fix(workspaces): give every subtask its own execution workspace (#19860)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - Agents split work into child tasks, and each task runs in an
execution workspace (a checkout, branch, or sandbox folder)
> - Since early 2026, a new child task used its parent's realized
workspace by default: the same checkout, branch and sandbox
> - A parent and its child often run at the same time. Two writers in
one folder lose each other's files, the waking parent is cancelled with
`workspace_busy`, and sandbox lease ownership crosses from the parent
into the child, so retained-file recovery refuses the workspace as
ambiguous
> - The product rule is simple: a subtask gets its own workspace,
independent of the parent's saved files. Paperclip never needs to carry
a parent's unmerged changes into a child
> - This pull request makes that the only behaviour on every creation
path, and moves existing shared children to their own workspace on their
next run, with no user or admin action
> - The benefit is that parents and children never block or overwrite
each other, and recovery ownership stays with one task

## Linked Issues or Issue Description

**What happened?**
A child task inherited its parent's realized execution workspace by
default (`createChild` defaulted to `executionWorkspaceInheritanceMode:
"linkage"`, and `issueService.create` fell back from
`inheritExecutionWorkspaceFromIssueId` to `parentId`). When the parent
woke while the child wrote to the shared workspace, the parent run was
cancelled with `workspace_busy`. In sandbox environments, the lease
ownership chain crossed from the parent into the child, and
retained-file recovery refused the workspace with
`allocation_ownership_ambiguous`.

**Expected behavior**
Every new child task gets its own execution workspace, realized from the
project base exactly as a top-level task in that project. It never uses
the parent's checkout, branch, saved snapshot or unmerged changes. A
parent and its descendant never share a workspace by any route.

**Steps to reproduce**
1. Run a parent task in a project with isolated (git worktree) or
sandbox workspaces, so the parent has a realized execution workspace.
2. From the parent run, create a child task with only `parentId` (or
through the runner `create_task` tool, chat suggestions, decision
effects, plugins, or the New sub-task dialog).
3. See that the child's `executionWorkspaceId` is the parent's, with
`executionWorkspacePreference: "reuse_existing"`.
4. Wake the parent while the child runs in a sandbox environment. The
parent run is cancelled with `workspace_busy`.

**Additional context**
Refs #9233 (the existing `strategy_only` opt-out).
The opt-out `executionWorkspaceInheritanceMode: "strategy_only"` already
existed for accepted-plan decomposition. This change makes that
behaviour (tightened to drop a pinned existing branch) the only
behaviour.

## What Changed

- **One rule for every creation path
(`server/src/services/issues.ts`).** `issueService.create` still uses
the parent (or `inheritExecutionWorkspaceFromIssueId`) as a source for
the project, project workspace and workspace *strategy*, but it never
copies the source's `executionWorkspaceId`, `reuse_existing` preference,
or pinned existing branch. All server paths that create a task go
through `create()`/`createChild()`: issue routes (`POST /issues`, `POST
/issues/:id/children`, the run-bound default parent and run workspace
source), runner `create_task`, chat suggestion acceptance, native status
decisions, accepted-plan decomposition, decision effects, plugins
(`ctx.issues.create`), external agents, watchdog follow-ups, monitor
recovery issues, case handoffs and email channels.
- **Explicit ancestor workspaces are dropped.** If a create names an
`executionWorkspaceId` (or an `existing` workspace selection) that an
ancestor of the new task created or is bound to, `create()` drops it and
keeps only the strategy. Older clients and skills that copied the
parent's id keep working and get an independent workspace.
- **`createChild` no longer has a "linkage" mode.**
`executionWorkspaceInheritanceMode` is still accepted from internal
callers and is ignored.
- **`inheritExecutionWorkspaceFromIssueId` decision.** I kept the field
for API compatibility, but it now copies only the source issue's project
and workspace strategy. I removed its workspace-sharing behaviour for
every pair, not only parent/child: the source task and its follow-up can
run at the same time (the runner, watchdog and status-decision callers
all create the follow-up while the source run is live), so sharing would
again let two tasks write one folder. Explicit sharing between unrelated
tasks stays available through an explicit `existing` workspace
selection.
- **New `server/src/services/task-workspace-lineage.ts`.**
`buildIndependentTaskWorkspaceSettings` (strategy only: mode,
environment, runtime, network egress, shared-workspace concurrency, base
ref, branch template, commands; no `reuse_existing`, no
`operator_branch`, no `existingBranch`), `loadTaskLineageIssueIds` (the
parent chain plus, for a task that depth placement put beside its
requester, the requester's chain via `privacyParentIssueId`) and
`isAncestorExecutionWorkspace` (the workspace's `sourceIssueId` is in
that lineage, or a lineage issue is bound to it). A child in another
project does not take the parent's strategy.
- **Upgrade-safe rebind at admission.**
`executionWorkspaceService.releaseAncestorWorkspaceBindingAtAdmission`
runs at the same admission point as the pending workspace selection
(`heartbeat.ts`). For a child (or a flattened task beside its requester)
that an older release bound to an ancestor's workspace, it clears the
child's binding (keeps the project workspace and strategy, bumps the
binding revision) so the run realizes the child's own workspace. It does
nothing while another run of the child is running, while the child's
earlier run still owns workspace finalization or recovery, for native
restart/lease-owner recovery, for a process-loss retry, or for a Retry
that keeps the current workspace. The parent and its workspace are never
changed.
- **Projects without a project workspace (per-task repository
acquisition).** A parent with no project workspace worked in its own
task files, so its settings (for example `isolated_workspace`) do not
describe the project base. A child of such a parent, and an older child
released from one, takes the project's defaults exactly like a top-level
task, instead of an isolated mode that would resolve to a git worktree
with no git base ("needs a project / project workspace"). When the
child's new workspace is created at admission,
`executionWorkspaceRepositoryService.prepareForAdmission` repeats the
parent's (or requester's) repository requests as the child's own pending
requests (identity, URL, catalog id and requested ref only; no pinned
commit, branch or files). The normal acquisition path then clones a
fresh copy into the child's task files with the child's own access
checks. This runs only for a workspace created by that admission, so
existing tasks never gain repositories.
- **UI.** The New sub-task dialog no longer pre-selects the parent's
workspace. `buildSubIssueDefaults` drops `executionWorkspaceId` and
`reuse_existing`, and derives the parent's independent mode
(`shared_workspace`, `isolated_workspace` or `agent_default`) from its
preference, saved settings or current workspace. The "This sub-task will
no longer use the parent task workspace" warning is removed.
- **Contracts and docs.** Shared validator and plugin SDK comments
describe the new meaning of `inheritExecutionWorkspaceFromIssueId`.
Updated `doc/execution-semantics.md` (new rule in §6 and a wording fix
in the retained-sandbox paragraph), `doc/SPEC-implementation.md` (child
workspace rule, requester keeps *strategy* inheritance, watchdog
follow-ups), `doc/SPEC.md` (task workspace ownership),
`docs/specs/external-task-protocol.md`, `skills/paperclip/SKILL.md`
(step 9 and the workspace bullet),
`skills/paperclip/references/issue-workspaces.md`, the CEO onboarding
`HEARTBEAT.md`, and the plugin SDK README.

### Previous-release story (`rules/upgrade-safe-run-state.mdc`)

- **Migrated on next admission.** A child that the previous release
bound to its parent's (or any ancestor's) execution workspace keeps that
binding until its next normal admission. Then the server clears the
binding and the run realizes the child's own workspace from the project
base. No schema migration is needed. No user or admin action is needed.
- **In-flight writers finish first.** A running child is not
interrupted. Its current run, its native restart recovery (admitted
native input or lease owner), a process-loss retry, and a Retry that
keeps the current workspace all finish in the shared workspace. While a
child's earlier run is still running or its workspace finalization or
recovery is unsettled, the binding stays and a later admission releases
it.
- **No files are dropped.** The release changes only the child's binding
row. The parent keeps its binding, and the shared workspace row, folder,
branch and saved snapshots are not touched. Anything the child left
there stays in the parent's workspace.
- **No new refusal codes.** Saved run identity (native execution input,
leases, checkpoints) is not changed or refused; the rebind only affects
new admissions.

## Verification

- New `server/src/__tests__/subtask-workspace-independence.test.ts`
(embedded Postgres): `create` with `parentId`, `createChild` with no
mode / `"linkage"` / `"strategy_only"`,
`inheritExecutionWorkspaceFromIssueId` pointing at the parent, explicit
parent and grandparent `executionWorkspaceId`, a non-child follow-up,
and unchanged top-level defaults and explicit top-level reuse. 7
creation cases fail on `master` and pass with this change. Admission
cases: an old-release child is rebound while its parent is running and
the parent keeps its workspace; a running child is not rebound (deploy
lands mid-run); an unrelated explicit share is kept; the parent is never
rebound.
- New heartbeat case in
`server/src/__tests__/heartbeat-workspace-busy.test.ts`: an old-release
child bound to its running parent's workspace in a sandbox environment
runs to `succeeded` with no `workspace_busy`, gets a new workspace, and
the parent run and binding stay unchanged. It fails on `master` (the
child waits with `workspace_busy`).
- Updated tests that asserted the old inheritance in
`issues-service.test.ts`, `task-workspace-binding.test.ts`,
`chat-project-tools.test.ts`, `task-workspace-child-trust.test.ts`,
`heartbeat-git-restore-point-resume.test.ts` (a child bound to a closed
parent's expired workspace now starts from the project base and leaves
the parent's restore point alone), and
`ui/src/lib/subIssueDefaults.test.ts`. Remote-workspace reservation,
continuation and writer-wait suites now seed the older-release shared
shape directly (or an unrelated explicit share), so those safety paths
stay covered.
- `npx vitest run` on the changed suites and about 45 related server
suites (heartbeat workspace, recovery admission, issue routes, routines,
plugins), `ui` `subIssueDefaults` and `NewIssueDialog` tests, `pnpm
check:token-gates`, `pnpm -r typecheck`.

- New
`server/src/__tests__/heartbeat-subtask-acquired-repository.test.ts`: a
project with no project workspace, a parent whose task files hold an
acquired repository with an unmerged change, and a child (new, and the
older-release shape bound to the parent's workspace) that runs to
`succeeded` in its own task files with a fresh clone at the project base
and its own ready repository receipt. The parent's checkout keeps its
change. Both cases fail on the previous head with "needs a project /
project workspace".

## Risks

- **Project-level configuration still applies to children exactly as to
top-level tasks.** In a project configured for `shared_workspace`, every
task (top-level or child) uses the project's one folder under the
existing shared-workspace concurrency policy. A branch that the project
itself pins applies to every task in the project. This PR removes only
the parent-to-child carry-over of the realized workspace; it does not
change those project defaults.
- **Standalone follow-ups that an older release bound through
`inheritExecutionWorkspaceFromIssueId`** are migrated only when the
source is in their recorded lineage (parent or privacy parent). Others
keep their explicit share and the existing writer-wait serialization.

- **Behaviour change for agents that relied on a shared checkout.** A
child or follow-up no longer sees the parent's unpushed or uncommitted
changes. Agents must push or merge code they want a subtask to build on.
The skill and onboarding text now say this.
- **Explicit ancestor workspace ids are silently dropped** instead of
rejected, so older clients do not break. The task gets an independent
workspace.
- **First run of a migrated child starts from the project base.** If an
older child had uncommitted work in the parent's workspace, that work
stays in the parent's workspace and is not copied into the child's new
workspace.
- **Admission adds one indexed read** for tasks with a parent and a
bound workspace; the locking transaction and ancestor query run only
when the bound workspace was created by another issue.

## Model Used

- Claude Opus 5.5 (Anthropic), model ID `claude-opus-5-5`, used through
Claude Code with tool use (file edits, shell, test execution) and
extended reasoning.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

server/src/__tests__/chat-project-tools.test.ts

@@ -4,7 +4,7 @@ import { callProjectTool } from "../services/project-tools.js";
 import { createLocalAgentJwt } from "../agent-auth-jwt.js";
 import { randomUUID } from "node:crypto";
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import { agents, issues, heartbeatRuns, projects, companyMemberships, executionWorkspaces } from "@paperclipai/db";
 import { startRunnerApiTestServer } from "./helpers/runner-api-server.js";
 import { issueService } from "../services/issues.js";
@@ -337,7 +337,13 @@ import { recoveryPostgresSupport as support } from "./helpers/recovery-postgres.
       expect(await server.db.select({ id: issues.id }).from(issues).where(eq(issues.companyId, f.companyId))).toEqual(before);
 
       await server.db.update(issues).set({ executionWorkspaceId: executionWorkspace.id }).where(eq(issues.id, f.issueId));
-      await expect(call(f, "create_task", { title: "Inherited source cannot escape", idempotencyKey: "inherited-source-denied", status: "backlog" })).rejects.toThrow(/outside.*boundary/i);
+      // A child never inherits its parent's workspace, so the parent's
+      // out-of-boundary files cannot leak into the child either.
+      await call(f, "create_task", { title: "Inherited source cannot escape", idempotencyKey: "inherited-source-denied", status: "backlog" });
+      const [inheritedChild] = await server.db.select({ executionWorkspaceId: issues.executionWorkspaceId }).from(issues)
+        .where(and(eq(issues.companyId, f.companyId), eq(issues.title, "Inherited source cannot escape")));
+      expect(inheritedChild?.executionWorkspaceId).toBeNull();
+      await server.db.delete(issues).where(and(eq(issues.companyId, f.companyId), eq(issues.title, "Inherited source cannot escape")));
       await server.db.update(agents).set({ permissions: { trustPreset: "low_trust_review", authorizationPolicy: {
         trustBoundary: { ...boundary, projectIds: [f.projectId] },
       } } }).where(eq(agents.id, f.agentId));

server/src/__tests__/git-restore-point-expiration.test.ts

@@ -15,7 +15,6 @@ import { expireReconstructableGitWorkspace, gitWorkspaceLastActivityAt } from ".
 import { getStorageService } from "../storage/index.js";
 import { markGitRestorePointExpired } from "../services/git-restore-point-storage.js";
 import { GIT_RESTORE_POINT_EXPIRED_WARNING, setMetadataReopenPendingConsumption } from "../services/execution-workspaces.js";
-import { issueService } from "../services/issues.js";
 
 const gitEnv = { ...process.env, GIT_AUTHOR_NAME: "Fixture", GIT_AUTHOR_EMAIL: "fixture@example.test",
   GIT_COMMITTER_NAME: "Fixture", GIT_COMMITTER_EMAIL: "fixture@example.test", GIT_TERMINAL_PROMPT: "0" };
@@ -472,10 +471,11 @@ describeEmbeddedPostgres("git restore point expiration", () => {
       expect(await exists(f.cwd)).toBe(true);
     });
 
-    it("keeps the worktree for a child created later that inherits it with reuse_existing", async () => {
+    it("keeps the worktree for an older-release child still bound to it with reuse_existing", async () => {
       const f = await fixture();
-      const created = await issueService(db).create(f.companyId, { parentId: f.issueId, title: "Inherited follow-up", status: "todo" });
-      expect(created).toMatchObject({ executionWorkspaceId: f.workspaceId, executionWorkspacePreference: "reuse_existing" });
+      // New children get their own workspace; this is the binding an older release wrote.
+      await child(f, { title: "Inherited follow-up", status: "todo", executionWorkspaceId: f.workspaceId,
+        executionWorkspacePreference: "reuse_existing" });
       expect(await f.expire()).toMatchObject({ expired: false, skipReason: "live_or_unresolved_consumer" });
       expect(await worker().sweepTerminalWorkspaces()).toMatchObject({ archived: 0, skippedNonTerminalTree: 1 });
       expect(await exists(f.cwd)).toBe(true);

server/src/__tests__/heartbeat-git-restore-point-resume.test.ts

@@ -18,6 +18,7 @@ import {
   executionWorkspaces,
   heartbeatRuns,
   issues,
+  projectWorkspaces,
   projects,
 } from "@paperclipai/db";
 import { getEmbeddedPostgresTestSupport, startEmbeddedPostgresTestDatabase } from "./helpers/embedded-postgres.js";
@@ -136,7 +137,7 @@ describe.skipIf(!support.supported)("heartbeat resume of an idle-expired workspa
       await db.update(issues).set({ checkoutRunId: runId, executionRunId: runId, executionAgentNameKey: "resumer", executionLockedAt: new Date() })
         .where(eq(issues.id, target));
     };
-    return { issueId, childId, workspaceId, runId, cwd: realized.cwd, unpushed, expiration, workspace, queueRun };
+    return { issueId, childId, companyId, projectId, author, workspaceId, runId, cwd: realized.cwd, unpushed, expiration, workspace, queueRun };
   }
 
   async function waitForRun(heartbeat: ReturnType<typeof heartbeatService>, runId: string) {
@@ -193,22 +194,37 @@ describe.skipIf(!support.supported)("heartbeat resume of an idle-expired workspa
     expect(issue.executionWorkspaceId).toBe(seeded.workspaceId);
   });
 
-  it("restores a closed parent's expired workspace when an open child binds to it", async () => {
+  it("gives an open child bound to a closed parent's expired workspace its own workspace and keeps the parent's restore point", async () => {
     const seeded = await seed({ closedParent: true });
     expect(seeded.expiration).toMatchObject({ expired: true, restorePoint: true });
     await expect(fs.access(seeded.cwd)).rejects.toMatchObject({ code: "ENOENT" });
-    await db.update(issues).set({ executionWorkspaceId: seeded.workspaceId, executionWorkspacePreference: "reuse_existing" })
-      .where(eq(issues.id, seeded.childId));
+    // The project base a fresh task in this project starts from.
+    const baseCwd = path.join(path.dirname(seeded.author), "project-checkout");
+    git(path.dirname(seeded.author), "clone", "-q", path.join(path.dirname(seeded.author), "remote.git"), baseCwd);
+    const [base] = await db.insert(projectWorkspaces).values({ companyId: seeded.companyId, projectId: seeded.projectId,
+      name: "Project checkout", sourceType: "local_path", cwd: baseCwd, isPrimary: true }).returning();
+    // The binding an older release wrote for every child.
+    await db.update(issues).set({ projectWorkspaceId: base!.id, executionWorkspaceId: seeded.workspaceId,
+      executionWorkspacePreference: "reuse_existing" }).where(eq(issues.id, seeded.childId));
+    const parentWorkspaceBefore = await seeded.workspace();
     await seeded.queueRun(seeded.childId);
     const heartbeat = heartbeatService(db);
     await heartbeat.resumeQueuedRuns();
     const run = await waitForRun(heartbeat, seeded.runId);
     await heartbeat.waitForRunExecutionDrain(seeded.runId);
     expect(run).toMatchObject({ status: "succeeded" });
-    expect(adapterExecute.mock.calls[0]?.[0]).toMatchObject({ context: { executionWorkspaceId: seeded.workspaceId,
-      paperclipWorkspace: { cwd: seeded.cwd } } });
-    expect(git(seeded.cwd, "rev-parse", "HEAD")).toBe(seeded.unpushed);
-    expect(await fs.readFile(path.join(seeded.cwd, "notes.md"), "utf8")).toBe("uncommitted notes\n");
-    expect((await seeded.workspace()).status).not.toBe("archived");
+    const context = (adapterExecute.mock.calls[0]?.[0] as { context?: Record<string, unknown> } | undefined)?.context;
+    expect(context?.executionWorkspaceId).not.toBe(seeded.workspaceId);
+    // The child starts from the project base, not the parent's unmerged changes,
+    // and the parent's saved restore point was left as it was.
+    const childCwd = (context?.paperclipWorkspace as { cwd?: string } | undefined)?.cwd;
+    expect(childCwd).toBeTruthy();
+    expect(childCwd).not.toBe(seeded.cwd);
+    expect(git(childCwd!, "rev-parse", "HEAD")).not.toBe(seeded.unpushed);
+    await expect(fs.access(path.join(childCwd!, "notes.md"))).rejects.toMatchObject({ code: "ENOENT" });
+    await expect(fs.access(seeded.cwd)).rejects.toMatchObject({ code: "ENOENT" });
+    const [child] = await db.select({ executionWorkspaceId: issues.executionWorkspaceId }).from(issues).where(eq(issues.id, seeded.childId));
+    expect(child?.executionWorkspaceId).not.toBe(seeded.workspaceId);
+    expect(await seeded.workspace()).toEqual(parentWorkspaceBefore);
   });
 });

server/src/__tests__/heartbeat-remote-workspace-busy.test.ts

@@ -68,8 +68,10 @@ describe.skipIf(!support.supported)("inherited remote workspace heartbeat wait",
       name: "Inherited remote workspace", mode, strategyType: "project_primary", providerType: "cloud_sandbox",
       cwd: `/workspaces/${randomUUID()}`, metadata: { remoteWorkspace: authority } }).returning();
     await db.update(issues).set({ executionWorkspaceId: workspace.id }).where(eq(issues.id, parent.id));
-    const [child] = await db.insert(issues).values({ companyId: company.id, parentId: parent.id,
-      title: "Use the inherited files", status: "todo", assigneeAgentId: agent.id, responsibleUserId: userId,
+    // An unrelated task that explicitly shares the running task's workspace. A
+    // child bound this way would get its own workspace at admission instead.
+    const [child] = await db.insert(issues).values({ companyId: company.id,
+      title: "Use the shared files", status: "todo", assigneeAgentId: agent.id, responsibleUserId: userId,
       executionWorkspaceId: workspace.id, executionWorkspacePreference: "reuse_existing", executionWorkspaceSettings: { mode } }).returning();
     const originalTransaction = db.transaction.bind(db);
     let reassignmentInjected = false;

server/src/__tests__/heartbeat-subtask-acquired-repository.test.ts

@@ -0,0 +1,166 @@
+import { randomUUID } from "node:crypto";
+import { execFile as execFileCallback } from "node:child_process";
+import { mkdtemp, mkdir, readFile, realpath, rm, writeFile, lstat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { and, eq } from "drizzle-orm";
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import {
+  agents, authUsers, companies, companyMemberships, createDb, executionWorkspaceRepositories, executionWorkspaces,
+  heartbeatRuns, issues, projectWorkspaces, projects,
+} from "@paperclipai/db";
+import { heartbeatService } from "../services/heartbeat.js";
+import { issueService } from "../services/issues.js";
+import { taskRepositoryRelativePath } from "../services/execution-workspace-repositories.js";
+import { instanceSettingsService } from "../services/instance-settings.js";
+import { recoveryPostgresSupport, startRecoveryPostgres } from "./helpers/recovery-postgres.js";
+import { drainHeartbeatRunsToQuiescence } from "./helpers/drain-heartbeat-runs.js";
+
+const execute = vi.hoisted(() => vi.fn());
+vi.mock("../adapters/index.js", () => ({
+  getServerAdapter: () => ({ type: "codex_local", execute, supportsLocalAgentJwt: false }),
+  findActiveServerAdapter: () => ({ type: "codex_local", execute, supportsLocalAgentJwt: false }),
+  runningProcesses: new Map(),
+}));
+
+const exec = promisify(execFileCallback);
+const REPO_URL = "https://github.com/team/source";
+
+describe.skipIf(!recoveryPostgresSupport.supported)("subtask in a project that acquires task repositories", () => {
+  let temporary: Awaited<ReturnType<typeof startRecoveryPostgres>>;
+  let db: ReturnType<typeof createDb>;
+  let heartbeat: ReturnType<typeof heartbeatService>;
+  let root: string;
+  let previousPath: string | undefined;
+
+  beforeAll(async () => {
+    root = await realpath(await mkdtemp(path.join(tmpdir(), "subtask-acquired-repository-")));
+    vi.stubEnv("PAPERCLIP_HOME", path.join(root, "home"));
+    vi.stubEnv("PAPERCLIP_SECRETS_MASTER_KEY", "01234567890123456789012345678901");
+    temporary = await startRecoveryPostgres("subtask-acquired-repository-");
+    db = createDb(temporary.connectionString);
+    await instanceSettingsService(db).updateExperimental({ enableIsolatedWorkspaces: true });
+    heartbeat = heartbeatService(db);
+    // Clone the public GitHub URL from a local fixture repository instead of the network.
+    const realGit = (await exec("which", ["git"])).stdout.trim();
+    const source = path.join(root, "source"), bin = path.join(root, "bin");
+    await Promise.all([mkdir(source), mkdir(bin)]);
+    const git = (...args: string[]) => exec(realGit, ["-C", source, ...args]);
+    await git("init", "--initial-branch=main");
+    await writeFile(path.join(source, "source.txt"), "project base\n");
+    await git("add", ".");
+    await git("-c", "user.name=Fixture", "-c", "user.email=fixture@example.test", "commit", "-m", "base");
+    await writeFile(path.join(bin, "git"), `#!${process.execPath}\n` +
+      `const { spawnSync } = require('node:child_process'); const args = process.argv.slice(2);\n` +
+      `const remote = args.includes('clone') ? args.at(-2) : null;\n` +
+      `if (remote && remote !== ${JSON.stringify(REPO_URL)}) process.exit(97);\n` +
+      `if (remote) args[args.length - 2] = ${JSON.stringify(source)};\n` +
+      `const result = spawnSync(${JSON.stringify(realGit)}, args, { stdio: 'inherit' });\n` +
+      `if (result.status) process.exit(result.status);\n` +
+      `if (remote) process.exit(spawnSync(${JSON.stringify(realGit)}, ['-C', args.at(-1), 'remote', 'set-url', 'origin', ${JSON.stringify(REPO_URL)}], { stdio: 'inherit' }).status ?? 98);\n` +
+      `process.exit(result.status ?? 99);\n`, { mode: 0o755 });
+    previousPath = process.env.PATH;
+    process.env.PATH = `${bin}${path.delimiter}${previousPath ?? ""}`;
+  }, 60_000);
+
+  afterEach(async () => {
+    await drainHeartbeatRunsToQuiescence(db, heartbeat);
+    execute.mockReset();
+  });
+
+  afterAll(async () => {
+    if (previousPath === undefined) delete process.env.PATH; else process.env.PATH = previousPath;
+    await db?.$client.end();
+    await temporary?.cleanup();
+    vi.unstubAllEnvs();
+    if (root) await rm(root, { recursive: true, force: true });
+  });
+
+  it.each(["new", "older-release", "cross-project"] as const)("gives a %s child its own workspace and never the parent's checkout", async (shape) => {
+    const companyId = randomUUID(), userId = randomUUID(), agentId = randomUUID(), projectId = randomUUID();
+    const parentId = randomUUID(), parentWorkspaceId = randomUUID();
+    await db.insert(authUsers).values({ id: userId, name: "Owner", email: `${userId}@example.test`, createdAt: new Date(), updatedAt: new Date() });
+    await db.insert(companies).values({ id: companyId, name: "Acquired repositories", issuePrefix: `A${companyId.slice(0, 6)}`,
+      defaultResponsibleUserId: userId, requireBoardApprovalForNewAgents: false });
+    await db.insert(companyMemberships).values({ companyId, principalId: userId, principalType: "user", membershipRole: "owner", status: "active" });
+    // A project with no project workspace: tasks acquire repositories into their own task files.
+    await db.insert(projects).values({ id: projectId, companyId, name: "Repository-free project", status: "in_progress" });
+    expect(await db.select().from(projectWorkspaces).where(eq(projectWorkspaces.projectId, projectId))).toEqual([]);
+    await db.insert(agents).values({ id: agentId, companyId, name: "Worker", status: "idle", adapterType: "codex_local",
+      adapterConfig: {}, runtimeConfig: { heartbeat: { wakeOnDemand: true, maxConcurrentRuns: 2 } }, permissions: {} });
+
+    // The parent's realized task files, with an acquired repository holding unmerged work.
+    const parentCwd = path.join(root, `parent-task-${parentId}`);
+    const relativePath = taskRepositoryRelativePath(REPO_URL);
+    const parentCheckout = path.join(parentCwd, relativePath);
+    await mkdir(path.dirname(parentCheckout), { recursive: true });
+    await exec("git", ["clone", REPO_URL, parentCheckout]);
+    const pinnedCommit = (await exec("git", ["-C", parentCheckout, "rev-parse", "HEAD"])).stdout.trim();
+    await writeFile(path.join(parentCheckout, "source.txt"), "parent unmerged change\n");
+    await db.insert(issues).values({ id: parentId, companyId, projectId, title: "Parent", status: "in_progress",
+      assigneeAgentId: agentId, responsibleUserId: userId });
+    await db.insert(executionWorkspaces).values({ id: parentWorkspaceId, companyId, projectId, sourceIssueId: parentId,
+      name: "Parent task files", cwd: parentCwd, mode: "isolated_workspace", strategyType: "project_primary",
+      providerType: "local_fs", metadata: { source: "task_session" } });
+    await db.update(issues).set({ executionWorkspaceId: parentWorkspaceId, executionWorkspacePreference: "reuse_existing",
+      executionWorkspaceSettings: { mode: "isolated_workspace" } }).where(eq(issues.id, parentId));
+    await db.insert(executionWorkspaceRepositories).values({ companyId, executionWorkspaceId: parentWorkspaceId,
+      requestedByIssueId: parentId, repoUrl: REPO_URL, repositoryIdentity: REPO_URL, relativePath, requestedRef: "HEAD",
+      pinnedCommit, branchName: "main", state: "ready", requestKey: "parent-repository", requestKeys: ["parent-repository"] });
+
+    // A second project without a project workspace, for the cross-project child.
+    const otherProjectId = randomUUID();
+    await db.insert(projects).values({ id: otherProjectId, companyId, name: "Other repository-free project", status: "in_progress" });
+    const child = shape !== "older-release"
+      ? await issueService(db).create(companyId, { parentId, title: "Child", status: "todo",
+          assigneeAgentId: agentId, actorResponsibleUserId: userId,
+          ...(shape === "cross-project" ? { projectId: otherProjectId } : {}) })
+      // An older release bound every child to its parent's realized workspace.
+      : (await db.insert(issues).values({ companyId, projectId, parentId, title: "Child", status: "todo",
+          assigneeAgentId: agentId, responsibleUserId: userId, executionWorkspaceId: parentWorkspaceId,
+          executionWorkspacePreference: "reuse_existing", executionWorkspaceSettings: { mode: "isolated_workspace" } }).returning())[0]!;
+    if (shape !== "older-release") expect(child.executionWorkspaceId).toBeNull();
+    if (shape === "cross-project") {
+      // The target project's defaults, exactly as for a top-level task there.
+      const topLevel = await issueService(db).create(companyId, { projectId: otherProjectId, title: "Top-level", status: "backlog" });
+      expect(child).toMatchObject({ projectId: otherProjectId, projectWorkspaceId: topLevel.projectWorkspaceId,
+        executionWorkspaceSettings: topLevel.executionWorkspaceSettings });
+    }
+
+    let childCwd: string | null = null;
+    execute.mockImplementation(async (input: { context: { paperclipWorkspace?: { cwd?: string } } }) => {
+      childCwd = input.context.paperclipWorkspace?.cwd ?? null;
+      return { exitCode: 0, signal: null, timedOut: false };
+    });
+    const run = await heartbeat.wakeup(agentId, { source: "on_demand", triggerDetail: "manual", contextSnapshot: { issueId: child.id } });
+    expect(run).not.toBeNull();
+    await vi.waitFor(async () => {
+      expect((await heartbeat.getRun(run!.id))?.status).toMatch(/^(succeeded|failed|cancelled|timed_out)$/);
+    }, { timeout: 30_000 });
+    const finished = await heartbeat.getRun(run!.id);
+    expect({ status: finished?.status, error: finished?.error }).toMatchObject({ status: "succeeded" });
+
+    // The child ran in its own task files with its own fresh copy of the repository.
+    expect(childCwd).toBeTruthy();
+    expect(childCwd).not.toBe(parentCwd);
+    const [childRow] = await db.select().from(issues).where(eq(issues.id, child.id));
+    expect(childRow.executionWorkspaceId).not.toBe(parentWorkspaceId);
+    const childRepositories = await db.select().from(executionWorkspaceRepositories)
+      .where(and(eq(executionWorkspaceRepositories.companyId, companyId), eq(executionWorkspaceRepositories.executionWorkspaceId, childRow.executionWorkspaceId!)));
+    if (shape === "cross-project") {
+      // The parent's repositories belong to the parent's project.
+      expect(childRepositories).toEqual([]);
+      expect(await lstat(path.join(childCwd!, relativePath)).catch(() => null)).toBeNull();
+      expect(await readFile(path.join(parentCheckout, "source.txt"), "utf8")).toBe("parent unmerged change\n");
+      return;
+    }
+    expect(await readFile(path.join(childCwd!, relativePath, "source.txt"), "utf8")).toBe("project base\n");
+    // The parent's checkout and its unmerged change are untouched.
+    expect(await readFile(path.join(parentCheckout, "source.txt"), "utf8")).toBe("parent unmerged change\n");
+    expect(childRepositories).toEqual([expect.objectContaining({ repositoryIdentity: REPO_URL, requestedByIssueId: child.id,
+      state: "ready", relativePath })]);
+    expect(await lstat(path.join(childCwd!, relativePath, ".git"))).toBeTruthy();
+    expect(await db.select({ id: heartbeatRuns.id }).from(heartbeatRuns).where(eq(heartbeatRuns.companyId, companyId))).toHaveLength(1);
+  }, 60_000);
+});

server/src/__tests__/heartbeat-workspace-busy.test.ts

@@ -240,6 +240,9 @@ describeEmbeddedPostgres("shared-workspace run serialization", () => {
     // Bind both issues to one reused shared execution workspace, as when a child
     // task inherits the workspace of a parent whose run is still live.
     sharedExecutionWorkspace?: boolean;
+    // Make the deferred issue a child of the holder issue, in the shape older
+    // releases wrote: the child bound to the parent's realized workspace.
+    childOfHolder?: boolean;
     holderIssueWorkspaceSettings?: Record<string, unknown> | null;
     holderProjectWorkspaceId?: string;
     holderActivityAt?: Date;
@@ -400,9 +403,15 @@ describeEmbeddedPostgres("shared-workspace run serialization", () => {
         : {}),
     });
 
+    if (sharedExecutionWorkspaceId && input?.childOfHolder) {
+      await db.update(executionWorkspaces).set({ sourceIssueId: holderIssueId })
+        .where(eq(executionWorkspaces.id, sharedExecutionWorkspaceId));
+    }
+
     await db.insert(issues).values({
       id: issueId,
       companyId,
+      ...(input?.childOfHolder ? { parentId: holderIssueId } : {}),
       title: "Deferred issue",
       status: "in_progress",
       priority: "medium",
@@ -698,6 +707,35 @@ describeEmbeddedPostgres("shared-workspace run serialization", () => {
       expect(issueRow?.status).not.toBe("blocked");
     });
 
+    it("gives an old-release subtask its own workspace instead of waiting on its running parent", async () => {
+      const fixture = await seedInheritedWorkspace({ childOfHolder: true });
+
+      const run = await heartbeat.invoke(
+        fixture.agentId,
+        "assignment",
+        { issueId: fixture.issueId, wakeReason: "issue_assigned" },
+        "system",
+      );
+      expect(run).not.toBeNull();
+
+      const finishedRun = await waitForRunToLeaveActiveStates(run!.id);
+      expect(finishedRun?.errorCode).not.toBe(WORKSPACE_BUSY_ERROR_CODE);
+      expect(finishedRun?.status).toBe("succeeded");
+      expect(executedRunIds).toContain(run!.id);
+      // The parent was never interrupted and keeps its workspace.
+      expect((await heartbeat.getRun(fixture.holderRunId))?.status).toBe("running");
+      const [parentRow] = await db.select({ executionWorkspaceId: issues.executionWorkspaceId })
+        .from(issues).where(eq(issues.id, fixture.holderIssueId));
+      expect(parentRow?.executionWorkspaceId).toBe(fixture.sharedExecutionWorkspaceId);
+      const [parentWorkspace] = await db.select({ status: executionWorkspaces.status })
+        .from(executionWorkspaces).where(eq(executionWorkspaces.id, fixture.sharedExecutionWorkspaceId!));
+      expect(parentWorkspace?.status).toBe("active");
+      // The child now has its own workspace.
+      const [childRow] = await db.select({ executionWorkspaceId: issues.executionWorkspaceId })
+        .from(issues).where(eq(issues.id, fixture.issueId));
+      expect(childRow?.executionWorkspaceId).not.toBe(fixture.sharedExecutionWorkspaceId);
+    });
+
     it("resumes in the inherited workspace once the holder finishes", async () => {
       const fixture = await seedInheritedWorkspace();
 

server/src/__tests__/issues-service.test.ts

@@ -3105,7 +3105,7 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     await tempDb?.cleanup();
   });
 
-  it("inherits the parent issue workspace linkage when child workspace fields are omitted", async () => {
+  it("gives a child its own workspace and keeps only the parent's strategy when child workspace fields are omitted", async () => {
     const companyId = randomUUID();
     const projectId = randomUUID();
     const parentIssueId = randomUUID();
@@ -3163,8 +3163,8 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
 
     expect(child.parentId).toBe(parentIssueId);
     expect(child.projectWorkspaceId).toBe(projectWorkspaceId);
-    expect(child.executionWorkspaceId).toBe(executionWorkspaceId);
-    expect(child.executionWorkspacePreference).toBe("reuse_existing");
+    expect(child.executionWorkspaceId).toBeNull();
+    expect(child.executionWorkspacePreference).toBeNull();
     expect(child.executionWorkspaceSettings).toEqual({
       mode: "isolated_workspace",
       workspaceRuntime: { profile: "agent" },
@@ -3770,7 +3770,7 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     });
   });
 
-  it("inherits workspace linkage from an explicit source issue without creating a parent-child relationship", async () => {
+  it("inherits project and strategy, not the realized workspace, from an explicit source issue without creating a parent-child relationship", async () => {
     const companyId = randomUUID();
     const projectId = randomUUID();
     const sourceIssueId = randomUUID();
@@ -3824,14 +3824,12 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
 
     expect(followUp.parentId).toBeNull();
     expect(followUp.projectWorkspaceId).toBe(projectWorkspaceId);
-    expect(followUp.executionWorkspaceId).toBe(executionWorkspaceId);
-    expect(followUp.executionWorkspacePreference).toBe("reuse_existing");
-    expect(followUp.executionWorkspaceSettings).toEqual({
-      mode: "operator_branch",
-    });
+    expect(followUp.executionWorkspaceId).toBeNull();
+    expect(followUp.executionWorkspacePreference).toBeNull();
+    expect(JSON.stringify(followUp.executionWorkspaceSettings ?? {})).not.toContain("operator_branch");
   });
 
-  it("createChild applies parent defaults, acceptance criteria, workspace inheritance, and optional parent blocker chaining", async () => {
+  it("createChild applies parent defaults, acceptance criteria, an independent workspace, and optional parent blocker chaining", async () => {
     const companyId = randomUUID();
     const projectId = randomUUID();
     const goalId = randomUUID();
@@ -3912,8 +3910,8 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     expect(child.description).toContain("## Acceptance Criteria");
     expect(child.description).toContain("- Uses the parent issue as parentId");
     expect(child.projectWorkspaceId).toBe(projectWorkspaceId);
-    expect(child.executionWorkspaceId).toBe(executionWorkspaceId);
-    expect(child.executionWorkspacePreference).toBe("reuse_existing");
+    expect(child.executionWorkspaceId).toBeNull();
+    expect(child.executionWorkspacePreference).toBeNull();
 
     const parentRelations = await svc.getRelationSummaries(parentIssueId);
     expect(parentRelations.blockedBy).toEqual([
@@ -4968,7 +4966,7 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     await tempDb?.cleanup();
   });
 
-  it("preserves the parent project when a generic child create inherits workspace linkage", async () => {
+  it("preserves the parent project when a generic child create inherits workspace strategy", async () => {
     const companyId = randomUUID();
     const projectId = randomUUID();
     const parentIssueId = randomUUID();
@@ -5023,7 +5021,7 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     expect(child.parentId).toBe(parentIssueId);
     expect(child.projectId).toBe(projectId);
     expect(child.projectWorkspaceId).toBe(projectWorkspaceId);
-    expect(child.executionWorkspaceId).toBe(executionWorkspaceId);
+    expect(child.executionWorkspaceId).toBeNull();
   });
 
   it("uses the target project's own workspaces for a cross-project child instead of inheriting the parent's", async () => {
@@ -5143,7 +5141,7 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     });
   });
 
-  it("inherits workspace linkage from an explicit source issue without creating a parent-child relationship", async () => {
+  it("inherits project and strategy, not the realized workspace, from an explicit source issue without creating a parent-child relationship", async () => {
     const companyId = randomUUID();
     const projectId = randomUUID();
     const sourceIssueId = randomUUID();
@@ -5197,11 +5195,9 @@ describeEmbeddedPostgres("issueService.create workspace inheritance", () => {
     expect(followUp.parentId).toBeNull();
     expect(followUp.projectId).toBe(projectId);
     expect(followUp.projectWorkspaceId).toBe(projectWorkspaceId);
-    expect(followUp.executionWorkspaceId).toBe(executionWorkspaceId);
-    expect(followUp.executionWorkspacePreference).toBe("reuse_existing");
-    expect(followUp.executionWorkspaceSettings).toEqual({
-      mode: "operator_branch",
-    });
+    expect(followUp.executionWorkspaceId).toBeNull();
+    expect(followUp.executionWorkspacePreference).toBeNull();
+    expect(JSON.stringify(followUp.executionWorkspaceSettings ?? {})).not.toContain("operator_branch");
   });
 
   it("preserves projectless organization when an update adds workspace linkage", async () => {

server/src/__tests__/subtask-workspace-independence.test.ts

@@ -0,0 +1,418 @@
+import { randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import {
+  activityLog,
+  agents,
+  companies,
+  createDb,
+  executionWorkspaces,
+  heartbeatRuns,
+  instanceSettings,
+  issueRelations,
+  issues,
+  projectWorkspaces,
+  projects,
+} from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+import { instanceSettingsService } from "../services/instance-settings.ts";
+import { issueService } from "../services/issues.ts";
+import { executionWorkspaceService } from "../services/execution-workspaces.ts";
+import { buildIndependentTaskWorkspaceSettings } from "../services/task-workspace-lineage.ts";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+describe("buildIndependentTaskWorkspaceSettings", () => {
+  it("keeps the workspace strategy but drops realized identity and pinned branches", () => {
+    expect(buildIndependentTaskWorkspaceSettings({
+      mode: "isolated_workspace",
+      workspaceRuntime: { profile: "agent" },
+      workspaceStrategy: {
+        type: "git_worktree",
+        baseRef: "origin/main",
+        branchTemplate: "{{issue.identifier}}",
+        existingBranch: "parent-branch",
+      },
+    })).toEqual({
+      mode: "isolated_workspace",
+      workspaceRuntime: { profile: "agent" },
+      workspaceStrategy: { type: "git_worktree", baseRef: "origin/main", branchTemplate: "{{issue.identifier}}" },
+    });
+    expect(buildIndependentTaskWorkspaceSettings({
+      mode: "shared_workspace",
+      sharedWorkspaceConcurrency: "serialize",
+      networkEgress: { allowFqdns: ["api.example.com"], allowCidrs: [] },
+    })).toEqual({
+      mode: "shared_workspace",
+      sharedWorkspaceConcurrency: "serialize",
+      networkEgress: { allowFqdns: ["api.example.com"], allowCidrs: [] },
+    });
+    expect(buildIndependentTaskWorkspaceSettings({ mode: "reuse_existing" })).toBeNull();
+    expect(buildIndependentTaskWorkspaceSettings({ mode: "operator_branch" })).toBeNull();
+  });
+});
+
+describeEmbeddedPostgres("subtasks never share an ancestor's execution workspace", () => {
+  let db!: ReturnType<typeof createDb>;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-subtask-workspace-");
+    db = createDb(tempDb.connectionString);
+  }, 20_000);
+
+  afterEach(async () => {
+    await db.delete(activityLog);
+    await db.delete(issueRelations);
+    await db.update(executionWorkspaces).set({ sourceIssueId: null });
+    await db.update(issues).set({ parentId: null, privacyParentIssueId: null, executionRunId: null });
+    await db.delete(issues);
+    await db.delete(heartbeatRuns);
+    await db.delete(executionWorkspaces);
+    await db.delete(projectWorkspaces);
+    await db.delete(projects);
+    await db.delete(agents);
+    await db.delete(instanceSettings);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await tempDb?.cleanup();
+  });
+
+  const parentSettings = {
+    mode: "isolated_workspace",
+    workspaceRuntime: { profile: "agent" },
+    workspaceStrategy: { type: "git_worktree", baseRef: "origin/main", existingBranch: "pap-1-parent" },
+  };
+
+  async function seedParentWithRealizedWorkspace() {
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const projectWorkspaceId = randomUUID();
+    const parentWorkspaceId = randomUUID();
+    const parentIssueId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await instanceSettingsService(db).updateExperimental({ enableIsolatedWorkspaces: true });
+    await db.insert(projects).values({ id: projectId, companyId, name: "Workspace project", status: "in_progress" });
+    await db.insert(projectWorkspaces).values({
+      id: projectWorkspaceId, companyId, projectId, name: "Primary workspace", isPrimary: true, sharedWorkspaceKey: "workspace-key",
+    });
+    await db.insert(issues).values({
+      id: parentIssueId, companyId, projectId, projectWorkspaceId, title: "Parent issue", status: "in_progress", priority: "medium",
+    });
+    await db.insert(executionWorkspaces).values({
+      id: parentWorkspaceId, companyId, projectId, projectWorkspaceId, sourceIssueId: parentIssueId,
+      mode: "isolated_workspace", strategyType: "git_worktree", name: "Parent worktree", status: "active",
+      branchName: "pap-1-parent", providerType: "git_worktree", providerRef: `/tmp/${parentWorkspaceId}`,
+    });
+    await db.update(issues).set({
+      executionWorkspaceId: parentWorkspaceId,
+      executionWorkspacePreference: "reuse_existing",
+      executionWorkspaceSettings: parentSettings,
+    }).where(eq(issues.id, parentIssueId));
+    return { companyId, projectId, projectWorkspaceId, parentWorkspaceId, parentIssueId };
+  }
+
+  function expectIndependentChild(
+    child: { executionWorkspaceId: string | null; executionWorkspacePreference: string | null; executionWorkspaceSettings: unknown; projectWorkspaceId: string | null; projectId: string | null },
+    fixture: Awaited<ReturnType<typeof seedParentWithRealizedWorkspace>>,
+  ) {
+    expect(child.executionWorkspaceId).toBeNull();
+    expect(child.executionWorkspacePreference).not.toBe("reuse_existing");
+    expect(child.projectId).toBe(fixture.projectId);
+    // The project base, not the parent's checkout.
+    expect(child.projectWorkspaceId).toBe(fixture.projectWorkspaceId);
+    expect(JSON.stringify(child.executionWorkspaceSettings ?? {})).not.toContain("pap-1-parent");
+    expect(JSON.stringify(child.executionWorkspaceSettings ?? {})).not.toContain("reuse_existing");
+  }
+
+  it("create() with parentId gives the child its own workspace and keeps the parent's strategy", async () => {
+    const fixture = await seedParentWithRealizedWorkspace();
+    const child = await issueService(db).create(fixture.companyId, { parentId: fixture.parentIssueId, title: "Child issue" });
+    expect(child.parentId).toBe(fixture.parentIssueId);
+    expectIndependentChild(child, fixture);
+    expect(child.executionWorkspaceSettings).toEqual({
+      mode: "isolated_workspace",
+      workspaceRuntime: { profile: "agent" },
+      workspaceStrategy: { type: "git_worktree", baseRef: "origin/main" },
+    });
+  });
+
+  it.each([undefined, "linkage", "strategy_only"] as const)(
+    "createChild never reuses the parent workspace (deprecated inheritance mode %s is ignored)",
+    async (mode) => {
+      const fixture = await seedParentWithRealizedWorkspace();
+      const { issue: child } = await issueService(db).createChild(fixture.parentIssueId, {
+        title: "Child issue",
+        status: "todo",
+        priority: "medium",
+        ...(mode ? { executionWorkspaceInheritanceMode: mode } : {}),
+      } as Parameters<ReturnType<typeof issueService>["createChild"]>[1]);
+      expectIndependentChild(child, fixture);
+    },
+  );
+
+  it("createChild into another project does not carry the parent's strategy across the project boundary", async () => {
+    const fixture = await seedParentWithRealizedWorkspace();
+    const otherProjectId = randomUUID();
+    await db.insert(projects).values({ id: otherProjectId, companyId: fixture.companyId, name: "Other project", status: "in_progress" });
+    const { issue: child } = await issueService(db).createChild(fixture.parentIssueId, {
+      title: "Cross-project child", status: "todo", priority: "medium", projectId: otherProjectId,
+    } as Parameters<ReturnType<typeof issueService>["createChild"]>[1]);
+    expect(child.projectId).toBe(otherProjectId);
+    expect(child.executionWorkspaceId).toBeNull();
+    expect(child.projectWorkspaceId).not.toBe(fixture.projectWorkspaceId);
+    expect(JSON.stringify(child.executionWorkspaceSettings ?? {})).not.toContain("workspaceRuntime");
+  });
+
+  it("keeps the parent's strategy when the New sub-task dialog names only the mode", async () => {
+    const fixture = await seedParentWithRealizedWorkspace();
+    const child = await issueService(db).create(fixture.companyId, {
+      parentId: fixture.parentIssueId,
+      projectId: fixture.projectId,
+      projectWorkspaceId: fixture.projectWorkspaceId,
+      executionWorkspacePreference: "isolated_workspace",
+      executionWorkspaceSettings: { mode: "isolated_workspace" },
+      title: "Dialog child",
+    });
+    expect(child.executionWorkspaceId).toBeNull();
+    expect(child.executionWorkspaceSettings).toEqual({
+      mode: "isolated_workspace",
+      workspaceRuntime: { profile: "agent" },
+      workspaceStrategy: { type: "git_worktree", baseRef: "origin/main" },
+    });
+  });
+
+  it("does not share when inheritExecutionWorkspaceFromIssueId points at the parent", async () => {
+    const fixture = await seedParentWithRealizedWorkspace();
+    const child = await issueService(db).create(fixture.companyId, {
+      parentId: fixture.parentIssueId,
+      inheritExecutionWorkspaceFromIssueId: fixture.parentIssueId,
+      title: "Child issue",
+    });
+    expectIndependentChild(child, fixture);
+  });
+
+  it("drops an explicit executionWorkspaceId that belongs to the parent or a further ancestor", async () => {
+    const fixture = await seedParentWithRealizedWorkspace();
+    const child = await issueService(db).create(fixture.companyId, {
+      parentId: fixture.parentIssueId,
+      projectId: fixture.projectId,
+      executionWorkspaceId: fixture.parentWorkspaceId,
+      executionWorkspacePreference: "reuse_existing",
+      executionWorkspaceSettings: { mode: "isolated_workspace" },
+      title: "Child issue",
+    });
+    expectIndependentChild(child, fixture);
+
+    const grandchild = await issueService(db).create(fixture.companyId, {
+      parentId: child.id,
+      parentDepthPolicy: "allow_nested",
+      projectId: fixture.projectId,
+      executionWorkspaceId: fixture.parentWorkspaceId,
+      executionWorkspacePreference: "reuse_existing",
+      title: "Grandchild issue",
+    });
+    expect(grandchild.executionWorkspaceId).toBeNull();
+  });
+
+  it("non-child follow-ups keep the source's project and strategy but get their own workspace", async () => {
+    const fixture = await seedParentWithRealizedWorkspace();
+    const followUp = await issueService(db).create(fixture.companyId, {
+      parentId: null,
+      inheritExecutionWorkspaceFromIssueId: fixture.parentIssueId,
+      title: "Follow-up issue",
+    });
+    expect(followUp.parentId).toBeNull();
+    expectIndependentChild(followUp, fixture);
+  });
+
+  it("leaves top-level tasks and project workspace defaults unchanged", async () => {
+    const fixture = await seedParentWithRealizedWorkspace();
+    const topLevel = await issueService(db).create(fixture.companyId, { projectId: fixture.projectId, title: "Top-level" });
+    expect(topLevel.parentId).toBeNull();
+    expect(topLevel.executionWorkspaceId).toBeNull();
+    expect(topLevel.projectWorkspaceId).toBe(fixture.projectWorkspaceId);
+
+    // An explicit existing workspace for an unrelated top-level task is still honoured.
+    const explicit = await issueService(db).create(fixture.companyId, {
+      projectId: fixture.projectId,
+      executionWorkspaceId: fixture.parentWorkspaceId,
+      executionWorkspacePreference: "reuse_existing",
+      title: "Explicit reuse",
+    });
+    expect(explicit.executionWorkspaceId).toBe(fixture.parentWorkspaceId);
+  });
+
+  describe("old-release children bound to the parent's workspace", () => {
+    async function seedOldReleaseChild() {
+      const fixture = await seedParentWithRealizedWorkspace();
+      const childIssueId = randomUUID();
+      // The shape older releases wrote by default for every child.
+      await db.insert(issues).values({
+        id: childIssueId, companyId: fixture.companyId, projectId: fixture.projectId, parentId: fixture.parentIssueId,
+        projectWorkspaceId: fixture.projectWorkspaceId, title: "Old child", status: "todo", priority: "medium",
+        executionWorkspaceId: fixture.parentWorkspaceId, executionWorkspacePreference: "reuse_existing",
+        executionWorkspaceSettings: { ...parentSettings, mode: "isolated_workspace" },
+      });
+      const agentId = randomUUID();
+      await db.insert(agents).values({
+        id: agentId, companyId: fixture.companyId, name: "Coder", role: "engineer", status: "active",
+        adapterType: "process", adapterConfig: {}, runtimeConfig: {}, permissions: {},
+      });
+      return { ...fixture, childIssueId, agentId };
+    }
+
+    async function insertRun(input: { companyId: string; agentId: string; issueId: string; status: string }) {
+      const id = randomUUID();
+      await db.insert(heartbeatRuns).values({
+        id, companyId: input.companyId, agentId: input.agentId, invocationSource: "assignment", triggerDetail: "system",
+        status: input.status, startedAt: new Date(), contextSnapshot: { issueId: input.issueId },
+      });
+      return id;
+    }
+
+    async function readIssue(id: string) {
+      const [row] = await db.select().from(issues).where(eq(issues.id, id));
+      return row!;
+    }
+
+    it("rebinds a child that is not running on its next admission and leaves the parent's workspace alone", async () => {
+      const fixture = await seedOldReleaseChild();
+      // The parent is writing in its workspace right now.
+      const parentRunId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.parentIssueId, status: "running" });
+      await db.update(issues).set({ executionRunId: parentRunId }).where(eq(issues.id, fixture.parentIssueId));
+      const admittedRunId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.childIssueId, status: "running" });
+      const before = await readIssue(fixture.childIssueId);
+
+      const released = await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.childIssueId, runId: admittedRunId,
+      });
+
+      expect(released).toBe(true);
+      const child = await readIssue(fixture.childIssueId);
+      expect(child.executionWorkspaceId).toBeNull();
+      expect(child.executionWorkspacePreference).toBeNull();
+      expect(child.projectWorkspaceId).toBe(fixture.projectWorkspaceId);
+      expect(child.executionWorkspaceSettings).toEqual({
+        mode: "isolated_workspace",
+        workspaceRuntime: { profile: "agent" },
+        workspaceStrategy: { type: "git_worktree", baseRef: "origin/main" },
+      });
+      expect(child.workspaceBindingRevision).toBe(before.workspaceBindingRevision + 1);
+
+      // The parent keeps its workspace, and the workspace (with its files) is untouched.
+      const parent = await readIssue(fixture.parentIssueId);
+      expect(parent.executionWorkspaceId).toBe(fixture.parentWorkspaceId);
+      const [workspace] = await db.select().from(executionWorkspaces).where(eq(executionWorkspaces.id, fixture.parentWorkspaceId));
+      expect(workspace).toMatchObject({ status: "active", sourceIssueId: fixture.parentIssueId, providerRef: `/tmp/${fixture.parentWorkspaceId}` });
+
+      // Idempotent: a second admission has nothing left to release.
+      expect(await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.childIssueId, runId: admittedRunId,
+      })).toBe(false);
+    });
+
+    it("rebinds a task that depth placement put beside the requester whose workspace it shares", async () => {
+      const fixture = await seedOldReleaseChild();
+      // Older releases inherited from the requested parent even when placement
+      // flattened the task beside it; the requester is recorded as privacy parent.
+      const grandparentId = randomUUID();
+      await db.insert(issues).values({ id: grandparentId, companyId: fixture.companyId, projectId: fixture.projectId,
+        title: "Root", status: "in_progress", priority: "medium" });
+      await db.update(issues).set({ parentId: grandparentId }).where(eq(issues.id, fixture.parentIssueId));
+      await db.update(issues).set({ parentId: grandparentId, privacyParentIssueId: fixture.parentIssueId })
+        .where(eq(issues.id, fixture.childIssueId));
+      const runId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.childIssueId, status: "running" });
+      expect(await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.childIssueId, runId,
+      })).toBe(true);
+      expect((await readIssue(fixture.childIssueId)).executionWorkspaceId).toBeNull();
+      expect((await readIssue(fixture.parentIssueId)).executionWorkspaceId).toBe(fixture.parentWorkspaceId);
+    });
+
+    it("keeps a child's own workspace when its parent selected it, and moves the parent instead", async () => {
+      const fixture = await seedOldReleaseChild();
+      const childWorkspaceId = randomUUID();
+      await db.insert(executionWorkspaces).values({
+        id: childWorkspaceId, companyId: fixture.companyId, projectId: fixture.projectId, projectWorkspaceId: fixture.projectWorkspaceId,
+        sourceIssueId: fixture.childIssueId, mode: "isolated_workspace", strategyType: "git_worktree", name: "Child worktree",
+        status: "active", providerType: "git_worktree", providerRef: `/tmp/${childWorkspaceId}`,
+      });
+      await db.update(issues).set({ executionWorkspaceId: childWorkspaceId }).where(eq(issues.id, fixture.childIssueId));
+      await db.update(issues).set({ executionWorkspaceId: childWorkspaceId }).where(eq(issues.id, fixture.parentIssueId));
+      // The child created the workspace, so its admission keeps it. A fresh
+      // workspace for the child would land on the same issue-named branch.
+      const childRunId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.childIssueId, status: "running" });
+      expect(await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.childIssueId, runId: childRunId,
+      })).toBe(false);
+      expect((await readIssue(fixture.childIssueId)).executionWorkspaceId).toBe(childWorkspaceId);
+      // The parent's next admission moves the parent off its descendant's workspace.
+      await db.update(heartbeatRuns).set({ status: "succeeded", finishedAt: new Date() }).where(eq(heartbeatRuns.id, childRunId));
+      const parentRunId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.parentIssueId, status: "running" });
+      expect(await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.parentIssueId, runId: parentRunId,
+      })).toBe(true);
+      expect((await readIssue(fixture.parentIssueId)).executionWorkspaceId).toBeNull();
+      expect((await readIssue(fixture.childIssueId)).executionWorkspaceId).toBe(childWorkspaceId);
+    });
+
+    it("keeps a child's own unshared workspace", async () => {
+      const fixture = await seedOldReleaseChild();
+      const childWorkspaceId = randomUUID();
+      await db.insert(executionWorkspaces).values({
+        id: childWorkspaceId, companyId: fixture.companyId, projectId: fixture.projectId, projectWorkspaceId: fixture.projectWorkspaceId,
+        sourceIssueId: fixture.childIssueId, mode: "isolated_workspace", strategyType: "git_worktree", name: "Child worktree",
+        status: "active", providerType: "git_worktree", providerRef: `/tmp/${childWorkspaceId}`,
+      });
+      await db.update(issues).set({ executionWorkspaceId: childWorkspaceId }).where(eq(issues.id, fixture.childIssueId));
+      const runId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.childIssueId, status: "running" });
+      expect(await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.childIssueId, runId,
+      })).toBe(false);
+      expect((await readIssue(fixture.childIssueId)).executionWorkspaceId).toBe(childWorkspaceId);
+    });
+
+    it("lets a running child finish in the shared workspace before rebinding", async () => {
+      const fixture = await seedOldReleaseChild();
+      // The deploy lands while the child's earlier run is still running.
+      await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.childIssueId, status: "running" });
+      const nextRunId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.childIssueId, status: "queued" });
+
+      expect(await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.childIssueId, runId: nextRunId,
+      })).toBe(false);
+      expect((await readIssue(fixture.childIssueId)).executionWorkspaceId).toBe(fixture.parentWorkspaceId);
+    });
+
+    it("keeps an explicit share between unrelated tasks", async () => {
+      const fixture = await seedOldReleaseChild();
+      await db.update(issues).set({ parentId: null }).where(eq(issues.id, fixture.childIssueId));
+      const runId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.childIssueId, status: "running" });
+      expect(await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.childIssueId, runId,
+      })).toBe(false);
+      expect((await readIssue(fixture.childIssueId)).executionWorkspaceId).toBe(fixture.parentWorkspaceId);
+    });
+
+    it("never rebinds the parent, even when it is bound to its own workspace a child shares", async () => {
+      const fixture = await seedOldReleaseChild();
+      const runId = await insertRun({ companyId: fixture.companyId, agentId: fixture.agentId, issueId: fixture.parentIssueId, status: "running" });
+      expect(await executionWorkspaceService(db).releaseAncestorWorkspaceBindingAtAdmission({
+        companyId: fixture.companyId, issueId: fixture.parentIssueId, runId,
+      })).toBe(false);
+      expect((await readIssue(fixture.parentIssueId)).executionWorkspaceId).toBe(fixture.parentWorkspaceId);
+    });
+  });
+});

server/src/__tests__/task-workspace-api.test.ts

@@ -54,8 +54,10 @@ const support = await getEmbeddedPostgresTestSupport();
         assigneeAgentId: f.agentId, status: "backlog", workspaceSelection: { kind: "existing", workspaceId: workspace.id } }),
     });
     const response = await create(f.issueId), body = await response.json();
+    // The selection passes the trust checks, but the workspace is the parent's,
+    // so the child gets its own workspace instead of sharing it.
     expect({ status: response.status, body }).toMatchObject({ status: 201, body: {
-      parentId: f.issueId, executionWorkspaceId: workspace.id,
+      parentId: f.issueId, executionWorkspaceId: null,
       executionPolicy: { authorizationPolicy: { trustBoundary: policy.authorizationPolicy.trustBoundary } },
     } });
     const denied = await create(f.blockerId);

server/src/__tests__/task-workspace-binding.test.ts

@@ -134,7 +134,7 @@ const support = await getEmbeddedPostgresTestSupport();
     }
   });
 
-  it.each(["create", "createChild"] as const)("inherits a parent task folder through %s with isolated workspaces disabled", async (entryPoint) => {
+  it.each(["create", "createChild"] as const)("gives a child its own task folder instead of the parent's through %s with isolated workspaces disabled", async (entryPoint) => {
     const f = await fixture(), settings = instanceSettingsService(db), previous = await settings.getExperimental();
     await settings.updateExperimental({ enableIsolatedWorkspaces: false });
     try {
@@ -145,10 +145,13 @@ const support = await getEmbeddedPostgresTestSupport();
       const child = entryPoint === "create"
         ? await tasks.create(f.companyId, { ...input, parentId: f.issueId })
         : (await tasks.createChild(f.issueId, input)).issue;
-      expect(child).toMatchObject({ parentId: f.issueId, projectId: null, executionWorkspaceId: f.workspaceId,
-        executionWorkspacePreference: "reuse_existing" });
+      expect(child).toMatchObject({ parentId: f.issueId, projectId: null, executionWorkspaceId: null });
+      expect(child.executionWorkspacePreference).not.toBe("reuse_existing");
       const view = await executionWorkspaceService(db).inspectTaskWorkspace(f.companyId, child.id, f.actor);
-      expect(view.workspace).toMatchObject({ id: f.workspaceId, cwd: `/tmp/task-${f.issueId}` });
+      expect(view.workspace).toBeNull();
+      // The parent keeps its own task folder.
+      expect((await executionWorkspaceService(db).inspectTaskWorkspace(f.companyId, f.issueId, f.actor)).workspace)
+        .toMatchObject({ id: f.workspaceId, cwd: `/tmp/task-${f.issueId}` });
       const explicit = await tasks.create(f.companyId, { ...input, title: "Explicit separate folder", parentId: f.issueId,
         workspaceSelectionSource: "explicit" });
       expect(explicit.executionWorkspaceId).toBeNull();
@@ -233,6 +236,11 @@ const support = await getEmbeddedPostgresTestSupport();
           : source === "inherited" ? {}
             : { workspaceSelection: { kind: "existing" as const, workspaceId: f.workspaceId }, workspaceSelectionSource: source }),
       });
+      if (source === "inherited") {
+        // A child never inherits the files its parent is bound to.
+        expect(created).toMatchObject({ projectId: project.id, executionWorkspaceId: null });
+        return;
+      }
       expect(created).toMatchObject({ projectId: project.id, executionWorkspaceId: f.workspaceId, projectWorkspaceId: null });
       const [original] = await db.select().from(issues).where(eq(issues.id, f.issueId));
       expect(original).toMatchObject({ projectId: null, projectWorkspaceId: null, executionWorkspaceId: f.workspaceId });

server/src/__tests__/task-workspace-child-trust.test.ts

@@ -45,13 +45,18 @@ const support = await getEmbeddedPostgresTestSupport();
     const baseInput = scenario === "omitted_policy" ? { ...f.input, executionPolicy: undefined } : f.input;
     // Descendant trust is the subject here, so keep the deeper placement (board-style nesting).
     const input = scenario === "descendant" ? { ...baseInput, parentDepthPolicy: "allow_nested" as const } : baseInput;
+    // The selection passes trust checks, but the workspace belongs to an
+    // ancestor, so the child still gets its own workspace instead of sharing it.
     await expect(issueService(db).create(f.companyId, input)).resolves.toMatchObject({
-      parentId: f.input.parentId, executionWorkspaceId: f.workspace.id,
+      parentId: f.input.parentId, executionWorkspaceId: null,
     });
   });
   it("allows a parent run to patch an authorized child's existing workspace settings", async () => {
     const f = await fixture();
     const child = await issueService(db).create(f.companyId, { ...f.input, status: "backlog", responsibleUserId: f.userId });
+    // Bind the child as an older release did, so the patch path still sees a bound workspace.
+    await db.update(issues).set({ executionWorkspaceId: f.workspace.id, executionWorkspacePreference: "reuse_existing" })
+      .where(eq(issues.id, child.id));
     const app = express();
     app.use(express.json());
     app.use((req, _res, next) => {

server/src/onboarding-assets/ceo/HEARTBEAT.md

@@ -47,7 +47,7 @@ Status quick guide:
 
 ## 6. Delegation
 
-- Create subtasks with `POST /api/companies/{companyId}/issues`. Always set `parentId` and `goalId`. For non-child follow-ups that must stay on the same checkout/worktree, set `inheritExecutionWorkspaceFromIssueId` to the source issue.
+- Create subtasks with `POST /api/companies/{companyId}/issues`. Always set `parentId` and `goalId`. Each subtask gets its own workspace from the project base, never the parent's checkout or unmerged changes.
 - When you know the needed work and owner, create those subtasks directly. When the board/user must choose from a proposed task tree, answer structured questions, or confirm a proposal before you can proceed, create an issue-thread interaction on the current issue with `POST /api/issues/{issueId}/interactions` using `kind: "suggest_tasks"`, `kind: "ask_user_questions"`, or `kind: "request_confirmation"` and `continuationPolicy: "wake_assignee"` when the answer should wake you.
 - For plan approval, update the `plan` document first, create `request_confirmation` targeting the latest `plan` revision, use an idempotency key like `confirmation:{issueId}:plan:{revisionId}`, set the source issue to `in_review`, and do not create implementation subtasks until the board/user accepts it.
 - `ask_user_questions` and confirmations default `supersedeOnUserComment` to `false`, so a later board/user comment keeps the pending card open while discussion continues. Set it to `true` when a new comment should replace the pending request. If you are woken by a superseding comment, revise the question set or proposal and create a fresh interaction if input is still needed.

server/src/services/execution-workspace-repositories.ts

@@ -208,6 +208,54 @@ export function executionWorkspaceRepositoryService(db: Db) {
     });
     return { kind: "requires_next_admission" as const, applies: "next_normal_admission" as const, operationId: receipt.id, repository: receipt, reason: "immutable_admitted_workspace" };
   }
+  /**
+   * A task in a project without a project workspace gets its repositories by
+   * acquisition into its own task files. A subtask's new workspace repeats its
+   * parent's (or requester's) repository requests as its own pending requests,
+   * so admission clones a fresh copy at the requested ref through the normal
+   * acquisition path, with the subtask's own access checks. Nothing is copied
+   * from the parent's checkout: no pinned commit, branch, or files.
+   */
+  async function inheritSelections(input: { companyId: string; issueId: string; workspaceId: string }) {
+    return db.transaction(async tx => {
+      const [workspace] = await tx.select({ id: executionWorkspaces.id, sourceIssueId: executionWorkspaces.sourceIssueId })
+        .from(executionWorkspaces).where(and(eq(executionWorkspaces.id, input.workspaceId),
+          eq(executionWorkspaces.companyId, input.companyId))).for("update");
+      if (!workspace || workspace.sourceIssueId !== input.issueId) return 0;
+      const [existing] = await tx.select({ id: executionWorkspaceRepositories.id }).from(executionWorkspaceRepositories)
+        .where(and(eq(executionWorkspaceRepositories.companyId, input.companyId),
+          eq(executionWorkspaceRepositories.executionWorkspaceId, input.workspaceId))).limit(1);
+      if (existing) return 0;
+      const [task] = await tx.select({ parentId: issues.parentId, privacyParentIssueId: issues.privacyParentIssueId,
+        projectId: issues.projectId })
+        .from(issues).where(and(eq(issues.id, input.issueId), eq(issues.companyId, input.companyId)));
+      const sourceIssueId = task?.privacyParentIssueId ?? task?.parentId;
+      if (!sourceIssueId) return 0;
+      const [source] = await tx.select({ executionWorkspaceId: issues.executionWorkspaceId, projectId: issues.projectId })
+        .from(issues).where(and(eq(issues.id, sourceIssueId), eq(issues.companyId, input.companyId)));
+      if (!source?.executionWorkspaceId || source.executionWorkspaceId === input.workspaceId) return 0;
+      // Repositories belong to the source's project. A task in another project
+      // takes its own project's defaults instead, like a top-level task there.
+      if (task?.projectId !== source.projectId) return 0;
+      const requested = await tx.select().from(executionWorkspaceRepositories).where(and(
+        eq(executionWorkspaceRepositories.companyId, input.companyId),
+        eq(executionWorkspaceRepositories.executionWorkspaceId, source.executionWorkspaceId)));
+      if (!requested.length) return 0;
+      const rows = await tx.insert(executionWorkspaceRepositories).values(requested.map(row => {
+        const requestKey = `inherited:${row.id}`;
+        return { companyId: input.companyId, executionWorkspaceId: input.workspaceId, requestedByIssueId: input.issueId,
+          repositoryIdentity: row.repositoryIdentity, catalogRepositoryId: row.catalogRepositoryId, repoUrl: row.repoUrl,
+          relativePath: row.relativePath, requestedRef: row.requestedRef, requestKey, requestKeys: [requestKey] };
+      })).onConflictDoNothing().returning({ id: executionWorkspaceRepositories.id });
+      if (rows.length) {
+        await tx.insert(activityLog).values({ companyId: input.companyId, actorType: "system", actorId: "workspace-preparation",
+          action: "workspace.repository.requested", entityType: "execution_workspace", entityId: input.workspaceId,
+          details: { issueId: input.issueId, inheritedFromIssueId: sourceIssueId, repositoryIds: rows.map(row => row.id),
+            applies: "current_admission" } });
+      }
+      return rows.length;
+    });
+  }
   async function list(companyId: string, workspaceId: string) {
     return measureRunPhase("workspace.repository.receipts", () => db.select().from(executionWorkspaceRepositories).where(and(eq(executionWorkspaceRepositories.companyId, companyId), eq(executionWorkspaceRepositories.executionWorkspaceId, workspaceId))));
   }
@@ -352,8 +400,10 @@ export function executionWorkspaceRepositoryService(db: Db) {
     return candidatePin;
   }
   async function prepareForAdmission(input: { companyId: string; issueId: string; workspaceId: string; cwd: string; agentId: string; runId: string; responsibleUserId: string | null;
-    remoteTarget?: AdapterExecutionTarget | null; remoteLease?: EnvironmentLease; assertOwned?: () => Promise<void> }) {
+    remoteTarget?: AdapterExecutionTarget | null; remoteLease?: EnvironmentLease; assertOwned?: () => Promise<void>;
+    inheritRepositorySelections?: boolean }) {
     const { acquisitionRestricted, workspace } = await publicationBinding(db, input, false);
+    if (input.inheritRepositorySelections) await inheritSelections(input);
     const rows = await list(input.companyId, input.workspaceId);
     if (!rows.length) return [];
     await publicationBinding(db, input);

server/src/services/execution-workspaces.ts

@@ -29,6 +29,7 @@ import { resolveCoreTrustPreset } from "./trust-preset-resolver.js";
 import { CONTROLLER_PROVISION_COPY_ONLY, workspaceRequiresCopyOnlyProvisioning } from "./workspace-host-provision.js";
 import { instanceSettingsService } from "./instance-settings.js";
 import { taskWorkspaceSelectableCondition } from "./task-workspace-selection.js";
+import { bindsRelativesExecutionWorkspace, buildIndependentTaskWorkspaceSettings } from "./task-workspace-lineage.js";
 import { executionWorkspaceRepositoryService, canonicalRepositoryRoot } from "./execution-workspace-repositories.js";
 import { assertSelectedWorkspaceTrust, type TaskWorkspaceCreationTrustContext } from "./task-repository-acquisition.js";
 import { forbidden } from "../errors.js";
@@ -1721,6 +1722,55 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
     });
   }
 
+  /**
+   * Releases a subtask from a workspace it shares with an ancestor (the shape
+   * older releases created by default) so this admission realizes the
+   * subtask's own workspace from the project base. The task that created the
+   * workspace keeps it and its files; a relative bound to it (an ancestor that
+   * selected a descendant's workspace included) is the one released. While an earlier run of this subtask is still
+   * running, finalizing, or under recovery, the binding is kept so that writer
+   * can save its files first; a later admission releases it. Never throws for
+   * that wait: the run proceeds on its current binding and nobody is asked to act.
+   */
+  async function releaseAncestorWorkspaceBindingAtAdmission(input: { companyId: string; issueId: string; runId: string }) {
+    // Cheap unlocked pre-check: a task bound to a workspace it created keeps it.
+    // When a relative selected that workspace, the relative is the one that moves.
+    const [candidate] = await db.select({ sourceIssueId: executionWorkspaces.sourceIssueId })
+      .from(issues).innerJoin(executionWorkspaces, eq(executionWorkspaces.id, issues.executionWorkspaceId))
+      .where(and(eq(issues.id, input.issueId), eq(issues.companyId, input.companyId))).limit(1);
+    if (!candidate || candidate.sourceIssueId === input.issueId) return false;
+    return db.transaction(async tx => {
+      const [task] = await tx.select().from(issues).where(and(eq(issues.id, input.issueId), eq(issues.companyId, input.companyId))).for("update");
+      if (!task?.executionWorkspaceId || task.workspacePendingSelection) return false;
+      if (!await bindsRelativesExecutionWorkspace(tx, { companyId: input.companyId, executionWorkspaceId: task.executionWorkspaceId, task })) {
+        return false;
+      }
+      const [holder] = await tx.select({ id: heartbeatRuns.id }).from(heartbeatRuns).where(and(
+        eq(heartbeatRuns.companyId, input.companyId), ne(heartbeatRuns.id, input.runId),
+        or(eq(heartbeatRuns.nativeIssueId, input.issueId),
+          sql`coalesce(${heartbeatRuns.contextSnapshot}->>'issueId', ${heartbeatRuns.contextSnapshot}->>'taskId') = ${input.issueId}`),
+        eq(heartbeatRuns.status, "running"),
+      )).limit(1);
+      if (holder) return false;
+      if (await hasPendingTaskWorkspaceRecovery(tx, { ...input, excludeRunId: input.runId })) return false;
+      const selection = task.workspaceSelection;
+      await notifyStatusCardIssueChange(tx, task.companyId);
+      await tx.update(issues).set({
+        executionWorkspaceId: null,
+        executionWorkspacePreference: null,
+        // Without a project workspace the old settings described the relative's
+        // task files; the project's defaults apply instead, as for a top-level task.
+        executionWorkspaceSettings: task.projectWorkspaceId
+          ? buildIndependentTaskWorkspaceSettings(task.executionWorkspaceSettings)
+          : null,
+        ...(selection?.selection.kind === "existing" ? { workspaceSelection: null } : {}),
+        workspaceBindingRevision: task.workspaceBindingRevision + 1,
+        updatedAt: new Date(),
+      }).where(eq(issues.id, task.id));
+      return true;
+    });
+  }
+
   async function bindTaskWorkspace(companyId: string, issueId: string, workspaceId: string, patch: TaskWorkspaceBindingPatch = {}) {
     return db.transaction(async tx => {
       const [task] = await measureRunPhase("workspace.row_lock", () => tx.select().from(issues).where(and(eq(issues.id, issueId), eq(issues.companyId, companyId))).for("no key update"));
@@ -2739,7 +2789,7 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
     assertTaskRepositoryPublicationAllowed: executionWorkspaceRepositoryService(db).assertPublicationAllowed,
     prepareConfiguredRepositoryCopy: executionWorkspaceRepositoryService(db).prepareConfiguredRepositoryCopy,
     assertTaskRepositoryRecoveryBinding: executionWorkspaceRepositoryService(db).assertRecoveryBinding,
-    resolveSourceWorkspaceStrategy, validateSelection, validateStoredSelectionForRun, inspectTaskWorkspace, selectTaskWorkspace, applyPendingTaskWorkspaceSelection, bindTaskWorkspace, prepareTaskWorkspaceUpdate, assertTaskWorkspaceUpdateAccess,
+    resolveSourceWorkspaceStrategy, validateSelection, validateStoredSelectionForRun, inspectTaskWorkspace, selectTaskWorkspace, applyPendingTaskWorkspaceSelection, releaseAncestorWorkspaceBindingAtAdmission, bindTaskWorkspace, prepareTaskWorkspaceUpdate, assertTaskWorkspaceUpdateAccess,
     listOverview: async (
       companyId: string,
       filters: WorkspaceOverviewQuery,

server/src/services/heartbeat.ts

@@ -2191,10 +2191,16 @@ export function heartbeatService(
       const taskKey = deriveTaskKeyWithHeartbeatFallback(context, null);
       const sessionCodec = getAdapterSessionCodec(agent.adapterType);
       const issueId = readNonEmptyString(context.issueId);
+      const freshWorkspace = await readFreshWorkspaceReadiness(db, run);
       if (issueId && canApplyTaskWorkspaceSelectionAtAdmission({ admittedInput: parseObject(run.runnerProfileJson).nativeExecutionInput, restarting: Boolean(runOptions.nativeRestartRecovery), hasLeaseOwner: Boolean(runOptions.nativeLeaseOwner) })) {
         const changed = await executionWorkspacesSvc.applyPendingTaskWorkspaceSelection({ companyId: agent.companyId,
           issueId, runId: run.id, actor: { type: "agent", agentId: agent.id, companyId: agent.companyId, source: "agent_key" } });
-        if (changed) {
+        // A subtask an older release bound to its parent's workspace gets its own
+        // here. A process-loss retry or a continuation that keeps the current
+        // workspace still finishes the interrupted attempt there first.
+        const released = run.processLossRetryCount > 0 || (freshWorkspace && freshWorkspace.mode !== "fresh_isolated_workspace") ? false
+          : await executionWorkspacesSvc.releaseAncestorWorkspaceBindingAtAdmission({ companyId: agent.companyId, issueId, runId: run.id });
+        if (changed || released) {
           delete context.resumeSessionParams;
           delete context.resumeSessionDisplayId;
           context.workspaceSelectionChanged = true;
@@ -2323,7 +2329,6 @@ export function heartbeatService(
       const externalProvider = heartbeatExternalProvider({ run, agent }) ?? providerApiPlacement?.provider;
       const [taskWorkspaceIntentRow] = issueId && !externalProvider ? await db.select({ intent: issues.workspaceSelection }).from(issues)
         .where(and(eq(issues.id, issueId), eq(issues.companyId, agent.companyId))) : [];
-      const freshWorkspace = await readFreshWorkspaceReadiness(db, run);
       const contextProjectId = readNonEmptyString(context.projectId);
       const boundSourceWorkspace = !externalProvider && issueContext?.executionWorkspaceId
         ? await executionWorkspacesSvc.getStoredById(agent.companyId, issueContext.executionWorkspaceId) : null;

server/src/services/heartbeat/workspace-preparation.ts

@@ -1033,6 +1033,9 @@ async function prepareHeartbeatWorkspaceLocked(db: Db, input: HeartbeatWorkspace
   const branchNameForInitialPersistence =
     pendingForwardBranchReconcile?.recordedBranchName ??
     executionWorkspace.branchName;
+  // A workspace created by this admission may inherit its parent's repository
+  // requests (never its files); see executionWorkspaceRepositoryService.
+  let createdExecutionWorkspaceThisRun = false;
   try {
     if (remoteAuthority) {
       if (!remoteSourceState.value || !issueId) throw new Error("remote_workspace_source_missing");
@@ -1095,7 +1098,7 @@ async function prepareHeartbeatWorkspaceLocked(db: Db, input: HeartbeatWorkspace
             },
           ))
         : !controllerOnly && !persistedNativeExecutionInput && (resolvedProjectId || issueRef)
-          ? await timeWorkspace("workspace_record_create", () => executionWorkspacesSvc.create({
+          ? await timeWorkspace("workspace_record_create", () => (createdExecutionWorkspaceThisRun = true, executionWorkspacesSvc.create({
               companyId: agent.companyId,
               projectId: resolvedProjectId,
               projectWorkspaceId: resolvedProjectWorkspaceId,
@@ -1129,7 +1132,7 @@ async function prepareHeartbeatWorkspaceLocked(db: Db, input: HeartbeatWorkspace
               lastUsedAt: new Date(),
               openedAt: new Date(),
               metadata: nextExecutionWorkspaceMetadata,
-            }))
+            })))
           : null;
   } catch (error) {
     if (executionWorkspace.created) {
@@ -1223,7 +1226,8 @@ async function prepareHeartbeatWorkspaceLocked(db: Db, input: HeartbeatWorkspace
     const taskRepositories = await timeWorkspace("workspace_repository_admission", () =>
       executionWorkspacesSvc.prepareTaskRepositoriesForAdmission({ companyId: agent.companyId,
         issueId, workspaceId: persistedExecutionWorkspace!.id, cwd: executionWorkspace.cwd,
-        agentId: agent.id, runId: run.id, responsibleUserId }));
+        agentId: agent.id, runId: run.id, responsibleUserId,
+        inheritRepositorySelections: createdExecutionWorkspaceThisRun && !resolvedProjectWorkspaceId }));
     projectRepositoryPaths.push(...taskRepositories.map(repository => repository.relativePath));
   }
   if (!pluginPrepared && !pluginTaskWorkspace && !remoteAuthority && executionWorkspace.projectId

server/src/services/issues.ts

@@ -191,6 +191,12 @@ import {
   type ParsedExecutionWorkspaceMode,
 } from "./execution-workspace-policy.js";
 import { mergeExecutionWorkspaceConfig } from "./execution-workspaces.js";
+import {
+  buildIndependentTaskWorkspaceSettings,
+  isAncestorExecutionWorkspace,
+  loadAncestorIssueIds,
+  mergeExplicitWorkspaceSettings,
+} from "./task-workspace-lineage.js";
 import { hasChatRunOwnedProviderInteraction } from "./chat-interaction-arbitration.js";
 import { readChatControlChronology } from "./chat-control-chronology.js";
 import { authorizeChatConversationForBoundRun } from "./native-runtime/chat-attachment-reuse.js";
@@ -538,59 +544,6 @@ function buildReusedExecutionWorkspaceConfigPatchFromIssueSettings(
   };
 }
 
-// Accepted-plan children are not realized yet, so carry only unresolved
-// workspace intent and let the first child run render/persist its own branch.
-function buildPreRealizationExecutionWorkspaceSettings(
-  raw: unknown,
-): Record<string, unknown> | null {
-  const settings = parseIssueExecutionWorkspaceSettings(raw, {
-    includeEnvironmentId: true,
-  });
-  if (!settings) return null;
-  const mode =
-    settings.mode &&
-    settings.mode !== "inherit" &&
-    settings.mode !== "reuse_existing"
-      ? settings.mode
-      : null;
-  const next: Record<string, unknown> = {};
-  if (mode) next.mode = mode;
-  if (settings.environmentId !== undefined)
-    next.environmentId = settings.environmentId;
-  if (settings.workspaceRuntime)
-    next.workspaceRuntime = settings.workspaceRuntime;
-  if (settings.workspaceStrategy) {
-    next.workspaceStrategy = {
-      type: settings.workspaceStrategy.type,
-      ...(settings.workspaceStrategy.baseRef
-        ? { baseRef: settings.workspaceStrategy.baseRef }
-        : {}),
-      ...(settings.workspaceStrategy.branchTemplate
-        ? { branchTemplate: settings.workspaceStrategy.branchTemplate }
-        : {}),
-      ...(settings.workspaceStrategy.existingBranch
-        ? { existingBranch: settings.workspaceStrategy.existingBranch }
-        : {}),
-      ...(settings.workspaceStrategy.worktreeParentDir
-        ? { worktreeParentDir: settings.workspaceStrategy.worktreeParentDir }
-        : {}),
-      ...(settings.workspaceStrategy.provisionCommand
-        ? { provisionCommand: settings.workspaceStrategy.provisionCommand }
-        : {}),
-      ...(settings.workspaceStrategy.runtimeProvisionCommand
-        ? {
-            runtimeProvisionCommand:
-              settings.workspaceStrategy.runtimeProvisionCommand,
-          }
-        : {}),
-      ...(settings.workspaceStrategy.teardownCommand
-        ? { teardownCommand: settings.workspaceStrategy.teardownCommand }
-        : {}),
-    };
-  }
-  return Object.keys(next).length > 0 ? next : null;
-}
-
 function toTimestampMs(value: Date | string | null | undefined) {
   if (!value) return null;
   const date = value instanceof Date ? value : new Date(value);
@@ -9760,14 +9713,14 @@ export function issueService(db: Db) {
       const {
         acceptanceCriteria,
         blockParentUntilDone,
-        executionWorkspaceInheritanceMode = "linkage",
+        // Deprecated and ignored: a child never reuses its parent's realized
+        // workspace, so every mode behaves like the old "strategy_only".
+        executionWorkspaceInheritanceMode: _deprecatedInheritanceMode,
         actorAgentId,
         actorUserId,
         ...issueData
       } = data;
 
-      const inheritStrategyOnly =
-        executionWorkspaceInheritanceMode === "strategy_only";
       // A child may target another project. Parent workspace identity is only
       // valid inside the parent's project, so do not forward it across that
       // boundary; create() then resolves the target project's own workspaces.
@@ -9778,12 +9731,23 @@ export function issueService(db: Db) {
         issueData.executionWorkspaceId !== undefined ||
         issueData.executionWorkspacePreference !== undefined ||
         issueData.executionWorkspaceSettings !== undefined;
+      // The child keeps the parent's workspace strategy, never its files. The
+      // strategy belongs to the parent's project, so it stays behind when the
+      // child targets another project.
+      // Only a parent realized from a project workspace has a strategy that
+      // applies to the project base; a parent in its own task files does not.
+      const parentStrategy = childInheritsParentProject && parent.projectWorkspaceId
+        ? buildIndependentTaskWorkspaceSettings(parent.executionWorkspaceSettings)
+        : null;
       const inheritedPreRealizationWorkspaceSettings =
-        inheritStrategyOnly && !hasExplicitExecutionWorkspaceOverride
-          ? buildPreRealizationExecutionWorkspaceSettings(
-              parent.executionWorkspaceSettings,
-            )
-          : null;
+        !hasExplicitExecutionWorkspaceOverride
+          ? parentStrategy
+          : issueData.executionWorkspaceId === undefined && issueData.executionWorkspaceSettings
+            ? mergeExplicitWorkspaceSettings(
+                parentStrategy,
+                issueData.executionWorkspaceSettings as Record<string, unknown>,
+              )
+            : null;
       let child = await issueService(db).create(parent.companyId, {
         ...issueData,
         parentId: parent.id,
@@ -9791,7 +9755,7 @@ export function issueService(db: Db) {
         projectWorkspaceId:
           issueData.projectWorkspaceId !== undefined
             ? issueData.projectWorkspaceId
-            : (inheritStrategyOnly && childInheritsParentProject
+            : (childInheritsParentProject
                 ? parent.projectWorkspaceId
                 : undefined),
         goalId: issueData.goalId ?? parent.goalId,
@@ -9814,9 +9778,7 @@ export function issueService(db: Db) {
                 inheritedPreRealizationWorkspaceSettings,
             }
           : {}),
-        ...(inheritStrategyOnly
-          ? { skipExecutionWorkspaceInheritance: true }
-          : { inheritExecutionWorkspaceFromIssueId: parent.id }),
+        skipExecutionWorkspaceInheritance: true,
       });
 
       if (blockParentUntilDone) {
@@ -10065,7 +10027,6 @@ export function issueService(db: Db) {
             tx as unknown as Db,
           ).createChild(sourceIssue.id, {
             ...nextChildInput,
-            executionWorkspaceInheritanceMode: "strategy_only",
             onDeduplicated: reason => {
               childReused = true;
               nextChildInput.onDeduplicated?.(reason);
@@ -10449,6 +10410,7 @@ export function issueService(db: Db) {
           issueData.executionWorkspaceId !== undefined ||
           issueData.executionWorkspacePreference !== undefined ||
           issueData.executionWorkspaceSettings !== undefined;
+        let inheritedIndependentSettings: Record<string, unknown> | null = null;
         if (workspaceInheritanceIssueId) {
           const workspaceSource = await getWorkspaceInheritanceIssue(
             tx,
@@ -10476,36 +10438,34 @@ export function issueService(db: Db) {
             projectWorkspaceId = workspaceSource.projectWorkspaceId;
             inheritedWorkspaceSelection = true;
           }
-          if (
-            inheritsSourceProject &&
-            !hasExplicitExecutionWorkspaceOverride &&
-            workspaceSource.executionWorkspaceId
+          // The source's realized workspace (its checkout, branch, saved
+          // snapshot and unmerged changes) is never shared. A parent and its
+          // child, or a source task and its follow-up, can run at the same
+          // time, and two writers in one folder lose each other's files. The
+          // new task keeps only the source's workspace strategy and realizes
+          // its own workspace from the project base on its first run.
+          // The source's strategy describes how to realize work from its
+          // project workspace. A source without one worked in its own task
+          // files, so the new task takes the project's defaults, exactly as a
+          // top-level task in that project would.
+          if (inheritsSourceProject && workspaceSource.projectWorkspaceId) {
+            inheritedIndependentSettings = buildIndependentTaskWorkspaceSettings(
+              workspaceSource.executionWorkspaceSettings,
+            );
+          }
+          if (!hasExplicitExecutionWorkspaceOverride && executionWorkspaceSettings == null) {
+            executionWorkspaceSettings = inheritedIndependentSettings;
+          } else if (
+            issueData.executionWorkspaceId === undefined &&
+            issueData.executionWorkspaceSettings &&
+            !(workspaceSelection !== undefined && workspaceSelectionSource === "explicit")
           ) {
-            const sourceWorkspace = await tx
-              .select({
-                id: executionWorkspaces.id,
-                mode: executionWorkspaces.mode,
-              })
-              .from(executionWorkspaces)
-              .where(
-                eq(
-                  executionWorkspaces.id,
-                  workspaceSource.executionWorkspaceId,
-                ),
-              )
-              .then((rows) => rows[0] ?? null);
-            if (sourceWorkspace) {
-              executionWorkspaceId = sourceWorkspace.id;
-              inheritedWorkspaceSelection = true;
-              executionWorkspacePreference = "reuse_existing";
-              executionWorkspaceSettings = {
-                ...((workspaceSource.executionWorkspaceSettings as
-                  Record<string, unknown> | null | undefined) ?? {}),
-                mode: issueExecutionWorkspaceModeForPersistedWorkspace(
-                  sourceWorkspace.mode,
-                ),
-              };
-            }
+            // A caller that names only a mode keeps the inherited base ref,
+            // branch template, commands and runtime for that mode.
+            executionWorkspaceSettings = mergeExplicitWorkspaceSettings(
+              inheritedIndependentSettings,
+              executionWorkspaceSettings,
+            );
           }
         }
         const workspaceActor: AuthorizationActor = workspaceSelectionActor ?? (issueData.createdByUserId
@@ -10525,6 +10485,25 @@ export function issueService(db: Db) {
           executionWorkspaceSettings = projection.executionWorkspaceSettings;
           workspaceIntent = { version: 1, selection: workspaceSelection, source: workspaceSelectionSource };
         }
+        // No route may bind a new subtask to an ancestor's workspace, including
+        // an explicit id copied from the parent (older clients and skills did
+        // this). Drop it and keep only the ancestor's strategy, so the subtask
+        // realizes its own workspace from the project base.
+        if (executionWorkspaceId && (requestedParentId || issueData.parentId)) {
+          const ancestorIssueIds = [...new Set([
+            ...(await loadAncestorIssueIds(tx, companyId, requestedParentId)),
+            ...(await loadAncestorIssueIds(tx, companyId, issueData.parentId)),
+          ])];
+          if (await isAncestorExecutionWorkspace(tx, { companyId, executionWorkspaceId, ancestorIssueIds })) {
+            executionWorkspaceId = null;
+            executionWorkspacePreference = null;
+            executionWorkspaceSettings = mergeExplicitWorkspaceSettings(
+              inheritedIndependentSettings,
+              buildIndependentTaskWorkspaceSettings(executionWorkspaceSettings),
+            );
+            if (workspaceIntent?.selection.kind === "existing") workspaceIntent = null;
+          }
+        }
         if (executionWorkspaceId) {
           const workspace = await assertValidExecutionWorkspace(companyId, null, executionWorkspaceId, tx);
           projectWorkspaceId = workspace.projectWorkspaceId;

server/src/services/remote-workspace-reservation.test.ts

@@ -13,7 +13,6 @@ import { getEmbeddedPostgresTestSupport, startEmbeddedPostgresTestDatabase } fro
 import { createLocalDiskStorageProvider } from "../storage/local-disk-provider.js";
 import { createStorageService } from "../storage/service.js";
 import { instanceSettingsService } from "./instance-settings.js";
-import { issueService } from "./issues.js";
 import { reserveRemoteWorkspace } from "./remote-workspaces.js";
 import { remoteTerminationReceipt } from "./remote-execution-termination.js";
 import { executionWorkspaceService } from "./execution-workspaces.js";
@@ -62,8 +61,9 @@ describe.skipIf(!support.supported)("remote workspace reservation authority", ()
       metadata: { remoteWorkspace: authority } }).returning();
     await db.update(issues).set({ executionWorkspaceId: workspace.id, executionWorkspacePreference: "reuse_existing",
       executionWorkspaceSettings: { mode } }).where(eq(issues.id, parent.id));
-    const child = await issueService(db).create(company.id, { parentId: parent.id, title: "Continue the saved work", assigneeAgentId: agent.id });
-    expect(child.executionWorkspaceId).toBe(workspace.id);
+    // New children never share a parent's workspace. This is the shape an older
+    // release wrote, which the reservation authority must still handle safely.
+    const child = await insertBoundChild(company.id, parent, workspace.id, mode, "Continue the saved work", agent.id);
     const [run] = await db.insert(heartbeatRuns).values({ companyId: company.id, agentId: agent.id,
       issueId: child.id, status: "running", runtimeMode: "legacy" }).returning();
     const storage = { ...createStorageService(createLocalDiskStorageProvider(join(home, company.id))), provider: "s3" as const };
@@ -73,6 +73,14 @@ describe.skipIf(!support.supported)("remote workspace reservation authority", ()
     const [boundWorkspace] = await db.select().from(executionWorkspaces).where(eq(executionWorkspaces.id, workspace.id));
     return { input, parent, child, workspace: boundWorkspace!, authority, run, agent, company };
   }
+  async function insertBoundChild(companyId: string, parent: typeof issues.$inferSelect, workspaceId: string,
+    mode: string, title: string, assigneeAgentId: string) {
+    const [child] = await db.insert(issues).values({ companyId, parentId: parent.id, projectId: parent.projectId,
+      projectWorkspaceId: parent.projectWorkspaceId, title, status: "todo", assigneeAgentId,
+      executionWorkspaceId: workspaceId, executionWorkspacePreference: "reuse_existing",
+      executionWorkspaceSettings: { mode } }).returning();
+    return child!;
+  }
   const current = async (id: string) => (await db.select().from(executionWorkspaces).where(eq(executionWorkspaces.id, id)))[0]!;
 
   it.each(["isolated_workspace", "operator_branch", "shared_workspace"])("reserves an inherited %s using the persisted task binding", async mode => {
@@ -180,8 +188,8 @@ describe.skipIf(!support.supported)("remote workspace reservation authority", ()
 
   it("grants only one writer when two bound children reserve concurrently", async () => {
     const f = await fixture();
-    const sibling = await issueService(db).create(f.company.id, { parentId: f.parent.id,
-      title: "Another child", assigneeAgentId: f.agent.id });
+    const sibling = await insertBoundChild(f.company.id, f.parent, f.workspace.id, "isolated_workspace",
+      "Another child", f.agent.id);
     const [run] = await db.insert(heartbeatRuns).values({ companyId: f.company.id, agentId: f.agent.id,
       issueId: sibling.id, status: "running" }).returning();
     const inputs = [f.input, { ...f.input, issueId: sibling.id, runId: run.id }];

server/src/services/remote-workspaces.integration.test.ts

@@ -1147,8 +1147,11 @@ suite("remote workspace lifecycle with real Postgres and independent filesystem
       lease: await lease(), target: first });
     await fs.writeFile(path.join(prepared.remoteRoot, "shared-result.txt"), "from the first task\n");
     const childInput = { title: "Continue saved work", status: "in_progress" as const, assigneeAgentId: ids.agent };
-    const child = inherited ? await issueService(db).create(ids.company, { ...childInput, parentId: ids.issue })
-      : (await db.insert(issues).values({ ...childInput, companyId: ids.company, projectId, projectWorkspaceId: sourceId }).returning())[0]!;
+    // New children never share a parent's workspace; `inherited` is the shape an
+    // older release wrote, which saved-file continuation must still handle.
+    const child = (await db.insert(issues).values({ ...childInput, companyId: ids.company, projectId, projectWorkspaceId: sourceId,
+      ...(inherited ? { parentId: ids.issue, executionWorkspaceId: reserved.id, executionWorkspacePreference: "reuse_existing",
+        executionWorkspaceSettings: { mode } } : {}) }).returning())[0]!;
     if (inherited) expect(child.executionWorkspaceId).toBe(reserved.id);
     const secondIssue = child.id, secondRun = randomUUID(), secondLease = randomUUID();
     await db.insert(heartbeatRuns).values({ id: secondRun, companyId: ids.company, agentId: ids.agent,

server/src/services/task-workspace-lineage.ts

@@ -0,0 +1,188 @@
+import { and, eq, inArray } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import { executionWorkspaces, issues } from "@paperclipai/db";
+import { parseIssueExecutionWorkspaceSettings } from "./execution-workspace-policy.js";
+import { loadParentChain } from "./issue-hierarchy.js";
+
+type LineageReader = Pick<Db, "select" | "execute">;
+
+/**
+ * A subtask never shares a workspace with its parent or any other ancestor.
+ * It may keep the ancestor's workspace *strategy* (mode, environment, runtime,
+ * branch template, base ref), but nothing that names realized files: no
+ * workspace id, no `reuse_existing` preference, and no pinned existing branch.
+ * The first run realizes the subtask's own workspace from the project base,
+ * exactly as it would for a top-level task.
+ */
+export function buildIndependentTaskWorkspaceSettings(
+  raw: unknown,
+): Record<string, unknown> | null {
+  const settings = parseIssueExecutionWorkspaceSettings(raw, {
+    includeEnvironmentId: true,
+  });
+  if (!settings) return null;
+  // `operator_branch` works on a named existing branch, which for a subtask
+  // would be the ancestor's branch; the project default applies instead.
+  const mode =
+    settings.mode &&
+    settings.mode !== "inherit" &&
+    settings.mode !== "reuse_existing" &&
+    settings.mode !== "operator_branch"
+      ? settings.mode
+      : null;
+  const next: Record<string, unknown> = {};
+  if (mode) next.mode = mode;
+  // Policy fields that name no files carry over with the strategy.
+  if (settings.sharedWorkspaceConcurrency)
+    next.sharedWorkspaceConcurrency = settings.sharedWorkspaceConcurrency;
+  if (settings.networkEgress) next.networkEgress = settings.networkEgress;
+  if (settings.environmentId !== undefined)
+    next.environmentId = settings.environmentId;
+  if (settings.workspaceRuntime)
+    next.workspaceRuntime = settings.workspaceRuntime;
+  const strategy = settings.workspaceStrategy;
+  if (strategy) {
+    next.workspaceStrategy = {
+      type: strategy.type,
+      ...(strategy.baseRef ? { baseRef: strategy.baseRef } : {}),
+      ...(strategy.branchTemplate ? { branchTemplate: strategy.branchTemplate } : {}),
+      ...(strategy.worktreeParentDir ? { worktreeParentDir: strategy.worktreeParentDir } : {}),
+      ...(strategy.provisionCommand ? { provisionCommand: strategy.provisionCommand } : {}),
+      ...(strategy.runtimeProvisionCommand
+        ? { runtimeProvisionCommand: strategy.runtimeProvisionCommand }
+        : {}),
+      ...(strategy.teardownCommand ? { teardownCommand: strategy.teardownCommand } : {}),
+    };
+  }
+  return Object.keys(next).length > 0 ? next : null;
+}
+
+/**
+ * Lays a task's explicit workspace settings over the strategy it inherited, so
+ * a caller that names only a mode (the New sub-task dialog does) keeps the
+ * inherited base ref, branch template, commands and runtime. A different
+ * explicit mode is a different strategy, so it replaces the inherited one.
+ */
+export function mergeExplicitWorkspaceSettings(
+  inherited: Record<string, unknown> | null,
+  explicit: Record<string, unknown> | null,
+): Record<string, unknown> | null {
+  if (!inherited) return explicit;
+  if (!explicit) return inherited;
+  if (explicit.mode && inherited.mode && explicit.mode !== inherited.mode) return explicit;
+  const inheritedStrategy = inherited.workspaceStrategy as Record<string, unknown> | undefined;
+  const explicitStrategy = explicit.workspaceStrategy as Record<string, unknown> | undefined;
+  return {
+    ...inherited,
+    ...explicit,
+    ...(inheritedStrategy || explicitStrategy
+      ? { workspaceStrategy: { ...(inheritedStrategy ?? {}), ...(explicitStrategy ?? {}) } }
+      : {}),
+  };
+}
+
+/**
+ * The issues a task must never share a workspace with: its parent chain, plus
+ * the requested parent's chain when depth placement put the task beside its
+ * requester (recorded as `privacyParentIssueId`).
+ */
+export async function loadTaskLineageIssueIds(
+  db: Pick<Db, "execute">,
+  companyId: string,
+  task: { id: string; parentId: string | null; privacyParentIssueId?: string | null },
+): Promise<string[]> {
+  const ids = new Set([
+    ...(await loadAncestorIssueIds(db, companyId, task.parentId)),
+    ...(task.privacyParentIssueId && task.privacyParentIssueId !== task.parentId
+      ? await loadAncestorIssueIds(db, companyId, task.privacyParentIssueId)
+      : []),
+  ]);
+  ids.delete(task.id);
+  return [...ids];
+}
+
+/** Ids of `parentId` and every ancestor above it (company-scoped). */
+export async function loadAncestorIssueIds(
+  db: Pick<Db, "execute">,
+  companyId: string,
+  parentId: string | null | undefined,
+): Promise<string[]> {
+  if (!parentId) return [];
+  const chain = await loadParentChain(db, companyId, parentId);
+  return chain.map((row) => row.id);
+}
+
+/**
+ * True when `task` is bound to a workspace that a relative in its task tree
+ * owns: an ancestor (or the requester it was placed beside) created it or is
+ * bound to it, or a descendant created it. The task that created the
+ * workspace keeps it; the relative bound to it is the one that moves, so its
+ * fresh workspace never lands on the owner's branch or folder.
+ */
+export async function bindsRelativesExecutionWorkspace(
+  db: LineageReader,
+  input: {
+    companyId: string;
+    executionWorkspaceId: string;
+    task: { id: string; parentId: string | null; privacyParentIssueId?: string | null };
+  },
+): Promise<boolean> {
+  const [workspace] = await db
+    .select({ sourceIssueId: executionWorkspaces.sourceIssueId })
+    .from(executionWorkspaces)
+    .where(and(
+      eq(executionWorkspaces.companyId, input.companyId),
+      eq(executionWorkspaces.id, input.executionWorkspaceId),
+    ))
+    .limit(1);
+  const ownerIssueId = workspace?.sourceIssueId ?? null;
+  if (ownerIssueId === input.task.id) return false;
+  const ancestorIssueIds = await loadTaskLineageIssueIds(db, input.companyId, input.task);
+  if (await isAncestorExecutionWorkspace(db, {
+    companyId: input.companyId,
+    executionWorkspaceId: input.executionWorkspaceId,
+    ancestorIssueIds,
+  })) return true;
+  if (!ownerIssueId) return false;
+  const [owner] = await db
+    .select({ parentId: issues.parentId, privacyParentIssueId: issues.privacyParentIssueId })
+    .from(issues)
+    .where(and(eq(issues.companyId, input.companyId), eq(issues.id, ownerIssueId)))
+    .limit(1);
+  if (!owner) return false;
+  const ownerLineage = await loadTaskLineageIssueIds(db, input.companyId, { id: ownerIssueId, ...owner });
+  return ownerLineage.includes(input.task.id);
+}
+
+/**
+ * True when the execution workspace belongs to one of `ancestorIssueIds`:
+ * an ancestor created it, or an ancestor is currently bound to it. Either way
+ * a descendant bound to it would write into the ancestor's files.
+ */
+export async function isAncestorExecutionWorkspace(
+  db: LineageReader,
+  input: { companyId: string; executionWorkspaceId: string; ancestorIssueIds: string[] },
+): Promise<boolean> {
+  if (input.ancestorIssueIds.length === 0) return false;
+  const [workspace] = await db
+    .select({ sourceIssueId: executionWorkspaces.sourceIssueId })
+    .from(executionWorkspaces)
+    .where(and(
+      eq(executionWorkspaces.companyId, input.companyId),
+      eq(executionWorkspaces.id, input.executionWorkspaceId),
+    ))
+    .limit(1);
+  if (workspace?.sourceIssueId && input.ancestorIssueIds.includes(workspace.sourceIssueId)) {
+    return true;
+  }
+  const [boundAncestor] = await db
+    .select({ id: issues.id })
+    .from(issues)
+    .where(and(
+      eq(issues.companyId, input.companyId),
+      inArray(issues.id, input.ancestorIssueIds),
+      eq(issues.executionWorkspaceId, input.executionWorkspaceId),
+    ))
+    .limit(1);
+  return Boolean(boundAncestor);
+}