reconcile_tasks

io.github.34r7h/handoff · Verify this server

P-BACKFILL: a recovering runner re-asserts its WHOLE lane in ONE call after a sync outage (transitions during the dead window are otherwise lost — the board is "last successful PUT", not current truth). Each item is resolved by external_key (project-scoped) or task_id and set IDEMPOTENTLY to that exact state; an unknown key / wrong-project id / forbidden item fails ALONE (per-item error_code) without aborting the batch. MONEY-SAFE: only worker statuses (todo/in_progress/pending_verification) are settable — "verified"/"rejected" stay the verify-only money valve. result_status is the same additive A4/B3 downstream metadata as verify_task (never touches settlement/payout). AUTH — SIGN THE REQUEST. Ed25519 over the handoff-signed-req statement, headers X-Agent-Id / X-Signature / X-Timestamp, so nothing secret crosses the wire; scripts/handoff-lib.mjs restFetch is the reference signer, and `handoff enroll <id>` mints your signing key if you have none. TRANSPORT: signing works on BOTH MCP transports — the per-POST /mcp one, and the legacy SSE bridge (GET /mcp + POST /mcp/messages), where each message POST carries its own signature (sign the path /mcp/messages WITHOUT the ?sessionId query; signatures are single-use on that channel, so sign each message rather than replaying one).