[Deicyde]

The Worker half of the claims API (Jack, 2026-11-11: "Build a claims API"). Stacked on #195, whose index bundles a package names; review that first. The coordinator publishes work packages, each one planned locate run; an outside contributor's agent claims one, downloads it, runs it on its own machine, submits the sealed sets through intake as today, and links each receipt to the claim, so the coordinator collects a run's results from one view. Intake is unchanged.

Routes (wiki/src/claims.ts).

• Owned agent: GET /api/packages (open packages, oldest first, and whether each is free); POST /api/claims {request_key, run_id?} (the oldest free package or the named one; a repeated request_key answers with the same claim); GET /api/claims/<id>/package (the envelope's bytes from the private bucket, Content-Digest = its sha256); POST /api/claims/<id>/renew, …/submissions {submission_id} and …/release {reason, note?}.
• Pipeline bearer: POST /api/packages publishes an envelope already uploaded to packages/v1/<sha256>.json (checks the object's size, a live bundle of the same universe and index, the run id and campaign grammar; published once, never replaced); POST /api/packages/<run>/state {open|done|retired} moves it and ends any live claim, so re-opening frees a package from a claimant who stopped; GET /api/packages/<run>/claims lists its claims with their linked receipts and verdicts.

Rules. A claim is a 24-hour lease, renewed as the client works, for at most 7 days. One live claim per package (a partial unique index as well as the insert's check); per owner, all their agents together, 2 live claims and 10 new ones a UTC day. Every claim runs in one batch that first ends lapsed claims and claims whose agent lost access, then inserts with the access, CC0, brake, lever and caps re-checked inside the statement. done needs a linked receipt; a receipt joins one claim, belongs to the same agent, and links only while the claim is live (at most 20). Revoking an agent at /agents ends its live claims (a third statement in the revoke batch). The brake stops every write here.

Migration 0023 seeds the claims lever closed (INSERT OR IGNORE) and creates contrib_packages, contrib_claims and contrib_claim_submissions; the promoter refuses a commit containing it until the last exists on D1. Agent revocation writes contrib_claims, so 0023 must be on D1 before this code is promoted, which the gate enforces.

Not here. The Python side (an envelope builder and uploader, publish_package.py --api, run_package.py --claims, collect_results.py --api) is the next PR. Packages carry no secrets and no article bytes (scripts/pipeline/contribute/package.py), and the Worker never parses one.

Release. Release-affecting (wiki/src, a migration). Before the promotion that carries it: back up, then apply and verify 0022 and 0023 in order. It ships dark: nothing is claimable until a package is published and the lever opened. CLAUDE.md, AGENTS.md and docs/AGENT-CONTRIBUTIONS.md say all of this.

Checks. Worker, Python and browser CI green at f6d06b8: https://github.com/Deicyde/WikiLean/actions/runs/43470477587 (wiki/test/claims.test.ts, 18 tests, among them two agents racing for one package; the promoter's order test for 0023).