Carry exact predecessor content through producing assignment grants

[adrianwebb]

Outcome

Generated reviews can inspect the exact TreeDX actor candidate without ambient or inferred authority.

Work authority

• Work item / Issue: Implement the minimal AgentKernel, profile, and workday architecture platform#520
• Proposal / decision: N/A — operator-requested allocation acceptance repair, not a golden deliverable.
• Assignment / checkpoint: stopped diagnostic SDK workday 4704cd25-4a95-4cf3-9790-6ba22791403f; no golden lifecycle accepted
• Actor: Codex
• Human authority: @adrianwebb
• Agent / capacity provider: operator Codex task; dev2 managed acceptance
• Exact base ref: staging 60d1200
• Exact head ref: 58f6cf9

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Repair the observed acceptance failure through the existing runtime path. Local verification complete; merge after required Actions, then verify managed local recovery. No tags or releases.

Changes and commits

58f6cf9: Read the existing producing assignment grant alongside its immutable result. Bind model/id from that grant and commit/path from the actual returned reference; do not infer models or grant unmarked paths. Reuse the existing context/grant/materialization path.

Verification

16 focused ready-node/review-result tests; supported strict build and file policies pass. Book/Knowledge positive and wrong-path negative cases covered.

• I ran the narrowest relevant package verification and documented any checks that could not be run.

Risk and rollback

No database, credential or contract migration. Revert 58f6cf9 through a PR and rebuild the same managed live target. No purge or bootstrap reinstall.

Completion summary

Bounded repair verified locally. Integrated golden lifecycles remain unproven and are not claimed as complete by this PR.

AGPL committer authorization

Base-owned workflow retains provider-authenticated author authorization.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.