Fix v0.2 worker queue and status contract blockers

[joryirving]

Problem

Mission Control is close to v0.2.0, but the worker-facing assignment contract is not safe enough to migrate agents yet.

The queue/status path has several inconsistencies:

1. GET /api/agents/[agentName]/queue issue items do not include enough data for workers to claim work cleanly.
2. docs/worker-cron-prompt-migration.md documents an /api/issues/move payload that does not match the actual route.
3. /api/issues/move mutates GitHub labels without bearer auth.
4. Claim/status transition behavior is ambiguous.

These need to be fixed before cutting v0.2.0 or migrating workers onto Mission Control queues.

Current risks

Queue payload is incomplete

Queue issue items need to include:

• type: "issue"
• issueId
• repoFullName
• number
• title
• url
• labels
• lane
• status
• priority
• rankingReason
• decomposed

Without issueId and repoFullName, workers cannot call claim/status endpoints cleanly.

Worker migration docs do not match the API

The docs currently imply workers can call /api/issues/move with a lane payload, but the actual route expects oldLabels and newLabels.

Mutation endpoint auth gap

/api/issues/move mutates GitHub labels and writes audit logs, but should require MISSION_CONTROL_AGENT_TOKEN bearer auth if it remains part of the worker path.

Claim behavior needs clarification

Decide whether claim should also move issues to status/in-progress, or whether claim only assigns and workers must explicitly call a status endpoint.

Preferred behavior:

• Claim assigns only.
• Status transition is explicit through a worker-friendly authenticated status endpoint.

Acceptance criteria

• Queue issue items include type: "issue".
• Queue issue items include issueId.
• Queue issue items include repoFullName.
• Queue issue items include status and priority metadata.
• PR-fix queue items still appear before issue queue items.
• Legacy lane=gpt alias still maps to escalated.
• Add a worker-friendly authenticated status endpoint, preferred: POST /api/issues/status.
• Status endpoint accepts:
  • issueId
  • repoFullName
  • issueNumber
  • status
  • optional actor or agentName
• Status endpoint replaces existing status/* labels safely.
• Status endpoint updates GitHub labels.
• Status endpoint updates local Prisma issue cache.
• Status endpoint writes AuditLog.
• Status endpoint requires MISSION_CONTROL_AGENT_TOKEN bearer auth.
• /api/issues/move either requires bearer auth or is clearly not used by worker migration docs.
• Claim behavior is documented clearly.
• Worker migration docs match the actual worker-facing API.
• Tests cover queue payload shape.
• Tests cover PR-fix items appearing before issue items.
• Tests cover status endpoint auth.
• Tests cover status label replacement.
• Tests cover docs/API consistency where practical.

Validation

Run:

• npm ci
• npx prisma generate
• npm run lint
• npm run typecheck
• npm run test
• npm run build
• Docker build if available

Notes

Do not cut a release in this issue.
Do not touch home-ops.
Do not edit agent workspace files.
This is a Mission Control app hardening task before v0.2.0 release.