fix(work-item-pipeline): finalize acts under claim-holder identity (item #137)

[getappz]

Fixes item #137 — finalize step fails to mark items done for non-claude-code agents.

Root cause

build_finalize_step runs item_done/item_release via the daemon's MCP, so the caller identity is the daemon's fixed claims::owner_id(). But the item's claim is held by the dispatched agent (e.g. opencode:<instance>). item_done's claim guard refuses a foreign live claim: item {id} is claimed by '{holder}' -- refusing to complete someone else's live claim. Legacy claude-code dispatches matched the daemon identity; opencode-dispatched items never got past finalize.

Fix

Carry the claim-holder identity (assignee_agent) into build_finalize_step/build_work_item_pipeline as an owner param and run item_done/item_release inside claims::with_owner_override(owner, ...) (via run_as_claim_holder). None falls through to ambient identity (pre-fix behavior, boot-time dummy definition). The guard stays intact — only the caller identity is made correct.

• src/work_item_pipeline.rs: run_as_claim_holder, build_finalize_step +owner, build_work_item_pipeline/_with_sender +owner
• src/dashboard/server.rs: pass None for the boot-time dummy definition

Summary by CodeRabbit

• Bug Fixes
  • Work-item finalization now consistently runs under the correct claim-holder identity.
  • Preserved existing identity behavior when no claim-holder is specified.
  • Improved identity handling for resumed work-item processing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2c295214-63b0-4dd7-aa47-d866a43be5ad

📥 Commits

Reviewing files that changed from the base of the PR and between aa5f10c and bc5cbbf.

📒 Files selected for processing (2)

• src/dashboard/server.rs
• src/work_item_pipeline.rs

Included review availability: 0 reviews are currently available. Based on recent review activity, included reviews refill at 1 per hour.

---

📝 Walkthrough

Walkthrough

The work-item pipeline now propagates an optional claim-holder identity through construction and resumable dispatch. Finalization uses that identity for item_release and item_done, while absent or blank owners preserve the ambient identity.

Changes

Claim-holder finalization

Layer / File(s)	Summary
Identity-aware finalization src/work_item_pipeline.rs	Finalization applies a nonblank owner to item_release and item_done. Missing or blank owners use the ambient identity.
Pipeline owner propagation src/work_item_pipeline.rs, src/dashboard/server.rs	Pipeline builders accept and forward the optional owner. Resumable dispatch supplies the item's assignee agent. Boot-time construction supplies no owner.
Identity behavior validation src/work_item_pipeline.rs	Tests cover the new parameter and verify owner override, absent-owner, and whitespace-only-owner behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to bc5cb

This PR updates finalization to use the claimed agent identity while preserving the existing claim guard. No actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• getappz/agentflare#165: Directly introduced claim, release, and completion integration in the work-item pipeline.
• getappz/agentflare#531: Also propagates an optional claim owner through work_item_pipeline.
• getappz/agentflare#183: Modifies owner-scoped work-item completion and deferred claim release.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the work-item pipeline fix and the claim-holder identity behavior.
Description check	✅ Passed	The description clearly explains the issue, root cause, fix, affected files, and ambient-identity behavior, but omits the test plan and reviewer notes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch task/137-finalize-step-fails-to-mark-items-done-f

---

_{Comment @coderabbitai help to get the list of available commands.}

[getappz]

Superseded by #531, which is already merged to master (ea4a7a6: capture owner_id() on the caller thread before block_on, thread into finalize, wrap in with_owner_override). Same root cause, same fix site. Closing this as a duplicate — no changes needed; please discard.

[getappz]

Superseded by merged #531