat/user/organization lifecycle; retaining provenance is not target access. Legacy Stop tables remain for compatibility. Later canonical activation requires the agreed compatible app/worker deployment and drain checks.

Testing

Latest remediation commit 35aaaa9c3f: 29 focused PostgreSQL/Redis integration tests passed using versioned migrations. Twelve independently injected regressions failed for the intended reasons, then all faults were restored: target/catalog scope widening, current access revocation, actual CLI execution correlation, forced Stop/admission ordering, transactional legacy-write failure, and source-deletion retention. The CLI path also rejects mismatched and unknown run correlation. Focused source/test types and targeted audits passed. Full hosted checks for this commit passed; prior green CI below is historical.

The combined real-model test passed for a crash after the initial user message was durable: a synthetic ownership change from workspace X to organization B, actual worker termination/restart and natural lease recovery, new successful workspace/member tool calls, and persisted browser output. Original X remained accessible, Y was denied, and a subsequent role downgrade plus explicit X revocation denied access; roles/grants were restored. Billing-enabled callbacks retained the distinct original payer A, left B's ledger unchanged, and rejected a duplicate callback without changing the usage ledger. This proves recorded usage accounting, not payment collection.

The original browser's complete answer and idle composer were visually verified in its trace/screenshot. Its exact-text completion locator timed out because the rendered marker had trailing markdown; that automated failure is retained, and reload/access checks passed separately. Extra model CLI attempts were refused. The initial Sim snapshot preceded normal billing-admission persistence; the original run identity and other saved fields were unchanged, and the saved billing admission matched the worker's immutable envelope.

An earlier crash window remains open: after worker admission but before its first conversation input is durable, recovery returns nothing_to_continue. That failure is preserved and requires a separately reviewed worker storage decision; no new storage has been implemented. The later-boundary pass does not close it. Ownership transitions here are synthetic disposable-data setup, not supported product transfer or canonical activation. Deployed staging and disabled approval flows remain untested.

Earlier validation:

• 64 focused PostgreSQL/Redis tests passed with INTEGRATION_DB_PROVISION=migrate: Stop/admission races, removal, orphan settlement, original admission and source deletion/history preservation.
• 30 focused recovery/original-admission/abandoned-run integration checks passed, including real reconnect preserving original billing after workspace-to-personal representation change.
• 48 focused callback/recovery tests passed; final 50-test boundary/auth/memory pass includes continuation Build permission, transient-principal serialization and early-Stop admission race coverage. These suites overlap; counts are not additive.
• 16 paired checks passed using actual worker direct calls/Redis control envelopes and Sim production handlers: personal/original control, notes, memory scope, mismatched identity and Stop. Synthetic org-to-personal fixtures prove authorization binding only, not a supported product transition.
• Focused source TypeScript, changed-file Biome, migration safety and diff checks passed. Repeat Drizzle generation reports no changes. Full hosted CI passed on commit 4163b52766 (run), including lint, types, unit/integration tests, builds and desktop/mobile E2E.

Actual local Chromium testing with both current PR heads passed session/start/response persistence, history reload, Stop with both persisted intents, active reconnect without duplicate admission, and denied-actor access. That deterministic matrix used a scripted model endpoint through the actual worker SDK; it is separate from real-provider testing and deployed verification. Approval was not exercised because the existing flag is disabled.

A separate real-provider browser pass with Google native gemini-3.8-flash passed streamed response/persistence, reload with contextual follow-up, verified read-only workspace/member CLI results, Stop during generation, and active-run reload/reconnect. Actual app/worker paths and stored outcomes were checked. Invalid model CLI argument attempts were refused before successful authorized reads. Local billing was disabled, so this does not prove charged billing.

Additional actual-browser lifecycle checks passed immediate reload after Stop and recovery after terminating/restarting the local worker, with the same run, saved request context and immutable worker admission hash; the worker lease advanced once and the run completed. The crash test used normal lease/sweeper timing and a deterministic provider; no database timestamps were altered.

Deployed staging verification is NOT RUN. The private before/after plan requires old-release legacy Stop/recovery fixtures and release/schema evidence before rollout; fixture setup is blocked on the coordinated workspace selection. Local paired proof is not staging or production readiness. No merge, deployment, rollback, flag change or live mutation performed.

Type of Change

• Bug fix
• Other: execution compatibility and schema expansion

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Focused tests added/updated and passing
• Full hosted CI completed on latest remediation commit
• Deployed staging before/after verification completed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 18, 2026 10:34pm UTC