Implement Step 8 fully in the current repository: fix systemic typed-OODA actor-session scope reuse by deterministic goal ID plus complete canonical ActorScopeKey routing; preserve direct incompatible

[rysweet]

Task Description

Implement Step 8 fully in the current repository: fix systemic typed-OODA actor-session scope reuse by deterministic goal ID plus complete canonical ActorScopeKey routing; preserve direct incompatible-rebinding failure; propagate the resolved session consistently through route, actor, invocation, lease, recipe, executor, and terminal correlation; support compatible legacy reuse and incompatible scoped isolation; add all requested regression coverage, telemetry, and directly affected documentation; run formatting, lint/build, targeted and full CI checks with NODE_OPTIONS=--max-old-space-size=32768. Modify the existing worktree and leave it merge-ready. Return concrete files changed and validation results.

Requirements

✓ Set NODE_OPTIONS=--max-old-space-size=32768

Final requirements

No blocking ambiguity remains. Design shall follow these decisions:

1. Use the established canonical goal normalization (goal_slug) to produce stable IDs for semantically equivalent typed-OODA goals.
2. Construct one canonical ActorScopeKey using the documented six-field ordering, normalization, encoding, and fingerprint rules. Resolve effective authenticated identity before construction; missing identity is an error, never a hard-coded fallback.
3. Resolve the session exactly once before actor registration. Propagate that resolved identity unchanged through route, actor, invocation, lease, recipe context, executor, telemetry, and terminal correlation.
4. Reuse a legacy goal-only session only when its persisted goal and complete scope positively match the canonical request.
5. If legacy state is incompatible, derive and use an isolated scoped session. If that scoped identity is already bound incompatibly, report collision/corruption through the established failure path.
6. Preserve immediate AuthorizationScopeViolation behavior when directly rebinding an existing session to an incompatible scope, including goal mismatches.
7. Emit existing-convention telemetry for new scoped creation, compatible scoped reuse, compatible legacy reuse, incompatible legacy isolation, and incompatibility failure. Use only approved identifiers/fingerprints; exclude credentials and raw sensitive scope data.
8. Add deterministic vectors and regression coverage for equivalent-goal reuse, end-to-end canonical routing, compatible legacy reuse, incompatible isolation, scoped collision, malformed scope inputs, terminal correlation, concurrency where applicable, and direct incompatible rebinding.
9. Update only directly affected typed-OODA scope/session documentation, changing planned behavior to implemented behavior and documenting reuse, isolation, and failure semantics.
10. Preserve existing staged work, avoid schema migration unless proven necessary, and leave no unrelated changes or temporary artifacts.
11. Run repository formatting, linting, builds, targeted typed-OODA tests, and every CI-equivalent check defined by .github/workflows/verify.yml with NODE_OPTIONS=--max-old-space-size=32768.

These requirements are ready for the design phase.

Acceptance Criteria

• All explicit requirements met
• Tests passing
• Philosophy compliant
• Documentation updated

Classification

Generated via default-workflow recipe