governance-start

Under the identity ontology v2 (docs/ontology/identity.md), a fresh process-instance mints fresh governance-identity. Lineage is declared via parent_agent_id, not resumed via token. This command starts a session in that posture.

Start by checking the local workspace cache inventory.

Use the shared helper in this repo:

• scripts/client/session_cache.py list

Then run the workspace start guard:

• python3 scripts/dev/workspace_closeout.py --start-check

This fails on dirty git state or non-baseline repo-rooted processes from a prior session, and writes a fresh process baseline only when the workspace is clean.

It also classifies workspace isolation: editing the shared/main checkout (or the deploy worktree) instead of an agent-owned linked worktree is surfaced as an advisory warning by default. Add --require-worktree to make that a hard failure (strict mode) once the fleet reliably works in worktrees — the advisory→strict rollout mirrors the Surface Lease Plane. Rationale: docs/proposals/active/worktree-isolation-vs-lease-default.md.

A cached parent_agent_id from a prior session is context, not a lineage instruction: co-location in this workspace is not lineage, and the prior session is almost always still a sibling rather than an exited predecessor. Ignore any legacy continuity_token field for startup; tokens are only for advanced same-live-owner diagnostic rebinds.

Call onboard() against UNITARES using the strongest honest mode:

• default: a fresh session onboards fresh — pass force_new=true with no parent_agent_id
• declare lineage only for a real causal event: a dispatched subagent (parent_agent_id=<dispatcher uuid>, spawn_reason="subagent", usually set automatically by the dispatcher) or a handoff from a finished prior session (parent_agent_id=<prior uuid>, spawn_reason="explicit"). Declaring a currently-live agent as parent is rejected (lineage_coincidental_rejected) and the claim cleared, unless spawn_reason marks a dispatched child (subagent, dispatch, dialectic_reviewer) or a compaction continuation — those relationships expect the parent to still be live.
• include model_type when the current runtime is clear from context
• do not invent a display name unless the user asked for one

start_session(...) is an equivalent alias (same parameters, same rules). Invoking the alias returns the normalized agent-experience envelope — next_action/state_summary first, with agent_uuid, client_session_id, agent_id, display_name, is_new, identity_resolution_outcome and a compact identity_assurance (tier, session_source, caller_proven, baseline) lifted to the top level. For a plain fresh mint (response_shape: "routine") the canonical payload is not repeated beneath them. That includes a mint on a thread earlier sessions occupied, where state_summary carries episode_fork_kind: "sibling_locus" and the earlier node's predecessor_uuid (co-location is not lineage; do not declare it as a parent), and a named mint, whose resident_registration verdict is lifted in compact form (status, on_roster, and for not_on_roster (and, briefly, caller_supplied_tags) a short detail: what it costs, that this identity cannot gain the tags, and the fix: add the name to the roster, restart, mint fresh). Any other mint (a resume miss, a reactivated identity, a declared lineage, a spawn reason other than new_session, a sibling whose earlier nodes were pruned, a label rename, an unrecognised notice), and any call with response_mode="full", also carries it under raw_governance; for a mint that was not plain, response_shape_reason names the field that kept it. Read the uuid from agent_uuid. The canonical payload defaults to response_mode="minimal", which omits session_resolution_source and continuity_token_supported; pass response_mode="full" when you need session_resolution_source for the cache below.

Do not use bare identity(agent_uuid=<uuid>, resume=true). UUID alone is an unsigned claim and is hijack-shaped under strict identity mode.