feat(hub,adr-030): permission_prompt re-addressing to parent steward (W10, v1.0.683-alpha)

ADR-030 Phase 1 W10 — re-address permission_prompt rows raised by
steward-parented workers. When a worker has a same-project steward
parent, the row lands assigned_tier='project-steward' +
current_assignees_json=[<parent_id>] so the parent steward sees it
in their inbox first. Otherwise the row stays team-wide-addressed
(existing behaviour preserved for orphan workers, non-steward
parents, and binding-drift cases).

mcp_more.go::permissionPromptAddressee:
- Single SQL JOIN with the strict three-clause predicate per
  ADR-030 pre-W1 decision #3:
    worker.parent_agent_id IS NOT NULL
    AND parent.kind LIKE 'steward.%'
    AND parent.project_id IS NOT NULL AND = worker.project_id
- Two IS NOT NULL guards defend against SQL's NULL=NULL → NULL
  semantics (without them, two unbound rows would accidentally
  match)
- Best-effort: DB errors log a warn + return '' so transient
  issues degrade to safe (team-wide)

mcpPermissionPrompt:
- Calls the helper before the INSERT
- When steward_id returned: stamps assigned_tier='project-steward'
  + current_assignees_json=[<steward_id>]
- Otherwise: leaves assignees='[]' and assigned_tier=NULL
- INSERT widened to include assigned_tier (the ADR-030 W1 column
  previously written only by the propose path)

Tests (6 in mcp_permission_prompt_addressing_test.go):
- same-project steward parent → row addressed to parent
- cross-project steward parent (binding drift) → stays team-wide
  (load-bearing regression for v1.0.605-class bug)
- non-steward parent → stays team-wide
- orphan worker (no parent) → stays team-wide
- NULL project_ids both sides → stays team-wide (NULL=NULL guard)
- direct helper test: ghost worker returns ''

Existing TestDecide_PermissionPromptFansOutAttentionReply still
passes — dispatchAttentionReply is untouched. The new addressing
only affects which inbox surfaces the row first; the fan-back
still routes by session_id.

Test fixture note: Write tool is TierRoutine (auto-allow), so
tests use Task (TierSignificant) so the gate doesn't short-circuit
before the INSERT. ctx timeout 100ms so the call returns
ctx-cancelled shortly after the INSERT lands.

Plan W10 rewritten to document the helper shape, 5-conjunct
JOIN, and 6-test coverage. New verify symbol anchor on
permissionPromptAddressee → 23 anchors total.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Ubuntu

docs/changelog.md

@@ -3,7 +3,7 @@
 > **Type:** reference
 > **Status:** Current (2026-05-24)
 > **Audience:** contributors, operators
-> **Last verified vs code:** v1.0.682
+> **Last verified vs code:** v1.0.683
 
 **TL;DR.** Append-only record of what shipped in each tagged release.
 One section per version, newest first. Format follows
@@ -23,6 +23,76 @@ binding). Seed entries prior to that are in
 
 ---
 
+## v1.0.683-alpha — 2026-05-24
+
+ADR-030 Phase 1 W10 — re-address `permission_prompt` rows raised by
+steward-parented workers. When a worker has a same-project steward
+parent, the row lands `assigned_tier='project-steward'` +
+`current_assignees_json=[<parent_id>]` so the parent steward sees
+it in their inbox first. Otherwise the row stays team-wide-addressed
+(existing behaviour preserved for orphan workers, non-steward
+parents, and binding-drift cases).
+
+### Added
+
+- `hub/internal/server/mcp_more.go::permissionPromptAddressee` —
+  new helper. Single SQL JOIN with the strict three-clause
+  predicate per ADR-030 pre-W1 decision #3:
+  ```
+  worker.parent_agent_id IS NOT NULL
+  AND parent.kind LIKE 'steward.%'
+  AND parent.project_id IS NOT NULL AND = worker.project_id
+  ```
+  Two `IS NOT NULL` guards defend against SQL's
+  `NULL = NULL → NULL` semantics. Best-effort: DB errors log
+  a warn + return "" so transient issues degrade to safe
+  (team-wide addressing).
+- `mcpPermissionPrompt` calls the helper before the row INSERT
+  and stamps `assigned_tier` + `current_assignees_json`
+  accordingly. The INSERT statement was widened to include
+  `assigned_tier` (the ADR-030 W1 column previously written
+  only by the propose path).
+- `hub/internal/server/mcp_permission_prompt_addressing_test.go`
+  — 6 cases: same-project steward parent addresses row;
+  cross-project steward parent (binding drift) stays
+  team-wide; non-steward parent stays team-wide; orphan
+  worker stays team-wide; NULL project_ids on both sides
+  stay team-wide (NULL=NULL guard); direct helper test
+  against ghost worker returns "".
+
+### Changed
+
+- `pubspec.yaml` 1.0.682 → 1.0.683-alpha.
+- `docs/decisions/030-governed-actions-and-propose-verb.md` +
+  `docs/plans/governed-actions-mvp-rollout.md` — stamps bumped to
+  v1.0.683. Plan W10 rewritten to document the helper shape, the
+  5-conjunct SQL JOIN, and the 6-test coverage breakdown. New
+  verify symbol anchor on `permissionPromptAddressee` → 23
+  anchors total now, all green.
+
+### Notes
+
+- **`dispatchAttentionReply` unchanged.** Fan-back still
+  addresses by `session_id`; the new addressing only affects
+  which inbox surfaces the row first. Existing
+  `TestDecide_PermissionPromptFansOutAttentionReply` passes
+  unchanged.
+- **Binding-drift guard is the load-bearing clause.** Without
+  the `p.project_id = w.project_id` check, a v1.0.605-class
+  bug where the parent-id pointer survives but the project
+  binding has drifted would route the row to a steward that
+  no longer owns the worker. Test 2
+  (`CrossProjectStewardParent_StaysTeamWide`) is the
+  regression for that scenario.
+- **Principal-override of permission_prompt deferred.** W9
+  ships override against propose-kind rows;
+  permission_prompt isn't a propose kind. Widening
+  `handleAttentionOverride` to handle it would require
+  per-engine-driver coordination (codex parked-RPC, etc.).
+  Tracked as a follow-up.
+
+---
+
 ## v1.0.682-alpha — 2026-05-24
 
 ADR-030 Phase 1 W9 — principal override. The most complex wedge in

docs/decisions/030-governed-actions-and-propose-verb.md

@@ -14,7 +14,7 @@ description: Generalise apply-on-approve to a single MCP verb `propose(kind, tar
 > Option 2′; reconciliations with ADR-032 + ADR-034; principal vs
 > owner; line-ref drift fixed).
 > **Audience:** contributors
-> **Last verified vs code:** v1.0.682-alpha
+> **Last verified vs code:** v1.0.683-alpha
 > **Freshness:** contract
 
 **TL;DR.** Promote *apply-on-approve* from two bespoke branches

docs/plans/governed-actions-mvp-rollout.md

@@ -13,7 +13,7 @@ description: Wedge-by-wedge execution plan for ADR-030 — generic `propose` MCP
 > overlap; principal ≠ owner) and fix file/line drift from
 > v1.0.620-636.
 > **Audience:** contributors
-> **Last verified vs code:** v1.0.682-alpha
+> **Last verified vs code:** v1.0.683-alpha
 > **Freshness:** contract
 
 **TL;DR.** Close the "approve isn't load-bearing enough" gap by
@@ -526,45 +526,59 @@ decisions_json regardless of the incoming Decision —
 callers may pass `decision="approve"` + `override=true`
 just as legibly as `decision="override"` + `override=true`.
 
-**W10. `worker_tool_call.escalate` — re-address `permission_prompt` rows raised by steward-parented workers (~90 LOC + 70 LOC tests).**
+**W10. `worker_tool_call.escalate` — re-address `permission_prompt` rows raised by steward-parented workers (~70 LOC + ~190 LOC tests). Shipped v1.0.683-alpha.**
 
 - `hub/internal/server/mcp_more.go` `mcpPermissionPrompt` <!-- verify symbol hub/internal/server/mcp_more.go mcpPermissionPrompt -->
-  (~line 687, function declared at `mcp_more.go:687` as of v1.0.636):
-  after creating the attention row, check
-  `agents.parent_agent_id` of the requesting agent.
-- **Strict same-project parent-steward predicate** (per
-  2026-05-20 pre-W1 decision #3). All three clauses must hold or
-  the row stays team-wide-addressed:
-  ```
-  worker.parent_agent_id IS NOT NULL
-  AND parent_agent.kind LIKE 'steward.%'        (kind-based — v1.0.607)
-  AND parent_agent.project_id = worker.project_id
+  — extended to call the new `permissionPromptAddressee` helper
+  <!-- verify symbol hub/internal/server/mcp_more.go permissionPromptAddressee -->
+  before the row INSERT. When the helper returns a non-empty
+  steward_id, the INSERT writes
+  `current_assignees_json = [<steward_id>]` AND
+  `assigned_tier = 'project-steward'`. Otherwise the row stays
+  team-wide-addressed (`assignees='[]'`, `assigned_tier=NULL`).
+- **Strict same-project parent-steward predicate** shipped as
+  one SQL JOIN with five conjuncts (per 2026-05-20 pre-W1
+  decision #3):
+  ```sql
+  SELECT p.id
+  FROM agents w
+  JOIN agents p ON p.id = w.parent_agent_id
+  WHERE w.team_id = ?
+    AND w.id = ?
+    AND w.parent_agent_id IS NOT NULL
+    AND p.kind LIKE 'steward.%'
+    AND p.project_id IS NOT NULL
+    AND w.project_id IS NOT NULL
+    AND p.project_id = w.project_id
   ```
-  The third clause (`project_id` match) avoids a v1.0.605-class
-  bug where the parent-id pointer survives but the project binding
-  has drifted. When the strict predicate holds, stamp the row with
-  `assigned_tier = "project-steward"` and `current_assignees_json
-  = [<parent_steward_id>]`. Otherwise leave the row team-wide-
-  addressed as today.
+  The two `IS NOT NULL` guards on `project_id` defend against
+  SQL's `NULL = NULL → NULL` semantics — without them, two
+  unbound rows would accidentally match. The third clause
+  (`p.project_id = w.project_id`) is the binding-drift guard
+  (v1.0.605-class bug — parent-id pointer survives but
+  project binding has drifted).
+- Best-effort: any non-`ErrNoRows` DB error logs a warn +
+  returns "" so a transient DB issue degrades to safe
+  (team-wide).
 - `dispatchAttentionReply` is unchanged — the existing fan-back
   already addresses by `session_id`; the new addressing only
   affects which inbox surfaces the row first.
-- Mobile: see W12.
-- Tests:
-  - Worker with same-project steward parent: row addressed to
-    parent.
-  - Worker with cross-project steward parent (binding drift):
-    row stays team-wide-addressed (third clause fails).
-  - Worker with non-steward parent: row stays team-wide-addressed
-    (second clause fails).
-  - Worker without parent (orphan): row stays team-wide-addressed
-    (first clause fails).
-  - Steward decides → fan-back to engine driver (codex / claude)
-    works as before.
-  - Principal override after steward-approve: emits override
-    audit; for codex parked-RPC, the driver's existing
-    `attention_reply` handler re-runs (this is the one case
-    where override is complex — needs a verification test).
+- Tests (6): same-project steward parent addresses row;
+  cross-project steward parent (binding drift) stays
+  team-wide; non-steward parent stays team-wide; orphan
+  worker (no parent) stays team-wide; both-sides-NULL
+  project_id stays team-wide (the NULL=NULL guard); direct
+  helper test against ghost worker returns "".
+- (Steward-decides → fan-back test deferred — covered by
+  existing `TestDecide_PermissionPromptFansOutAttentionReply`
+  which lives in `handlers_attention_permission_prompt_test.go`
+  and still passes under the W10 changes since `dispatchAttentionReply`
+  is untouched.)
+- (Principal-override-of-codex-parked-RPC complex case
+  deferred — W9 ships the override path against
+  propose-kind rows; permission_prompt isn't a propose
+  kind, so override on it would require widening
+  `handleAttentionOverride`. Tracked separately.)
 
 **W11. `dispatchAttentionReply` allowlist + fan-back payload + ADR-032 envelope (~40 LOC + 30 LOC tests).**
 

hub/internal/server/mcp_more.go

@@ -782,15 +782,31 @@ func (s *Server) mcpPermissionPrompt(ctx context.Context, team, fromID string, r
 	now := NowUTC()
 	actorHandle, _ := s.lookupHandleByID(ctx, team, fromID)
 
+	// ADR-030 W10: re-address the row to the worker's parent steward
+	// when the strict same-project predicate holds. Otherwise leave
+	// it team-wide-addressed (assignees='[]', assigned_tier=NULL) so
+	// the existing behaviour is unchanged for orphan workers,
+	// non-steward parents, and binding-drift cases.
+	assignees := "[]"
+	assignedTier := sql.NullString{}
+	if stewardID := s.permissionPromptAddressee(ctx, team, fromID); stewardID != "" {
+		b, _ := json.Marshal([]string{stewardID})
+		assignees = string(b)
+		assignedTier = sql.NullString{String: GovTierProjectSteward, Valid: true}
+	}
+
 	if _, err := s.db.ExecContext(ctx, `
 		INSERT INTO attention_items (
 			id, project_id, scope_kind, scope_id, kind,
 			summary, severity, current_assignees_json, status, created_at,
-			actor_kind, actor_handle, pending_payload_json
+			actor_kind, actor_handle, pending_payload_json,
+			assigned_tier
 		) VALUES (?, NULL, 'team', NULL, 'permission_prompt',
-		          ?, 'minor', '[]', 'open', ?,
-		          'agent', NULLIF(?, ''), ?)`,
-		id, summary, now, actorHandle, string(payload),
+		          ?, 'minor', ?, 'open', ?,
+		          'agent', NULLIF(?, ''), ?,
+		          ?)`,
+		id, summary, assignees, now, actorHandle, string(payload),
+		assignedTier,
 	); err != nil {
 		return nil, &jrpcError{Code: -32000, Message: err.Error()}
 	}
@@ -839,6 +855,50 @@ func (s *Server) mcpPermissionPrompt(ctx context.Context, team, fromID string, r
 	}), nil
 }
 
+// permissionPromptAddressee returns the parent steward's agent_id
+// when the ADR-030 W10 strict same-project parent-steward predicate
+// holds for the requesting worker, or "" otherwise. All three
+// clauses MUST hold:
+//
+//  1. The worker has a non-NULL `parent_agent_id`.
+//  2. The parent agent's `kind` matches the kind-based steward
+//     predicate `LIKE 'steward.%'` (v1.0.607 detection rule).
+//  3. The parent agent's `project_id` matches the worker's
+//     `project_id`. This third clause is the binding-drift guard
+//     — without it, a v1.0.605-class bug where the parent-id
+//     pointer survives but the project binding has drifted would
+//     route the row to a steward that no longer owns the worker.
+//
+// `project_id IS NOT NULL` is required on both sides so SQL's
+// `NULL = NULL → NULL` semantics don't accidentally accept two
+// unbound rows as "matching".
+//
+// Best-effort. Any DB error returns "" + a Warn log; the row stays
+// team-wide-addressed (the existing pre-W10 behaviour), so a
+// transient DB issue degrades to safe.
+func (s *Server) permissionPromptAddressee(ctx context.Context, team, workerID string) string {
+	var stewardID string
+	err := s.db.QueryRowContext(ctx, `
+		SELECT p.id
+		  FROM agents w
+		  JOIN agents p ON p.id = w.parent_agent_id
+		 WHERE w.team_id = ?
+		   AND w.id = ?
+		   AND w.parent_agent_id IS NOT NULL
+		   AND p.kind LIKE 'steward.%'
+		   AND p.project_id IS NOT NULL
+		   AND w.project_id IS NOT NULL
+		   AND p.project_id = w.project_id`,
+		team, workerID).Scan(&stewardID)
+	if err == nil {
+		return stewardID
+	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		s.log.Warn("permission_prompt addressee lookup", "worker_id", workerID, "err", err)
+	}
+	return ""
+}
+
 // waitForAttentionResolution polls attention_items until status='resolved'
 // (or ctx fires). Returns the full last decision dict so callers that
 // care about extra fields (notably option_id from request_select) can