MegaTask (#248)

* feat(batch): batch_id + collision descriptor columns

Sequenced batch intake ("Mega task") foundation: tasks.batch_id (indexed)
groups a batch of top-level tasks created together; intends_to_touch (text[]),
adds_migration and touches_shared (bool, NOT NULL default false) are the
per-task collision surface the SequencingService will read to wire dependency
waves. Mirrored on the Task model + TaskCreateRequest and wired through
TaskService.create. Migration 046 (real upgrade->downgrade->upgrade verified
vs a throwaway pgvector PG); a non-batch task declares no surface (defaults).

Task 1 of the 0.11.0 sequenced-batch-intake plan.

* feat(batch): flag + draft collision descriptors

Default-off ROBOCO_BATCH_INTAKE_ENABLED (config + FEATURE_FLAGS + panel card);
the propose_draft tool doc + the TS DraftProposal gain the per-task collision
surface intends_to_touch / adds_migration / touches_shared. The draft is a loose
dict so the descriptors ride it through the relay intact (test asserts the
forwarded payload); the analyzer (Task 3) reads them to wire dependency waves.

Task 2 of the 0.11.0 sequenced-batch-intake plan.

* feat(batch): deterministic collision-sequencing analyzer

SequencingService.analyze turns a batch's per-task collision surfaces into a
dependency DAG + execution waves — correctness in CODE, not agent judgment.
Rules in order: file overlap serializes (more-important first), migrations form
a serial chain (no concurrent Alembic heads), touches_shared runs last, cell
contention warns (never serializes); then dedupe, existence + cycle check, and
Kahn topological layering. Pure (no DB/services); SequencingError on a cycle or
out-of-range edge.

Golden test reproduces the CEO's hand-sequenced 4 waves of the 11-item
guard-core-app batch (the effort that deadlocked the Main PM): S6 alone last,
the R1/R3/R4 migration chain, R2/R3/S8 serialized on the shared threat service,
S1/S2/S7 in one parallel wave.

Task 3 of the 0.11.0 sequenced-batch-intake plan.

* chore(batch): brand the user-facing surfaces "MegaTask"

The user-facing name is MegaTask: the feature-flag label is "MegaTask intake",
the panel flag-card and the config description lead with MegaTask. Internal
names stay technical (batch_intake_enabled, batch_id, SequencingService).

* chore(batch): drop the feature flag — MegaTask is a core intake scope

MegaTask is additive and opt-in by its own nature (the Prompter proposes a
batch only when the CEO asks for several tasks; single-task intake is
unchanged), so there is no risk surface a flag protects — 'don't create a
MegaTask' is the off switch. Remove batch_intake_enabled from config, the
FEATURE_FLAGS registry, the panel flag card, and its tests. MegaTask will be
a third scope option in the Intake modal (single-cell / multi-project /
MegaTask), not a toggle.

* feat(batch): MegaTask identity predicate + orchestrator branchless recognition

The single source of truth for the umbrella's exemptions: pure
is_batch_umbrella / is_batch_root_subtask / is_branchless_coordination
(foundation/policy/batch.py) — an umbrella has a batch_id and is top-level; a
root-subtask shares the batch_id but is parented. The orchestrator's
_is_coordination_task now consults is_branchless_coordination, so a MegaTask
umbrella is recognized as doing no git of its own (git-exempt at spawn-readiness
/ stuck-detection) exactly like a product fan-out root. Non-batch behavior is
identical (the predicate reduces to the old no-project+product check; the
orchestrator coordination suite stays green), and the umbrella branch is inert
until the create path exists.

First slice of the MegaTask umbrella enforcement (branchless guard).

* feat(batch): branchless umbrella guard across the git-exemption sites

A MegaTask umbrella does no git of its own — every git-exemption site in
TaskService now consults the shared is_branchless_coordination predicate
instead of an inline product-only check, so the umbrella's exemptions
cannot drift between sites:

- the claimed->in_progress branch gate (GitContext.is_coordination) lets
  an unbranched umbrella reach in_progress and delegate;
- _ensure_branch_for_task short-circuits an umbrella to "" instead of the
  misconfigured raise (the claim path ignores the return, treating it as
  branchless);
- CEO-reject routing sends a rejected umbrella to the Main PM in PENDING
  (needs_revision is developer-claim-only and would deadlock it).

Covers both shapes via the predicate (product fan-out root OR umbrella);
a batch root-subtask keeps its own branch/PR. Adds orchestrator
recognition tests for the umbrella plus claim/branch/reject integration
tests.

* feat(batch): umbrella assembles no PR; completes branchless

submit_root now hard-rejects a MegaTask umbrella up front (a preflight
that also folds in the unknown-role refusal to stay within the
return-count budget): the umbrella spans many projects with no single
master, so each root-subtask opens and is reviewed on its own PR — the
umbrella never enters the in-path review gate. The Main PM completes it
directly once every root-subtask is terminal.

Umbrella completion needs no new code: it is branchless (no branch_name),
so _main_pm_complete_guard already accepts it from in_progress, checks
all_subtasks_terminal, and main_pm_complete walks it to awaiting_pm_review
and escalates to the CEO with no PR creation — exactly the product
fan-out root path. Adds the submit_root-reject and umbrella-completion
gateway tests; pins batch_id=None on the normal-root submit_root test
(a MagicMock auto-attr would otherwise read as an umbrella).

* feat(batch): MegaTask create path — umbrella + sequenced root-subtasks

PrompterService.confirm_live_batch turns N confirmed drafts into a real
MegaTask: it builds each draft's collision surface, runs the pure
SequencingService to get conflict-free waves, creates the branchless
umbrella (batch_id, no project/product), then one root-subtask per draft
(own project, parent=umbrella, sequence=wave index, descriptors), and
wires the analyzer's edges through add_dependency so the existing
dependency-gate runs the waves in order. The route picks the start path
like a single confirm: 'board' holds the root-subtasks in BACKLOG for the
batch review; 'main_pm' creates them PENDING so wave 0 dispatches at once.

create_task_from_draft gains a BatchPlacement (parent/batch/sequence/
team_override) and forwards the collision descriptors; the exactly-one-
target rule (here and the TaskService.create invariant) is relaxed for an
umbrella, which legitimately targets neither. New route
POST /live/{session}/confirm-batch + BatchConfirmRequest mirror the single
confirm. Adds the structural-invariant + board-hold + empty-batch tests.

* feat(batch): release MegaTask root-subtasks on CEO approval; board awareness

The board route holds a MegaTask's root-subtasks in BACKLOG so the work
waits for the batch review. approve_and_start (CEO gate #1, board->Main PM)
now releases them via _activate_batch_root_subtasks: each held child flips
BACKLOG -> PENDING + team=main_pm so the dependency-gate dispatches wave 0.
No-op for a non-umbrella; idempotent (children past BACKLOG untouched).

The Product Owner and Head of Marketing identity prompts gain a MegaTask
section so they review the whole batch + wave plan and adjust scope before
sign-off (they review drafts; the umbrella is their unit). Also extracts
the create() target invariant into _require_target_or_umbrella to keep the
method under the complexity gate after the umbrella exemption. Adds the
umbrella-approval activation test.

* feat(batch): multi-project intake scope for MegaTask

A MegaTask spans several possibly-unrelated repos, so the intake chat can
now be scoped to an explicit project list (not just one project or one
product). StartLiveRequest gains project_ids; /live/start threads it
through start/spawn_intake_session -> _spawn_intake_container ->
_clone_intake_scope. The multi-repo clone machinery already existed for
products; _intake_scope_slugs now also resolves an explicit project_ids
set (split into _slugs_for_project_ids / _slugs_for_product), cloning each
repo with the first as the primary cwd and the siblings readable. Scope
validation is now 'exactly one of project_slug / product_id / project_ids'
via the shared _require_one_intake_scope. Adds scope-resolution, spawn,
and route tests for the MegaTask path.

* feat(batch): propose_batch intake tool (MegaTask multi-draft hand-off)

The intake agent can now hand the panel a whole MegaTask in one tool call.
Both intake paths gain propose_batch alongside propose_draft:
- Claude (intake_driver): a propose_batch tool registered on the in-SDK
  MCP server + allowlisted; the driver intercepts the ToolUseBlock and
  emits ONE StreamChunk(kind="batch") carrying {drafts:[...], title}.
- grok (intake_server): a propose_batch tool that POSTs a "batch" relay
  event via the shared _post_event helper (post_draft/post_batch).

A batch carries N drafts, each the propose_draft shape PLUS its own
project_id (a MegaTask spans unrelated repos) and collision surface so the
analyzer sequences the waves. The prompter prompt documents the MegaTask
scope + when to call propose_batch. Adds Claude-normalize and grok-relay
tests for the batch path.

* feat(batch): MegaTask intake panel — third scope, batch review, waves

The panel now drives a MegaTask end to end. The intake modal gains a
third scope, 'MegaTask', beside Single cell and Board-led: a multi-project
checklist (a MegaTask spans several possibly-unrelated repos), validated
to at least two. start() sends project_ids; use-prompter accumulates the
agent's single propose_batch hand-off as a 'batch' SSE event into a
BatchProposal and lands in a new batch_preview state.

A new BatchReviewCard lists every proposed task with its target project +
collision-surface badges (migration / shared) and offers one start path
for the whole batch — Board review & Start or Approve & Start — wired to
confirmBatch → POST /confirm-batch. The success card shows the sequenced
result: N tasks in M waves (+ any advisory notes). prompter.ts gains the
DraftScale 'megatask' + the BatchConfirm payload/result types; the SSE
client allows the 'batch' kind. Panel typecheck + lint + 113 tests green.

* docs(batch): MegaTask across changelog, CLAUDE.md, site, and RAG

The four documentation obligations for the MegaTask feature:
- CHANGELOG: an Unreleased entry covering the umbrella model, sequencing,
  multi-project intake, propose_batch, and the create/approval path.
- CLAUDE.md: a MegaTask section (identity predicate, umbrella/root-subtask
  hierarchy, sequencing rules, intake + create path, board activation).
- Published site: a user-facing company/megatask.md (scopes, waves, the
  umbrella, the two start buttons) + nav entry; a pointer added to the
  intake chapter of the Tour.
- RAG corpus: workflows/megatask.md so the Main PM (and any agent) can
  retrieve the umbrella's branchless / no-PR / completion rules at runtime.

The runtime concurrent-migration guard is intentionally NOT added: the
analyzer already chains migration-adders into dependencies and the
dependency-gate serializes them, so a separate guard would be dead code.

* feat(batch): batch_id guardrail + wave preview + batch_id on TaskResponse

Guardrail (CEO): a batch_id is denied on any task that is not a well-formed
MegaTask member. is_valid_batch_shape permits batch_id only on an umbrella
(no parent → must target neither project nor product) or a root-subtask
(has a parent → exactly one target); TaskService.create enforces it AND
verifies a root-subtask's parent is the batch umbrella (same batch_id,
top-level). This closes a latent hole: is_batch_umbrella is true for a
batch_id + no-parent task even with a project, so a stray batch_id could
have spoofed the branchless branch-gate / no-PR exemption. (The public
task API never exposed batch_id for write; this guards the service layer.)

Wave preview: PrompterService.preview_batch + POST .../preview-batch
compute a MegaTask's waves from the proposed drafts WITHOUT creating
anything, so the panel can show the sequencing before confirm. Extracted
_sequence_drafts as the single source shared by preview and confirm, so
the previewed waves are exactly the ones wired.

TaskResponse now carries batch_id so the panel can badge the umbrella.

* feat(batch): MegaTask review — project editor, wave preview, persistence, badge

Closes the panel gaps in the MegaTask review experience:
- Per-task project editor: each proposed task gets an inline project
  Select (updateBatchDraftProject), so a task the agent put in the wrong
  or no repo can be fixed before launch — not only by re-chatting. Launch
  stays blocked until every task has a project.
- Wave preview: on a batch proposal the panel fetches POST .../preview-batch
  (no task created) and shows the conflict-free wave plan, so the human
  reviews the sequencing before confirming.
- Refresh durability: the MegaTask review (batch + waves + projectIds) is
  persisted, so a browser reload mid-review restores it like a single draft.
- MegaTask badge: TaskResponse exposes batch_id, the panel Task type
  carries it, and the task table badges the umbrella row 'MegaTask'.

Panel typecheck + lint + 113 tests green.

* test(batch): stub task carries batch_id for task_to_response

task_to_response now serializes batch_id (TaskResponse field), so the
_stub_task SimpleNamespace fixture must provide it — without it the reader
hit AttributeError, failing the 8 task-schema serialization/enrichment
tests. Test-only; the real TaskTable carries the column (migration 046).

* fix(batch): close MegaTask audit gaps — completion crash, analyzer cycle, guardrails

An adversarial multi-agent audit of the feature surfaced 20 verified gaps;
this closes the backend ones.

HIGH:
- Umbrella completion crashed. escalate_to_ceo hard-required a pr_number,
  which a branchless umbrella never has, so main_pm_complete dereferenced
  None. Both pr_number gates now waive a MegaTask umbrella (escalate_to_ceo
  + the awaiting_pm_review->awaiting_ceo_approval lifecycle gate via a new
  GitContext.is_umbrella), and main_pm_complete guards a None return. The
  completion test had mocked escalate_to_ceo, hiding it — now a real
  service test covers the waiver.
- The collision analyzer could fabricate a cycle (a touches_shared +
  adds_migration draft overlapping another migration draft) and raise
  SequencingError — a bare ValueError that escaped as an opaque 500. The
  migration chain is now shared-last-aware (never contradicts rule 3), and
  _sequence_drafts translates SequencingError to a clean 400.

MEDIUM:
- Collisions are now project-scoped: two repos can't collide on a
  coincidental path or serialize independent migrations (DraftSurface
  carries project_id; rules 1/2/3 respect it).
- The batch_id guardrail ran only at create. update() + the PATCH
  null-clear path now re-assert is_valid_batch_shape, so a mutation can't
  break a member's shape and spoof the branchless exemption.
- A draft missing title/acceptance_criteria now raises ValidationError
  (was a bare KeyError -> 500).
- confirm_live_batch re-asserts every draft targets a scoped project and
  the batch spans >=2 distinct projects (project_ids added to the request).
- Route-level tests for confirm-batch / preview-batch.

LOW: strict multi-repo clone (fail loud on any unresolvable project);
malformed/empty propose_batch surfaces an error chunk (Claude) / refuses
to POST (grok) instead of silently acking; dropped malformed drafts are
counted and surfaced; stale grok intake docstrings updated.

* fix(batch): MegaTask panel + doc audit gaps

Frontend half of the audit fixes:
- The confirm payload now carries project_ids (the schema requires it), and
  the panel re-checks every task targets one of the scoped repos before
  launching, naming the offending task.
- The Review-MegaTask project picker is filtered to the scoped repos and
  the per-task validity (border + launch gate) keys off scoped membership,
  so a task can only be (re)pointed at an in-scope project — also fixing the
  case where the agent emitted a non-UUID / unknown project.
- Dropped malformed drafts are surfaced as a chat error so the human knows
  the batch shrank instead of silently confirming fewer tasks.
- Doc wording: a wave releases on the previous wave's terminal state
  (normally a merge; a cancellation releases it too), not strictly 'merged'.

* test(batch): lock the CEO's EXACT 4-wave hand-sequencing as the golden bar

The golden test asserted the constraints (S6 last, the migration chain, the
shared-threats serialization, S1/S2/S7 parallel) but not the full wave
partition. The bar for MegaTask is 'reproduce my exact waves or it's not
done', so assert the exact 4-wave partition the analyzer produces for the
guard-core-app batch:
  wave 1: R1 R2 S1 S2 S3 S5 S7  ·  wave 2: R3  ·  wave 3: R4 S8  ·  wave 4: S6
Confirmed unchanged by the audit's analyzer fixes (no migration is shared;
single project).

* fix(batch): tolerate a stub task in assert_batch_shape_intact

The batch-shape re-validation read task.batch_id directly, but update()'s
partial-caller contract is exercised with a SimpleNamespace stub that has no
batch_id column → AttributeError. Use getattr(..., None) for batch_id and the
shape fields so the guard no-ops on any task lacking the column (a stub, or a
non-batch task) while still enforcing on a real batch member.

* fix(orchestrator): authenticate internal API self-calls with the system identity

The dispatcher httpx clients were built without an agent identity, so the
orchestrator's self-PATCHes to /api/tasks/{id} (auto-block, auto-resume,
auto-recover, SLA annotation) were rejected 401 "Missing X-Agent-ID" and
silently no-op'd. The auto-resume that lifts a PM's paused parent could never
write, so paused/blocked parents stayed wedged and stranded their dependents
(the fe-pm/be-pm respawn churn seen in prod).

Header propagation was inconsistent across the separate AsyncClient call-sites:
only the main dispatch client carried the system identity; the readiness and
sweep clients did not. Hoist the identity into a shared _SYSTEM_API_HEADERS
constant and apply it to every API-facing dispatcher client. The system role
holds TaskAction.ASSIGN, so it is authorized for the audited admin_set_status
path those write routes use. The external provider-recovery probe client is
intentionally left untouched.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/agent_sdk/test_intake_driver.py

@@ -158,6 +158,72 @@ def test_normalize_other_tool_stays_tool_use() -> None:
     assert chunks[0].tool == "Read"
 
 
+def test_normalize_propose_batch_becomes_one_batch_chunk() -> None:
+    # A MegaTask: one propose_batch call with N drafts → a single `batch` chunk
+    # carrying all of them + the title (not a tool_use chunk, not N draft chunks).
+    msg = AssistantMessage(
+        [
+            ToolUseBlock(
+                "propose_batch",
+                {
+                    "drafts": [
+                        {"title": "SaaS work", "acceptance_criteria": ["a"]},
+                        {"title": "OSS core work", "acceptance_criteria": ["b"]},
+                    ],
+                    "title": "Guard Core triple",
+                },
+            )
+        ]
+    )
+    chunks = normalize(msg)
+    assert [c.kind for c in chunks] == ["batch"]
+    assert chunks[0].data["title"] == "Guard Core triple"
+    assert [d["title"] for d in chunks[0].data["drafts"]] == [
+        "SaaS work",
+        "OSS core work",
+    ]
+
+
+def test_normalize_propose_batch_namespaced_name() -> None:
+    msg = AssistantMessage(
+        [
+            ToolUseBlock(
+                "mcp__intake__propose_batch",
+                {"drafts": [{"title": "X", "acceptance_criteria": []}]},
+            )
+        ]
+    )
+    assert [c.kind for c in normalize(msg)] == ["batch"]
+
+
+def test_normalize_propose_batch_empty_or_titleless_emits_error() -> None:
+    # No usable drafts → an ERROR chunk (the panel renders it), not silence with
+    # the tool falsely acking success.
+    empty = AssistantMessage([ToolUseBlock("propose_batch", {"drafts": []})])
+    assert [c.kind for c in normalize(empty)] == ["error"]
+    titleless = AssistantMessage(
+        [ToolUseBlock("propose_batch", {"drafts": [{"acceptance_criteria": []}]})]
+    )
+    assert [c.kind for c in normalize(titleless)] == ["error"]
+
+
+def test_normalize_propose_batch_reports_dropped_count() -> None:
+    # One well-formed, one malformed → batch chunk with dropped=1 so the panel can
+    # tell the human the batch shrank.
+    msg = AssistantMessage(
+        [
+            ToolUseBlock(
+                "propose_batch",
+                {"drafts": [{"title": "Good"}, {"no_title": True}]},
+            )
+        ]
+    )
+    chunks = normalize(msg)
+    assert [c.kind for c in chunks] == ["batch"]
+    assert chunks[0].data["dropped"] == 1
+    assert [d["title"] for d in chunks[0].data["drafts"]] == ["Good"]
+
+
 def test_normalize_propose_draft_without_title_is_ignored() -> None:
     msg = AssistantMessage(
         [ToolUseBlock("propose_draft", {"draft": {"acceptance_criteria": []}})]

tests/unit/api/test_schemas_tasks.py

@@ -299,6 +299,7 @@ def _stub_task(*, with_project: bool = False) -> SimpleNamespace:
         created_by=uuid4(),
         assigned_to=None,
         parent_task_id=None,
+        batch_id=None,
         dependency_ids=[],
         blocker_ids=[],
         created_at=datetime.now(UTC),

tests/unit/foundation/policy/test_batch.py

@@ -0,0 +1,91 @@
+"""MegaTask identity + branchless-coordination predicates (the single source of
+truth the orchestrator / git-gate / branch-creation / reject-routing consult)."""
+
+from __future__ import annotations
+
+from uuid import uuid4
+
+from roboco.foundation.policy.batch import (
+    is_batch_root_subtask,
+    is_batch_umbrella,
+    is_branchless_coordination,
+    is_valid_batch_shape,
+)
+
+
+def test_umbrella_is_batch_id_set_and_top_level() -> None:
+    bid = uuid4()
+    assert is_batch_umbrella(batch_id=bid, parent_task_id=None)
+    assert not is_batch_umbrella(batch_id=bid, parent_task_id=uuid4())  # a child
+    assert not is_batch_umbrella(batch_id=None, parent_task_id=None)  # a normal root
+
+
+def test_root_subtask_is_batch_id_set_and_parented() -> None:
+    bid = uuid4()
+    assert is_batch_root_subtask(batch_id=bid, parent_task_id=uuid4())
+    assert not is_batch_root_subtask(batch_id=bid, parent_task_id=None)  # the umbrella
+    assert not is_batch_root_subtask(batch_id=None, parent_task_id=uuid4())
+
+
+def test_branchless_coordination_covers_product_root_and_umbrella() -> None:
+    # product fan-out coordination root: no project, carries a product
+    assert is_branchless_coordination(project_id=None, product_id=uuid4())
+    # MegaTask umbrella: batch_id set, top-level
+    assert is_branchless_coordination(
+        project_id=None, product_id=None, batch_id=uuid4(), parent_task_id=None
+    )
+
+
+def test_branchless_coordination_excludes_normal_and_root_subtasks() -> None:
+    # a normal project task does its own git
+    assert not is_branchless_coordination(project_id=uuid4(), product_id=None)
+    # a root-subtask (has a parent + a project) is NOT the branchless umbrella
+    assert not is_branchless_coordination(
+        project_id=uuid4(),
+        product_id=None,
+        batch_id=uuid4(),
+        parent_task_id=uuid4(),
+    )
+    # genuinely unroutable (none of project / product / batch) stays gated
+    assert not is_branchless_coordination(project_id=None, product_id=None)
+
+
+def test_valid_batch_shape_allows_umbrella_and_root_subtask() -> None:
+    bid = uuid4()
+    # umbrella: batch_id, no parent, NO target
+    assert is_valid_batch_shape(
+        batch_id=bid, parent_task_id=None, project_id=None, product_id=None
+    )
+    # root-subtask: batch_id, a parent, exactly one target (project)
+    assert is_valid_batch_shape(
+        batch_id=bid, parent_task_id=uuid4(), project_id=uuid4(), product_id=None
+    )
+    # root-subtask targeting a product instead is also well-formed
+    assert is_valid_batch_shape(
+        batch_id=bid, parent_task_id=uuid4(), project_id=None, product_id=uuid4()
+    )
+    # no batch_id → unconstrained here
+    assert is_valid_batch_shape(
+        batch_id=None, parent_task_id=None, project_id=uuid4(), product_id=None
+    )
+
+
+def test_valid_batch_shape_denies_stray_batch_id() -> None:
+    bid = uuid4()
+    # an umbrella-shaped task (batch_id, no parent) that ALSO targets a project —
+    # the spoof that would otherwise get the branchless exemption — is refused.
+    assert not is_valid_batch_shape(
+        batch_id=bid, parent_task_id=None, project_id=uuid4(), product_id=None
+    )
+    # umbrella with a product is equally malformed
+    assert not is_valid_batch_shape(
+        batch_id=bid, parent_task_id=None, project_id=None, product_id=uuid4()
+    )
+    # a root-subtask (has a parent) with NO target is malformed
+    assert not is_valid_batch_shape(
+        batch_id=bid, parent_task_id=uuid4(), project_id=None, product_id=None
+    )
+    # a root-subtask with BOTH targets is malformed
+    assert not is_valid_batch_shape(
+        batch_id=bid, parent_task_id=uuid4(), project_id=uuid4(), product_id=uuid4()
+    )

tests/unit/gateway/test_choreographer_completion_guards.py

@@ -253,3 +253,109 @@ async def test_submit_up_blocks_when_subtask_pending() -> None:
     assert body["error"] == "tracing_gap"
     assert str(sub_id) in body["remediate"]
     task_svc.submit_pm_review.assert_not_awaited()
+
+
+# ---------------------------------------------------------------------------
+# MegaTask umbrella: no PR assembly + branchless completion
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_submit_root_rejects_batch_umbrella() -> None:
+    """A MegaTask umbrella assembles no PR of its own — submit_root must
+    hard-reject it (each root-subtask PRs itself) so it never enters the
+    in-path review gate."""
+    pm_id = uuid4()
+    umbrella_id = uuid4()
+    t = MagicMock(
+        id=umbrella_id,
+        status="in_progress",
+        assigned_to=pm_id,
+        parent_task_id=None,
+        batch_id=uuid4(),
+        branch_name=None,
+        team="main_pm",
+    )
+    task_svc = AsyncMock()
+    task_svc.get.return_value = t
+    task_svc.agent_for.return_value = MagicMock(role="main_pm")
+    deps = _make_deps(task=task_svc)
+    c = Choreographer(deps)
+
+    env = await c.submit_root(pm_id, umbrella_id, "all root-subtasks shipped")
+    body = env.as_dict()
+    assert body["error"] == "invalid_state"
+    assert "no PR" in body["message"]
+    assert "complete(" in body["remediate"]
+
+
+@pytest.mark.asyncio
+async def test_main_pm_complete_allows_batch_umbrella_from_in_progress() -> None:
+    """A MegaTask umbrella is branchless: with every root-subtask terminal it
+    completes straight from in_progress (no submit_root / PR), walking to
+    awaiting_pm_review and escalating to the CEO — the PR requirement is waived."""
+    pm_id = uuid4()
+    umbrella_id = uuid4()
+    t = MagicMock(
+        id=umbrella_id,
+        status="in_progress",
+        assigned_to=pm_id,
+        parent_task_id=None,
+        batch_id=uuid4(),
+        branch_name=None,
+        team="main_pm",
+    )
+    escalated = MagicMock(**{**t.__dict__, "status": "awaiting_ceo_approval"})
+    task_svc = AsyncMock()
+    task_svc.get.return_value = t
+    task_svc.all_subtasks_terminal.return_value = True
+    task_svc.get_subtasks.return_value = []
+    task_svc.submit_pm_review.return_value = MagicMock(status="awaiting_pm_review")
+    task_svc.escalate_to_ceo.return_value = escalated
+    journal_svc = AsyncMock()
+    journal_svc.has_decision_for_task.return_value = True
+    journal_svc.latest_decision_at.return_value = datetime.now(UTC)
+    journal_svc.has_reflect_for_task.return_value = True
+    deps = _make_deps(task=task_svc, journal=journal_svc)
+    c = Choreographer(deps)
+
+    env = await c.main_pm_complete(
+        pm_id, umbrella_id, "every root-subtask is terminal; MegaTask ready for CEO"
+    )
+    assert env.error is None
+    # Branchless walk in_progress -> awaiting_pm_review, then escalate. No PR.
+    task_svc.submit_pm_review.assert_awaited_once()
+    task_svc.escalate_to_ceo.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+async def test_main_pm_complete_handles_escalate_returning_none() -> None:
+    """Defense-in-depth: if escalate_to_ceo refuses (returns None), the verb
+    surfaces an invalid_state rejection instead of dereferencing None."""
+    pm_id = uuid4()
+    umbrella_id = uuid4()
+    t = MagicMock(
+        id=umbrella_id,
+        status="in_progress",
+        assigned_to=pm_id,
+        parent_task_id=None,
+        batch_id=uuid4(),
+        branch_name=None,
+        team="main_pm",
+    )
+    task_svc = AsyncMock()
+    task_svc.get.return_value = t
+    task_svc.all_subtasks_terminal.return_value = True
+    task_svc.get_subtasks.return_value = []
+    task_svc.submit_pm_review.return_value = MagicMock(status="awaiting_pm_review")
+    task_svc.escalate_to_ceo.return_value = None  # refused
+    journal_svc = AsyncMock()
+    journal_svc.has_decision_for_task.return_value = True
+    journal_svc.latest_decision_at.return_value = datetime.now(UTC)
+    journal_svc.has_reflect_for_task.return_value = True
+    deps = _make_deps(task=task_svc, journal=journal_svc)
+    c = Choreographer(deps)
+
+    env = await c.main_pm_complete(pm_id, umbrella_id, "ready for CEO sign-off")
+    assert env.error == "invalid_state"
+    assert "escalate_to_ceo" in env.as_dict()["message"]

tests/unit/gateway/test_choreographer_pm.py

@@ -535,6 +535,7 @@ async def test_submit_root_accepts_main_pm_and_enters_the_gate() -> None:
         pr_number=None,
         branch_name="feature/main_pm/root123",
         parent_task_id=None,
+        batch_id=None,  # a normal root carries no batch_id (not a MegaTask umbrella)
         team="main_pm",
     )
     gated = MagicMock(**{**in_prog.__dict__, "status": "awaiting_pr_review"})

tests/unit/mcp_servers/test_intake_server.py

@@ -35,6 +35,34 @@ async def test_post_draft_posts_to_the_relay(monkeypatch: pytest.MonkeyPatch) ->
     assert seen["json"]["data"] == {"title": "Build X"}
 
 
+@pytest.mark.asyncio
+async def test_post_draft_forwards_batch_collision_descriptors(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A batch draft carries its collision surface through to the relay intact."""
+    monkeypatch.setenv("ROBOCO_API_URL", "http://orch:8000")
+    seen: dict[str, Any] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen["json"] = __import__("json").loads(request.content)
+        return httpx.Response(200, json={"ok": True})
+
+    draft = {
+        "title": "Fix charts",
+        "intends_to_touch": ["svc/dashboard.py", "page/metrics.tsx"],
+        "adds_migration": True,
+        "touches_shared": False,
+    }
+    async with _client(handler) as client:
+        result = await intake_server.post_draft("sess-1", draft, client=client)
+
+    assert result == {"ok": True}
+    data = seen["json"]["data"]
+    assert data["intends_to_touch"] == ["svc/dashboard.py", "page/metrics.tsx"]
+    assert data["adds_migration"] is True
+    assert data["touches_shared"] is False
+
+
 @pytest.mark.asyncio
 async def test_post_draft_reports_http_error() -> None:
     def handler(_request: httpx.Request) -> httpx.Response:
@@ -56,6 +84,69 @@ async def test_post_draft_reports_request_failure() -> None:
     assert "boom" in result["detail"]
 
 
+@pytest.mark.asyncio
+async def test_post_batch_posts_a_batch_event(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("ROBOCO_API_URL", "http://orch:8000")
+    seen: dict[str, Any] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen["url"] = str(request.url)
+        seen["json"] = __import__("json").loads(request.content)
+        return httpx.Response(200, json={"ok": True})
+
+    batch = {"drafts": [{"title": "A"}, {"title": "B"}], "title": "MegaTask"}
+    async with _client(handler) as client:
+        result = await intake_server.post_batch("sess-1", batch, client=client)
+
+    assert result == {"ok": True}
+    assert seen["url"] == "http://orch:8000/api/prompter/live/sess-1/events"
+    assert seen["json"]["kind"] == "batch"
+    assert seen["json"]["tool"] == "propose_batch"
+    assert [d["title"] for d in seen["json"]["data"]["drafts"]] == ["A", "B"]
+
+
+@pytest.mark.asyncio
+async def test_propose_batch_acks_on_success(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ROBOCO_PROMPTER_SESSION_ID", "sess-1")
+
+    async def _ok(_sid: str, _batch: dict[str, Any]) -> dict[str, Any]:
+        return {"ok": True}
+
+    monkeypatch.setattr(intake_server, "post_batch", _ok)
+    msg = await intake_server.propose_batch([{"title": "A"}], "MegaTask")
+    assert "MegaTask submitted" in msg
+
+
+@pytest.mark.asyncio
+async def test_propose_batch_requires_a_live_session(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.delenv("ROBOCO_PROMPTER_SESSION_ID", raising=False)
+    msg = await intake_server.propose_batch([{"title": "A"}], "MegaTask")
+    assert "No live session id" in msg
+
+
+@pytest.mark.asyncio
+async def test_propose_batch_refuses_empty_without_posting(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("ROBOCO_PROMPTER_SESSION_ID", "sess-1")
+    posted = False
+
+    async def _spy(_sid: str, _batch: dict[str, Any]) -> dict[str, Any]:
+        nonlocal posted
+        posted = True
+        return {"ok": True}
+
+    monkeypatch.setattr(intake_server, "post_batch", _spy)
+    # No titles anywhere → nothing well-formed → don't POST, tell the agent.
+    msg = await intake_server.propose_batch([{"no_title": True}], "MegaTask")
+    assert "no well-formed task drafts" in msg
+    assert posted is False
+
+
 @pytest.mark.asyncio
 async def test_propose_draft_requires_a_live_session(
     monkeypatch: pytest.MonkeyPatch,

tests/unit/runtime/test_intake_spawn.py

@@ -184,6 +184,76 @@ class TestIntakeScopeSlugs:
                 product_id="33333333-3333-3333-3333-333333333333",
             )
 
+    @pytest.mark.asyncio
+    async def test_megatask_scope_resolves_explicit_project_ids_in_order(self) -> None:
+        # A MegaTask spans an explicit set of (possibly unrelated) projects; the
+        # slugs are resolved in the given order (the first is the primary cwd).
+        ids = [
+            "11111111-1111-1111-1111-111111111111",
+            "22222222-2222-2222-2222-222222222222",
+        ]
+
+        class _FakeProjectSvc:
+            async def get(self, pid: Any) -> Any:
+                return SimpleNamespace(slug=f"proj-{str(pid)[0]}")
+
+        with patch(
+            "roboco.services.project.get_project_service",
+            lambda _db: _FakeProjectSvc(),
+        ):
+            slugs = await AgentOrchestrator._intake_scope_slugs(
+                db=object(),
+                project_slug=None,
+                product_id=None,
+                project_ids=ids,
+            )
+        assert slugs == ["proj-1", "proj-2"]
+
+    @pytest.mark.asyncio
+    async def test_megatask_scope_with_unresolvable_project_raises(self) -> None:
+        class _FakeProjectSvc:
+            async def get(self, _pid: Any) -> Any:
+                return None
+
+        with (
+            patch(
+                "roboco.services.project.get_project_service",
+                lambda _db: _FakeProjectSvc(),
+            ),
+            pytest.raises(ValueError, match="not found"),
+        ):
+            await AgentOrchestrator._intake_scope_slugs(
+                db=object(),
+                project_slug=None,
+                product_id=None,
+                project_ids=["11111111-1111-1111-1111-111111111111"],
+            )
+
+    @pytest.mark.asyncio
+    async def test_megatask_scope_with_one_unresolvable_id_raises(self) -> None:
+        # A PARTIAL failure (one of N ids invalid) must fail loud, not silently
+        # clone fewer repos than the agent was told it has.
+        good = "11111111-1111-1111-1111-111111111111"
+        bad = "22222222-2222-2222-2222-222222222222"
+
+        class _FakeProjectSvc:
+            async def get(self, pid: Any) -> Any:
+                return SimpleNamespace(slug="proj-a") if str(pid) == good else None
+
+        with (
+            patch(
+                "roboco.services.project.get_project_service",
+                lambda _db: _FakeProjectSvc(),
+            ),
+            pytest.raises(ValueError, match="not found"),
+        ):
+            await AgentOrchestrator._intake_scope_slugs(
+                db=object(),
+                project_slug=None,
+                product_id=None,
+                project_ids=[good, bad],
+            )
+
 
 # ---------------------------------------------------------------------------
 # spawn_intake_session / reap_intake_session — orchestration (docker mocked).
@@ -206,7 +276,7 @@ def _wire_spawn_mocks(
 ) -> None:
     """Patch every external boundary spawn_intake_session touches."""
 
-    async def _clone(_p: Any, _pr: Any) -> tuple[str, list[str]]:
+    async def _clone(_p: Any, _pr: Any, _pids: Any = None) -> tuple[str, list[str]]:
         return "/data/workspaces/roboco/board/intake-1", [
             "/data/workspaces/roboco/board/intake-1"
         ]
@@ -271,6 +341,25 @@ class TestSpawnIntakeSession:
             await orch.spawn_intake_session("s", project_slug="roboco", product_id="p")
         with pytest.raises(ValueError, match="exactly one"):
             await orch.spawn_intake_session("s")
+        # A MegaTask scope cannot combine with a single-project scope.
+        with pytest.raises(ValueError, match="exactly one"):
+            await orch.spawn_intake_session(
+                "s", project_slug="roboco", project_ids=["p1"]
+            )
+
+    @pytest.mark.asyncio
+    async def test_spawn_accepts_megatask_project_ids_scope(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        orch = _make_minimal_orchestrator()
+        run_calls: list[list[str]] = []
+        _wire_spawn_mocks(monkeypatch, orch, run_calls)
+
+        instance = await orch.spawn_intake_session(
+            "sess-mega", project_ids=["11111111-1111-1111-1111-111111111111"]
+        )
+        assert orch._instances[INTAKE_AGENT_ID] is instance
+        assert run_calls  # the container actually launched for the MegaTask scope
 
     @pytest.mark.asyncio
     async def test_spawn_reaps_prior_session_first(

tests/unit/runtime/test_orchestrator_coordination_task.py

@@ -48,6 +48,28 @@ def test_not_coordination_when_neither() -> None:
     assert _is_coordination_task({"project_id": None, "product_id": None}) is False
 
 
+def test_coordination_task_when_batch_umbrella() -> None:
+    # A MegaTask umbrella carries a batch_id and is top-level (no parent); it does
+    # no git of its own — its root-subtasks each branch/PR — so it is coordination.
+    assert (
+        _is_coordination_task(
+            {"project_id": None, "product_id": None, "batch_id": "b1"}
+        )
+        is True
+    )
+
+
+def test_not_coordination_when_batch_root_subtask() -> None:
+    # A MegaTask root-subtask shares the batch_id but has a parent (the umbrella)
+    # and its own project — it does real git, so it is NOT coordination.
+    assert (
+        _is_coordination_task(
+            {"project_id": "r1", "batch_id": "b1", "parent_task_id": "u1"}
+        )
+        is False
+    )
+
+
 # ---------------------------------------------------------------------------
 # _readiness_check_task
 # ---------------------------------------------------------------------------
@@ -90,6 +112,16 @@ def test_readiness_skips_branch_gate_for_coordination_task() -> None:
     assert reason is None
 
 
+def test_readiness_skips_branch_gate_for_batch_umbrella() -> None:
+    # A MegaTask umbrella (batch_id, no project/branch) coordinates its
+    # root-subtasks and does no git — it must reach in_progress unbranched.
+    orch = _bare_orchestrator()
+    reason = orch._readiness_check_task(
+        "main-pm", _task(batch_id="b1", status="in_progress", branch_name=None)
+    )
+    assert reason is None
+
+
 def test_readiness_still_gates_code_task_without_project() -> None:
     orch = _bare_orchestrator()
     reason = orch._readiness_check_task("be-dev-1", _task(status="pending"))
@@ -132,6 +164,21 @@ def test_stuck_check_ignores_missing_branch_for_coordination_task() -> None:
     assert issues == []
 
 
+def test_stuck_check_ignores_missing_branch_for_batch_umbrella() -> None:
+    orch = _bare_orchestrator()
+    issues = orch._check_stuck_conditions(
+        {
+            "project_id": None,
+            "product_id": None,
+            "batch_id": "b1",
+            "branch_name": None,
+            "description": _GOOD_DESC,
+        }
+    )
+    assert "Task missing branch_name" not in issues
+    assert issues == []
+
+
 def test_stuck_check_flags_missing_branch_for_claimed_code_task() -> None:
     # A claimed code task SHOULD already own a branch (auto-created on claim).
     orch = _bare_orchestrator()
@@ -214,3 +261,13 @@ def test_branch_never_expected_for_coordination_task() -> None:
         )
         is False
     )
+
+
+def test_branch_never_expected_for_batch_umbrella() -> None:
+    # A MegaTask umbrella never gets a branch even at in_progress.
+    assert (
+        _branch_is_expected(
+            {"project_id": None, "batch_id": "b1", "status": "in_progress"}
+        )
+        is False
+    )

tests/unit/runtime/test_system_api_headers.py

@@ -0,0 +1,28 @@
+"""The orchestrator's internal API calls must carry an authorized identity.
+
+Regression guard for the wedge where dispatcher ``httpx`` clients were built
+without an agent identity, so the orchestrator's self-PATCHes (auto-block /
+auto-resume / auto-recover / SLA annotation) were rejected ``401 Missing
+X-Agent-ID`` and silently no-op'd — leaving paused/blocked parents stuck and
+their dependents stranded. The fix gives every API-facing dispatcher client the
+system identity; these tests lock that the identity is both *present* and
+*authorized* for task writes (otherwise the self-call would 403 instead of act).
+"""
+
+from roboco.foundation import identity as _foundation
+from roboco.models import AgentRole
+from roboco.models.permissions import TASK_PERMISSIONS, TaskAction
+from roboco.runtime.orchestrator import _SYSTEM_API_HEADERS
+
+
+def test_system_api_headers_match_the_system_identity() -> None:
+    system = _foundation.AGENTS["system"]
+    assert _SYSTEM_API_HEADERS["X-Agent-ID"] == str(system.uuid)
+    assert _SYSTEM_API_HEADERS["X-Agent-Role"] == "system"
+
+
+def test_system_identity_is_authorized_for_task_writes() -> None:
+    # admin_set_status — the audited override path the orchestrator's
+    # auto-recover / auto-resume drive — is gated behind TaskAction.ASSIGN.
+    # The identity the orchestrator sends must hold it.
+    assert TaskAction.ASSIGN in TASK_PERMISSIONS[AgentRole.SYSTEM]

tests/unit/services/test_prompter.py

@@ -28,7 +28,7 @@ from roboco.models.base import (
     Team,
 )
 from roboco.seeds.initial_data import AGENT_UUIDS
-from roboco.services.base import ServiceError
+from roboco.services.base import ServiceError, ValidationError
 from roboco.services.prompter import (
     PrompterService,
     compose_description,
@@ -423,3 +423,210 @@ async def test_confirm_live_draft_product_routes_to_main_pm(db_session: Any) ->
     assert row.team == Team.MAIN_PM
     assert row.product_id == product_id
     assert row.project_id is None
+
+
+# =============================================================================
+# MegaTask: confirm_live_batch (umbrella + sequenced root-subtasks)
+# =============================================================================
+
+
+async def _seed_second_project(db_session: Any, ceo_id: UUID) -> UUID:
+    """Seed a second project so a MegaTask can span multiple repos."""
+    project_id = uuid4()
+    db_session.add(
+        ProjectTable(
+            id=project_id,
+            name="Intake Test Project 2",
+            slug=f"intake2-{uuid4().hex[:8]}",
+            git_url="https://github.com/example/intake2.git",
+            default_branch="main",
+            protected_branches=["main"],
+            assigned_cell=Team.FRONTEND,
+            created_by=ceo_id,
+            is_active=True,
+        )
+    )
+    await db_session.flush()
+    return project_id
+
+
+@pytest.mark.asyncio
+async def test_confirm_live_batch_builds_umbrella_and_sequenced_subtasks(
+    db_session: Any,
+) -> None:
+    """A MegaTask creates one branchless umbrella + N root-subtasks across many
+    projects, with the collision-derived dependency edges wired so the
+    dependency-gate runs the waves in order."""
+    project1, ceo_id = await _seed_project_and_ceo(db_session)
+    project2 = await _seed_second_project(db_session, ceo_id)
+    service = get_prompter_service(db=db_session)
+
+    # A & B both add a migration → serial chain A→B (the migration rule orders
+    # them by priority then index). C is an independent frontend task in another
+    # project, so it runs in parallel with A in wave 0.
+    drafts: list[dict[str, Any]] = [
+        {
+            "title": "A: add table",
+            "acceptance_criteria": ["a"],
+            "team": "backend",
+            "project_id": str(project1),
+            "intends_to_touch": ["roboco/services/foo.py"],
+            "adds_migration": True,
+        },
+        {
+            "title": "B: extend table",
+            "acceptance_criteria": ["b"],
+            "team": "backend",
+            "project_id": str(project1),
+            "intends_to_touch": ["roboco/services/bar.py"],
+            "adds_migration": True,
+        },
+        {
+            "title": "C: frontend widget",
+            "acceptance_criteria": ["c"],
+            "team": "frontend",
+            "project_id": str(project2),
+            "intends_to_touch": ["panel/src/widget.tsx"],
+        },
+    ]
+    result = await service.confirm_live_batch(
+        "Three things",
+        drafts,
+        ceo_id,
+        project_ids=[project1, project2],
+        route="main_pm",
+    )
+
+    # A (migration) and C (independent) run in wave 0; B chains after A.
+    assert result["waves"] == [[0, 2], [1]]
+    ids = result["root_subtask_ids"]
+    assert len(ids) == len(drafts)
+
+    umbrella_id = UUID(result["umbrella_task_id"])
+    umbrella = await db_session.get(TaskTable, umbrella_id)
+    assert umbrella.batch_id is not None
+    assert umbrella.parent_task_id is None
+    assert umbrella.project_id is None and umbrella.product_id is None
+    assert umbrella.team == Team.MAIN_PM
+    assert umbrella.status == TaskStatus.PENDING
+    assert umbrella.branch_name is None  # branchless
+
+    a, b, c = [await db_session.get(TaskTable, UUID(sid)) for sid in ids]
+    for sub in (a, b, c):
+        assert sub.parent_task_id == umbrella_id
+        assert sub.batch_id == umbrella.batch_id
+        assert sub.team == Team.MAIN_PM
+        assert sub.status == TaskStatus.PENDING
+    assert a.project_id == project1
+    assert b.project_id == project1
+    assert c.project_id == project2
+    # sequence = wave index: A and C in wave 0, B in wave 1.
+    assert (a.sequence, b.sequence, c.sequence) == (0, 1, 0)
+    # Dependency wiring: B waits on A; C is independent.
+    assert UUID(ids[0]) in b.dependency_ids
+    assert c.dependency_ids == []
+
+
+@pytest.mark.asyncio
+async def test_confirm_live_batch_board_route_holds_subtasks_in_backlog(
+    db_session: Any,
+) -> None:
+    """The "board" route sends the umbrella to the Product Owner for batch review
+    and holds the root-subtasks in BACKLOG until the umbrella is approved."""
+    project1, ceo_id = await _seed_project_and_ceo(db_session)
+    project2 = await _seed_second_project(db_session, ceo_id)
+    service = get_prompter_service(db=db_session)
+    drafts = [
+        {
+            "title": "One",
+            "acceptance_criteria": ["x"],
+            "team": "backend",
+            "project_id": str(project1),
+        },
+        {
+            "title": "Two",
+            "acceptance_criteria": ["y"],
+            "team": "frontend",
+            "project_id": str(project2),
+        },
+    ]
+    result = await service.confirm_live_batch(
+        "Two repos", drafts, ceo_id, project_ids=[project1, project2], route="board"
+    )
+
+    umbrella = await db_session.get(TaskTable, UUID(result["umbrella_task_id"]))
+    assert umbrella.team == Team.BOARD
+    assert umbrella.assigned_to == UUID(AGENT_UUIDS["product-owner"])
+    assert umbrella.status == TaskStatus.PENDING
+    sub = await db_session.get(TaskTable, UUID(result["root_subtask_ids"][0]))
+    assert sub.status == TaskStatus.BACKLOG  # held until batch review approves
+    assert sub.team == Team.BOARD
+
+
+@pytest.mark.asyncio
+async def test_confirm_live_batch_rejects_empty(db_session: Any) -> None:
+    _project1, ceo_id = await _seed_project_and_ceo(db_session)
+    service = get_prompter_service(db=db_session)
+    with pytest.raises(ValidationError):
+        await service.confirm_live_batch(
+            "Empty", [], ceo_id, project_ids=[uuid4(), uuid4()]
+        )
+
+
+@pytest.mark.asyncio
+async def test_confirm_live_batch_rejects_draft_outside_scope(db_session: Any) -> None:
+    """A draft targeting a project NOT in the scoped project_ids is refused — the
+    intake agent only read the scoped repos."""
+    project1, ceo_id = await _seed_project_and_ceo(db_session)
+    project2 = await _seed_second_project(db_session, ceo_id)
+    service = get_prompter_service(db=db_session)
+    outside = uuid4()  # never in scope
+    drafts = [
+        {"title": "A", "acceptance_criteria": ["a"], "project_id": str(project1)},
+        {"title": "B", "acceptance_criteria": ["b"], "project_id": str(outside)},
+    ]
+    with pytest.raises(ValidationError, match="outside this MegaTask"):
+        await service.confirm_live_batch(
+            "Scoped", drafts, ceo_id, project_ids=[project1, project2], route="main_pm"
+        )
+
+
+@pytest.mark.asyncio
+async def test_confirm_live_batch_rejects_single_project(db_session: Any) -> None:
+    """A degenerate batch whose drafts all target one project is not a MegaTask."""
+    project1, ceo_id = await _seed_project_and_ceo(db_session)
+    project2 = await _seed_second_project(db_session, ceo_id)
+    service = get_prompter_service(db=db_session)
+    drafts = [
+        {"title": "A", "acceptance_criteria": ["a"], "project_id": str(project1)},
+        {"title": "B", "acceptance_criteria": ["b"], "project_id": str(project1)},
+    ]
+    with pytest.raises(ValidationError, match="at least two distinct projects"):
+        await service.confirm_live_batch(
+            "One repo",
+            drafts,
+            ceo_id,
+            project_ids=[project1, project2],
+            route="main_pm",
+        )
+
+
+def test_preview_batch_computes_waves_without_creating() -> None:
+    """preview_batch is pure: it returns the same waves confirm would wire, with
+    no DB session and no task creation."""
+    service = get_prompter_service()  # no db — pure compute
+    drafts: list[dict[str, Any]] = [
+        {"title": "A", "adds_migration": True, "intends_to_touch": ["a.py"]},
+        {"title": "B", "adds_migration": True, "intends_to_touch": ["b.py"]},
+        {"title": "C", "intends_to_touch": ["c.py"]},
+    ]
+    result = service.preview_batch(drafts)
+    # A & B chain on the migration rule; C is independent → [[0, 2], [1]].
+    assert result["waves"] == [[0, 2], [1]]
+    assert isinstance(result["warnings"], list)
+
+
+def test_preview_batch_rejects_empty() -> None:
+    service = get_prompter_service()
+    with pytest.raises(ValidationError):
+        service.preview_batch([])

tests/unit/services/test_sequencing.py

@@ -0,0 +1,183 @@
+"""SequencingService — the deterministic collision-sequencing analyzer.
+
+The unit tests pin each rule in isolation; the golden test asserts the analyzer
+reproduces the CEO's own hand-sequencing of the 11-item guard-core-app batch
+(the effort that motivated the feature, and whose hand-coordination deadlocked
+the Main PM): S6 alone last, the R1/R3/R4 migration chain, R2/R3/S8 serialized on
+the shared threat service, and S1/S2/S7 in one parallel wave.
+"""
+
+from __future__ import annotations
+
+import pytest
+from roboco.foundation.policy.sequencing.models import (
+    DraftSurface,
+    SequencingError,
+)
+from roboco.services.sequencing import SequencingService
+
+
+def _backend(_i: int) -> str:
+    return "backend"
+
+
+def _frontend(_i: int) -> str:
+    return "frontend"
+
+
+def _wave_of(waves: list[list[int]], idx: int) -> int:
+    return next(w for w, wave in enumerate(waves) if idx in wave)
+
+
+# ---------------------------------------------------------------------------
+# Per-rule unit tests
+# ---------------------------------------------------------------------------
+
+
+def test_disjoint_surfaces_no_edges() -> None:
+    s = [
+        DraftSurface(0, 1, ["a/x.py"], False, False),
+        DraftSurface(1, 1, ["b/y.py"], False, False),
+    ]
+    plan = SequencingService().analyze(s, _backend, {"backend": 2})
+    assert plan.edges == []
+    assert plan.waves == [[0, 1]]
+
+
+def test_file_overlap_serializes_more_important_first() -> None:
+    # idx 1 has the lower priority NUMBER (more important) → it runs first.
+    s = [
+        DraftSurface(0, 2, ["svc/threats.py"], False, False),
+        DraftSurface(1, 1, ["svc/threats.py"], False, False),
+    ]
+    plan = SequencingService().analyze(s, _backend, {"backend": 2})
+    assert (1, 0) in plan.edges  # more-important runs first, the other waits
+
+
+def test_migrations_form_serial_chain() -> None:
+    s = [
+        DraftSurface(0, 1, ["a.py"], True, False),
+        DraftSurface(1, 1, ["b.py"], True, False),
+        DraftSurface(2, 1, ["c.py"], True, False),
+    ]
+    plan = SequencingService().analyze(s, _backend, {"backend": 2})
+    assert (0, 1) in plan.edges  # no two migrations run in parallel
+    assert (1, 2) in plan.edges
+
+
+def test_touches_shared_runs_last() -> None:
+    s = [
+        DraftSurface(0, 1, ["page/a.tsx"], False, False),
+        DraftSurface(1, 1, ["page/b.tsx"], False, False),
+        DraftSurface(2, 1, ["page/a.tsx", "components/shared.tsx"], False, True),
+    ]
+    plan = SequencingService().analyze(s, _frontend, {"frontend": 2})
+    assert plan.waves[-1] == [2]  # the shared task is the final wave
+
+
+def test_cycle_is_rejected() -> None:
+    with pytest.raises(SequencingError):
+        SequencingService()._toposort([(0, 1), (1, 0)], 2)
+
+
+def test_existence_check_rejects_out_of_range_edge() -> None:
+    with pytest.raises(SequencingError):
+        SequencingService()._toposort([(0, 5)], 2)
+
+
+def test_shared_migration_chains_after_non_shared_no_cycle() -> None:
+    # Regression: a draft that is BOTH touches_shared AND adds_migration,
+    # overlapping a non-shared migration draft on the same file, used to fabricate
+    # a cycle — rule 2 (migration chain) emitted shared->non-shared while rule 3
+    # (shared-last) emitted non-shared->shared. The migration chain is now
+    # shared-last-aware, so the shared draft is ordered LAST and there is no cycle.
+    s = [
+        DraftSurface(0, 1, ["svc/threats.py"], True, True),  # shared migration
+        DraftSurface(1, 1, ["svc/threats.py"], True, False),  # non-shared migration
+    ]
+    plan = SequencingService().analyze(s, _backend, {"backend": 2})
+    assert plan.waves == [[1], [0]]  # non-shared first, shared migration last
+
+
+def test_cross_project_surfaces_do_not_collide() -> None:
+    # A MegaTask spans repos that don't share a working tree — two migrations in
+    # different projects run in PARALLEL, and a coincidentally-equal path across
+    # repos is not a collision.
+    s = [
+        DraftSurface(0, 1, ["alembic/x.py"], True, False, project_id="proj-a"),
+        DraftSurface(1, 1, ["alembic/x.py"], True, False, project_id="proj-b"),
+    ]
+    plan = SequencingService().analyze(s, _backend, {"backend": 2})
+    assert plan.waves == [[0, 1]]  # independent repos → one parallel wave
+
+
+def test_cell_contention_warns_not_serializes() -> None:
+    s = [DraftSurface(i, 1, [f"page/{i}.tsx"], False, False) for i in range(3)]
+    plan = SequencingService().analyze(s, _frontend, {"frontend": 2})
+    assert plan.edges == []  # contention never adds an edge
+    assert any("frontend" in w for w in plan.warnings)
+
+
+# ---------------------------------------------------------------------------
+# Golden test — reproduce the CEO's 4-wave plan for the 11-item batch
+# ---------------------------------------------------------------------------
+
+# Index map for the guard-core-app items (see obs: wave-based sequencing).
+R1, R2, R3, R4 = 0, 1, 2, 3
+S1, S2, S3, S5, S7, S8, S6 = 4, 5, 6, 7, 8, 9, 10
+
+
+def _guard_core_app_batch() -> list[DraftSurface]:
+    # (idx, priority, intends_to_touch, adds_migration, touches_shared)
+    return [
+        DraftSurface(R1, 1, ["be/services/project_service.py"], True, False),
+        DraftSurface(R2, 1, ["be/services/threats_service.py"], False, False),
+        DraftSurface(
+            R3,
+            1,
+            ["be/services/threats_service.py", "be/services/behavioral_service.py"],
+            True,
+            False,
+        ),
+        DraftSurface(R4, 1, ["fe/app/rules/page.tsx"], True, False),
+        DraftSurface(S1, 1, ["fe/app/metrics/page.tsx"], False, False),
+        DraftSurface(S2, 1, ["fe/app/settings/page.tsx"], False, False),
+        DraftSurface(S3, 1, ["be/services/dashboard_service.py"], False, False),
+        DraftSurface(S5, 1, ["be/services/audit_service.py"], False, False),
+        DraftSurface(S7, 1, ["fe/app/threats/page.tsx"], False, False),
+        DraftSurface(S8, 1, ["be/services/threats_service.py"], False, False),
+        DraftSurface(S6, 1, ["fe/components/", "fe/app/"], False, True),
+    ]
+
+
+def _cell_of(idx: int) -> str:
+    return "backend" if idx in {R1, R2, R3, S3, S5, S8} else "frontend"
+
+
+def test_golden_reproduces_ceo_waves() -> None:
+    plan = SequencingService().analyze(
+        _guard_core_app_batch(), _cell_of, {"backend": 2, "frontend": 2}
+    )
+
+    # EXACT partition — the CEO's own 4-wave hand-sequencing, locked. The bar is
+    # "reproduce my exact waves or it's not done", so assert the full partition,
+    # not just the properties below.
+    assert plan.waves == [
+        sorted([R1, R2, S1, S2, S3, S5, S7]),  # wave 1: everything unblocked
+        [R3],  # wave 2: the shared+migration hinge
+        sorted([R4, S8]),  # wave 3: after R3
+        [S6],  # wave 4: the shared UI-consistency pass, alone, last
+    ]
+
+    # The properties that partition expresses (kept as documentation of WHY):
+    # S6 (the shared UI-consistency pass) runs alone, last.
+    assert plan.waves[-1] == [S6]
+    # R1/R3/R4 form a serial migration chain (no concurrent Alembic heads).
+    assert (R1, R3) in plan.edges
+    assert (R3, R4) in plan.edges
+    # R2/R3/S8 serialize on the shared threats service surface.
+    assert (R2, R3) in plan.edges
+    assert (R3, S8) in plan.edges
+    # The page-isolated frontend work (S1/S2/S7) lands in one parallel wave.
+    assert _wave_of(plan.waves, S1) == _wave_of(plan.waves, S2)
+    assert _wave_of(plan.waves, S2) == _wave_of(plan.waves, S7)