Verified workflow resume stays fenced to its original work
Explicit GitHub verification resume now carries the exact repository, PR, head SHA, runner installation, host, preserved thread, and source lease through claim and worktree checks.
Atoll can now resume a preserved agent thread after a GitHub workflow completes, while keeping every part of that handoff tied to the work that produced it. The setting is explicit and remains disabled until an owner or admin selects GitHub verification resume.
Resume the exact delivery context
A completed issue lease records the repository identity, pull request, exact head SHA, runner installation, host, and Codex thread. Atoll upgrades a verification attention item only when the signed workflow event and current issue PR link still match that binding. The runner carries the event, repository, PR number, and SHA in its durable local candidate and checks the retained worktree before it starts a turn and before it reports the result.
Mismatches stay available for review
A stale link, replaced runner installation, changed source lease, or ambiguous server binding produces a definiteRUNNER_LEASE_VERIFICATION_BINDING_MISMATCHrejection. The local claim journal closes, the server notification stays unread, and the next heartbeat or supervisor pass can handle the ordinary verification attention. If the retained local worktree HEAD differs, the runner fails closed withverification_worktree_sha_mismatchand leaves the active lease and unread attention for operator reconciliation. Neither path acknowledges the item, submits another turn, or creates a new thread from uncertain evidence.
Intake pause preserves held work
Pausing a runner stops new claims. A lease already held by the current runner can still renew, persist progress, complete, or reconcile under its existing fencing. This lets an operator stop intake without interrupting a bounded turn that already owns its work.