Merge branch 'master' into feat/issue-638-webui-app-shell-phase1

Resolve conflict remediation for PR #818 (Closes #638) against master
caaae9b6. Two conflicts in webui/app.py, both resolved as unions since
the Phase 1 shell work (#638) and the merged master changes touch
disjoint concerns:

- Imports: keep the new webui.nav (NAV_GROUPS, STUB_PAGES) import from
  #638 alongside master's expanded project_registry / project_views API
  (ProjectRegistry, RegistryError, known_project_ids,
  project_detail_to_dict, render_registry_error).
- Route table: keep master's read-only /api/console/security-model route
  alongside #638's read-only Phase 1 stub routes (STUB_PAGES).

No behavior change beyond union; console stays read-only. docs/webui-local-dev.md
auto-merged. Full webui suite green (272 passed, 310 subtests).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

allocator_service.py

@@ -1115,12 +1115,6 @@ def allocate_next_work(
             "reasons": [
                 "dry-run only (apply=false); no assignment/lease created — "
                 "call again with apply=true to reserve via control-plane DB"
-                + (
-                    "; after apply, the required-role worker consumes via "
-                    "gitea_adopt_workflow_lease (#843)"
-                    if mode == ALLOCATION_MODE_CROSS_ROLE and expected_role != role_norm
-                    else ""
-                )
             ],
             "skipped": [s.as_dict() for s in skipped],
             "terminal_pr": terminal_pr,
@@ -1152,9 +1146,6 @@ def allocate_next_work(
     # Atomic reserve via #613 substrate.
     ttl = lease_ttl_seconds if lease_ttl_seconds is not None else None
     try:
-        cross_role_handoff = (
-            mode == ALLOCATION_MODE_CROSS_ROLE and lease_role != role_norm
-        )
         kwargs: dict[str, Any] = {
             "session_id": session_id,
             "role": lease_role,
@@ -1166,8 +1157,7 @@ def allocate_next_work(
             "expected_head_sha": selected.head_sha,
             "allowed_actions": allowed,
             "forbidden_actions": forbidden,
-            # #843: mark cross-role allocations as awaiting independent consume
+            "phase": "allocated",
-            "phase": "awaiting_handoff" if cross_role_handoff else "allocated",
         }
         if ttl is not None:
             kwargs["lease_ttl_seconds"] = int(ttl)
@@ -1247,52 +1237,7 @@ def allocate_next_work(
         "lease_role": lease_role,
         "source": "control_plane_db.assign_and_lease",
     }
-    consume_allocation = None
+    return {
-    if cross_role_handoff and result.lease_id:
-        # Durable handoff marker so independent required-role workers can
-        # consume without sharing the controller session (#843).
-        handoff_prov = {
-            "cross_role_handoff": True,
-            "handoff_status": "pending",
-            "allocating_session_id": session_id,
-            "allocating_role": role_norm,
-            "required_role": expected_role,
-            "required_profile": selection["required_profile"],
-            "required_namespace": selection["required_namespace"],
-            "assignment_id": result.assignment_id,
-            "lease_id": result.lease_id,
-            "allocation_mode": mode,
-            "adopted_by_session_id": None,
-        }
-        try:
-            db.attach_lease_provenance(result.lease_id, handoff_prov)
-        except ControlPlaneError:
-            # Still return assignment evidence; consume path may be unavailable
-            handoff_prov["attach_failed"] = True
-        consume_allocation = {
-            "tool": "gitea_adopt_workflow_lease",
-            "lease_id": result.lease_id,
-            "assignment_id": result.assignment_id,
-            "required_role": expected_role,
-            "required_profile": selection["required_profile"],
-            "required_namespace": selection["required_namespace"],
-            "handoff_status": "pending",
-            "controller_session_required": False,
-            "instructions": (
-                f"From an independent {expected_role} session "
-                f"({selection['required_namespace']} / "
-                f"{selection['required_profile']}), call "
-                f"gitea_adopt_workflow_lease(lease_id={result.lease_id!r}) "
-                "to consume this controller allocation. The allocating "
-                "controller process does not need to remain alive. Wrong-role "
-                "and second-adoption attempts fail closed."
-            ),
-        }
-        lease_proof["cross_role_handoff"] = True
-        lease_proof["handoff_status"] = "pending"
-        lease_proof["consume_tool"] = "gitea_adopt_workflow_lease"
-
-    out = {
         "success": True,
         "outcome": OUTCOME_ASSIGNED,
         "apply": True,
@@ -1326,17 +1271,8 @@ def allocate_next_work(
             "lease_role": lease_role,
             "lease_proof": lease_proof,
             "selection_policy": SELECTION_POLICY,
-            "cross_role_handoff": bool(cross_role_handoff),
         },
-        "next_valid_command": (
+        "next_valid_command": _next_command(lease_role, selected),
-            (
-                f"consume lease {result.lease_id} via gitea_adopt_workflow_lease "
-                f"as {expected_role}, then "
-            )
-            + _next_command(lease_role, selected)
-            if cross_role_handoff
-            else _next_command(lease_role, selected)
-        ),
         "substrate": "control_plane_db",
         "file_lock_only": False,
         "comment_lease_only": False,
@@ -1351,14 +1287,9 @@ def allocate_next_work(
         "downstream_note": (
             "#612 incident bridge remains downstream of #600; "
             "allocator never assigns raw monitoring incidents; "
-            "controller routes only under cross_role (#840); "
+            "controller routes only under cross_role (#840)"
-            "cross-role assignments are consumable by independent "
-            "required-role workers via gitea_adopt_workflow_lease (#843)"
         ),
     }
-    if consume_allocation is not None:
-        out["consume_allocation"] = consume_allocation
-    return out
 
 
 def _next_command(role: str, c: WorkCandidate) -> str:

control_plane_db.py

@@ -1637,13 +1637,11 @@ class ControlPlaneDB:
         provenance: dict[str, Any] | None = None,
         lease_ttl_seconds: int = DEFAULT_LEASE_TTL_SECONDS,
     ) -> dict[str, Any]:
-        """Transfer or refresh a lease with provenance (#601 / #843).
+        """Transfer or refresh a lease with provenance (#601).
 
         * Same owner + active → refresh (owner-resume).
-        * Cross-role handoff pending + matching required role → atomic consume
-          (even while the allocating controller session still "owns" the lease).
         * Expired/abandoned/released → create new assignment+lease with provenance.
-        * Active foreign (non-handoff) → raise ForeignLeaseError (never silent steal).
+        * Active foreign → raise ForeignLeaseError (never silent steal).
         """
         now = _utc_now()
         now_s = _ts(now)
@@ -1679,35 +1677,7 @@ class ControlPlaneDB:
                 status = "expired"
 
             owner = lease["session_id"]
-            # Parse durable provenance for cross-role handoff consume (#843).
+            if status == "active" and owner != adopter_session_id:
-            lease_prov: dict[str, Any] = {}
-            if "provenance_json" in lease.keys() and lease["provenance_json"]:
-                try:
-                    loaded = json.loads(lease["provenance_json"])
-                    if isinstance(loaded, dict):
-                        lease_prov = loaded
-                except (TypeError, json.JSONDecodeError):
-                    lease_prov = {}
-            handoff_pending = bool(lease_prov.get("cross_role_handoff")) and (
-                str(lease_prov.get("handoff_status") or "pending").strip().lower()
-                == "pending"
-            )
-            already_adopted = bool(
-                (lease["adopted_by_session_id"] if "adopted_by_session_id" in lease.keys() else None)
-                or lease_prov.get("adopted_by_session_id")
-            )
-            required_role = str(
-                lease_prov.get("required_role") or lease["role"] or ""
-            ).strip().lower()
-            adopter_role = (role or "").strip().lower()
-            cross_role_consume = (
-                handoff_pending
-                and not already_adopted
-                and status == "active"
-                and owner != adopter_session_id
-            )
-
-            if status == "active" and owner != adopter_session_id and not cross_role_consume:
                 raise ForeignLeaseError(
                     f"cannot adopt active foreign lease {lease_id} owned by {owner}"
                 )
@@ -1791,142 +1761,6 @@ class ControlPlaneDB:
                     "reasons": ["owner-resume: refreshed lease with provenance"],
                 }
 
-            # #843: controller→required-role handoff consume (atomic, same lease_id)
-            if cross_role_consume:
-                if not required_role:
-                    raise ControlPlaneError(
-                        f"cross-role handoff lease {lease_id} missing required_role"
-                    )
-                if adopter_role != required_role:
-                    raise ForeignLeaseError(
-                        f"wrong role for cross-role handoff consume: "
-                        f"required={required_role} adopter={adopter_role or 'none'} "
-                        f"(fail closed)"
-                    )
-                # CAS: only transfer if still owned by allocating session and unadopted
-                cols = self._lease_columns(conn)
-                adopted_col_null = (
-                    "(adopted_by_session_id IS NULL OR adopted_by_session_id = '')"
-                    if "adopted_by_session_id" in cols
-                    else "1=1"
-                )
-                cas = conn.execute(
-                    f"""
-                    UPDATE leases
-                    SET session_id = ?,
-                        heartbeat_at = ?,
-                        expires_at = ?,
-                        phase = ?,
-                        role = ?
-                    WHERE lease_id = ?
-                      AND status = 'active'
-                      AND session_id = ?
-                      AND {adopted_col_null}
-                    """,
-                    (
-                        adopter_session_id,
-                        now_s,
-                        expires,
-                        "adopted",
-                        required_role,
-                        lease_id,
-                        owner,
-                    ),
-                )
-                if cas.rowcount != 1:
-                    raise ForeignLeaseError(
-                        f"cross-role handoff consume lost race for lease {lease_id} "
-                        "(already adopted or no longer pending; fail closed)"
-                    )
-                if "adopted_from_session_id" in cols:
-                    conn.execute(
-                        """
-                        UPDATE leases
-                        SET adopted_from_session_id = ?, adopted_by_session_id = ?
-                        WHERE lease_id = ?
-                        """,
-                        (owner, adopter_session_id, lease_id),
-                    )
-                if "worktree_path" in cols and worktree_path:
-                    conn.execute(
-                        "UPDATE leases SET worktree_path = ? WHERE lease_id = ?",
-                        (worktree_path, lease_id),
-                    )
-                if "owner_pid" in cols and owner_pid is not None:
-                    conn.execute(
-                        "UPDATE leases SET owner_pid = ? WHERE lease_id = ?",
-                        (owner_pid, lease_id),
-                    )
-                if "expected_head_sha" in cols and expected_head_sha:
-                    conn.execute(
-                        "UPDATE leases SET expected_head_sha = ? WHERE lease_id = ?",
-                        (expected_head_sha, lease_id),
-                    )
-                # Merge handoff provenance + caller provenance
-                merged = dict(lease_prov)
-                merged.update(provenance or {})
-                merged["cross_role_handoff"] = True
-                merged["handoff_status"] = "adopted"
-                merged["adopted_from_session_id"] = owner
-                merged["adopted_by_session_id"] = adopter_session_id
-                merged["required_role"] = required_role
-                if "provenance_json" in cols:
-                    conn.execute(
-                        "UPDATE leases SET provenance_json = ? WHERE lease_id = ?",
-                        (json.dumps(merged), lease_id),
-                    )
-                # Transfer active assignment ownership atomically
-                asn_cas = conn.execute(
-                    """
-                    UPDATE assignments
-                    SET session_id = ?, role = ?
-                    WHERE lease_id = ? AND status = 'active' AND session_id = ?
-                    """,
-                    (adopter_session_id, required_role, lease_id, owner),
-                )
-                if asn_cas.rowcount < 1:
-                    # Fail closed: assignment must move with the lease
-                    raise ControlPlaneError(
-                        f"cross-role handoff: no active assignment for lease {lease_id} "
-                        f"owned by {owner}"
-                    )
-                lease2 = conn.execute(
-                    "SELECT * FROM leases WHERE lease_id = ?", (lease_id,)
-                ).fetchone()
-                asn = conn.execute(
-                    """
-                    SELECT * FROM assignments
-                    WHERE lease_id = ? AND status = 'active'
-                    ORDER BY created_at DESC LIMIT 1
-                    """,
-                    (lease_id,),
-                ).fetchone()
-                conn.execute(
-                    """
-                    INSERT INTO events(work_item_id, event_type, message, created_at)
-                    VALUES (?, 'lease_adopted', ?, ?)
-                    """,
-                    (
-                        lease["work_item_id"],
-                        f"cross-role handoff: {adopter_session_id} consumed "
-                        f"{lease_id} from {owner} as {required_role}",
-                        now_s,
-                    ),
-                )
-                return {
-                    "outcome": "adopted_cross_role_handoff",
-                    "lease": dict(lease2) if lease2 else dict(lease),
-                    "assignment": dict(asn) if asn else None,
-                    "reasons": [
-                        "cross-role handoff: independent required-role worker consumed "
-                        "controller allocation without abandonment"
-                    ],
-                    "adopted_by_session_id": adopter_session_id,
-                    "adopted_from_session_id": owner,
-                    "required_role": required_role,
-                    "handoff_status": "adopted",
-                }
-
             # Non-active: create new lease + assignment (transfer)
             new_lease_id = f"lease-{uuid.uuid4().hex[:16]}"
             new_asn_id = f"asn-{uuid.uuid4().hex[:16]}"

docs/webui-local-dev.md

@@ -73,6 +73,11 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
 | `/api/actions/{id}/preview` | Mutation ledger preview (GET, read-only) |
 | `/leases` | Lease and collision visibility (#433) |
 | `/api/leases` | JSON lease/collision export |
+| `/sessions` | Phase 1 shell stub — session inventory (backed by #636) |
+| `/inventory` | Phase 1 shell stub — unified inventory (backed by #636) |
+| `/timeline` | Phase 1 shell stub — workflow event timeline |
+| `/policy` | Phase 1 shell stub — capability/role policy placeholder |
+| `/insights` | Phase 1 shell stub — operational insights placeholder |
 
 Most routes are GET-only. POST/PUT/PATCH/DELETE return `405` with
 `read-only-mvp`, except `/audit` and `/api/audit` which accept POST for
@@ -153,6 +158,26 @@ health, workflow/schema SHA-256 hashes, and stale-runtime warnings when the
 checkout is behind merged safety-gate changes. Restart guidance links to #420;
 no tokens or MCP restart actions are exposed.
 
+## Application shell — Phase 1 (#638)
+
+The console shell (`webui/layout.py`) renders a grouped navigation driven by a
+single nav-config module, `webui/nav.py`. Nav groups follow the epic #631
+Phase 1 information architecture: **Health, Traffic, Runtime/Sessions,
+Projects, Inventory, Timeline, Policy** (placeholder), and **Insights**
+(placeholder). Live views and Phase 1 placeholders (`stub`) are declared in one
+place so the layout and the route table cannot drift.
+
+The header carries two read-only status badges — an **environment** badge
+(`local` for loopback binds, `remote` otherwise, derived from `WEBUI_HOST`) and
+a **mode: read-only** badge — plus a **Docs** link to this document. No
+privileged action controls are present in the Phase 1 shell.
+
+Not-yet-implemented surfaces (`/sessions`, `/inventory`, `/timeline`,
+`/policy`, `/insights`) resolve to graceful read-only stub pages instead of
+404s; their backing views land in later child issues of #631 (the inventory
+surfaces are backed by #636). Mutating methods on stub routes still fail closed
+with `read-only-mvp`.
+
 ## Deployment boundary (#435)
 
 MVP serves on loopback by default. Binding `0.0.0.0` or `::` is **refused**

gitea_mcp_server.py

@@ -21148,21 +21148,10 @@ def gitea_adopt_workflow_lease(
     remote: str = "dadeschools",
     host: str | None = None,
 ) -> dict:
-    """Adopt a control-plane lease through the sanctioned path (#601 / #843).
+    """Adopt a control-plane lease through the sanctioned path (#601).
 
-    Same-owner resume refreshes provenance. Foreign active leases are refused
+    Same-owner resume refreshes provenance. Foreign active leases are refused.
-    unless the lease is a pending controller cross-role handoff and the caller
+    Expired leases may be reclaimed; provenance records adopted_from/by.
-    holds the required role (independent consume without sharing the
-    controller session). Expired leases may be reclaimed; provenance records
-    adopted_from/by. Terminal (abandoned/released) leases cannot be adopted.
-
-    #843 F1: the adopter role is derived authoritatively from the active
-    authenticated profile — never from caller input. A supplied ``role`` that
-    does not exactly match the profile-derived role is rejected (no silent
-    accept or reinterpretation), and handoff provenance ``required_profile`` /
-    ``required_namespace`` restrictions are validated against the same
-    authoritative caller context. Caller-supplied role/profile/namespace can
-    never grant authority.
     """
     read_block = _profile_operation_gate("gitea.read")
     if read_block:
@@ -21171,64 +21160,25 @@ def gitea_adopt_workflow_lease(
             "reasons": read_block,
             "permission_report": _permission_block_report("gitea.read"),
         }
-    profile = get_profile()
-    profile_name = (profile.get("profile_name") or "").strip() or "session"
-    active_role = (_profile_role_kind(profile) or "").strip().lower()
-    if not active_role:
-        return {
-            "success": False,
-            "outcome": "blocked",
-            "mutation_performed": False,
-            "reasons": [
-                "active profile role could not be derived authoritatively; "
-                "refusing lease adoption (fail closed, #843)"
-            ],
-            "lease_id": lease_id,
-            "authoritative_source": "control_plane_db",
-            "file_lock_only": False,
-            "comment_lease_only": False,
-        }
-    if role is not None and str(role).strip():
-        supplied_role = str(role).strip().lower()
-        if supplied_role != active_role:
-            return {
-                "success": False,
-                "outcome": "blocked",
-                "mutation_performed": False,
-                "profile_role_kind": active_role,
-                "supplied_role": supplied_role,
-                "reasons": [
-                    f"caller-supplied role '{supplied_role}' does not match "
-                    f"the authenticated profile-derived role '{active_role}'; "
-                    "caller-supplied role/profile/namespace can never grant "
-                    "authority (fail closed, #843)"
-                ],
-                "lease_id": lease_id,
-                "authoritative_source": "control_plane_db",
-                "file_lock_only": False,
-                "comment_lease_only": False,
-            }
     db, errs = _control_plane_db_or_error()
     if db is None:
         return {"success": False, "reasons": errs}
+    profile = get_profile()
+    profile_name = (profile.get("profile_name") or "").strip() or "session"
+    active_role = _profile_role_kind(profile) or "author"
     sid = (session_id or "").strip() or (
         f"{profile_name}-{os.getpid()}-{uuid.uuid4().hex[:8]}"
     )
-    adopter_namespace = allocator_service.DEFAULT_ROLE_NAMESPACES.get(
-        active_role, f"gitea-{active_role}"
-    )
     try:
         return lease_lifecycle.adopt_lease(
             db,
             lease_id=lease_id,
             adopter_session_id=sid,
-            role=active_role,
+            role=(role or active_role).strip() or "author",
             worktree_path=worktree_path,
             expected_head_sha=expected_head_sha,
             owner_pid=os.getpid(),
             operator_authorized=bool(operator_authorized),
-            adopter_profile_name=profile_name,
-            adopter_namespace=adopter_namespace,
         )
     except (lease_lifecycle.LeaseLifecycleError, control_plane_db.ControlPlaneError) as exc:
         return {

lease_lifecycle.py

@@ -39,7 +39,6 @@ SAFE_RELEASE_OWNED = "release_owned"
 SAFE_STALE_PROMPT = "stale_prompt_lease"
 SAFE_UNKNOWN = "inspect_only"
 SAFE_NO_AUTHORITY = "file_or_comment_not_authoritative"
-SAFE_CONSUME_CROSS_ROLE = "consume_cross_role_handoff"
 
 LEASE_STATUS_ACTIVE = "active"
 LEASE_STATUS_RELEASED = "released"
@@ -251,23 +250,6 @@ def decide_safe_next_action(
                 "same_owner": True,
                 "also_allowed": [SAFE_ABANDON_ALLOWED, SAFE_RELEASE_OWNED],
             }
-        handoff = is_pending_cross_role_handoff({"lease": lease})
-        if handoff:
-            return {
-                "safe_next_action": SAFE_CONSUME_CROSS_ROLE,
-                "reasons": [
-                    f"controller allocation pending handoff (freshness={status}); "
-                    "required-role worker may consume without abandon/reassign; "
-                    f"required_role={handoff['required_role']}"
-                ],
-                "block": False,
-                "same_owner": False,
-                "owner_session_id": owner,
-                "required_role": handoff["required_role"],
-                "cross_role_handoff": True,
-                "handoff_status": "pending",
-                "also_allowed": [SAFE_ABANDON_ALLOWED],
-            }
         return {
             "safe_next_action": SAFE_ABANDON_ALLOWED,
             "reasons": [
@@ -290,24 +272,6 @@ def decide_safe_next_action(
         }
 
     if not same_owner and status == "active":
-        # #843: pending cross-role handoff is consumable by required role
-        handoff = is_pending_cross_role_handoff({"lease": lease})
-        if handoff:
-            return {
-                "safe_next_action": SAFE_CONSUME_CROSS_ROLE,
-                "reasons": [
-                    "controller cross-role allocation pending handoff; "
-                    f"required_role={handoff['required_role']}; "
-                    "consume via gitea_adopt_workflow_lease without "
-                    "abandonment or sharing the controller session"
-                ],
-                "block": False,
-                "same_owner": False,
-                "owner_session_id": owner,
-                "required_role": handoff["required_role"],
-                "cross_role_handoff": True,
-                "handoff_status": "pending",
-            }
         return {
             "safe_next_action": SAFE_WAIT_FOREIGN,
             "reasons": [
@@ -476,84 +440,6 @@ def list_active_leases(
     }
 
 
-
-def parse_lease_provenance(lease_or_state: Mapping[str, Any] | None) -> dict[str, Any]:
-    """Return durable lease provenance dict (empty when absent/unparseable)."""
-    if not lease_or_state:
-        return {}
-    if "provenance" in lease_or_state and isinstance(lease_or_state.get("provenance"), dict):
-        return dict(lease_or_state["provenance"])
-    raw = None
-    if "provenance_json" in lease_or_state:
-        raw = lease_or_state.get("provenance_json")
-    elif "lease" in lease_or_state and isinstance(lease_or_state.get("lease"), Mapping):
-        raw = lease_or_state["lease"].get("provenance_json")
-    if not raw:
-        return {}
-    if isinstance(raw, dict):
-        return dict(raw)
-    try:
-        loaded = json.loads(raw)
-    except (TypeError, json.JSONDecodeError):
-        return {}
-    return dict(loaded) if isinstance(loaded, dict) else {}
-
-
-def is_pending_cross_role_handoff(
-    state: Mapping[str, Any] | None,
-) -> dict[str, Any] | None:
-    """Return handoff evidence when a controller allocation awaits consume (#843).
-
-    A pending handoff is identified by durable provenance written at
-    cross-role apply time — not by title heuristics or session-id guessing.
-    """
-    if not state:
-        return None
-    lease = state.get("lease") if isinstance(state.get("lease"), Mapping) else state
-    if not isinstance(lease, Mapping):
-        return None
-    status = str(lease.get("status") or "").strip().lower()
-    if status in (LEASE_STATUS_ABANDONED, LEASE_STATUS_RELEASED, LEASE_STATUS_EXPIRED):
-        return None
-    prov = parse_lease_provenance(state)
-    if not prov and isinstance(lease, Mapping):
-        prov = parse_lease_provenance(lease)
-    if not prov.get("cross_role_handoff"):
-        return None
-    handoff_status = str(prov.get("handoff_status") or "pending").strip().lower()
-    if handoff_status != "pending":
-        return None
-    adopted_by = (
-        lease.get("adopted_by_session_id")
-        or prov.get("adopted_by_session_id")
-        or ""
-    )
-    if str(adopted_by).strip():
-        return None
-    required_role = str(
-        prov.get("required_role") or lease.get("role") or ""
-    ).strip().lower()
-    if not required_role:
-        return None
-    return {
-        "cross_role_handoff": True,
-        "handoff_status": "pending",
-        "required_role": required_role,
-        "allocating_session_id": str(
-            prov.get("allocating_session_id") or lease.get("session_id") or ""
-        ),
-        "allocating_role": str(prov.get("allocating_role") or "controller"),
-        "lease_id": str(lease.get("lease_id") or ""),
-        "assignment_id": (
-            str(state["assignment"]["assignment_id"])
-            if isinstance(state.get("assignment"), Mapping)
-            and state["assignment"].get("assignment_id")
-            else None
-        ),
-        "provenance": prov,
-    }
-
-
 def adopt_lease(
     db: cpd.ControlPlaneDB,
     *,
@@ -564,17 +450,8 @@ def adopt_lease(
     expected_head_sha: str | None = None,
     owner_pid: int | None = None,
     operator_authorized: bool = False,
-    adopter_profile_name: str | None = None,
-    adopter_namespace: str | None = None,
 ) -> dict[str, Any]:
-    """Sanctioned adopt path with provenance; never silent foreign steal.
+    """Sanctioned adopt path with provenance; never silent foreign steal."""
-
-    #843 F1: for a pending cross-role handoff, ``role`` must be the
-    authoritative profile-derived role supplied by the MCP boundary — never
-    caller-asserted authority. When the handoff provenance declares
-    ``required_profile`` / ``required_namespace`` and the caller context is
-    provided, both are validated exactly; a mismatch fails closed.
-    """
     state = db.get_lease_workflow_state(lease_id)
     if not state:
         raise LeaseLifecycleError(
@@ -586,8 +463,11 @@ def adopt_lease(
     owner = str(lease.get("session_id") or "")
     same_owner = owner == str(adopter_session_id)
 
-    handoff = is_pending_cross_role_handoff(state)
+    if freshness["freshness"] == "active" and not same_owner:
-    adopter_role = (role or "").strip().lower()
+        raise LeaseLifecycleError(
+            f"refusing to steal active foreign lease {lease_id} owned by "
+            f"{owner} (fail closed)"
+        )
 
     if freshness["freshness"] in ("abandoned", "released"):
         raise LeaseLifecycleError(
@@ -595,64 +475,13 @@ def adopt_lease(
             "(fail closed)"
         )
 
-    if handoff and not same_owner:
+    # Expired or stale: require abandon-style safety before ownership transfer
-        # Terminal statuses already rejected above. Freshness may be
+    # when not same owner; same owner may reclaim.
-        # active OR stale_dead_process (controller exited) — both are
+    if not same_owner and freshness["freshness"] in (
-        # consumable without abandonment when handoff is still pending.
-        if freshness["freshness"] not in (
-            "active",
-            "stale_dead_process",
-            "stale_missing_worktree",
-        ):
-            raise LeaseLifecycleError(
-                f"lease {lease_id} freshness={freshness['freshness']}; "
-                "terminal or non-active allocation cannot be handoff-consumed "
-                "(fail closed)"
-            )
-        required = handoff["required_role"]
-        if adopter_role != required:
-            raise LeaseLifecycleError(
-                f"wrong role for cross-role handoff consume of {lease_id}: "
-                f"required={required} adopter={adopter_role or 'none'} "
-                "(fail closed)"
-            )
-        # #843 F1: provenance profile/namespace restrictions are validated
-        # against the authoritative caller context when declared. Caller
-        # input can never widen authority; a mismatch fails closed.
-        handoff_prov = handoff.get("provenance") or {}
-        required_profile = str(
-            handoff_prov.get("required_profile") or ""
-        ).strip()
-        if required_profile and adopter_profile_name is not None:
-            if str(adopter_profile_name).strip() != required_profile:
-                raise LeaseLifecycleError(
-                    f"wrong profile for cross-role handoff consume of "
-                    f"{lease_id}: required_profile={required_profile} "
-                    f"adopter_profile={adopter_profile_name} (fail closed)"
-                )
-        required_namespace = str(
-            handoff_prov.get("required_namespace") or ""
-        ).strip()
-        if required_namespace and adopter_namespace is not None:
-            if str(adopter_namespace).strip() != required_namespace:
-                raise LeaseLifecycleError(
-                    f"wrong namespace for cross-role handoff consume of "
-                    f"{lease_id}: required_namespace={required_namespace} "
-                    f"adopter_namespace={adopter_namespace} (fail closed)"
-                )
-        reason = "cross-role-handoff-consume"
-    elif freshness["freshness"] == "active" and not same_owner:
-        raise LeaseLifecycleError(
-            f"refusing to steal active foreign lease {lease_id} owned by "
-            f"{owner} (fail closed)"
-        )
-    elif not same_owner and freshness["freshness"] in (
         "expired",
         "stale_dead_process",
         "stale_missing_worktree",
     ):
-        # Expired or stale (non-handoff): require abandon-style safety before
-        # ownership transfer when not same owner; same owner may reclaim.
         if not operator_authorized and freshness["freshness"] == "expired":
             # Deterministic reclaim of expired foreign lease is allowed
             # without operator flag (sanctioned expire reclaim).
@@ -663,9 +492,6 @@ def adopt_lease(
                 f"lease {lease_id} freshness={freshness['freshness']}; "
                 "use abandon with proof before foreign adopt (fail closed)"
             )
-        reason = "sanctioned-reclaim-adopt"
-    else:
-        reason = "owner-resume-adopt" if same_owner else "sanctioned-reclaim-adopt"
 
     provenance = build_adopt_provenance(
         adopted_from_session_id=owner,
@@ -678,14 +504,10 @@ def adopt_lease(
         worktree_path=worktree_path,
         expected_head_sha=expected_head_sha or lease.get("expected_head_sha"),
         prior_lease_id=lease_id,
-        reason=reason,
+        reason=(
+            "owner-resume-adopt" if same_owner else "sanctioned-reclaim-adopt"
+        ),
     )
-    if handoff and not same_owner:
-        provenance["cross_role_handoff"] = True
-        provenance["handoff_status"] = "adopted"
-        provenance["required_role"] = handoff["required_role"]
-        provenance["allocating_session_id"] = handoff["allocating_session_id"]
-        provenance["allocating_role"] = handoff["allocating_role"]
 
     result = db.adopt_lease(
         lease_id=lease_id,
@@ -696,7 +518,7 @@ def adopt_lease(
         owner_pid=owner_pid if owner_pid is not None else os.getpid(),
         provenance=provenance,
     )
-    out = {
+    return {
         "success": True,
         "outcome": result.get("outcome"),
         "same_owner": same_owner,
@@ -709,24 +531,6 @@ def adopt_lease(
         "comment_lease_only": False,
         "reasons": result.get("reasons") or [],
     }
-    if handoff and not same_owner:
-        out["cross_role_handoff"] = True
-        out["handoff_status"] = "adopted"
-        out["required_role"] = handoff["required_role"]
-        out["adopted_by_session_id"] = adopter_session_id
-        out["adopted_from_session_id"] = owner
-        lease_row = result.get("lease") or {}
-        if isinstance(lease_row, Mapping):
-            out["read_after_write"] = {
-                "lease_id": lease_row.get("lease_id"),
-                "session_id": lease_row.get("session_id"),
-                "role": lease_row.get("role"),
-                "status": lease_row.get("status"),
-                "adopted_by_session_id": lease_row.get("adopted_by_session_id"),
-                "adopted_from_session_id": lease_row.get("adopted_from_session_id"),
-                "phase": lease_row.get("phase"),
-            }
-    return out
 
 
 def release_lease(

tests/test_issue_843_cross_role_handoff.py

@@ -1,682 +0,0 @@
-"""Cross-role allocation handoff consumable by independent workers (#843).
-
-Regression coverage for the controller→required-role consume path:
-
-* controller allocates author work; independent author adopts successfully
-* author adoption succeeds after allocating controller process exits
-* author adoption without sharing controller session identity
-* wrong-role adoption rejected
-* concurrent/second adoption rejected without state corruption
-* terminal allocation adoption rejected
-* successful adoption produces authoritative ownership evidence
-* genuine abandoned-lease recovery remains valid
-* process_work_queue / allocate results include consume identifiers
-* same-role allocation behavior remains compatible
-"""
-
-from __future__ import annotations
-
-import os
-import tempfile
-import unittest
-from datetime import timedelta
-from unittest.mock import patch
-
-from allocator_service import (
-    ALLOCATION_MODE_CROSS_ROLE,
-    ALLOCATION_MODE_ROLE_SCOPED,
-    OUTCOME_ASSIGNED,
-    ROLE_AUTHOR,
-    ROLE_CONTROLLER,
-    ROLE_REVIEWER,
-    WorkCandidate,
-    allocate_next_work,
-)
-from control_plane_db import ControlPlaneDB, ForeignLeaseError, _ts, _utc_now
-import lease_lifecycle as ll
-
-
-class CrossRoleHandoffTest(unittest.TestCase):
-    def setUp(self) -> None:
-        self._tmp = tempfile.TemporaryDirectory()
-        self.db_path = os.path.join(self._tmp.name, "cp.sqlite3")
-        self.db = ControlPlaneDB(self.db_path)
-        self.db.upsert_session(
-            session_id="ctrl-session",
-            role="controller",
-            profile="prgs-controller",
-            pid=99999999,  # dead-looking pid
-        )
-        self.db.upsert_session(
-            session_id="author-worker",
-            role="author",
-            profile="prgs-author",
-            pid=os.getpid(),
-        )
-        self.db.upsert_session(
-            session_id="author-worker-2",
-            role="author",
-            profile="prgs-author",
-            pid=os.getpid(),
-        )
-        self.db.upsert_session(
-            session_id="reviewer-worker",
-            role="reviewer",
-            profile="prgs-reviewer",
-            pid=os.getpid(),
-        )
-        self.wt = self._tmp.name
-
-    def tearDown(self) -> None:
-        self._tmp.cleanup()
-
-    def _ready_issue(self, number: int = 843, title: str = "handoff target") -> WorkCandidate:
-        return WorkCandidate(
-            kind="issue",
-            number=number,
-            labels=("status:ready", "type:bug"),
-            title=title,
-            priority=20,
-        )
-
-    def _controller_allocate(self, number: int = 843, **kwargs):
-        defaults = dict(
-            db=self.db,
-            session_id="ctrl-session",
-            role=ROLE_CONTROLLER,
-            remote="prgs",
-            org="Scaled-Tech-Consulting",
-            repo="Gitea-Tools",
-            candidates=[self._ready_issue(number)],
-            apply=True,
-            profile_name="prgs-controller",
-            username="controller-user",
-            allocation_mode=ALLOCATION_MODE_CROSS_ROLE,
-        )
-        defaults.update(kwargs)
-        return allocate_next_work(**defaults)
-
-    def test_controller_allocates_author_independent_author_adopts(self) -> None:
-        res = self._controller_allocate()
-        self.assertEqual(res["outcome"], OUTCOME_ASSIGNED)
-        self.assertEqual(res["required_role"], ROLE_AUTHOR)
-        self.assertIn("consume_allocation", res)
-        consume = res["consume_allocation"]
-        self.assertEqual(consume["tool"], "gitea_adopt_workflow_lease")
-        self.assertEqual(consume["required_role"], ROLE_AUTHOR)
-        self.assertFalse(consume["controller_session_required"])
-        lid = res["assignment"]["lease_id"]
-        self.assertEqual(consume["lease_id"], lid)
-        self.assertIn(lid, res["next_valid_command"])
-
-        adopted = ll.adopt_lease(
-            self.db,
-            lease_id=lid,
-            adopter_session_id="author-worker",
-            role=ROLE_AUTHOR,
-            worktree_path=self.wt,
-        )
-        self.assertTrue(adopted["success"])
-        self.assertEqual(adopted["outcome"], "adopted_cross_role_handoff")
-        self.assertEqual(adopted["adopted_by_session_id"], "author-worker")
-        self.assertEqual(adopted["adopted_from_session_id"], "ctrl-session")
-        raw = adopted["read_after_write"]
-        self.assertEqual(raw["session_id"], "author-worker")
-        self.assertEqual(raw["adopted_by_session_id"], "author-worker")
-        self.assertEqual(raw["status"], "active")
-        self.assertEqual(raw["phase"], "adopted")
-
-        # Authoritative re-read
-        state = self.db.get_lease_workflow_state(lid)
-        self.assertEqual(state["lease"]["session_id"], "author-worker")
-        self.assertEqual(state["lease"]["adopted_by_session_id"], "author-worker")
-        self.assertEqual(state["assignment"]["session_id"], "author-worker")
-        self.assertEqual(state["provenance"]["handoff_status"], "adopted")
-
-    def test_author_adoption_after_controller_process_exits(self) -> None:
-        res = self._controller_allocate(number=900)
-        lid = res["assignment"]["lease_id"]
-        # Force owner_pid dead + freshness stale_dead_process
-        import sqlite3
-
-        conn = sqlite3.connect(self.db_path)
-        try:
-            conn.execute(
-                "UPDATE leases SET owner_pid = 99999999 WHERE lease_id = ?",
-                (lid,),
-            )
-            conn.commit()
-        finally:
-            conn.close()
-        state = self.db.get_lease_workflow_state(lid)
-        fr = ll.classify_lease_freshness(
-            state["lease"], pid_checker=lambda _p: False
-        )
-        self.assertEqual(fr["freshness"], "stale_dead_process")
-
-        adopted = ll.adopt_lease(
-            self.db,
-            lease_id=lid,
-            adopter_session_id="author-worker",
-            role=ROLE_AUTHOR,
-            worktree_path=self.wt,
-        )
-        self.assertEqual(adopted["outcome"], "adopted_cross_role_handoff")
-        self.assertEqual(adopted["adopted_by_session_id"], "author-worker")
-        # No abandon required
-        state2 = self.db.get_lease_workflow_state(lid)
-        self.assertEqual(state2["lease"]["status"], "active")
-        self.assertNotEqual(state2["lease"]["status"], "abandoned")
-
-    def test_adoption_without_sharing_controller_session_identity(self) -> None:
-        res = self._controller_allocate(number=901)
-        lid = res["assignment"]["lease_id"]
-        adopted = ll.adopt_lease(
-            self.db,
-            lease_id=lid,
-            adopter_session_id="author-worker",
-            role=ROLE_AUTHOR,
-            worktree_path=self.wt,
-        )
-        self.assertNotEqual(adopted["adopted_by_session_id"], "ctrl-session")
-        self.assertFalse(adopted["same_owner"])
-        self.assertEqual(adopted["adopted_from_session_id"], "ctrl-session")
-
-    def test_wrong_role_adoption_rejected(self) -> None:
-        res = self._controller_allocate(number=902)
-        lid = res["assignment"]["lease_id"]
-        with self.assertRaises(ll.LeaseLifecycleError) as ctx:
-            ll.adopt_lease(
-                self.db,
-                lease_id=lid,
-                adopter_session_id="reviewer-worker",
-                role=ROLE_REVIEWER,
-            )
-        self.assertIn("wrong role", str(ctx.exception).lower())
-        # State unchanged
-        state = self.db.get_lease_workflow_state(lid)
-        self.assertEqual(state["lease"]["session_id"], "ctrl-session")
-        self.assertIsNone(state["lease"].get("adopted_by_session_id") or None)
-        self.assertEqual(state["provenance"]["handoff_status"], "pending")
-
-    def test_second_adoption_rejected_without_corruption(self) -> None:
-        res = self._controller_allocate(number=903)
-        lid = res["assignment"]["lease_id"]
-        first = ll.adopt_lease(
-            self.db,
-            lease_id=lid,
-            adopter_session_id="author-worker",
-            role=ROLE_AUTHOR,
-            worktree_path=self.wt,
-        )
-        self.assertEqual(first["outcome"], "adopted_cross_role_handoff")
-        with self.assertRaises(ll.LeaseLifecycleError):
-            ll.adopt_lease(
-                self.db,
-                lease_id=lid,
-                adopter_session_id="author-worker-2",
-                role=ROLE_AUTHOR,
-                worktree_path=self.wt,
-            )
-        state = self.db.get_lease_workflow_state(lid)
-        self.assertEqual(state["lease"]["session_id"], "author-worker")
-        self.assertEqual(state["lease"]["adopted_by_session_id"], "author-worker")
-        self.assertEqual(state["assignment"]["session_id"], "author-worker")
-        self.assertEqual(state["lease"]["status"], "active")
-
-    def test_terminal_allocation_adoption_rejected(self) -> None:
-        res = self._controller_allocate(number=904)
-        lid = res["assignment"]["lease_id"]
-        # Abandon as terminal
-        proof = ll.AbandonProof(
-            dead_process=True,
-            missing_worktree=True,
-            no_open_pr=True,
-            no_live_mutation_risk=True,
-            owner_pid=99999999,
-            worktree_path="/nonexistent/for-843",
-        )
-        # Attach dead pid / missing wt for abandon eligibility
-        import sqlite3
-
-        conn = sqlite3.connect(self.db_path)
-        try:
-            conn.execute(
-                "UPDATE leases SET owner_pid = 99999999, worktree_path = ? WHERE lease_id = ?",
-                ("/nonexistent/for-843", lid),
-            )
-            conn.commit()
-        finally:
-            conn.close()
-        abandoned = ll.abandon_lease(
-            self.db,
-            lease_id=lid,
-            requester_session_id="author-worker",
-            proof=proof,
-        )
-        self.assertEqual(abandoned["outcome"], "abandoned")
-        with self.assertRaises(ll.LeaseLifecycleError) as ctx:
-            ll.adopt_lease(
-                self.db,
-                lease_id=lid,
-                adopter_session_id="author-worker",
-                role=ROLE_AUTHOR,
-            )
-        self.assertIn("abandoned", str(ctx.exception).lower())
-
-    def test_successful_adoption_read_after_write_ownership(self) -> None:
-        res = self._controller_allocate(number=905)
-        lid = res["assignment"]["lease_id"]
-        adopted = ll.adopt_lease(
-            self.db,
-            lease_id=lid,
-            adopter_session_id="author-worker",
-            role=ROLE_AUTHOR,
-            worktree_path=self.wt,
-        )
-        raw = adopted["read_after_write"]
-        self.assertEqual(raw["lease_id"], lid)
-        self.assertEqual(raw["session_id"], "author-worker")
-        self.assertEqual(raw["adopted_by_session_id"], "author-worker")
-        self.assertEqual(raw["adopted_from_session_id"], "ctrl-session")
-        # Re-fetch proves durable write
-        state = self.db.get_lease_workflow_state(lid)
-        self.assertEqual(state["lease"]["session_id"], raw["session_id"])
-        self.assertEqual(
-            state["lease"]["adopted_by_session_id"], raw["adopted_by_session_id"]
-        )
-
-    def test_genuine_abandoned_recovery_still_valid(self) -> None:
-        """Same-role author lease abandoned remains reclaimable via abandon path."""
-        same = allocate_next_work(
-            self.db,
-            session_id="author-worker",
-            role=ROLE_AUTHOR,
-            remote="prgs",
-            org="Scaled-Tech-Consulting",
-            repo="Gitea-Tools",
-            candidates=[self._ready_issue(906, "same-role")],
-            apply=True,
-            profile_name="prgs-author",
-            username="author-user",
-            allocation_mode=ALLOCATION_MODE_ROLE_SCOPED,
-        )
-        self.assertEqual(same["outcome"], OUTCOME_ASSIGNED)
-        lid = same["assignment"]["lease_id"]
-        import sqlite3
-
-        conn = sqlite3.connect(self.db_path)
-        try:
-            conn.execute(
-                "UPDATE leases SET owner_pid = 99999999, worktree_path = ? WHERE lease_id = ?",
-                ("/nonexistent/same-role", lid),
-            )
-            conn.commit()
-        finally:
-            conn.close()
-        proof = ll.AbandonProof(
-            dead_process=True,
-            missing_worktree=True,
-            no_open_pr=True,
-            no_live_mutation_risk=True,
-            owner_pid=99999999,
-            worktree_path="/nonexistent/same-role",
-        )
-        abandoned = ll.abandon_lease(
-            self.db,
-            lease_id=lid,
-            requester_session_id="author-worker-2",
-            proof=proof,
-        )
-        self.assertEqual(abandoned["outcome"], "abandoned")
-        # Foreign author cannot handoff-consume an abandoned non-handoff lease
-        with self.assertRaises(ll.LeaseLifecycleError):
-            ll.adopt_lease(
-                self.db,
-                lease_id=lid,
-                adopter_session_id="author-worker-2",
-                role=ROLE_AUTHOR,
-            )
-        # Reclaim path still works for expired/abandoned after force-expire
-        reclaimed = ll.reclaim_expired_lease(
-            self.db,
-            lease_id=lid,
-            session_id="author-worker-2",
-            role=ROLE_AUTHOR,
-            worktree_path=self.wt,
-        )
-        self.assertEqual(reclaimed["outcome"], "reclaimed")
-        self.assertEqual(reclaimed["assignment"]["session_id"], "author-worker-2")
-
-    def test_allocate_payload_includes_consume_identifiers(self) -> None:
-        res = self._controller_allocate(number=907)
-        self.assertIn("consume_allocation", res)
-        c = res["consume_allocation"]
-        for key in (
-            "tool",
-            "lease_id",
-            "assignment_id",
-            "required_role",
-            "required_profile",
-            "required_namespace",
-            "instructions",
-            "handoff_status",
-        ):
-            self.assertIn(key, c)
-        self.assertEqual(c["required_namespace"], "gitea-author")
-        self.assertEqual(c["required_profile"], "prgs-author")
-        self.assertIn("gitea_adopt_workflow_lease", c["instructions"])
-        self.assertTrue(res["lease_proof"]["cross_role_handoff"])
-        self.assertEqual(res["lease_proof"]["handoff_status"], "pending")
-
-    def test_same_role_allocation_remains_compatible(self) -> None:
-        res = allocate_next_work(
-            self.db,
-            session_id="author-worker",
-            role=ROLE_AUTHOR,
-            remote="prgs",
-            org="Scaled-Tech-Consulting",
-            repo="Gitea-Tools",
-            candidates=[self._ready_issue(908)],
-            apply=True,
-            profile_name="prgs-author",
-            username="author-user",
-        )
-        self.assertEqual(res["outcome"], OUTCOME_ASSIGNED)
-        self.assertNotIn("consume_allocation", res)
-        lid = res["assignment"]["lease_id"]
-        state = self.db.get_lease_workflow_state(lid)
-        # No cross-role handoff provenance
-        prov = state.get("provenance") or {}
-        self.assertFalse(prov.get("cross_role_handoff"))
-        # Owner resume still works
-        resume = ll.adopt_lease(
-            self.db,
-            lease_id=lid,
-            adopter_session_id="author-worker",
-            role=ROLE_AUTHOR,
-            worktree_path=self.wt,
-        )
-        self.assertTrue(resume["same_owner"])
-        self.assertEqual(resume["outcome"], "adopted_owner_resume")
-
-    def test_inspect_points_required_role_at_consume(self) -> None:
-        res = self._controller_allocate(number=909)
-        lid = res["assignment"]["lease_id"]
-        decision = ll.inspect_lease(
-            self.db, lid, caller_session_id="author-worker"
-        )
-        self.assertEqual(
-            decision["safe_next_action"], ll.SAFE_CONSUME_CROSS_ROLE
-        )
-        self.assertFalse(decision["block"])
-        self.assertEqual(decision["required_role"], ROLE_AUTHOR)
-
-    def test_db_cas_rejects_concurrent_second_consume(self) -> None:
-        res = self._controller_allocate(number=910)
-        lid = res["assignment"]["lease_id"]
-        # First consume via DB layer directly
-        first = self.db.adopt_lease(
-            lease_id=lid,
-            adopter_session_id="author-worker",
-            role=ROLE_AUTHOR,
-            worktree_path=self.wt,
-            provenance={
-                "cross_role_handoff": True,
-                "handoff_status": "adopted",
-                "required_role": "author",
-            },
-        )
-        self.assertEqual(first["outcome"], "adopted_cross_role_handoff")
-        # Second CAS must fail
-        with self.assertRaises(ForeignLeaseError):
-            self.db.adopt_lease(
-                lease_id=lid,
-                adopter_session_id="author-worker-2",
-                role=ROLE_AUTHOR,
-                worktree_path=self.wt,
-                provenance={
-                    "cross_role_handoff": True,
-                    "handoff_status": "pending",
-                    "required_role": "author",
-                },
-            )
-        state = self.db.get_lease_workflow_state(lid)
-        self.assertEqual(state["lease"]["session_id"], "author-worker")
-
-
-class MCPBoundaryAdoptRoleBindingTest(unittest.TestCase):
-    """#843 F1: MCP-boundary role binding for ``gitea_adopt_workflow_lease``.
-
-    The library-level wrong-role test calls ``lease_lifecycle.adopt_lease``
-    directly. These tests prove the MCP entry point derives the adopter role
-    authoritatively from the active authenticated profile and rejects any
-    caller-supplied role that disagrees, so a reviewer/merger profile cannot
-    consume an author handoff by passing ``role="author"``.
-    """
-
-    AUTHOR_PROFILE = {
-        "profile_name": "prgs-author",
-        "role": "author",
-        "allowed_operations": [
-            "gitea.read",
-            "gitea.pr.create",
-            "gitea.branch.push",
-        ],
-        "forbidden_operations": [],
-    }
-    REVIEWER_PROFILE = {
-        "profile_name": "prgs-reviewer",
-        "role": "reviewer",
-        "allowed_operations": [
-            "gitea.read",
-            "gitea.pr.review",
-            "gitea.pr.approve",
-            "gitea.pr.request_changes",
-        ],
-        "forbidden_operations": ["gitea.pr.create", "gitea.branch.push"],
-    }
-    MERGER_PROFILE = {
-        "profile_name": "prgs-merger",
-        "role": "merger",
-        "allowed_operations": ["gitea.read", "gitea.pr.merge"],
-        "forbidden_operations": ["gitea.pr.create", "gitea.branch.push"],
-    }
-    FOREIGN_AUTHOR_PROFILE = {
-        "profile_name": "dadeschools-author",
-        "role": "author",
-        "allowed_operations": [
-            "gitea.read",
-            "gitea.pr.create",
-            "gitea.branch.push",
-        ],
-        "forbidden_operations": [],
-    }
-
-    def setUp(self) -> None:
-        self._tmp = tempfile.TemporaryDirectory()
-        self.db_path = os.path.join(self._tmp.name, "cp.sqlite3")
-        self.db = ControlPlaneDB(self.db_path)
-        self.db.upsert_session(
-            session_id="ctrl-session",
-            role="controller",
-            profile="prgs-controller",
-            pid=99999999,
-        )
-        self.db.upsert_session(
-            session_id="author-worker",
-            role="author",
-            profile="prgs-author",
-            pid=os.getpid(),
-        )
-        self.wt = self._tmp.name
-
-    def tearDown(self) -> None:
-        self._tmp.cleanup()
-
-    def _ready_issue(self, number: int) -> WorkCandidate:
-        return WorkCandidate(
-            kind="issue",
-            number=number,
-            labels=("status:ready", "type:bug"),
-            title="handoff target",
-            priority=20,
-        )
-
-    def _handoff_lease(self, number: int = 843) -> str:
-        res = allocate_next_work(
-            db=self.db,
-            session_id="ctrl-session",
-            role=ROLE_CONTROLLER,
-            remote="prgs",
-            org="Scaled-Tech-Consulting",
-            repo="Gitea-Tools",
-            candidates=[self._ready_issue(number)],
-            apply=True,
-            profile_name="prgs-controller",
-            username="controller-user",
-            allocation_mode=ALLOCATION_MODE_CROSS_ROLE,
-        )
-        self.assertEqual(res["outcome"], OUTCOME_ASSIGNED)
-        self.assertEqual(res["required_role"], ROLE_AUTHOR)
-        return res["assignment"]["lease_id"]
-
-    def _call_adopt_tool(self, profile: dict, **kwargs):
-        import gitea_mcp_server as mcp_server
-
-        with (
-            patch.object(mcp_server, "get_profile", return_value=profile),
-            patch.object(
-                mcp_server,
-                "_control_plane_db_or_error",
-                return_value=(self.db, []),
-            ),
-        ):
-            return mcp_server.gitea_adopt_workflow_lease(
-                remote="prgs", **kwargs
-            )
-
-    def _assert_handoff_untouched(self, lease_id: str) -> None:
-        state = self.db.get_lease_workflow_state(lease_id)
-        self.assertEqual(state["lease"]["session_id"], "ctrl-session")
-        self.assertIsNone(state["lease"].get("adopted_by_session_id") or None)
-        self.assertEqual(state["lease"]["status"], "active")
-        self.assertEqual(state["provenance"]["handoff_status"], "pending")
-
-    def test_reviewer_profile_cannot_consume_author_handoff_via_role_author(
-        self,
-    ) -> None:
-        lid = self._handoff_lease(920)
-        result = self._call_adopt_tool(
-            self.REVIEWER_PROFILE,
-            lease_id=lid,
-            session_id="reviewer-worker",
-            role="author",
-            worktree_path=self.wt,
-        )
-        self.assertFalse(result["success"])
-        self.assertEqual(result["outcome"], "blocked")
-        self.assertEqual(result["profile_role_kind"], "reviewer")
-        self.assertEqual(result["supplied_role"], "author")
-        self.assertIn("does not match", result["reasons"][0])
-        self._assert_handoff_untouched(lid)
-
-    def test_merger_profile_cannot_consume_author_handoff_via_role_author(
-        self,
-    ) -> None:
-        lid = self._handoff_lease(921)
-        result = self._call_adopt_tool(
-            self.MERGER_PROFILE,
-            lease_id=lid,
-            session_id="merger-worker",
-            role="author",
-            worktree_path=self.wt,
-        )
-        self.assertFalse(result["success"])
-        self.assertEqual(result["outcome"], "blocked")
-        self.assertEqual(result["profile_role_kind"], "merger")
-        self._assert_handoff_untouched(lid)
-
-    def test_reviewer_profile_rejected_without_role_argument(self) -> None:
-        """Even without a spoofed role, the profile-derived role binds."""
-        lid = self._handoff_lease(922)
-        result = self._call_adopt_tool(
-            self.REVIEWER_PROFILE,
-            lease_id=lid,
-            session_id="reviewer-worker",
-            worktree_path=self.wt,
-        )
-        self.assertFalse(result["success"])
-        self.assertEqual(result["outcome"], "blocked")
-        self.assertIn("wrong role", result["reasons"][0].lower())
-        self._assert_handoff_untouched(lid)
-
-    def test_author_profile_mismatching_supplied_role_rejected(self) -> None:
-        lid = self._handoff_lease(923)
-        result = self._call_adopt_tool(
-            self.AUTHOR_PROFILE,
-            lease_id=lid,
-            session_id="author-worker",
-            role="reviewer",
-            worktree_path=self.wt,
-        )
-        self.assertFalse(result["success"])
-        self.assertEqual(result["outcome"], "blocked")
-        self.assertEqual(result["profile_role_kind"], "author")
-        self.assertEqual(result["supplied_role"], "reviewer")
-        self._assert_handoff_untouched(lid)
-
-    def test_foreign_profile_name_rejected_for_author_handoff(self) -> None:
-        """Provenance required_profile binds even when the role matches."""
-        lid = self._handoff_lease(924)
-        result = self._call_adopt_tool(
-            self.FOREIGN_AUTHOR_PROFILE,
-            lease_id=lid,
-            session_id="foreign-author-worker",
-            worktree_path=self.wt,
-        )
-        self.assertFalse(result["success"])
-        self.assertEqual(result["outcome"], "blocked")
-        self.assertIn("wrong profile", result["reasons"][0].lower())
-        self._assert_handoff_untouched(lid)
-
-    def test_author_profile_consumes_author_handoff(self) -> None:
-        lid = self._handoff_lease(925)
-        result = self._call_adopt_tool(
-            self.AUTHOR_PROFILE,
-            lease_id=lid,
-            session_id="author-worker",
-            role="author",
-            worktree_path=self.wt,
-        )
-        self.assertTrue(result["success"])
-        self.assertEqual(result["outcome"], "adopted_cross_role_handoff")
-        self.assertEqual(result["adopted_by_session_id"], "author-worker")
-        self.assertEqual(result["adopted_from_session_id"], "ctrl-session")
-        state = self.db.get_lease_workflow_state(lid)
-        self.assertEqual(state["lease"]["session_id"], "author-worker")
-        self.assertEqual(
-            state["lease"]["adopted_by_session_id"], "author-worker"
-        )
-        self.assertEqual(state["assignment"]["session_id"], "author-worker")
-        self.assertEqual(state["provenance"]["handoff_status"], "adopted")
-
-    def test_author_profile_consumes_author_handoff_without_role_argument(
-        self,
-    ) -> None:
-        lid = self._handoff_lease(926)
-        result = self._call_adopt_tool(
-            self.AUTHOR_PROFILE,
-            lease_id=lid,
-            session_id="author-worker",
-            worktree_path=self.wt,
-        )
-        self.assertTrue(result["success"])
-        self.assertEqual(result["outcome"], "adopted_cross_role_handoff")
-        state = self.db.get_lease_workflow_state(lid)
-        self.assertEqual(state["lease"]["session_id"], "author-worker")
-        self.assertEqual(state["lease"]["role"], "author")
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_webui_shell.py

@@ -0,0 +1,135 @@
+"""Tests for the Phase 1 operator console application shell (#638)."""
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from starlette.routing import Route
+from starlette.testclient import TestClient
+
+from webui import layout
+from webui.app import create_app
+from webui.nav import NAV_GROUPS, STUB_PAGES, nav_hrefs
+
+
+class TestShellNav(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_nav_group_labels_present(self):
+        text = self.client.get("/").text
+        for group in NAV_GROUPS:
+            with self.subTest(group=group.label):
+                self.assertIn(f">{group.label}<", text)
+
+    def test_phase1_group_labels_cover_expected_ia(self):
+        labels = {group.label for group in NAV_GROUPS}
+        for expected in (
+            "Health",
+            "Traffic",
+            "Runtime/Sessions",
+            "Projects",
+            "Inventory",
+            "Timeline",
+            "Policy",
+            "Insights",
+        ):
+            with self.subTest(label=expected):
+                self.assertIn(expected, labels)
+
+    def test_every_nav_href_resolves_to_a_get_route(self):
+        app = create_app()
+        get_paths = {
+            route.path
+            for route in app.routes
+            if isinstance(route, Route) and "GET" in route.methods
+        }
+        for href in nav_hrefs():
+            with self.subTest(href=href):
+                self.assertIn(href, get_paths, f"nav href {href} has no GET route")
+
+    def test_legacy_hrefs_still_navigable(self):
+        text = self.client.get("/").text
+        for href in ("/queue", "/projects", "/prompts", "/runtime",
+                     "/audit", "/worktrees", "/leases", "/actions"):
+            with self.subTest(href=href):
+                self.assertIn(f'href="{href}"', text)
+
+
+class TestShellBadges(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_mode_badge_present(self):
+        self.assertIn("mode: read-only", self.client.get("/").text)
+
+    def test_environment_badge_present(self):
+        self.assertIn("env:", self.client.get("/").text)
+
+    def test_default_environment_is_local(self):
+        self.assertEqual(layout.environment_label(), "local")
+
+    def test_remote_bind_reports_remote_environment(self):
+        import os
+
+        prior = os.environ.get("WEBUI_HOST")
+        os.environ["WEBUI_HOST"] = "10.0.0.5"
+        try:
+            self.assertEqual(layout.environment_label(), "remote")
+        finally:
+            if prior is None:
+                os.environ.pop("WEBUI_HOST", None)
+            else:
+                os.environ["WEBUI_HOST"] = prior
+
+    def test_docs_link_present(self):
+        text = self.client.get("/").text
+        self.assertIn(layout.DOCS_URL, text)
+        self.assertIn(">Docs<", text)
+
+
+class TestShellStubs(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_stub_routes_render_200(self):
+        for path, (title, _desc) in STUB_PAGES.items():
+            with self.subTest(path=path):
+                response = self.client.get(path)
+                self.assertEqual(response.status_code, 200, path)
+                self.assertIn(title, response.text)
+                self.assertIn("placeholder", response.text)
+
+    def test_stub_routes_are_read_only(self):
+        for path in STUB_PAGES:
+            with self.subTest(path=path):
+                response = self.client.post(path)
+                self.assertEqual(response.status_code, 405)
+                self.assertEqual(response.json()["error"], "read-only-mvp")
+
+    def test_stub_pages_carry_nav_and_badges(self):
+        response = self.client.get("/inventory")
+        self.assertIn("mode: read-only", response.text)
+        self.assertIn('href="/queue"', response.text)
+
+
+class TestShellHome(unittest.TestCase):
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_home_summarizes_console(self):
+        text = self.client.get("/").text
+        self.assertIn("Operator console", text)
+        self.assertIn("Phase 1", text)
+
+    def test_home_links_legacy_pages(self):
+        text = self.client.get("/").text
+        self.assertIn("MVP legacy pages", text)
+        for href in ("/queue", "/audit", "/leases"):
+            with self.subTest(href=href):
+                self.assertIn(f'href="{href}"', text)
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/app.py

@@ -12,6 +12,7 @@ from starlette.routing import Route
 
 from webui.deployment_boundary import deployment_snapshot
 from webui.layout import render_page
+from webui.nav import NAV_GROUPS, STUB_PAGES
 from webui.project_registry import (
     ProjectRegistry,
     RegistryError,
@@ -59,24 +60,62 @@ def _stub_page(title: str, description: str) -> HTMLResponse:
     return HTMLResponse(render_page(title=title, body_html=body))
 
 
+_LEGACY_PAGES = (
+    ("/queue", "Queue", "live PR and issue dashboard (#429)"),
+    ("/projects", "Projects", "registry and onboarding (#427)"),
+    ("/prompts", "Prompts", "canonical workflow prompt library (#428)"),
+    ("/runtime", "Runtime", "MCP health and stale-runtime detection (#430)"),
+    ("/audit", "Audit", "final-report paste and validator preview (#431)"),
+    ("/worktrees", "Worktrees", "branch hygiene dashboard (#432)"),
+    ("/leases", "Leases", "collision and lease visibility (#433)"),
+    ("/actions", "Actions", "gated write-action framework (#434)"),
+)
+
+
+def _render_home_nav_groups() -> str:
+    groups = []
+    for group in NAV_GROUPS:
+        items = "".join(
+            f'<li><a href="{item.href}">{item.label}</a>'
+            + ("" if item.status == "live" else " <span class=\"muted\">(stub)</span>")
+            + "</li>"
+            for item in group.items
+        )
+        groups.append(f"<h3>{group.label}</h3><ul>{items}</ul>")
+    return "".join(groups)
+
+
 async def home(_request: Request) -> HTMLResponse:
+    legacy = "".join(
+        f"<li><strong>{label}</strong> — {desc} "
+        f'(<a href="{href}">{href}</a>)</li>'
+        for href, label, desc in _LEGACY_PAGES
+    )
     body = (
         "<h2>Operator console</h2>"
-        "<p>Local entry point for MCP Control Plane operational views.</p>"
+        "<p>Read-only home for the MCP Control Plane Phase 1 operator console. "
-        "<ul>"
+        "Gitea, MCP capability gates, and canonical workflows remain the source "
-        "<li><strong>Queue</strong> — live PR and issue dashboard (#429)</li>"
+        "of truth; this console never mutates them.</p>"
-        "<li><strong>Projects</strong> — registry and onboarding (#427)</li>"
+        "<h2>Phase 1 surfaces</h2>"
-        "<li><strong>Prompts</strong> — canonical workflow prompt library (#428)</li>"
+        + _render_home_nav_groups()
-        "<li><strong>Runtime</strong> — MCP health and stale-runtime detection (#430)</li>"
+        + "<h2>MVP legacy pages</h2>"
-        "<li><strong>Audit</strong> — final-report paste and validator preview (#431)</li>"
+        "<ul>" + legacy + "</ul>"
-        "<li><strong>Worktrees</strong> — branch hygiene dashboard (#432)</li>"
-        "<li><strong>Leases</strong> — collision and lease visibility (#433)</li>"
-        "<li><strong>Actions</strong> — gated write-action framework (#434)</li>"
-        "</ul>"
     )
     return HTMLResponse(render_page(title="Home", body_html=body))
 
 
+async def phase_stub(request: Request) -> HTMLResponse:
+    """Graceful read-only placeholder for a not-yet-implemented Phase 1 surface."""
+    title, description = STUB_PAGES[request.url.path]
+    body = (
+        f"<h2>{title}</h2>"
+        f'<div class="stub"><p>{description}</p>'
+        "<p>Phase 1 shell placeholder — no write actions. Tracked under "
+        "epic #631.</p></div>"
+    )
+    return HTMLResponse(render_page(title=title, body_html=body))
+
+
 async def health(_request: Request) -> JSONResponse:
     bind_host = _request.app.state.webui_bind_host
     return JSONResponse({
@@ -438,6 +477,10 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
                 api_console_security_model,
                 methods=["GET"],
             ),
+            *[
+                Route(path, phase_stub, methods=["GET"])
+                for path in STUB_PAGES
+            ],
         ],
         exception_handlers={405: method_not_allowed},
     )

webui/layout.py

@@ -2,28 +2,66 @@
 
 from __future__ import annotations
 
-NAV_ITEMS = (
+import os
-    ("/", "Home"),
+
-    ("/queue", "Queue"),
+from webui.nav import NAV_GROUPS
-    ("/projects", "Projects"),
-    ("/prompts", "Prompts"),
-    ("/runtime", "Runtime"),
-    ("/audit", "Audit"),
-    ("/worktrees", "Worktrees"),
-    ("/leases", "Leases"),
-    ("/actions", "Actions"),
-)
 
 MVP_NOTICE = (
     "Read-only MVP — Gitea, MCP tools, and canonical workflows remain the "
     "source of truth. No mutation endpoints."
 )
 
+# Canonical docs entry point surfaced from the shell header (#638).
+DOCS_URL = (
+    "https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/src/branch/"
+    "master/docs/webui-local-dev.md"
+)
+
+_LOCAL_HOSTS = frozenset({"", "127.0.0.1", "localhost", "::1"})
+
+
+def environment_label() -> str:
+    """Classify the serving environment as ``local`` or ``remote`` (#638).
+
+    Derived from the same ``WEBUI_HOST`` default the app binds to; loopback
+    hosts are ``local``, anything else is ``remote``. Read-only signal only.
+    """
+    host = (os.environ.get("WEBUI_HOST", "127.0.0.1") or "").strip().lower()
+    return "local" if host in _LOCAL_HOSTS else "remote"
+
+
+def _render_nav() -> str:
+    groups_html = []
+    for group in NAV_GROUPS:
+        links = "".join(
+            f'<a href="{item.href}"'
+            + (' class="nav-stub"' if item.status == "stub" else "")
+            + f'>{item.label}</a>'
+            for item in group.items
+        )
+        groups_html.append(
+            '<div class="nav-group">'
+            f'<span class="nav-group-label">{group.label}</span>'
+            f'<span class="nav-group-links">{links}</span>'
+            "</div>"
+        )
+    return "".join(groups_html)
+
+
+def _render_badges() -> str:
+    env = environment_label()
+    return (
+        '<div class="header-badges">'
+        f'<span class="badge env-badge env-{env}">env: {env}</span>'
+        '<span class="badge mode-badge">mode: read-only</span>'
+        f'<a class="badge docs-link" href="{DOCS_URL}">Docs</a>'
+        "</div>"
+    )
+
 
 def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
-    nav_links = "".join(
+    nav_links = _render_nav()
-        f'<a href="{href}">{label}</a>' for href, label in NAV_ITEMS
+    header_badges = _render_badges()
-    )
     return f"""<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -53,21 +91,58 @@ def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
       padding: 0.75rem 1.25rem;
     }}
     header h1 {{
-      margin: 0 0 0.5rem;
+      margin: 0;
       font-size: 1.1rem;
       font-weight: 600;
     }}
+    .header-top {{
+      display: flex;
+      flex-wrap: wrap;
+      align-items: center;
+      justify-content: space-between;
+      gap: 0.5rem 1rem;
+      margin-bottom: 0.6rem;
+    }}
+    .header-badges {{ display: inline-flex; flex-wrap: wrap; gap: 0.4rem; }}
+    .env-badge.env-local {{ color: #8fd19e; border-color: #3d6b4a; }}
+    .env-badge.env-remote {{ color: #e0c27a; border-color: #6b5730; }}
+    .mode-badge {{ color: #9ec8f0; border-color: #3d5f7a; }}
+    a.docs-link {{
+      color: var(--accent);
+      border-color: var(--accent);
+      text-decoration: none;
+      text-transform: none;
+    }}
+    a.docs-link:hover {{ filter: brightness(1.12); }}
     nav {{
       display: flex;
       flex-wrap: wrap;
-      gap: 0.75rem 1rem;
+      gap: 0.5rem 1.25rem;
     }}
+    .nav-group {{
+      display: flex;
+      flex-direction: column;
+      gap: 0.15rem;
+    }}
+    .nav-group-label {{
+      font-size: 0.68rem;
+      text-transform: uppercase;
+      letter-spacing: 0.04em;
+      color: var(--muted);
+    }}
+    .nav-group-links {{ display: inline-flex; flex-wrap: wrap; gap: 0.6rem; }}
     nav a {{
       color: var(--accent);
       text-decoration: none;
       font-size: 0.9rem;
     }}
     nav a:hover {{ text-decoration: underline; }}
+    nav a.nav-stub {{ color: var(--muted); }}
+    nav a.nav-stub::after {{
+      content: " ·stub";
+      font-size: 0.7rem;
+      color: var(--muted);
+    }}
     main {{
       max-width: 52rem;
       margin: 0 auto;
@@ -166,7 +241,10 @@ def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
 </head>
 <body>
   <header>
-    <h1>MCP Control Plane</h1>
+    <div class="header-top">
+      <h1>MCP Control Plane</h1>
+      {header_badges}
+    </div>
     <nav>{nav_links}</nav>
   </header>
   <main>

webui/nav.py

@@ -0,0 +1,111 @@
+"""Navigation IA for the Phase 1 operator console shell (#638).
+
+Single source of truth for the console navigation so ``webui/layout.py`` and
+the ``webui/app.py`` route table stay aligned with epic #631. Read-only: every
+destination is a GET view or a Phase 1 placeholder. No mutation links.
+
+Nav groups follow the #631 Phase 1 information architecture: Health, Traffic,
+Runtime/Sessions, Projects, Inventory, Timeline, Policy (placeholder), and
+Insights (placeholder). Later-phase surfaces are declared as ``stub`` items and
+backed by ``STUB_PAGES`` so their nav links resolve to a graceful placeholder
+instead of a 404.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class NavItem:
+    """A single navigation destination.
+
+    ``status`` is ``"live"`` for implemented views and ``"stub"`` for Phase 1
+    placeholders whose backing view lands in a later child issue.
+    """
+
+    href: str
+    label: str
+    status: str = "live"
+
+
+@dataclass(frozen=True)
+class NavGroup:
+    label: str
+    items: tuple[NavItem, ...]
+
+
+NAV_GROUPS: tuple[NavGroup, ...] = (
+    NavGroup("Health", (
+        NavItem("/health", "Liveness"),
+    )),
+    NavGroup("Traffic", (
+        NavItem("/queue", "Queue"),
+        NavItem("/leases", "Leases"),
+        NavItem("/actions", "Actions"),
+    )),
+    NavGroup("Runtime/Sessions", (
+        NavItem("/runtime", "Runtime health"),
+        NavItem("/sessions", "Sessions", "stub"),
+    )),
+    NavGroup("Projects", (
+        NavItem("/projects", "Projects"),
+    )),
+    NavGroup("Inventory", (
+        NavItem("/inventory", "Inventory", "stub"),
+        NavItem("/worktrees", "Worktrees"),
+    )),
+    NavGroup("Timeline", (
+        NavItem("/timeline", "Timeline", "stub"),
+    )),
+    NavGroup("Policy", (
+        NavItem("/policy", "Policy", "stub"),
+        NavItem("/prompts", "Prompts"),
+    )),
+    NavGroup("Insights", (
+        NavItem("/insights", "Insights", "stub"),
+        NavItem("/audit", "Audit"),
+    )),
+)
+
+
+# Phase 1 placeholder destinations whose backing views land in later child
+# issues of epic #631. Each maps a path to (title, description). Routes are
+# registered so nav links resolve to a graceful, read-only stub page.
+STUB_PAGES: dict[str, tuple[str, str]] = {
+    "/sessions": (
+        "Sessions",
+        "Active session, capability, and role inventory. Backed by the unified "
+        "inventory API (#636) once it lands.",
+    ),
+    "/inventory": (
+        "Inventory",
+        "Unified sessions, leases, locks, namespaces, and worktree inventory. "
+        "Backed by the Phase 1 inventory API (#636).",
+    ),
+    "/timeline": (
+        "Timeline",
+        "Workflow event timeline across issues and PRs. A later Phase 1 surface.",
+    ),
+    "/policy": (
+        "Policy",
+        "Capability and role policy surface. Placeholder until a later phase.",
+    ),
+    "/insights": (
+        "Insights",
+        "Aggregate operational insights and trends. Placeholder until a later "
+        "phase.",
+    ),
+}
+
+
+def iter_nav_items():
+    """Yield every ``NavItem`` across all groups in declared order."""
+    for group in NAV_GROUPS:
+        for item in group.items:
+            yield item
+
+
+def nav_hrefs() -> tuple[str, ...]:
+    """Return every navigation href in declared order."""
+    return tuple(item.href for item in iter_nav_items())