Add federation worker and canonical handoffs

AUDIT.md

@@ -889,3 +889,36 @@ implemented when nothing can reach it.
 Everything else audited (provider layer, continuity schema/validation,
 router matching, delivery, federation registration primitives) was
 spot-checked against the code and its tests and matched described behavior.
+
+---
+
+## Handoff provenance correction (2026-07-28)
+
+The previous rotation path had a **primacy inversion**: the harness wrote a
+free-form Markdown “semantic report”, while `canonicalHandoff` fabricated
+the canonical fields around it (`goal`, `done_when`, a circular action and a
+`cat` command) and placed the entire report in one `remaining` element. That
+made the apparent schema a wrapper around prose rather than an authoritative
+handoff.
+
+The release path now asks the harness for only six labelled, bounded answers:
+`NEXT`, `WHY`, `REMAINING`, `DEAD ENDS`, `OPEN Q`, and `LEARNED`, each with a
+`NONE` escape. `canonicalHandoff` parses those answers and derives only
+worker-owned facts (Git anchor, dirty state, metadata, and last observed
+harness command). It never invents task intent. `goal` and `done_when` were
+removed from `continuity.Handoff`; pickup must obtain task scope and success
+criteria from immutable `TASK.md`.
+
+`continuity.Handoff.Validate` is the shared semantic gate for both release
+and pickup. Strict decoding rejects removed/unknown fields, and validation
+rejects circular handoff actions, commands that point at report/handoff
+files, oversize or Markdown-smuggled authored list items, and malformed dead
+ends. A failed release remains refused and is retried by the existing
+rotation loop; a bad artifact that somehow reaches CAS is also refused at
+pickup. The fuzzy “empty dead ends after a non-trivial later rotation” signal
+is intentionally not yet enforced: no reliable diff-size/rotation-index
+evidence is available at this validation boundary, so inventing a hard rule
+would create false refusals.
+
+Verified after the change with `go test ./...`, `go build ./...`, `go vet
+./...`, and `git diff --check`.