feat(ack): refine intake and validation workflow

skills/ack/scripts/worker_profiles.py

@@ -68,6 +68,7 @@ RECEIPT_FIELDS = frozenset(
         "receiptHash",
     }
 )
+RECEIPT_CONTEXT_FIELDS = frozenset({"projectRoot", "boardHash"})
 CREATED_FOR_FIELDS = frozenset({"taskId", "attemptId", "role"})
 WORKTREE_FIELDS = frozenset(
     {
@@ -222,7 +223,6 @@ def validate_profile(profile: Any, *, where: str = "profile") -> list[str]:
         errors.append(
             f"{where}.permissionMode: must be read-only/workspace-write"
         )
-
     if cli == "codex":
         if not isinstance(effort, str) or effort not in REASONING_EFFORTS:
             errors.append(
@@ -613,8 +613,20 @@ def validate_worker_receipt(
 
     if not isinstance(receipt, dict):
         return [f"{where}: must be an object"]
-    errors = _unknown_fields(receipt, RECEIPT_FIELDS, where)
+    errors = _unknown_fields(receipt, RECEIPT_FIELDS | RECEIPT_CONTEXT_FIELDS, where)
     errors.extend(_missing_fields(receipt, RECEIPT_FIELDS, where))
+    project_root = receipt.get("projectRoot")
+    board_hash = receipt.get("boardHash")
+    if (project_root is None) != (board_hash is None):
+        errors.append(f"{where}: projectRoot and boardHash must be present together")
+    if project_root is not None and (
+        not isinstance(project_root, str) or not project_root.startswith("/")
+    ):
+        errors.append(f"{where}.projectRoot: must be an absolute path")
+    if board_hash is not None and (
+        not isinstance(board_hash, str) or SHA256_RE.fullmatch(board_hash) is None
+    ):
+        errors.append(f"{where}.boardHash: must be a canonical sha256 hex digest")
 
     version = receipt.get("receiptVersion")
     if version != RECEIPT_VERSION or isinstance(version, bool):
@@ -728,18 +740,20 @@ def validate_worker_receipt(
         and isinstance(requested, dict)
     ):
         try:
-            expected_fingerprint = canonical_sha256(
-                {
-                    "protocolVersion": LAUNCH_PROTOCOL_VERSION,
-                    "backend": "orca",
-                    "profileId": receipt.get("profileId"),
-                    "profileHash": receipt.get("profileHash"),
-                    "createdFor": created_for,
-                    "worktree": worktree,
-                    "requested": requested,
-                    "slot": slot,
-                }
-            )
+            facts = {
+                "protocolVersion": LAUNCH_PROTOCOL_VERSION,
+                "backend": "orca",
+                "profileId": receipt.get("profileId"),
+                "profileHash": receipt.get("profileHash"),
+                "createdFor": created_for,
+                "worktree": worktree,
+                "requested": requested,
+                "slot": slot,
+            }
+            if project_root is not None and board_hash is not None:
+                facts["projectRoot"] = project_root
+                facts["boardHash"] = board_hash
+            expected_fingerprint = canonical_sha256(facts)
         except ValueError:
             errors.append(f"{where}.launchFingerprint: cannot hash launch facts")
         else: