Add READY state for human-in-the-loop verification

Top-level tasks now land in READY after successful execution instead of
going directly to COMPLETED. Subtasks (with parent_task_id) skip the gate
and remain COMPLETED. Users accept or reject via new API endpoints:

  POST /api/tasks/{id}/accept  → READY → COMPLETED
  POST /api/tasks/{id}/reject  → READY → PENDING (with rejection_comment)

- task: add StateReady, RejectionComment field, update ValidTransition
- storage: migrate rejection_comment column, add RejectTask method
- executor: route top-level vs subtask to READY vs COMPLETED
- api: /accept and /reject handlers with 409 on invalid state

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 49 insertions, 0 deletions

diff --git a/internal/api/server.go b/internal/api/server.go
index 8415b28..608cdd4 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -60,6 +60,8 @@ func (s *Server) routes() {
 	s.mux.HandleFunc("GET /api/tasks", s.handleListTasks)
 	s.mux.HandleFunc("GET /api/tasks/{id}", s.handleGetTask)
 	s.mux.HandleFunc("POST /api/tasks/{id}/run", s.handleRunTask)
+	s.mux.HandleFunc("POST /api/tasks/{id}/accept", s.handleAcceptTask)
+	s.mux.HandleFunc("POST /api/tasks/{id}/reject", s.handleRejectTask)
 	s.mux.HandleFunc("GET /api/tasks/{id}/subtasks", s.handleListSubtasks)
 	s.mux.HandleFunc("GET /api/tasks/{id}/executions", s.handleListExecutions)
 	s.mux.HandleFunc("GET /api/executions/{id}", s.handleGetExecution)
@@ -210,6 +212,53 @@ func (s *Server) handleRunTask(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+func (s *Server) handleAcceptTask(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	t, err := s.store.GetTask(id)
+	if err != nil {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "task not found"})
+		return
+	}
+	if !task.ValidTransition(t.State, task.StateCompleted) {
+		writeJSON(w, http.StatusConflict, map[string]string{
+			"error": fmt.Sprintf("task cannot be accepted from state %s", t.State),
+		})
+		return
+	}
+	if err := s.store.UpdateTaskState(id, task.StateCompleted); err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "task accepted", "task_id": id})
+}
+
+func (s *Server) handleRejectTask(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	t, err := s.store.GetTask(id)
+	if err != nil {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "task not found"})
+		return
+	}
+	if !task.ValidTransition(t.State, task.StatePending) {
+		writeJSON(w, http.StatusConflict, map[string]string{
+			"error": fmt.Sprintf("task cannot be rejected from state %s", t.State),
+		})
+		return
+	}
+	var input struct {
+		Comment string `json:"comment"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON: " + err.Error()})
+		return
+	}
+	if err := s.store.RejectTask(id, input.Comment); err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "task rejected", "task_id": id})
+}
+
 func (s *Server) handleListSubtasks(w http.ResponseWriter, r *http.Request) {
 	parentID := r.PathValue("id")
 	tasks, err := s.store.ListSubtasks(parentID)