ThothII/.superpowers/sdd/2026-08-03-git-workspace-registry/task-7-report.md

Task 7 report — revision-pinned sessions

Delivered

• New-session requests may carry workspaceId, provider, model, and thinking. The backend resolves the active operational registry revision, enforces its LLM policy, and persists the workspace ID/revision with the selected LLM settings.
• The harness manifest and tht session new support the optional, backward-compatible workspace_id and workspace_revision fields.
• Resume resolves the manifest's retained snapshot, including after later registry publication. A missing retained revision returns a sanitized workspace_revision_unavailable response. Legacy manifests retain the prior workspace behavior and are marked with a visible warning on GET /sessions/:id.
• /settings is now a non-mutating compatibility endpoint: installation defaults remain readable, while anonymous workspace/provider/model/thinking selections are no longer written to backend settings or principal preferences.

TDD evidence

• RED: npx vitest run test/routes-sessions.test.ts test/routes-settings.test.ts failed for the new immutable-snapshot and no-settings-mutation assertions; the manifest test failed because new_session_manifest did not accept workspace revision fields.
• GREEN: npx vitest run test/tht-runner.test.ts test/routes-sessions.test.ts test/routes-settings.test.ts && npx tsc --noEmit -p . completed with 97 passing tests and a clean type check.
• GREEN: THT_HOME=/private/tmp/thothii-task7-home .venv/bin/pytest tests/test_session_documents.py tests/test_session_mutations.py -q completed with 22 passing tests.
• git diff --check completed cleanly.

Verification note

The unscoped backend suite was also run. The Task 7 code regressions in test/tht-runner.test.ts were fixed; the remaining failures were existing sandbox restrictions on tests that listen on 127.0.0.1 (listen EPERM: operation not permitted in SSE/e2e health tests), not application assertions.