[Safety] Exact-base worktree creation so every subagent shares a verified identity #126

Goal

A worker branch/worktree must be created from an explicit, verified commit rather than ambient controller HEAD, a stale checkout, or an existing branch with ambiguous identity.

Required contract

• Resolve the requested start point to one canonical commit before mutation.
• Create or validate the worker branch and worktree against that exact commit.
• Return the canonical start commit, resulting worker HEAD, branch identity, path, and registration evidence.
• Fail closed on an existing or mismatched branch; never silently adopt it.
• Preserve structured postcondition/residual data across the Rust/Python bridge.
• Treat postcondition identity failures as typed operational failures rather than generic policy prose.
• Compare full symbolic refs, not ambiguous shortened branch names.
• Normalize and validate full commit IDs consistently across Rust and Python.

Boundary compatibility — absorbed from #135

Adding a required --start-point changes the published machine request grammar. PR #131 must not label that change as compatible schema v1.

Use the smallest safe pre-1.0 migration:

• explicitly version the request boundary, or
• return a deterministic machine-readable upgrade/incompatibility error for the legacy request shape.

Do not restore ambient-HEAD behavior for compatibility. Once this acceptance is implemented, close #135 as absorbed.

Out of scope for this PR

• [Enforce] Close symlink-swap races on externally-chosen worktree paths #127 same-user symlink-swap hardening;
• [Enforce] Verify untrusted fork PR heads — now the common path #134 importing fork heads that are absent locally;
• [Lease] Crash consistency between git mutation and lease record #136 general crash recovery for interrupted pending allocations;
• general branch resume/adoption;
• graph scheduling or peer communication.

Those paths must continue to fail closed.

Acceptance criteria

• Dirty or stale controller checkout cannot change the created worker base.
• Existing branch mismatch fails before worktree adoption.
• Canonical start and worker HEAD identities are returned and verified.
• Full symbolic-ref comparison handles tag/branch-name collisions.
• Typed residual evidence survives the Python bridge.
• Request grammar and errors have an honest machine-readable boundary version.
• Current submitted commits satisfy attribution checks; synthetic review commits are ignored.
• Rust and Python native gates pass.

Relationships

• Stabilization parent: Epic: Phase 1 — Claude Code hook-based enforcement on writ #124
• Implementation: PR fix(worktree): enforce exact-base creation identity #131
• Absorbs required work from: [Absorbed] Exact-base boundary migration #135
• Deferred related work: [Enforce] Close symlink-swap races on externally-chosen worktree paths #127, [Enforce] Verify untrusted fork PR heads — now the common path #134, [Lease] Crash consistency between git mutation and lease record #136

Planning synthesis: OpenAI Codex, 2026-08-31.