Give the phase brief a protocol, and end the session it advances

The brief told the agent to ask for a phase change and never carried the
asking. The agent asked in prose, no code represented the request, and the
session idled until its lease expired. That is what failed run 3.

F21. The agent asks with .orchestra/phase-request.json, and seals
research.json or plan.json where the phase it is leaving produces one. At a
verified turn boundary the worker checks the phase belief, the transition and
the artifact, then calls the coordinator with its lease epoch and a derived
operation id. AdvanceWorkPhase is unchanged, so a request cannot reach a move
the operator surface could not also make. Redelivery is idempotent.

F22. A session now records the phase it was launched to run. One that no
longer matches its task rotates with reason phase_changed, whether this worker
asked for the change or an operator made it.

F20. CLIAdapter.prompt sent handoff and rotation prompts without confirming
them, which is the failure F20 exists to catch. Fixed at the shared call site.

F23 needed no change. Issue comments already become decisions with no
submission, through Reconciler.Reconcile at PreLease and at every turn
boundary. The earlier finding searched internal/operations alone and was
wrong. Tests now cover the boundary it turns on.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011xsXyr5J1RACo71YeKG3Pu

internal/federation/client.go

@@ -144,6 +144,30 @@ func (c Client) Turn(ctx context.Context, taskID, epoch, verdict string, deliver
 	return out, nil
 }
 
+// AdvancePhase carries an agent's bounded phase-change request to the
+// coordinator, which decides. The accepted phase comes back so the worker
+// knows the session it owns has been superseded and must rotate.
+//
+// artifact is the sealed output of the phase being left, and is empty for a
+// phase that produces none.
+func (c Client) AdvancePhase(ctx context.Context, taskID, epoch, operationID string, from, to domain.WorkPhase, artifact []byte) (domain.WorkPhase, error) {
+	resp, err := c.request(ctx, http.MethodPost, "/v1/federation/phase", map[string]any{
+		"task_id": taskID, "lease_epoch": epoch, "operation_id": operationID,
+		"from": string(from), "to": string(to), "artifact": artifact,
+	})
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	var out struct {
+		Phase domain.WorkPhase `json:"phase"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return "", err
+	}
+	return out.Phase, nil
+}
+
 // Intent fetches the reduced authority for one task: its contract plus the
 // human decisions still standing. A worker renders its launch instruction
 // from this, never from handoff prose.