From de512088dbf110f9527f3eb464f35efcff2ac774 Mon Sep 17 00:00:00 2001
From: Jacob Hull <jacob@planethull.com>
Date: Tue, 6 Oct 2026 14:14:06 -0700
Subject: [PATCH 1/5] refactor: brand the request id

RequestId is a newtype that only RequestId::generate,
RequestId::for_a2a_task, and RequestId::for_slack_message construct. It
replaces the String alias and the bare request id strings in HITL, MCP
cancellation, the session stores, scratchpad storage, StreamingAgent,
and the web server. A run's id is its request's id.

A parked approval's ApprovalOwner is the request that raised it, the
orchestration run that parked it, or no one for an agent built without
a request. Stored records and the webhook payload keep the bare-string
request_id field.

Signed-off-by: Jacob Hull <jacob@planethull.com>
---
 crates/aura-cli/src/repl/mcp/wizard.rs        |   4 +-
 crates/aura-test-utils/src/mock_agent.rs      |  63 +++++--
 .../aura-web-server/src/a2a/agent_executor.rs |  60 +++----
 crates/aura-web-server/src/handlers.rs        |  30 ++--
 .../src/session_store/redis/approval_store.rs |  10 +-
 crates/aura-web-server/src/slack/runner.rs    |  20 +--
 .../aura-web-server/src/streaming/handlers.rs |   8 +-
 crates/aura-web-server/src/streaming/otel.rs  |   4 +-
 crates/aura-web-server/tests/common/mod.rs    |  17 +-
 .../tests/file_session_store_test.rs          |  13 +-
 .../tests/redis_session_store_test.rs         |  42 +++--
 crates/aura/src/builder.rs                    |  76 +++++----
 crates/aura/src/config.rs                     |   2 +-
 crates/aura/src/domain/mod.rs                 |   5 +
 crates/aura/src/domain/request_id.rs          |  95 +++++++++++
 crates/aura/src/hitl/decision.rs              |  38 +++++
 crates/aura/src/hitl/events.rs                |   2 +-
 crates/aura/src/hitl/gate.rs                  |  87 ++++++----
 crates/aura/src/hitl/mod.rs                   |  15 +-
 crates/aura/src/hitl/protocol.rs              |   7 +-
 crates/aura/src/hitl/registry.rs              |  41 ++---
 crates/aura/src/hitl/route.rs                 |  47 +++---
 crates/aura/src/hitl/tool.rs                  |  26 +--
 crates/aura/src/lib.rs                        |   4 +-
 crates/aura/src/mcp/client.rs                 | 158 +++++++++---------
 crates/aura/src/mcp/manager.rs                |  58 ++++---
 crates/aura/src/mcp/progress.rs               |  23 ++-
 crates/aura/src/orchestration/factory.rs      |  16 +-
 crates/aura/src/orchestration/mod.rs          |   8 +-
 crates/aura/src/orchestration/orchestrator.rs |  57 ++++---
 crates/aura/src/orchestration/overview.rs     |   4 +-
 crates/aura/src/orchestration/park/commit.rs  |  48 +++---
 .../src/orchestration/park/continuation.rs    |   4 +-
 crates/aura/src/orchestration/park/guard.rs   |  35 ++--
 crates/aura/src/orchestration/park/mod.rs     |   4 +-
 .../src/orchestration/persistence_wrapper.rs  |  12 +-
 crates/aura/src/orchestration/test_rig.rs     |   2 +-
 crates/aura/src/request_cancellation.rs       |   2 -
 crates/aura/src/rig_builder.rs                |   6 +-
 crates/aura/src/run_context.rs                |  83 ++++-----
 crates/aura/src/scratchpad/storage.rs         |  78 ++-------
 crates/aura/src/scratchpad/tools.rs           |   6 +-
 crates/aura/src/scratchpad/wrapper.rs         |  72 ++------
 crates/aura/src/session_store/fault_store.rs  |   6 +-
 crates/aura/src/session_store/file.rs         |  12 +-
 crates/aura/src/session_store/memory.rs       |  34 ++--
 crates/aura/src/session_store/mod.rs          |   4 +-
 crates/aura/src/session_store/record.rs       |  73 +++++++-
 crates/aura/src/streaming.rs                  |  18 +-
 crates/aura/src/streaming_request_hook.rs     |  28 ++--
 50 files changed, 916 insertions(+), 651 deletions(-)
 create mode 100644 crates/aura/src/domain/mod.rs
 create mode 100644 crates/aura/src/domain/request_id.rs

diff --git a/crates/aura-cli/src/repl/mcp/wizard.rs b/crates/aura-cli/src/repl/mcp/wizard.rs
index 393c95464..350c251e2 100644
--- a/crates/aura-cli/src/repl/mcp/wizard.rs
+++ b/crates/aura-cli/src/repl/mcp/wizard.rs
@@ -400,9 +400,7 @@ fn verify_server(
                 (info.status.clone(), tools)
             })
             .ok_or_else(|| format!("`{name}` missing from the connection status snapshot"));
-        manager
-            .cancel_and_close_all("mcp-add-verify", "verification complete")
-            .await;
+        manager.close_all().await;
         result
     })
 }
diff --git a/crates/aura-test-utils/src/mock_agent.rs b/crates/aura-test-utils/src/mock_agent.rs
index 9796ced3e..1d956068d 100644
--- a/crates/aura-test-utils/src/mock_agent.rs
+++ b/crates/aura-test-utils/src/mock_agent.rs
@@ -173,9 +173,9 @@ impl StreamingAgent for MockAgent {
         _query: &str,
         _chat_history: Vec<Message>,
         options: aura::streaming::RunOptions,
-        request_id: &str,
+        request_id: &aura::RequestId,
     ) -> AgentRun {
-        let stream = self.start(request_id).await;
+        let stream = self.start(request_id.as_str()).await;
         // Carries a caller-supplied token so `cancel_token()` returns the one the
         // caller named. The scripts do not race it, so cancelling does not end a
         // mock stream.
@@ -186,7 +186,7 @@ impl StreamingAgent for MockAgent {
         )
     }
 
-    async fn cancel_and_close_mcp(&self, _request_id: &str, _reason: &str) -> usize {
+    async fn cancel_and_close_mcp(&self, _request_id: &aura::RequestId, _reason: &str) -> usize {
         0
     }
 }
@@ -200,7 +200,12 @@ mod tests {
     async fn a_pending_agent_never_yields() {
         let agent = MockAgent::pending();
         let mut stream = agent
-            .stream("q", vec![], aura::streaming::RunOptions::default(), "req_1")
+            .stream(
+                "q",
+                vec![],
+                aura::streaming::RunOptions::default(),
+                &aura::RequestId::generate(),
+            )
             .await
             .into_events();
         assert!(
@@ -216,7 +221,12 @@ mod tests {
     async fn a_yielding_agent_produces_its_items_then_ends() {
         let agent = MockAgent::yielding(vec![items::text("hello "), items::text("world")]);
         let mut stream = agent
-            .stream("q", vec![], aura::streaming::RunOptions::default(), "req_1")
+            .stream(
+                "q",
+                vec![],
+                aura::streaming::RunOptions::default(),
+                &aura::RequestId::generate(),
+            )
             .await
             .into_events();
 
@@ -235,16 +245,24 @@ mod tests {
     async fn the_start_hook_runs_before_the_stream() {
         let ran = Arc::new(AtomicBool::new(false));
         let flag = Arc::clone(&ran);
-        let agent = MockAgent::pending().on_stream_start(move |request_id| {
+        let request_id = aura::RequestId::generate();
+        let expected = request_id.to_string();
+        let agent = MockAgent::pending().on_stream_start(move |seen| {
             let flag = Arc::clone(&flag);
+            let expected = expected.clone();
             async move {
-                assert_eq!(request_id, "req_1");
+                assert_eq!(seen, expected);
                 flag.store(true, Ordering::SeqCst);
             }
         });
 
         let _ = agent
-            .stream("q", vec![], aura::streaming::RunOptions::default(), "req_1")
+            .stream(
+                "q",
+                vec![],
+                aura::streaming::RunOptions::default(),
+                &request_id,
+            )
             .await
             .into_events();
 
@@ -253,6 +271,7 @@ mod tests {
 
     #[tokio::test(start_paused = true)]
     async fn effects_run_in_script_order_and_see_the_request_id() {
+        let request_id = aura::RequestId::generate();
         let order = Arc::new(Mutex::new(Vec::new()));
         let effect_order = Arc::clone(&order);
         let agent = MockAgent::scripted(vec![
@@ -270,13 +289,16 @@ mod tests {
                 "q",
                 vec![],
                 aura::streaming::RunOptions::default(),
-                "req_42",
+                &request_id,
             )
             .await
             .into_events();
         let items: Vec<_> = stream.collect().await;
 
-        assert_eq!(order.lock().expect("order lock").as_slice(), ["req_42"]);
+        assert_eq!(
+            order.lock().expect("order lock").as_slice(),
+            [request_id.to_string()]
+        );
         assert_eq!(items.len(), 1, "effects do not yield stream items");
     }
 
@@ -285,13 +307,23 @@ mod tests {
         let agent = MockAgent::yielding([items::text("once")]);
 
         let first: Vec<_> = agent
-            .stream("q", vec![], aura::streaming::RunOptions::default(), "req_1")
+            .stream(
+                "q",
+                vec![],
+                aura::streaming::RunOptions::default(),
+                &aura::RequestId::generate(),
+            )
             .await
             .into_events()
             .collect()
             .await;
         let second: Vec<_> = agent
-            .stream("q", vec![], aura::streaming::RunOptions::default(), "req_1")
+            .stream(
+                "q",
+                vec![],
+                aura::streaming::RunOptions::default(),
+                &aura::RequestId::generate(),
+            )
             .await
             .into_events()
             .collect()
@@ -318,7 +350,12 @@ mod tests {
         ]);
 
         let mut stream = agent
-            .stream("q", vec![], aura::streaming::RunOptions::default(), "req_1")
+            .stream(
+                "q",
+                vec![],
+                aura::streaming::RunOptions::default(),
+                &aura::RequestId::generate(),
+            )
             .await
             .into_events();
         while stream.next().await.is_some() {
diff --git a/crates/aura-web-server/src/a2a/agent_executor.rs b/crates/aura-web-server/src/a2a/agent_executor.rs
index 2fed3d215..e4e1b6be9 100644
--- a/crates/aura-web-server/src/a2a/agent_executor.rs
+++ b/crates/aura-web-server/src/a2a/agent_executor.rs
@@ -16,7 +16,7 @@ use a2a::{
 };
 use a2a_server::{AgentExecutor, ExecutorContext, TaskStore};
 use aura::RigBuilder;
-use aura::{StreamItem, StreamedAssistantContent, StreamingAgent};
+use aura::{RequestId, StreamItem, StreamedAssistantContent, StreamingAgent};
 use futures_util::StreamExt;
 use futures_util::stream::BoxStream;
 use serde_json::Value;
@@ -46,7 +46,7 @@ pub struct AuraAgentExecutor {
 struct TaskCancelEntry {
     token: CancellationToken,
     agent: Option<Arc<dyn StreamingAgent>>,
-    request_id: String,
+    request_id: RequestId,
 }
 
 /// Whether `cancel()` got to a task before the code asking.
@@ -269,7 +269,7 @@ impl AgentExecutor for AuraAgentExecutor {
                 metadata: None,
             }));
 
-            let request_id = format!("a2a_{}", task_id);
+            let request_id = RequestId::for_a2a_task(&task_id);
 
             // Registered before the agent build and history fetch, both of which
             // await, so a cancelTask during those has a token to cancel. Its
@@ -358,13 +358,13 @@ impl AgentExecutor for AuraAgentExecutor {
                 let Some(item) = next else { break };
                 match item {
                     Ok(StreamItem::StreamAssistantItem(StreamedAssistantContent::Text(t))) => {
-                        event!(Level::DEBUG, request_id, t, "stream content received");
+                        event!(Level::DEBUG, %request_id, t, "stream content received");
 
                         let append = append_tracker.entry((task_id.clone(), context_id.clone(), RESPONSE_ARTIFACT_ID.to_owned()))
                             .and_modify(|e| *e = true)
                             .or_insert(false);
 
-                        event!(Level::DEBUG, request_id, "response returned and should be appended: {}", *append);
+                        event!(Level::DEBUG, %request_id, "response returned and should be appended: {}", *append);
 
                         let artifact = Artifact {
                             artifact_id: RESPONSE_ARTIFACT_ID.to_owned(),
@@ -384,7 +384,7 @@ impl AgentExecutor for AuraAgentExecutor {
                         }));
                     }
                     Ok(StreamItem::StreamAssistantItem(StreamedAssistantContent::ToolCall(tc))) => {
-                        event!(Level::DEBUG, request_id, tool_name = tc.name.as_str(), "tool call received");
+                        event!(Level::DEBUG, %request_id, tool_name = tc.name.as_str(), "tool call received");
 
                         let artifact_id: String = format!("tool_call_{}", tc.id);
                         let append = append_tracker.entry((task_id.clone(), context_id.clone(), artifact_id.to_owned()))
@@ -414,7 +414,7 @@ impl AgentExecutor for AuraAgentExecutor {
                         }));
                     }
                     Ok(StreamItem::StreamAssistantItem(StreamedAssistantContent::Reasoning(r))) => {
-                        event!(Level::DEBUG, request_id, reasoning = r, "reasoning received");
+                        event!(Level::DEBUG, %request_id, reasoning = r, "reasoning received");
                         reasoning_num += 1;
 
                         let artifact_id: String = format!("reasoning_{}", reasoning_num);
@@ -440,7 +440,7 @@ impl AgentExecutor for AuraAgentExecutor {
                         }));
                     }
                     Ok(StreamItem::ScratchpadUsage { agent_id, tokens_intercepted, tokens_extracted }) => {
-                        event!(Level::DEBUG, request_id, "scratchpad usage");
+                        event!(Level::DEBUG, %request_id, "scratchpad usage");
 
                         let artifact_id: String = format!("scratchpad_{}", agent_id);
                         let append = append_tracker.entry((task_id.clone(), context_id.clone(), artifact_id.to_owned()))
@@ -468,25 +468,25 @@ impl AgentExecutor for AuraAgentExecutor {
                         }));
                     }
                     Ok(StreamItem::TurnUsage(..)) => {
-                        event!(Level::DEBUG, request_id, "turn usage");
+                        event!(Level::DEBUG, %request_id, "turn usage");
                     }
                     Ok(StreamItem::ContextUsage { .. }) => {
-                        event!(Level::DEBUG, request_id, "context usage");
+                        event!(Level::DEBUG, %request_id, "context usage");
                     }
                     Ok(StreamItem::AgentEvent(_)) => {
-                        event!(Level::DEBUG, request_id, "orchestration event");
+                        event!(Level::DEBUG, %request_id, "orchestration event");
                     }
                     Ok(StreamItem::McpStatus(_)) => {
-                        event!(Level::DEBUG, request_id, "mcp status");
+                        event!(Level::DEBUG, %request_id, "mcp status");
                     }
                     Ok(StreamItem::StreamUserItem(_)) => {
-                        event!(Level::DEBUG, request_id, "stream user item");
+                        event!(Level::DEBUG, %request_id, "stream user item");
                     }
                     Ok(StreamItem::StreamAssistantItem(StreamedAssistantContent::ToolCallDelta { .. })) => {
-                        event!(Level::DEBUG, request_id, "stream assistant item");
+                        event!(Level::DEBUG, %request_id, "stream assistant item");
                     }
                     Ok(StreamItem::StreamAssistantItem(StreamedAssistantContent::ReasoningDelta { .. })) => {
-                        event!(Level::DEBUG, request_id, "reasoning delta");
+                        event!(Level::DEBUG, %request_id, "reasoning delta");
                     }
                     Ok(StreamItem::Final(final_info)) => {
                         let append = append_tracker.entry((task_id.clone(), context_id.clone(), FINAL_ARTIFACT_ID.to_owned()))
@@ -516,11 +516,11 @@ impl AgentExecutor for AuraAgentExecutor {
                         break; // done processing
                     }
                     Ok(StreamItem::FinalMarker) => {
-                        event!(Level::DEBUG, request_id, "stream final marker");
+                        event!(Level::DEBUG, %request_id, "stream final marker");
                         break; // done processing
                     }
                     Err(e) => {
-                        event!(Level::ERROR, request_id, task_id, error = e.to_string(), "stream error");
+                        event!(Level::ERROR, %request_id, task_id, error = e.to_string(), "stream error");
                         yield Ok(fail_status(&task_id, &context_id, &e.to_string()));
                         success = false;
                         break; // done processing
@@ -642,7 +642,7 @@ pub(super) fn fail_status(task_id: &str, context_id: &str, error_msg: &str) -> S
 
 async fn get_history_for_context(
     task_store: SharedTaskStore,
-    request_id: &str,
+    request_id: &RequestId,
     context_id: &str,
     task_id: &str,
 ) -> Result<Vec<aura::Message>, A2AError> {
@@ -652,7 +652,7 @@ async fn get_history_for_context(
     loop {
         event!(
             Level::DEBUG,
-            request_id,
+            %request_id,
             context_id,
             "processing history for context"
         );
@@ -673,7 +673,7 @@ async fn get_history_for_context(
 
         event!(
             Level::DEBUG,
-            request_id,
+            %request_id,
             context_id,
             "found {} tasks, continue token '{}'",
             page.tasks.len(),
@@ -695,7 +695,7 @@ async fn get_history_for_context(
 
     let chat_history: Vec<aura::Message> = tasks.iter().flat_map(task_turns).collect();
 
-    event!(Level::DEBUG, request_id, context_id, chat_history = ?chat_history, "determined this following history to use");
+    event!(Level::DEBUG, %request_id, context_id, chat_history = ?chat_history, "determined this following history to use");
     Ok(chat_history)
 }
 
@@ -909,7 +909,7 @@ mod tests {
     #[test]
     fn dropping_the_cancel_guard_releases_the_entry() {
         let task_id = format!("t_{}", uuid::Uuid::new_v4());
-        let request_id = format!("a2a_{task_id}");
+        let request_id = RequestId::for_a2a_task(&task_id);
         let state: Arc<TaskCancelState> = Arc::new(Mutex::new(HashMap::new()));
 
         let guard = TaskCancelGuard {
@@ -943,7 +943,7 @@ mod tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: format!("a2a_{task_id}"),
+                    request_id: RequestId::for_a2a_task(&task_id),
                 },
             );
             (state, task_id)
@@ -1004,7 +1004,7 @@ mod tests {
             TaskCancelEntry {
                 token: CancellationToken::new(),
                 agent: None,
-                request_id: "a2a_t".to_string(),
+                request_id: RequestId::for_a2a_task("t"),
             },
         );
         lock_cancel_state(&state).remove("t");
@@ -1020,7 +1020,7 @@ mod tests {
     #[test]
     fn claiming_the_agent_reports_a_cancel_that_already_ran() {
         let task_id = format!("t_{}", uuid::Uuid::new_v4());
-        let request_id = format!("a2a_{task_id}");
+        let request_id = RequestId::for_a2a_task(&task_id);
         let state: Arc<TaskCancelState> = Arc::new(Mutex::new(HashMap::new()));
         let agent: Arc<dyn StreamingAgent> = Arc::new(MockAgent::pending());
 
@@ -1051,7 +1051,7 @@ mod tests {
     #[test]
     fn an_early_return_before_the_run_releases_the_entry() {
         let task_id = format!("t_{}", uuid::Uuid::new_v4());
-        let request_id = format!("a2a_{task_id}");
+        let request_id = RequestId::for_a2a_task(&task_id);
         let state: Arc<TaskCancelState> = Arc::new(Mutex::new(HashMap::new()));
 
         {
@@ -1161,7 +1161,7 @@ mod tests {
         for task in tasks {
             store.create(task).await.expect("task created");
         }
-        get_history_for_context(store, "req", "ctx", executing)
+        get_history_for_context(store, &RequestId::for_a2a_task(executing), "ctx", executing)
             .await
             .expect("history built")
     }
@@ -1319,7 +1319,7 @@ mod loom_tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: "a2a_t1".to_string(),
+                    request_id: RequestId::for_a2a_task("t1"),
                 },
             );
 
@@ -1372,7 +1372,7 @@ mod loom_tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: "a2a_t1".to_string(),
+                    request_id: RequestId::for_a2a_task("t1"),
                 },
             );
 
@@ -1423,7 +1423,7 @@ mod loom_tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: "a2a_t1".to_string(),
+                    request_id: RequestId::for_a2a_task("t1"),
                 },
             );
 
diff --git a/crates/aura-web-server/src/handlers.rs b/crates/aura-web-server/src/handlers.rs
index a5e1ccffd..7e79ecd70 100644
--- a/crates/aura-web-server/src/handlers.rs
+++ b/crates/aura-web-server/src/handlers.rs
@@ -1,6 +1,7 @@
 use a2a::VERSION;
 use aura::RigBuilder;
-use aura::{ResponseContent, StreamingAgent, UsageState};
+use aura::hitl::ApprovalOwner;
+use aura::{RequestId, ResponseContent, StreamingAgent, UsageState};
 use aura_events::{AgentInfo, NativeToolOverview, ServerInfo};
 use axum::Json;
 use axum::body::Body;
@@ -24,12 +25,12 @@ use crate::types::*;
 
 /// Guard over a request's pending approvals.
 struct RequestResourceGuard {
-    request_id: String,
+    request_id: RequestId,
     pending_approvals: aura::hitl::PendingApprovals,
 }
 
 impl RequestResourceGuard {
-    fn new(request_id: String, pending_approvals: aura::hitl::PendingApprovals) -> Self {
+    fn new(request_id: RequestId, pending_approvals: aura::hitl::PendingApprovals) -> Self {
         Self {
             request_id,
             pending_approvals,
@@ -42,18 +43,17 @@ impl Drop for RequestResourceGuard {
     fn drop(&mut self) {
         // Synchronous so parked awaits cancel even when the runtime is
         // shutting down and the spawn below never polls.
-        self.pending_approvals
-            .cancel_request_local(&self.request_id);
+        let owner = ApprovalOwner::Request(self.request_id.clone());
+        self.pending_approvals.cancel_request_local(&owner);
 
         // Use try_current to avoid panic during runtime shutdown
         if let Ok(handle) = tokio::runtime::Handle::try_current() {
-            let id = self.request_id.clone();
             let pending_approvals = self.pending_approvals.clone();
             // Instrument with the span current at drop so cleanup events
             // stay parented to the request's trace.
             let cleanup = tracing::Instrument::instrument(
                 async move {
-                    pending_approvals.cancel_request(&id).await;
+                    pending_approvals.cancel_request(&owner).await;
                 },
                 tracing::Span::current(),
             );
@@ -111,7 +111,7 @@ impl std::fmt::Display for PrepareError {
 /// Both streaming and non-streaming handlers delegate to the same core logic with different
 /// delivery modes but the same observability instrumentation and stream processing.
 pub struct CompletionConfig {
-    pub request_id: String,
+    pub request_id: RequestId,
     pub timeout_duration: Option<std::time::Duration>,
     pub first_chunk_timeout: Option<std::time::Duration>,
     pub inactivity_timeout: Option<std::time::Duration>,
@@ -176,7 +176,7 @@ async fn build_agent_for_request(
     req_headers: &HashMap<String, String>,
     additional_tools: Vec<Box<dyn aura::ToolDyn>>,
     client_tools: Option<&[ClientToolDefinition]>,
-    request_id: String,
+    request_id: RequestId,
     session_id: String,
 ) -> Result<Arc<aura::Agent>, PrepareError> {
     let client_tool_defs =
@@ -214,7 +214,7 @@ pub struct RequestSetup {
     /// invokes a passthrough tool.
     pub has_client_tools: bool,
     /// Request id (`req_…`) shared by the agent build and the completion stream.
-    pub request_id: String,
+    pub request_id: RequestId,
     /// OpenAI-compatible `user` field, for the `user.id` span attribute.
     pub user_id: Option<String>,
     /// Request `metadata` serialized as a JSON object string, for the
@@ -247,7 +247,7 @@ pub async fn prepare_request(
     // orchestration) shares one value with the completion stream. The HITL gate
     // and approval events stamp this id; previously it was minted later in
     // `build_completion_config`, after the agent was already built.
-    let request_id = format!("req_{}", Uuid::new_v4().simple());
+    let request_id = RequestId::generate();
 
     // Find the matching config: single-config passthrough > explicit model > DEFAULT_AGENT
     // Single-config servers accept any model field value (clients like LibreChat always send one).
@@ -770,7 +770,7 @@ async fn handle_non_streaming_completion(
 
     {
         let span = tracing::Span::current();
-        aura::logging::set_span_attribute(&span, "http.request_id", config.request_id.clone());
+        aura::logging::set_span_attribute(&span, "http.request_id", config.request_id.to_string());
     }
 
     let response_ctx = ResponseContext {
@@ -818,7 +818,7 @@ async fn handle_streaming_completion(
 
     {
         let span = tracing::Span::current();
-        aura::logging::set_span_attribute(&span, "http.request_id", config.request_id.clone());
+        aura::logging::set_span_attribute(&span, "http.request_id", config.request_id.to_string());
     }
 
     let chat_session_id = setup.chat_session_id.clone();
@@ -2621,7 +2621,7 @@ url = "http://127.0.0.1:9"
                 version: aura::hitl::PROTOCOL_VERSION,
                 instance_id: "test-instance".to_string(),
                 decision_id: aura::hitl::DecisionId::generate(),
-                request_id: "req-smoke".into(),
+                owner: aura::hitl::ApprovalOwner::Request(aura::RequestId::generate()),
                 scope: aura::hitl::AgentScope::Single { session_id: None },
                 origin: aura::hitl::ApprovalOrigin::ConfigGate {
                     matched_pattern: "test_*".into(),
@@ -2830,7 +2830,7 @@ url = "http://127.0.0.1:9"
                 version: aura::hitl::PROTOCOL_VERSION,
                 instance_id: "test-instance".to_string(),
                 decision_id: aura::hitl::DecisionId::generate(),
-                request_id: "req-hmac".into(),
+                owner: aura::hitl::ApprovalOwner::Request(aura::RequestId::generate()),
                 scope: aura::hitl::AgentScope::Single { session_id: None },
                 origin: aura::hitl::ApprovalOrigin::ConfigGate {
                     matched_pattern: "test_*".into(),
diff --git a/crates/aura-web-server/src/session_store/redis/approval_store.rs b/crates/aura-web-server/src/session_store/redis/approval_store.rs
index 0d59ca6ca..64ad9108c 100644
--- a/crates/aura-web-server/src/session_store/redis/approval_store.rs
+++ b/crates/aura-web-server/src/session_store/redis/approval_store.rs
@@ -22,7 +22,7 @@
 use std::sync::LazyLock;
 
 use async_trait::async_trait;
-use aura::hitl::{ApprovalDecision, DecisionId, ParkedApproval, ResolveError};
+use aura::hitl::{ApprovalDecision, ApprovalOwner, DecisionId, ParkedApproval, ResolveError};
 use aura::session_store::{ApprovalStore, DecisionRecord, ParkedApprovalRecord, SessionStoreError};
 use redis::AsyncCommands;
 use redis::aio::ConnectionManager;
@@ -94,8 +94,8 @@ impl RedisApprovalStore {
         format!("{}:approval:decision:{decision_id}", self.key_prefix)
     }
 
-    fn req_key(&self, request_id: &str) -> String {
-        format!("{}:approval:req:{request_id}", self.key_prefix)
+    fn req_key(&self, owner: impl std::fmt::Display) -> String {
+        format!("{}:approval:req:{owner}", self.key_prefix)
     }
 
     /// `GETDEL` a record and prune its request index best-effort, returning
@@ -204,9 +204,9 @@ impl ApprovalStore for RedisApprovalStore {
 
     async fn cancel_request(
         &self,
-        request_id: &str,
+        owner: &ApprovalOwner,
     ) -> Result<Vec<ParkedApproval>, SessionStoreError> {
-        let req_key = self.req_key(request_id);
+        let req_key = self.req_key(owner);
         let mut conn = self.conn.clone();
         let ids: Vec<String> = conn.smembers(&req_key).await.map_err(request_err)?;
         if ids.is_empty() {
diff --git a/crates/aura-web-server/src/slack/runner.rs b/crates/aura-web-server/src/slack/runner.rs
index abbf0d9c7..4e1cbf0b1 100644
--- a/crates/aura-web-server/src/slack/runner.rs
+++ b/crates/aura-web-server/src/slack/runner.rs
@@ -3,7 +3,7 @@
 use std::sync::Arc;
 use std::time::Duration;
 
-use aura::{Message, RigBuilder, RunToolFactory, StreamItem, ToolDyn, no_run_tools};
+use aura::{Message, RequestId, RigBuilder, RunToolFactory, StreamItem, ToolDyn, no_run_tools};
 use futures_util::StreamExt;
 use tokio::sync::{Semaphore, mpsc};
 use tracing::{Instrument, debug, error, info, warn};
@@ -264,14 +264,14 @@ impl SlackIngress {
     /// hold the bot turn that earned it. A conversation read here is
     /// checked here.
     async fn answer(&self, inbound: Inbound, prefetched: Option<Vec<SlackMessage>>) {
-        let request_id = format!("slack_{}_{}", inbound.channel, inbound.ts);
+        let request_id = RequestId::for_slack_message(&inbound.channel, &inbound.ts);
         let earlier = match prefetched {
             Some(earlier) => earlier,
             None => {
                 let earlier = match self.earlier_messages(&inbound).await {
                     Ok(earlier) => earlier,
                     Err(e) => {
-                        error!(request_id, error = %e, "could not read slack history");
+                        error!(%request_id, error = %e, "could not read slack history");
                         return;
                     }
                 };
@@ -288,7 +288,7 @@ impl SlackIngress {
             .add_reaction(&inbound.channel, &inbound.ts, ACK_REACTION)
             .await
         {
-            warn!(request_id, error = %e, "could not react to slack message");
+            warn!(%request_id, error = %e, "could not react to slack message");
         }
 
         let reply = match self.run_agent(&inbound, &earlier, &request_id).await {
@@ -298,13 +298,13 @@ impl SlackIngress {
             // tell the user something broke when nothing did.
             Err(RunError::Cancelled) => {
                 warn!(
-                    request_id,
+                    %request_id,
                     "slack-triggered agent run cancelled by shutdown"
                 );
                 return;
             }
             Err(e) => {
-                error!(request_id, error = %e, "slack-triggered agent run failed");
+                error!(%request_id, error = %e, "slack-triggered agent run failed");
                 FAILED_REPLY.to_owned()
             }
         };
@@ -313,7 +313,7 @@ impl SlackIngress {
             .post_message(&inbound.channel, inbound.reply_thread(), &reply)
             .await
         {
-            error!(request_id, error = %e, "could not post slack reply");
+            error!(%request_id, error = %e, "could not post slack reply");
         }
     }
 
@@ -344,7 +344,7 @@ impl SlackIngress {
         &self,
         inbound: &Inbound,
         earlier: &[SlackMessage],
-        request_id: &str,
+        request_id: &RequestId,
     ) -> Result<String, RunError> {
         let history = thread_history(earlier, &self.identity, &inbound.ts);
         let session_id = match inbound.reply_thread() {
@@ -353,7 +353,7 @@ impl SlackIngress {
         };
         let (config, tools) = run_setup(&self.config, &self.api, inbound);
         debug!(
-            request_id,
+            %request_id,
             search = inbound.action_token.is_some(),
             "slack run tools"
         );
@@ -363,7 +363,7 @@ impl SlackIngress {
                 None,
                 Some(session_id),
                 None,
-                Some(request_id.to_owned()),
+                Some(request_id.clone()),
                 tools,
             )
             .await
diff --git a/crates/aura-web-server/src/streaming/handlers.rs b/crates/aura-web-server/src/streaming/handlers.rs
index 28d8c352b..8447a2a17 100644
--- a/crates/aura-web-server/src/streaming/handlers.rs
+++ b/crates/aura-web-server/src/streaming/handlers.rs
@@ -42,7 +42,7 @@ use tokio::sync::mpsc;
 /// Context for cancellation and cleanup callbacks.
 pub struct StreamingCallbacks {
     /// The request's id.
-    pub request_id: String,
+    pub request_id: aura::RequestId,
     /// Agent reference for MCP cleanup (cancel_and_close_mcp)
     pub agent: Arc<dyn StreamingAgent>,
     /// The run's own events.
@@ -2405,7 +2405,7 @@ mod tests {
             let (run_events_tx, run_events) = mpsc::channel(8);
             (
                 StreamingCallbacks {
-                    request_id: "req_inactivity_test".to_string(),
+                    request_id: aura::RequestId::generate(),
                     agent: Arc::new(MockAgent::pending()),
                     agent_events: Some(run_events),
                     usage_state: aura::UsageState::new(),
@@ -2873,7 +2873,7 @@ mod tests {
             (
                 Senders { run_events_tx },
                 StreamingCallbacks {
-                    request_id: "req_tool_events".to_string(),
+                    request_id: aura::RequestId::generate(),
                     agent: Arc::new(MockAgent::pending()),
                     agent_events: Some(run_events),
                     usage_state: UsageState::new(),
@@ -2928,7 +2928,7 @@ mod tests {
                     "q",
                     vec![],
                     aura::streaming::RunOptions::default(),
-                    "req_tool_events",
+                    &aura::RequestId::generate(),
                 )
                 .await
                 .into_events();
diff --git a/crates/aura-web-server/src/streaming/otel.rs b/crates/aura-web-server/src/streaming/otel.rs
index 7e5a482e6..9ac4d0d56 100644
--- a/crates/aura-web-server/src/streaming/otel.rs
+++ b/crates/aura-web-server/src/streaming/otel.rs
@@ -22,7 +22,7 @@ use super::StreamTermination;
 pub struct StreamOtelContext {
     pub provider: String,
     pub model: String,
-    pub request_id: String,
+    pub request_id: aura::RequestId,
     pub session_id: String,
     pub query: String,
     /// OpenAI-compatible `user` field from the request.
@@ -50,7 +50,7 @@ impl StreamOtelContext {
         if let Some(system_prompt) = &self.system_prompt {
             aura::logging::set_system_prompt_attribute(&span, system_prompt);
         }
-        aura::logging::set_span_attribute(&span, "http.request_id", self.request_id.clone());
+        aura::logging::set_span_attribute(&span, "http.request_id", self.request_id.to_string());
         aura::logging::set_span_attribute(&span, "session.id", self.session_id.clone());
         aura::logging::set_span_attribute(
             &span,
diff --git a/crates/aura-web-server/tests/common/mod.rs b/crates/aura-web-server/tests/common/mod.rs
index 2f4fc12b6..25628ace0 100644
--- a/crates/aura-web-server/tests/common/mod.rs
+++ b/crates/aura-web-server/tests/common/mod.rs
@@ -12,20 +12,25 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use aura::hitl::{
-    AgentScope, ApprovalDecision, ApprovalItem, ApprovalOrigin, ApprovalRequest, DecisionId,
-    PROTOCOL_VERSION, ParkedApproval, ResolveError,
+    AgentScope, ApprovalDecision, ApprovalItem, ApprovalOrigin, ApprovalOwner, ApprovalRequest,
+    DecisionId, PROTOCOL_VERSION, ParkedApproval, ResolveError,
 };
 use aura::session_store::{ApprovalStore, ParkedApprovalRecord};
 
-/// A representative parked approval, expiring in `ttl`.
-pub fn make_parked(request_id: &str, ttl: Duration) -> ParkedApproval {
+/// The same label always names the same owner; it stores as `a2a_<label>`.
+pub fn owner(label: &str) -> ApprovalOwner {
+    ApprovalOwner::Request(aura::RequestId::for_a2a_task(label))
+}
+
+/// A representative parked approval owned by `owner(label)`, expiring in `ttl`.
+pub fn make_parked(label: &str, ttl: Duration) -> ParkedApproval {
     let now = chrono::Utc::now();
     ParkedApproval {
         request: ApprovalRequest {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: request_id.to_string(),
+            owner: owner(label),
             scope: AgentScope::Single { session_id: None },
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: "kubectl_*".to_string(),
@@ -153,7 +158,7 @@ pub async fn cancel_request_removes_only_matching(instance: &Arc<dyn ApprovalSto
     instance.register(cancel).await.unwrap();
     instance.register(keep).await.unwrap();
 
-    let cleared = instance.cancel_request("req-cancel").await.unwrap();
+    let cleared = instance.cancel_request(&owner("req-cancel")).await.unwrap();
 
     assert_eq!(cleared.len(), 1, "exactly the matching ticket is cleared");
     assert_eq!(
diff --git a/crates/aura-web-server/tests/file_session_store_test.rs b/crates/aura-web-server/tests/file_session_store_test.rs
index e3c1d0075..fcc08da1d 100644
--- a/crates/aura-web-server/tests/file_session_store_test.rs
+++ b/crates/aura-web-server/tests/file_session_store_test.rs
@@ -23,7 +23,7 @@ use aura::session_store::{
 };
 use aura_web_server::session_store::{FileSessionStore, SessionStore};
 
-use common::make_parked;
+use common::{make_parked, owner};
 
 /// Two handles to one file store at `dir`'s root: the single-writing-process
 /// deployment shape.
@@ -235,7 +235,10 @@ async fn resolve_moves_the_approval_into_the_decision_file() {
     let on_disk: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(decision_path).unwrap()).unwrap();
     assert_eq!(on_disk["approval"]["decision_id"], id.to_string());
-    assert_eq!(on_disk["approval"]["request_id"], "req-move");
+    assert_eq!(
+        on_disk["approval"]["request_id"],
+        owner("req-move").to_string()
+    );
     assert_eq!(on_disk["decision"]["approved"], true);
     assert_eq!(on_disk["decision"]["reason"], serde_json::Value::Null);
 }
@@ -261,7 +264,7 @@ async fn cancel_request_removes_only_undecided_matching_approvals() {
     let other_id = other.request.decision_id;
     store.register(other).await.unwrap();
 
-    let cleared = store.cancel_request("req-owner").await.unwrap();
+    let cleared = store.cancel_request(&owner("req-owner")).await.unwrap();
 
     assert_eq!(cleared.len(), 1, "only the undecided ticket is cleared");
     assert_eq!(cleared[0].request.decision_id, undecided_id);
@@ -305,7 +308,7 @@ async fn cancel_request_sweeps_a_stale_decided_approval_without_returning_it() {
     )
     .unwrap();
 
-    let cleared = store.cancel_request("req-residue").await.unwrap();
+    let cleared = store.cancel_request(&owner("req-residue")).await.unwrap();
 
     assert_eq!(cleared.len(), 1, "only the undecided ticket is cleared");
     assert_eq!(cleared[0].request.decision_id, undecided_id);
@@ -342,7 +345,7 @@ async fn cancel_request_skips_an_undecodable_approval_file() {
     let corrupt = dir.path().join("approvals").join("corrupt.json");
     std::fs::write(&corrupt, b"not json").unwrap();
 
-    let cleared = store.cancel_request("req-corrupt").await.unwrap();
+    let cleared = store.cancel_request(&owner("req-corrupt")).await.unwrap();
 
     assert_eq!(cleared.len(), 1);
     assert_eq!(cleared[0].request.decision_id, id);
diff --git a/crates/aura-web-server/tests/redis_session_store_test.rs b/crates/aura-web-server/tests/redis_session_store_test.rs
index 4490618c1..e65c3a222 100644
--- a/crates/aura-web-server/tests/redis_session_store_test.rs
+++ b/crates/aura-web-server/tests/redis_session_store_test.rs
@@ -33,7 +33,7 @@ use bytes::Bytes;
 use futures_util::StreamExt;
 use tokio::io::AsyncWriteExt;
 
-use common::make_parked;
+use common::{make_parked, owner};
 
 fn redis_url() -> String {
     std::env::var("AURA_TEST_REDIS_URL").unwrap_or_else(|_| "redis://127.0.0.1:6379".to_string())
@@ -449,7 +449,10 @@ async fn approval_cancel_request_returns_cleared_set() {
         .await
         .unwrap();
 
-    let cleared = approvals.cancel_request("req-cancel-return").await.unwrap();
+    let cleared = approvals
+        .cancel_request(&owner("req-cancel-return"))
+        .await
+        .unwrap();
 
     assert_eq!(cleared.len(), 1, "only the undecided ticket is cleared");
     assert_eq!(
@@ -478,8 +481,9 @@ async fn approval_cancel_request_returns_cleared_set() {
     let mut raw = client.get_multiplexed_async_connection().await.unwrap();
     let still_indexed: bool = redis::cmd("SISMEMBER")
         .arg(format!(
-            "{}:approval:req:req-cancel-return",
-            config.key_prefix
+            "{}:approval:req:{}",
+            config.key_prefix,
+            owner("req-cancel-return")
         ))
         .arg(late_id.to_string())
         .query_async(&mut raw)
@@ -490,7 +494,10 @@ async fn approval_cancel_request_returns_cleared_set() {
         "the first cancel's SREM left the late registration's index entry"
     );
 
-    let cleared_late = approvals.cancel_request("req-cancel-return").await.unwrap();
+    let cleared_late = approvals
+        .cancel_request(&owner("req-cancel-return"))
+        .await
+        .unwrap();
 
     assert_eq!(
         cleared_late.len(),
@@ -551,7 +558,11 @@ async fn remove_tolerates_an_undecodable_record() {
 async fn cancel_request_skips_a_wrong_type_value_and_returns_valid_records() {
     let config = test_config(60);
     let approvals = connect(&config).await.approvals();
-    let req_index_key = format!("{}:approval:req:req-wrong-type", config.key_prefix);
+    let req_index_key = format!(
+        "{}:approval:req:{}",
+        config.key_prefix,
+        owner("req-wrong-type")
+    );
     let client = redis::Client::open(redis_url()).unwrap();
     let mut raw = client.get_multiplexed_async_connection().await.unwrap();
 
@@ -576,7 +587,7 @@ async fn cancel_request_skips_a_wrong_type_value_and_returns_valid_records() {
         .unwrap();
 
     let cleared = approvals
-        .cancel_request("req-wrong-type")
+        .cancel_request(&owner("req-wrong-type"))
         .await
         .expect("a wrong-typed record must not fail the sweep");
 
@@ -627,7 +638,7 @@ async fn cancel_request_skips_a_wrong_type_value_and_returns_valid_records() {
     );
 
     let cleared_again = approvals
-        .cancel_request("req-wrong-type")
+        .cancel_request(&owner("req-wrong-type"))
         .await
         .expect("a retry over a wrong-typed key must not fail the sweep");
     assert!(
@@ -660,7 +671,7 @@ async fn cancel_request_skips_a_wrong_type_value_and_returns_valid_records() {
         .unwrap();
 
     let cleared = approvals
-        .cancel_request("req-wrong-type")
+        .cancel_request(&owner("req-wrong-type"))
         .await
         .expect("a non-UTF-8 record must not fail the sweep");
 
@@ -867,7 +878,11 @@ async fn read_frame<R: tokio::io::AsyncBufRead + Unpin>(
 async fn cancel_request_leaves_a_mid_sweep_registration_indexed() {
     tokio::time::timeout(Duration::from_secs(30), async {
         let config = test_config(60);
-        let req_index_key = format!("{}:approval:req:req-mid-sweep", config.key_prefix);
+        let req_index_key = format!(
+            "{}:approval:req:{}",
+            config.key_prefix,
+            owner("req-mid-sweep")
+        );
         let (proxy, mut events) = SmembersHoldProxy::start(req_index_key.clone()).await;
         let proxied = RedisSessionStoreConfig {
             url: proxy.url(),
@@ -884,7 +899,7 @@ async fn cancel_request_leaves_a_mid_sweep_registration_indexed() {
         proxy.armed.store(true, Ordering::Release);
         let sweep = tokio::spawn({
             let approvals = approvals.clone();
-            async move { approvals.cancel_request("req-mid-sweep").await }
+            async move { approvals.cancel_request(&owner("req-mid-sweep")).await }
         });
         match events.recv().await {
             Some(ProxyEvent::Captured) => {}
@@ -922,7 +937,10 @@ async fn cancel_request_leaves_a_mid_sweep_registration_indexed() {
             .unwrap();
         assert!(indexed, "the mid-sweep registration kept its index entry");
 
-        let cleared_late = approvals.cancel_request("req-mid-sweep").await.unwrap();
+        let cleared_late = approvals
+            .cancel_request(&owner("req-mid-sweep"))
+            .await
+            .unwrap();
         assert_eq!(
             cleared_late.len(),
             1,
diff --git a/crates/aura/src/builder.rs b/crates/aura/src/builder.rs
index 83ca931e8..d3eb02a4e 100644
--- a/crates/aura/src/builder.rs
+++ b/crates/aura/src/builder.rs
@@ -332,7 +332,7 @@ impl Agent {
                     .clone()
                     .map(crate::config::SessionId::new),
             };
-            let request_id = config_owned.request_id.clone().unwrap_or_default();
+            let request_id = config_owned.request_id.clone();
             let wrapper = Arc::new(crate::hitl::HitlApprovalWrapper::new(
                 hitl.patterns.clone(),
                 hitl.route.clone(),
@@ -1546,23 +1546,25 @@ impl Agent {
         (self.inner.provider_name(), &self.model)
     }
 
-    /// Cancel all in-flight MCP tool requests for an HTTP request.
+    /// Cancel all in-flight MCP tool requests for a request.
     ///
     /// This sends `notifications/cancelled` to all MCP servers that have
     /// in-flight requests, allowing them to abort long-running operations.
     /// Call this when a client disconnects or request times out.
     ///
     /// # Arguments
-    /// * `http_request_id` - The HTTP request ID whose MCP calls should be cancelled
+    /// * `request_id` - The request whose MCP calls should be cancelled
     /// * `reason` - Reason for cancellation (e.g., "client disconnected", "timeout")
     ///
     /// # Returns
     /// Total number of cancellation notifications sent
-    pub async fn cancel_mcp_requests(&self, http_request_id: &str, reason: &str) -> usize {
+    pub async fn cancel_mcp_requests(
+        &self,
+        request_id: &crate::domain::RequestId,
+        reason: &str,
+    ) -> usize {
         if let Some(mcp_manager) = &self.mcp_manager {
-            mcp_manager
-                .cancel_all_for_request(http_request_id, reason)
-                .await
+            mcp_manager.cancel_all_for_request(request_id, reason).await
         } else {
             0
         }
@@ -1579,16 +1581,18 @@ impl Agent {
     /// will need to reinitialize them.
     ///
     /// # Arguments
-    /// * `http_request_id` - The HTTP request ID whose MCP calls should be cancelled
+    /// * `request_id` - The request whose MCP calls should be cancelled
     /// * `reason` - Reason for cancellation
     ///
     /// # Returns
     /// Total number of cancellation notifications sent
-    pub async fn cancel_and_close_mcp(&self, http_request_id: &str, reason: &str) -> usize {
+    pub async fn cancel_and_close_mcp(
+        &self,
+        request_id: &crate::domain::RequestId,
+        reason: &str,
+    ) -> usize {
         if let Some(mcp_manager) = &self.mcp_manager {
-            mcp_manager
-                .cancel_and_close_all(http_request_id, reason)
-                .await
+            mcp_manager.cancel_and_close_all(request_id, reason).await
         } else {
             0
         }
@@ -1700,14 +1704,14 @@ impl StreamingAgent for Agent {
         query: &str,
         chat_history: Vec<rig::completion::Message>,
         options: crate::streaming::RunOptions,
-        request_id: &str,
+        request_id: &crate::domain::RequestId,
     ) -> crate::streaming::AgentRun {
         // The run is built on the token it will stop on, so the work that awaits
         // cancellation finds it there from the start.
         let (timeout, cancel) = options.into_parts();
         let cancel = cancel.unwrap_or_default();
         let (run, run_events) =
-            crate::run_context::RunContext::channel_on(request_id, cancel.clone());
+            crate::run_context::RunContext::channel_on(request_id.clone(), cancel.clone());
         let options = crate::streaming::RunOptions::on_token(timeout, cancel);
 
         // The gate and the approval tool are built with the agent, before any
@@ -1729,10 +1733,10 @@ impl StreamingAgent for Agent {
         }
 
         let started = if chat_history.is_empty() {
-            self.stream_prompt_with_timeout(query, options, request_id)
+            self.stream_prompt_with_timeout(query, options, request_id.as_str())
                 .await
         } else {
-            self.stream_chat_with_timeout(query, chat_history, options, request_id)
+            self.stream_chat_with_timeout(query, chat_history, options, request_id.as_str())
                 .await
         };
 
@@ -1750,7 +1754,11 @@ impl StreamingAgent for Agent {
             .observed_by(run_events)
     }
 
-    async fn cancel_and_close_mcp(&self, request_id: &str, reason: &str) -> usize {
+    async fn cancel_and_close_mcp(
+        &self,
+        request_id: &crate::domain::RequestId,
+        reason: &str,
+    ) -> usize {
         Agent::cancel_and_close_mcp(self, request_id, reason).await
     }
 
@@ -2263,7 +2271,7 @@ mod tests {
         /// because rig calls the tool on its server task and no scope reaches
         /// there.
         fn gated_config(
-            request_id: &str,
+            request_id: &crate::domain::RequestId,
             pattern: &str,
             run: Arc<crate::run_context::RunContext>,
         ) -> AgentRuntimeConfig {
@@ -2274,7 +2282,7 @@ mod tests {
                     timeout: Duration::from_millis(50),
                 }),
                 AgentScope::Single { session_id: None },
-                request_id.to_owned(),
+                Some(request_id.to_owned()),
                 "test-agent".to_owned(),
                 "test-instance-id".to_owned(),
             );
@@ -2287,7 +2295,7 @@ mod tests {
 
         async fn compose_gated_agent(
             server: &RecordingMcpServer,
-            request_id: &str,
+            request_id: &crate::domain::RequestId,
             pattern: &str,
             namespace: &str,
             tool: &str,
@@ -2307,12 +2315,18 @@ mod tests {
         /// one `add_mcp_tool` stamped, carried through `pre_call`.
         #[tokio::test]
         async fn a_namespace_scoped_pattern_gates_a_tool_from_that_server() {
-            let request_id = "req_ns_gating_match";
+            let request_id = crate::domain::RequestId::generate();
             let server = RecordingMcpServer::start().await;
-            let (run, mut rx) = crate::run_context::RunContext::channel(request_id);
-            let agent =
-                compose_gated_agent(&server, request_id, "github:*", "github", "list_repos", run)
-                    .await;
+            let (run, mut rx) = crate::run_context::RunContext::channel(request_id.clone());
+            let agent = compose_gated_agent(
+                &server,
+                &request_id,
+                "github:*",
+                "github",
+                "list_repos",
+                run,
+            )
+            .await;
 
             // The parked approval expires unanswered; the call's own outcome is
             // not what this test is about.
@@ -2341,11 +2355,11 @@ mod tests {
         /// namespace were ignored and the bare name alone matched.
         #[tokio::test]
         async fn a_namespace_scoped_pattern_ignores_a_tool_from_another_server() {
-            let request_id = "req_ns_gating_miss";
+            let request_id = crate::domain::RequestId::generate();
             let server = RecordingMcpServer::start().await;
-            let (run, mut rx) = crate::run_context::RunContext::channel(request_id);
+            let (run, mut rx) = crate::run_context::RunContext::channel(request_id.clone());
             let agent =
-                compose_gated_agent(&server, request_id, "github:*", "k8s", "list_repos", run)
+                compose_gated_agent(&server, &request_id, "github:*", "k8s", "list_repos", run)
                     .await;
 
             agent
@@ -2646,11 +2660,7 @@ mod tests {
         }
 
         let tmp = tempfile::TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-single-compose")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
         let counter = TiktokenCounter::default_counter();
         let sp_budget = scratchpad::ContextBudget::new(128_000, 0.20, 0, Arc::new(counter));
 
diff --git a/crates/aura/src/config.rs b/crates/aura/src/config.rs
index ed155833d..d0658ff0f 100644
--- a/crates/aura/src/config.rs
+++ b/crates/aura/src/config.rs
@@ -138,7 +138,7 @@ pub struct AgentRuntimeConfig {
     /// Request id (`req_…`) for this build, used to stamp HITL approval requests
     /// and route their SSE events. Threaded from the web server so the
     /// single-agent and orchestration paths share one value.
-    pub request_id: Option<String>,
+    pub request_id: Option<crate::domain::RequestId>,
 
     /// Computed instance UUID for this agent, derived from agent config and
     /// host identity. Threaded into HITL approval requests so webhook
diff --git a/crates/aura/src/domain/mod.rs b/crates/aura/src/domain/mod.rs
new file mode 100644
index 000000000..0be86b856
--- /dev/null
+++ b/crates/aura/src/domain/mod.rs
@@ -0,0 +1,5 @@
+//! Identifiers and types that more than one feature uses.
+
+mod request_id;
+
+pub use request_id::RequestId;
diff --git a/crates/aura/src/domain/request_id.rs b/crates/aura/src/domain/request_id.rs
new file mode 100644
index 000000000..f0a4d2e70
--- /dev/null
+++ b/crates/aura/src/domain/request_id.rs
@@ -0,0 +1,95 @@
+//! The id of one inbound request, which the run serving it carries.
+
+use std::fmt;
+use std::sync::Arc;
+
+use uuid::Uuid;
+
+const COMPLETION_PREFIX: &str = "req_";
+const A2A_PREFIX: &str = "a2a_";
+const SLACK_PREFIX: &str = "slack_";
+
+/// The identity of one inbound request.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct RequestId(Arc<str>);
+
+impl RequestId {
+    /// Mint a fresh id for a chat completion request.
+    #[must_use]
+    pub fn generate() -> Self {
+        Self(format!("{COMPLETION_PREFIX}{}", Uuid::new_v4().simple()).into())
+    }
+
+    /// The id of the request serving A2A task `task_id`. The same task id
+    /// always yields the same request id.
+    #[must_use]
+    pub fn for_a2a_task(task_id: &str) -> Self {
+        Self(format!("{A2A_PREFIX}{task_id}").into())
+    }
+
+    /// The id of the request answering the Slack message posted at `ts` in
+    /// `channel`.
+    #[must_use]
+    pub fn for_slack_message(channel: &str, ts: &str) -> Self {
+        Self(format!("{SLACK_PREFIX}{channel}_{ts}").into())
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    /// Accepts only the shapes the minting constructors produce.
+    pub(crate) fn parse(s: &str) -> Option<Self> {
+        let minted = if let Some(uuid) = s.strip_prefix(COMPLETION_PREFIX) {
+            uuid.len() == 32 && uuid.bytes().all(|b| b.is_ascii_hexdigit())
+        } else if let Some(message) = s.strip_prefix(SLACK_PREFIX) {
+            message.contains('_')
+        } else {
+            s.starts_with(A2A_PREFIX)
+        };
+        minted.then(|| Self(s.into()))
+    }
+}
+
+impl fmt::Display for RequestId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn minted_ids_parse_back() {
+        for id in [
+            RequestId::generate(),
+            RequestId::for_a2a_task("task-7"),
+            RequestId::for_a2a_task(""),
+            RequestId::for_a2a_task("task_with_underscores"),
+            RequestId::for_slack_message("C0123ABCD", "1712345678.123456"),
+            RequestId::for_slack_message("", ""),
+            RequestId::for_slack_message("C_0123", "1712345678_123456"),
+        ] {
+            assert_eq!(RequestId::parse(id.as_str()), Some(id));
+        }
+    }
+
+    #[test]
+    fn unminted_strings_do_not_parse() {
+        for s in [
+            "",
+            "req-1",
+            "req_",
+            "req_not-a-uuid",
+            "req_0191e8c0111170008000000000000042ff",
+            "a2a",
+            "slack_",
+            "slack_C0123ABCD",
+            "run:0191e8c0-1111-7000-8000-000000000042",
+        ] {
+            assert_eq!(RequestId::parse(s), None, "{s:?} parsed");
+        }
+    }
+}
diff --git a/crates/aura/src/hitl/decision.rs b/crates/aura/src/hitl/decision.rs
index e975ebf0f..19ad5854d 100644
--- a/crates/aura/src/hitl/decision.rs
+++ b/crates/aura/src/hitl/decision.rs
@@ -14,6 +14,7 @@ use tokio::time::Instant;
 use tracing::warn;
 use uuid::Uuid;
 
+use crate::domain::RequestId;
 use crate::request_cancellation::RequestCancelToken;
 
 use crate::config::SessionId;
@@ -56,6 +57,43 @@ impl fmt::Display for DecisionId {
     }
 }
 
+const RUN_OWNER_PREFIX: &str = "run:";
+
+/// The key a parked approval is registered under and swept by.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum ApprovalOwner {
+    Request(RequestId),
+    Unowned,
+    Run(RunId),
+}
+
+impl ApprovalOwner {
+    /// Inverse of `Display`, which is also the stored and webhook form.
+    pub(crate) fn parse(s: &str) -> Option<Self> {
+        match s.strip_prefix(RUN_OWNER_PREFIX) {
+            Some(run_id) => run_id.parse().ok().map(Self::Run),
+            None if s.is_empty() => Some(Self::Unowned),
+            None => RequestId::parse(s).map(Self::Request),
+        }
+    }
+}
+
+impl fmt::Display for ApprovalOwner {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Request(request_id) => request_id.fmt(f),
+            Self::Unowned => Ok(()),
+            Self::Run(run_id) => write!(f, "{RUN_OWNER_PREFIX}{run_id}"),
+        }
+    }
+}
+
+impl Serialize for ApprovalOwner {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.collect_str(self)
+    }
+}
+
 /// The terminal human (or webhook) decision on a gated call.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub enum ApprovalDecision {
diff --git a/crates/aura/src/hitl/events.rs b/crates/aura/src/hitl/events.rs
index ef426e12d..05168ddf8 100644
--- a/crates/aura/src/hitl/events.rs
+++ b/crates/aura/src/hitl/events.rs
@@ -127,7 +127,7 @@ impl<'a> From<&'a ApprovalRequest> for ApprovalRequestWire<'a> {
             version: request.version,
             instance_id: request.instance_id.as_str(),
             decision_id: request.decision_id,
-            request_id: request.request_id.as_str(),
+            request_id: &request.owner,
             scope: scope_to_wire(&request.scope),
             origin: origin_to_wire(&request.origin),
             items: request.items.as_slice(),
diff --git a/crates/aura/src/hitl/gate.rs b/crates/aura/src/hitl/gate.rs
index 1090a714d..73a7fd590 100644
--- a/crates/aura/src/hitl/gate.rs
+++ b/crates/aura/src/hitl/gate.rs
@@ -12,13 +12,12 @@ use aura_config::GlobPattern;
 use rig::tool::ToolError;
 use serde_json::Value;
 
-use super::decision::{AgentScope, ApprovalOrigin, ApprovalOutcome, DecisionId};
+use super::decision::{AgentScope, ApprovalOrigin, ApprovalOutcome, ApprovalOwner, DecisionId};
 use super::protocol::{ApprovalItem, ApprovalRequest, PROTOCOL_VERSION};
 use super::registry::{ParkedApproval, PendingApprovals};
 use super::route::{ApprovalError, DecisionRoute, GateDecision};
-use crate::orchestration::{
-    BlockedCell, CallKey, ParkGuard, PendingCall, RecordedDecisions, run_owner_id,
-};
+use crate::domain::RequestId;
+use crate::orchestration::{BlockedCell, CallKey, ParkGuard, PendingCall, RecordedDecisions};
 use crate::tool_wrapper::{PreCallOutcome, ToolCallContext, ToolWrapper};
 
 /// The placeholder tool result a parked call returns.
@@ -46,8 +45,7 @@ pub struct HitlApprovalWrapper {
     route: Arc<DecisionRoute>,
     /// Who this wrapper speaks for, stamped onto every request it raises.
     scope: AgentScope,
-    /// Global request id, for SSE event routing.
-    request_id: String,
+    request_id: Option<RequestId>,
     /// The run whose observer sees this gate's approvals.
     run: crate::run_context::BoundRun,
     /// `[agent].name` of the config that built this agent.
@@ -69,7 +67,7 @@ impl HitlApprovalWrapper {
         patterns: Arc<[GlobPattern]>,
         route: Arc<DecisionRoute>,
         scope: AgentScope,
-        request_id: String,
+        request_id: Option<RequestId>,
         agent_name: String,
         instance_id: String,
     ) -> Self {
@@ -105,7 +103,7 @@ impl HitlApprovalWrapper {
                 run.emit(event).await;
             }
             None => tracing::warn!(
-                request_id = %self.request_id,
+                request_id = ?self.request_id,
                 "no run bound to this gate; its approval reaches no observer"
             ),
         }
@@ -194,10 +192,10 @@ impl HitlApprovalWrapper {
             version: PROTOCOL_VERSION,
             instance_id: self.instance_id.clone(),
             decision_id,
-            // Request teardown sweeps `cancel_request` by the live request
-            // id; the run-scoped owner id keeps a parked ticket out of that
-            // sweep. The run's own sweep passes the same `run_owner_id`.
-            request_id: run_owner_id(&run_id.to_string()),
+            // Request teardown sweeps the live request's approvals; owning a
+            // parked ticket by its run keeps it out of that sweep, and the
+            // run's own sweep cancels it.
+            owner: ApprovalOwner::Run(*run_id),
             scope: self.scope.clone(),
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: matched.to_string(),
@@ -323,7 +321,10 @@ impl ToolWrapper for HitlApprovalWrapper {
             version: PROTOCOL_VERSION,
             instance_id: self.instance_id.clone(),
             decision_id: DecisionId::generate(),
-            request_id: self.request_id.clone(),
+            owner: self
+                .request_id
+                .clone()
+                .map_or(ApprovalOwner::Unowned, ApprovalOwner::Request),
             scope: self.scope.clone(),
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: matched.to_string(),
@@ -401,7 +402,7 @@ mod tests {
                 timeout: Duration::from_secs(1),
             }),
             AgentScope::Single { session_id: None },
-            "t".into(),
+            Some(crate::domain::RequestId::generate()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         );
@@ -425,7 +426,7 @@ mod tests {
                 timeout: Duration::from_secs(1),
             }),
             AgentScope::Single { session_id: None },
-            "t".into(),
+            Some(crate::domain::RequestId::generate()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         );
@@ -463,7 +464,7 @@ mod tests {
                 timeout: Duration::from_secs(2),
             }),
             AgentScope::Single { session_id: None },
-            "req-test".into(),
+            Some(crate::domain::RequestId::generate()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         );
@@ -559,14 +560,14 @@ mod tests {
         fn parked_gate(
             registry: &PendingApprovals,
             route: &Arc<DecisionRoute>,
-            request_id: &str,
+            request_id: &crate::domain::RequestId,
             cell: &Arc<crate::orchestration::BlockedCell>,
         ) -> HitlApprovalWrapper {
             HitlApprovalWrapper::new(
                 Arc::from(["kubectl_*".into()]),
                 route.clone(),
                 worker_scope(),
-                request_id.to_string(),
+                Some(request_id.clone()),
                 "test-agent".to_string(),
                 "test-instance".to_string(),
             )
@@ -575,14 +576,14 @@ mod tests {
                 cell.clone(),
                 ParkGuard::new(
                     registry.clone(),
-                    "0191e8c0-1111-7000-8000-000000000042".to_string(),
+                    "0191e8c0-1111-7000-8000-000000000042".parse().unwrap(),
                 ),
             )
         }
 
         #[tokio::test]
         async fn register_error_fails_closed_with_no_cell_entry_and_no_event() {
-            let request_id = format!("req_park_fail_{}", uuid::Uuid::new_v4().simple());
+            let request_id = crate::domain::RequestId::generate();
             let store: Arc<dyn crate::session_store::ApprovalStore> =
                 Arc::new(crate::session_store::FaultInjectingStore::failing_register());
             let registry = PendingApprovals::with_backend(
@@ -596,7 +597,7 @@ mod tests {
             let args = serde_json::json!({ "namespace": "prod" });
             let ctx = ToolCallContext::new("kubectl_apply");
             let (result, events) =
-                crate::run_context::observing(&request_id, gate.pre_call(&args, &ctx)).await;
+                crate::run_context::observing(request_id.clone(), gate.pre_call(&args, &ctx)).await;
 
             let err = result.expect_err("a register fault must fail the call closed");
             assert!(
@@ -619,7 +620,7 @@ mod tests {
 
         #[tokio::test]
         async fn happy_path_registers_publishes_appends_and_short_circuits() {
-            let request_id = format!("req_park_ok_{}", uuid::Uuid::new_v4().simple());
+            let request_id = crate::domain::RequestId::generate();
             let store: Arc<dyn crate::session_store::ApprovalStore> =
                 Arc::new(crate::session_store::InMemoryApprovalStore::new());
             let registry = PendingApprovals::with_backend(
@@ -634,7 +635,7 @@ mod tests {
             let args = serde_json::json!({ "namespace": "prod" });
             let ctx = ToolCallContext::new("kubectl_apply");
             let (outcome, events) =
-                crate::run_context::observing(&request_id, gate.pre_call(&args, &ctx)).await;
+                crate::run_context::observing(request_id.clone(), gate.pre_call(&args, &ctx)).await;
             let outcome = outcome.unwrap();
 
             assert_eq!(
@@ -664,7 +665,7 @@ mod tests {
                         .unwrap()
                         .expect("ticket parked in the store");
                     assert_eq!(
-                        parked.request.request_id,
+                        parked.request.owner.to_string(),
                         "run:0191e8c0-1111-7000-8000-000000000042"
                     );
                     assert_eq!(parked.request.items[0].tool_name, "kubectl_apply");
@@ -697,7 +698,12 @@ mod tests {
         async fn two_gated_calls_append_two_cell_entries() {
             let (registry, route) = conv_route(Duration::from_secs(60));
             let cell = Arc::new(crate::orchestration::BlockedCell::default());
-            let gate = parked_gate(&registry, &route, "req-two-calls", &cell);
+            let gate = parked_gate(
+                &registry,
+                &route,
+                &crate::domain::RequestId::generate(),
+                &cell,
+            );
 
             let first = gate
                 .pre_call(
@@ -733,7 +739,12 @@ mod tests {
         async fn ungated_tool_proceeds_without_parking() {
             let (registry, route) = conv_route(Duration::from_secs(60));
             let cell = Arc::new(crate::orchestration::BlockedCell::default());
-            let gate = parked_gate(&registry, &route, "req-ungated", &cell);
+            let gate = parked_gate(
+                &registry,
+                &route,
+                &crate::domain::RequestId::generate(),
+                &cell,
+            );
 
             let outcome = gate
                 .pre_call(&serde_json::json!({}), &ToolCallContext::new("ls"))
@@ -755,13 +766,13 @@ mod tests {
             let cell = Arc::new(crate::orchestration::BlockedCell::default());
             let guard = ParkGuard::new(
                 registry.clone(),
-                "0191e8c0-1111-7000-8000-000000000042".to_string(),
+                "0191e8c0-1111-7000-8000-000000000042".parse().unwrap(),
             );
             let gate = HitlApprovalWrapper::new(
                 Arc::from(["kubectl_*".into()]),
                 route,
                 worker_scope(),
-                "req-guard".to_string(),
+                Some(crate::domain::RequestId::generate()),
                 "test-agent".to_string(),
                 "test-instance".to_string(),
             )
@@ -829,7 +840,7 @@ mod tests {
                 Arc::from(["kubectl_*".into()]),
                 route,
                 AgentScope::Single { session_id: None },
-                "req-recorded".to_string(),
+                Some(crate::domain::RequestId::generate()),
                 "test-agent".to_string(),
                 "test-instance".to_string(),
             )
@@ -985,14 +996,16 @@ mod tests {
             Arc::from(["kubectl_*".into()]),
             route,
             AgentScope::Single { session_id: None },
-            "req_run_cancel".into(),
+            Some(crate::domain::RequestId::generate()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         ));
 
         let cancel = tokio_util::sync::CancellationToken::new();
-        let (run, mut events) =
-            crate::run_context::RunContext::channel_on("req_run_cancel", cancel.clone());
+        let (run, mut events) = crate::run_context::RunContext::channel_on(
+            crate::domain::RequestId::generate(),
+            cancel.clone(),
+        );
         gate.bind_run(run);
 
         let gated = Arc::clone(&gate);
@@ -1214,7 +1227,7 @@ mod tests {
         /// reproduce by spawning — and no scope crosses that.
         fn gated_tool(
             route: DecisionRoute,
-            request_id: &str,
+            request_id: &crate::domain::RequestId,
             tool_name: &str,
         ) -> (WrappedTool<StubTool>, Arc<AtomicBool>, Receiver<AgentEvent>) {
             let ran = Arc::new(AtomicBool::new(false));
@@ -1226,11 +1239,11 @@ mod tests {
                 Arc::from(["kubectl_*".into()]),
                 Arc::new(route),
                 AgentScope::Single { session_id: None },
-                request_id.to_string(),
+                Some(request_id.clone()),
                 "test-agent".to_string(),
                 "test-instance-id".to_string(),
             );
-            let (run, events) = crate::run_context::RunContext::channel(request_id);
+            let (run, events) = crate::run_context::RunContext::channel(request_id.clone());
             gate.bind_run(run);
             (
                 WrappedTool::new(inner, Arc::new(gate) as Arc<dyn ToolWrapper>),
@@ -1255,8 +1268,8 @@ mod tests {
             }
         }
 
-        fn unique_request_id() -> String {
-            format!("req_span_{}", uuid::Uuid::new_v4().simple())
+        fn unique_request_id() -> crate::domain::RequestId {
+            crate::domain::RequestId::generate()
         }
 
         /// The correlation the whole feature exists for: the id the approver
diff --git a/crates/aura/src/hitl/mod.rs b/crates/aura/src/hitl/mod.rs
index 77ae9e38a..240fa1851 100644
--- a/crates/aura/src/hitl/mod.rs
+++ b/crates/aura/src/hitl/mod.rs
@@ -38,8 +38,8 @@ mod signing;
 mod tool;
 
 pub use decision::{
-    AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOutcome, AwaitingDecision, CancelReason,
-    DecisionId, Timestamp,
+    AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOutcome, ApprovalOwner, AwaitingDecision,
+    CancelReason, DecisionId, Timestamp,
 };
 pub(crate) use events::completed_cancelled_event;
 pub use gate::HitlApprovalWrapper;
@@ -54,3 +54,14 @@ pub use signing::{
     Tolerance, VerificationError, VerifiedBody, WebhookHmac, authorize_ingress,
 };
 pub use tool::{RequestApprovalArgs, RequestApprovalTool};
+
+#[cfg(test)]
+pub(crate) mod test_support {
+    use super::ApprovalOwner;
+    use crate::domain::RequestId;
+
+    /// The same label always names the same owner.
+    pub(crate) fn owner(label: &str) -> ApprovalOwner {
+        ApprovalOwner::Request(RequestId::for_a2a_task(label))
+    }
+}
diff --git a/crates/aura/src/hitl/protocol.rs b/crates/aura/src/hitl/protocol.rs
index 6179b5263..049bde16a 100644
--- a/crates/aura/src/hitl/protocol.rs
+++ b/crates/aura/src/hitl/protocol.rs
@@ -5,7 +5,7 @@ use aura_events::{AgentScopeWire, ApprovalOriginWire};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
-use super::decision::{AgentScope, ApprovalDecision, ApprovalOrigin, DecisionId};
+use super::decision::{AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOwner, DecisionId};
 
 /// Current approval webhook protocol version.
 pub const PROTOCOL_VERSION: u32 = 1;
@@ -22,8 +22,7 @@ pub struct ApprovalRequest {
     pub instance_id: String,
     /// The handle a decision resolves against.
     pub decision_id: DecisionId,
-    /// The id of the request this approval was raised under.
-    pub request_id: String,
+    pub owner: ApprovalOwner,
     /// Who is asking.
     pub scope: AgentScope,
     /// Why this approval exists.
@@ -92,7 +91,7 @@ pub(crate) struct ApprovalRequestWire<'a> {
     pub version: u32,
     pub instance_id: &'a str,
     pub decision_id: DecisionId,
-    pub request_id: &'a str,
+    pub request_id: &'a ApprovalOwner,
     pub scope: AgentScopeWire,
     pub origin: ApprovalOriginWire,
     pub items: &'a [ApprovalItem],
diff --git a/crates/aura/src/hitl/registry.rs b/crates/aura/src/hitl/registry.rs
index 897efae7c..cc8c80608 100644
--- a/crates/aura/src/hitl/registry.rs
+++ b/crates/aura/src/hitl/registry.rs
@@ -33,7 +33,7 @@ use crate::session_store::{
     Subscription,
 };
 
-use super::decision::{ApprovalDecision, AwaitingDecision, DecisionId, Timestamp};
+use super::decision::{ApprovalDecision, ApprovalOwner, AwaitingDecision, DecisionId, Timestamp};
 use super::protocol::ApprovalRequest;
 
 /// Bus topic carrying the decision for one parked approval.
@@ -60,7 +60,7 @@ struct PendingApprovalsInner {
 
 /// The process-local half of one parked approval.
 struct WakeEntry {
-    request_id: String,
+    owner: ApprovalOwner,
     wake: oneshot::Sender<ApprovalDecision>,
     wake_task: AbortHandle,
 }
@@ -121,7 +121,7 @@ impl PendingApprovals {
     #[must_use]
     pub async fn register(&self, request: ApprovalRequest, timeout: Duration) -> AwaitingDecision {
         let id = request.decision_id;
-        let request_id = request.request_id.clone();
+        let owner = request.owner.clone();
         let now = chrono::Utc::now();
         let (tx, rx) = oneshot::channel();
         let parked = ParkedApproval {
@@ -156,7 +156,7 @@ impl PendingApprovals {
         self.0.wakes.lock().expect("registry lock poisoned").insert(
             id,
             WakeEntry {
-                request_id,
+                owner,
                 wake: tx,
                 wake_task,
             },
@@ -243,16 +243,16 @@ impl PendingApprovals {
         }
     }
 
-    /// Synchronously drop the wake handles parked under a request id; their
-    /// awaits resolve to `Cancelled`. Leaves store entries in place — use
+    /// Synchronously drop the wake handles parked under `owner`; their awaits
+    /// resolve to `Cancelled`. Leaves store entries in place — use
     /// [`Self::cancel_request`] to also clean the store.
-    pub fn cancel_request_local(&self, request_id: &str) {
+    pub fn cancel_request_local(&self, owner: &ApprovalOwner) {
         self.0
             .wakes
             .lock()
             .expect("registry lock poisoned")
             .retain(|_, entry| {
-                if entry.request_id == request_id {
+                if entry.owner == *owner {
                     entry.abort_wake_task();
                     false
                 } else {
@@ -261,15 +261,15 @@ impl PendingApprovals {
             });
     }
 
-    /// Cancel every approval parked under a request id (stream drop /
-    /// shutdown); their awaits resolve to `Cancelled`. Returns the approvals
-    /// the store cleared, empty on a store fault.
-    pub async fn cancel_request(&self, request_id: &str) -> Vec<ParkedApproval> {
-        self.cancel_request_local(request_id);
-        match self.0.store.cancel_request(request_id).await {
+    /// Cancel every approval parked under `owner` (stream drop / shutdown);
+    /// their awaits resolve to `Cancelled`. Returns the approvals the store
+    /// cleared, empty on a store fault.
+    pub async fn cancel_request(&self, owner: &ApprovalOwner) -> Vec<ParkedApproval> {
+        self.cancel_request_local(owner);
+        match self.0.store.cancel_request(owner).await {
             Ok(cleared) => cleared,
             Err(err) => {
-                warn!(request_id, error = %err, "approval store cancel_request failed");
+                warn!(%owner, error = %err, "approval store cancel_request failed");
                 Vec::new()
             }
         }
@@ -370,13 +370,14 @@ mod tests {
         AgentScope, ApprovalOrigin, ApprovalOutcome, CancelReason, DecisionId,
     };
     use crate::hitl::protocol::{ApprovalItem, ApprovalRequest, PROTOCOL_VERSION};
+    use crate::hitl::test_support::owner;
 
-    fn test_request(request_id: &str) -> ApprovalRequest {
+    fn test_request(label: &str) -> ApprovalRequest {
         ApprovalRequest {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: request_id.to_string(),
+            owner: owner(label),
             scope: AgentScope::Single { session_id: None },
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: "test_*".to_string(),
@@ -533,7 +534,7 @@ mod tests {
         let handle = registry.register(req, Duration::from_secs(60)).await;
         let cancel = RequestCancelToken::unbound();
 
-        registry.cancel_request_local("req-local");
+        registry.cancel_request_local(&owner("req-local"));
 
         assert_eq!(
             handle.outcome(&cancel).await,
@@ -544,7 +545,7 @@ mod tests {
             "store entry remains for the async half"
         );
 
-        registry.cancel_request("req-local").await;
+        registry.cancel_request(&owner("req-local")).await;
         assert!(store.get(&id).await.unwrap().is_none());
     }
 
@@ -559,7 +560,7 @@ mod tests {
         let handle_b = registry.register(req_b, Duration::from_secs(60)).await;
         let cancel = RequestCancelToken::unbound();
 
-        registry.cancel_request("req-cancel").await;
+        registry.cancel_request(&owner("req-cancel")).await;
 
         assert_eq!(
             handle_a.outcome(&cancel).await,
diff --git a/crates/aura/src/hitl/route.rs b/crates/aura/src/hitl/route.rs
index 56c7ecc7f..e0c77738f 100644
--- a/crates/aura/src/hitl/route.rs
+++ b/crates/aura/src/hitl/route.rs
@@ -758,13 +758,14 @@ mod tests {
     use serde_json::json;
 
     use super::super::decision::{
-        AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOutcome, DecisionId,
+        AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOutcome, ApprovalOwner, DecisionId,
     };
     use super::super::protocol::{
         ApprovalDecisionWire, ApprovalItem, ApprovalRequest, ApprovalRequestWire, PROTOCOL_VERSION,
     };
     use super::super::registry::PendingApprovals;
     use super::DecisionRoute;
+    use crate::hitl::test_support::owner;
     use std::time::Duration;
 
     fn conv_route(timeout: Duration) -> (PendingApprovals, DecisionRoute) {
@@ -776,12 +777,12 @@ mod tests {
         (registry, route)
     }
 
-    fn single_request(request_id: &str, origin: ApprovalOrigin) -> ApprovalRequest {
+    fn single_request(owner: ApprovalOwner, origin: ApprovalOrigin) -> ApprovalRequest {
         ApprovalRequest {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: request_id.into(),
+            owner,
             scope: AgentScope::Single { session_id: None },
             origin,
             items: vec![],
@@ -794,7 +795,7 @@ mod tests {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: "req-123".to_string(),
+            owner: owner("req-123"),
             scope: AgentScope::Single { session_id: None },
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: "shell*".to_string(),
@@ -812,7 +813,7 @@ mod tests {
             serde_json::to_value(ApprovalRequestWire::from(&request)).expect("serializable");
 
         assert_eq!(value["version"], PROTOCOL_VERSION);
-        assert_eq!(value["request_id"], "req-123");
+        assert_eq!(value["request_id"], request.owner.to_string());
         assert!(value["decision_id"].is_string());
         assert!(value["instance_id"].is_string());
         // scope/origin are flat, `kind`-tagged DTOs: no Rust variant names leak.
@@ -863,7 +864,7 @@ mod tests {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: "req-9".to_string(),
+            owner: owner("req-9"),
             scope: AgentScope::Worker {
                 run_id,
                 task: crate::orchestration::TaskIdentity::new(2, Some("k8s-agent".to_string())),
@@ -880,7 +881,7 @@ mod tests {
             serde_json::to_value(ApprovalRequestWire::from(&request)).expect("serializable");
 
         assert_eq!(value["scope"]["kind"], "worker");
-        assert_eq!(value["request_id"], "req-9");
+        assert_eq!(value["request_id"], request.owner.to_string());
         assert_eq!(value["scope"]["task_id"], 2);
         assert_eq!(value["scope"]["worker"], "k8s-agent");
         assert_eq!(value["scope"]["session_id"], "sess-abc");
@@ -900,7 +901,7 @@ mod tests {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: "req-cg-intent".to_string(),
+            owner: owner("req-cg-intent"),
             scope: AgentScope::Single { session_id: None },
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: "kubectl_*".to_string(),
@@ -929,7 +930,7 @@ mod tests {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: "req-ar-none".to_string(),
+            owner: owner("req-ar-none"),
             scope: AgentScope::Single { session_id: None },
             origin: ApprovalOrigin::AgentRequested {
                 reason: "touches prod".to_string(),
@@ -958,7 +959,7 @@ mod tests {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: "req-ar-intent".to_string(),
+            owner: owner("req-ar-intent"),
             scope: AgentScope::Single { session_id: None },
             origin: ApprovalOrigin::AgentRequested {
                 reason: "touches prod".to_string(),
@@ -1013,7 +1014,7 @@ mod tests {
     async fn conversational_decide_approved() {
         let (registry, route) = conv_route(Duration::from_secs(60));
         let request = single_request(
-            "conv-req-1",
+            owner("conv-req-1"),
             ApprovalOrigin::AgentRequested {
                 reason: "test".into(),
                 agent_name: "test-agent".to_string(),
@@ -1050,7 +1051,7 @@ mod tests {
     async fn conversational_decide_denied() {
         let (registry, route) = conv_route(Duration::from_secs(60));
         let request = single_request(
-            "conv-req-2",
+            owner("conv-req-2"),
             ApprovalOrigin::ConfigGate {
                 matched_pattern: "rm_*".into(),
                 agent_name: "test-agent".to_string(),
@@ -1096,7 +1097,7 @@ mod tests {
 
         let (registry, route) = conv_route(Duration::from_secs(5));
         let request = single_request(
-            "conv-req-3",
+            owner("conv-req-3"),
             ApprovalOrigin::AgentRequested {
                 reason: "test".into(),
                 agent_name: "test-agent".to_string(),
@@ -1161,7 +1162,7 @@ mod tests {
             timeout: Duration::from_secs(2),
         };
         let request = single_request(
-            "conv-req-backstop",
+            owner("conv-req-backstop"),
             ApprovalOrigin::AgentRequested {
                 reason: "test".into(),
                 agent_name: "test-agent".to_string(),
@@ -1195,7 +1196,7 @@ mod tests {
     async fn conversational_decide_cancelled_on_disconnect() {
         let (_, route) = conv_route(Duration::from_secs(60));
         let request = single_request(
-            "conv-req-4",
+            owner("conv-req-4"),
             ApprovalOrigin::AgentRequested {
                 reason: "test".into(),
                 agent_name: "test-agent".to_string(),
@@ -1221,12 +1222,12 @@ mod tests {
 
     #[tokio::test]
     async fn conversational_resolve_at_requested_event_succeeds() {
-        let request_id = format!("req_test_{}", uuid::Uuid::new_v4().simple());
-        let (run, mut rx) = crate::run_context::RunContext::channel(request_id.as_str());
+        let request_id = crate::domain::RequestId::generate();
+        let (run, mut rx) = crate::run_context::RunContext::channel(request_id.clone());
 
         let (registry, route) = conv_route(Duration::from_secs(60));
         let request = single_request(
-            &request_id,
+            ApprovalOwner::Request(request_id.clone()),
             ApprovalOrigin::ConfigGate {
                 matched_pattern: "dangerous_*".into(),
                 agent_name: "test-agent".to_string(),
@@ -1302,7 +1303,7 @@ mod tests {
                 version: PROTOCOL_VERSION,
                 instance_id: "test-instance".to_string(),
                 decision_id,
-                request_id: "req-signed".into(),
+                owner: crate::hitl::ApprovalOwner::Request(crate::domain::RequestId::generate()),
                 scope: AgentScope::Single { session_id: None },
                 origin: ApprovalOrigin::ConfigGate {
                     matched_pattern: "dangerous_*".into(),
@@ -2219,8 +2220,8 @@ mod tests {
 
     #[tokio::test]
     async fn webhook_route_emits_requested_and_completed_on_channel_error() {
-        let request_id = format!("req_test_{}", uuid::Uuid::new_v4().simple());
-        let (run, mut rx) = crate::run_context::RunContext::channel(request_id.as_str());
+        let request_id = crate::domain::RequestId::generate();
+        let (run, mut rx) = crate::run_context::RunContext::channel(request_id.clone());
         let route = super::DecisionRoute::Webhook {
             client: super::WebhookClient::new(
                 super::build_webhook_client(),
@@ -2232,7 +2233,7 @@ mod tests {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: request_id.clone(),
+            owner: ApprovalOwner::Request(request_id.clone()),
             scope: AgentScope::Single { session_id: None },
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: "dangerous_*".into(),
@@ -2582,7 +2583,7 @@ mod tests {
             version: PROTOCOL_VERSION,
             instance_id: "test-instance".to_string(),
             decision_id: DecisionId::generate(),
-            request_id: "hdr-test".into(),
+            owner: owner("hdr-test"),
             scope: AgentScope::Single { session_id: None },
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: "dangerous_*".into(),
diff --git a/crates/aura/src/hitl/tool.rs b/crates/aura/src/hitl/tool.rs
index 2afff69fa..e217a5be8 100644
--- a/crates/aura/src/hitl/tool.rs
+++ b/crates/aura/src/hitl/tool.rs
@@ -13,9 +13,12 @@ use rig::tool::{Tool, ToolError};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
-use super::decision::{AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOutcome, DecisionId};
+use super::decision::{
+    AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOutcome, ApprovalOwner, DecisionId,
+};
 use super::protocol::{ApprovalItem, ApprovalRequest, PROTOCOL_VERSION};
 use super::route::{ApprovalError, DecisionRoute};
+use crate::domain::RequestId;
 
 /// The `request_approval` tool. Constructs an
 /// [`ApprovalOrigin::AgentRequested`] and dispatches through the shared
@@ -26,7 +29,7 @@ use super::route::{ApprovalError, DecisionRoute};
 pub struct RequestApprovalTool {
     route: Arc<DecisionRoute>,
     scope: AgentScope,
-    request_id: String,
+    request_id: Option<RequestId>,
     run: Arc<crate::run_context::BoundRun>,
     agent_name: String,
     /// Instance ID of the AURA process that built this tool.
@@ -38,7 +41,7 @@ impl RequestApprovalTool {
     pub fn new(
         route: Arc<DecisionRoute>,
         scope: AgentScope,
-        request_id: String,
+        request_id: Option<RequestId>,
         agent_name: String,
         instance_id: String,
     ) -> Self {
@@ -164,7 +167,10 @@ impl Tool for RequestApprovalTool {
             version: PROTOCOL_VERSION,
             instance_id: self.instance_id.clone(),
             decision_id: DecisionId::generate(),
-            request_id: self.request_id.clone(),
+            owner: self
+                .request_id
+                .clone()
+                .map_or(ApprovalOwner::Unowned, ApprovalOwner::Request),
             scope: self.scope.clone(),
             origin: ApprovalOrigin::AgentRequested {
                 reason: args.risk_rationale.clone(),
@@ -333,17 +339,17 @@ mod tests {
         route: &Arc<DecisionRoute>,
         args: RequestApprovalArgs,
     ) -> ApprovalItem {
-        let request_id = format!("req_w2_{}", uuid::Uuid::new_v4().simple());
+        let request_id = crate::domain::RequestId::generate();
         let tool = RequestApprovalTool::new(
             route.clone(),
             AgentScope::Single { session_id: None },
-            request_id.clone(),
+            Some(request_id.clone()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         );
 
         // The scope goes inside the spawn, because task-locals do not cross one.
-        let (run, mut rx) = crate::run_context::RunContext::channel(request_id.as_str());
+        let (run, mut rx) = crate::run_context::RunContext::channel(request_id.clone());
         let call_handle: tokio::task::JoinHandle<Result<String, ToolError>> =
             tokio::spawn(crate::run_context::with_run(run, async move {
                 tool.call(args).await
@@ -499,12 +505,12 @@ mod tests {
                 timeout: std::time::Duration::from_secs(60),
             });
 
-            let request_id = format!("req_tool_span_{}", uuid::Uuid::new_v4().simple());
-            let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+            let request_id = crate::domain::RequestId::generate();
+            let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
             let tool = RequestApprovalTool::new(
                 route,
                 AgentScope::Single { session_id: None },
-                request_id.clone(),
+                Some(request_id.clone()),
                 "test-agent".to_string(),
                 "test-instance-id".to_string(),
             );
diff --git a/crates/aura/src/lib.rs b/crates/aura/src/lib.rs
index e3bd4efb2..dc1667590 100644
--- a/crates/aura/src/lib.rs
+++ b/crates/aura/src/lib.rs
@@ -9,6 +9,7 @@ pub mod approver_headers;
 pub mod bedrock_embedding;
 pub mod builder;
 pub mod config;
+pub mod domain;
 pub mod env_flags;
 pub mod error;
 pub mod fallback_tool_parser;
@@ -96,9 +97,10 @@ pub type AuraToolCall = provider_agent::ToolCall;
 pub type AuraToolResult = provider_agent::ToolResult;
 
 pub use aura_events::{TokenUsage, ToolCallId, ToolName};
+pub use domain::RequestId;
 pub use mcp::{InFlightRequests, McpManager, ProgressEnabledHandler};
 pub use rag_tools::{AutoIngest, VectorIngestTool};
-pub use request_cancellation::{RequestCancelToken, RequestId};
+pub use request_cancellation::RequestCancelToken;
 pub use rmcp::model::{NumberOrString, ProgressToken};
 pub use skill_tool::{LoadSkillTool, ReadSkillFileTool, SkillToolset, render_skill_catalog};
 pub use stream_events::{
diff --git a/crates/aura/src/mcp/client.rs b/crates/aura/src/mcp/client.rs
index 9b1c6f6d7..ee6e47d2e 100644
--- a/crates/aura/src/mcp/client.rs
+++ b/crates/aura/src/mcp/client.rs
@@ -8,7 +8,7 @@ use rmcp::{
     RoleClient,
     model::{
         CallToolRequestParam, CancelledNotificationParam, ClientRequest, ProgressNotificationParam,
-        ProgressToken, Request, RequestId, Tool,
+        ProgressToken, Request, RequestId as McpRequestId, Tool,
     },
     serve_client,
     service::{PeerRequestOptions, RunningService},
@@ -26,6 +26,7 @@ use tokio::sync::{RwLock, mpsc};
 use tracing::{debug, error, info, warn};
 
 use crate::approver_headers::ApproverHeaders;
+use crate::domain::RequestId;
 use crate::mcp::progress::ProgressEnabledHandler;
 use crate::mcp::response::extract_tool_result;
 use crate::mcp::types::ToolNamespace;
@@ -320,10 +321,10 @@ pub(crate) fn call_tool_request(
 const CANCEL_NOTIFICATION_TIMEOUT: Duration = Duration::from_secs(2);
 
 /// Tracks in-flight MCP requests for cancellation support.
-/// Maps HTTP request_id → set of MCP request_ids that are in-flight.
+/// Maps a request id → the set of its MCP request ids in flight.
 #[derive(Default)]
 pub struct InFlightRequests {
-    requests: RwLock<HashMap<String, HashSet<RequestId>>>,
+    requests: RwLock<HashMap<RequestId, HashSet<McpRequestId>>>,
 }
 
 impl InFlightRequests {
@@ -331,37 +332,37 @@ impl InFlightRequests {
         Self::default()
     }
 
-    /// Register an in-flight MCP request for an HTTP request
-    pub async fn register(&self, http_request_id: &str, mcp_request_id: RequestId) {
+    /// Register an in-flight MCP request for a request
+    pub async fn register(&self, request_id: &RequestId, mcp_request_id: McpRequestId) {
         let mut map = self.requests.write().await;
-        map.entry(http_request_id.to_string())
+        map.entry(request_id.clone())
             .or_default()
             .insert(mcp_request_id);
     }
 
     /// Remove an MCP request (completed or cancelled)
-    pub async fn remove(&self, http_request_id: &str, mcp_request_id: &RequestId) {
+    pub async fn remove(&self, request_id: &RequestId, mcp_request_id: &McpRequestId) {
         let mut map = self.requests.write().await;
-        if let Some(set) = map.get_mut(http_request_id) {
+        if let Some(set) = map.get_mut(request_id) {
             set.remove(mcp_request_id);
             if set.is_empty() {
-                map.remove(http_request_id);
+                map.remove(request_id);
             }
         }
     }
 
-    /// Get all in-flight MCP request IDs for an HTTP request
-    pub async fn get_all(&self, http_request_id: &str) -> Vec<RequestId> {
+    /// Get all in-flight MCP request IDs for a request
+    pub async fn get_all(&self, request_id: &RequestId) -> Vec<McpRequestId> {
         let map = self.requests.read().await;
-        map.get(http_request_id)
+        map.get(request_id)
             .map(|set| set.iter().cloned().collect())
             .unwrap_or_default()
     }
 
-    /// Clear all in-flight requests for an HTTP request (cleanup)
-    pub async fn clear(&self, http_request_id: &str) {
+    /// Clear all in-flight requests for a request (cleanup)
+    pub async fn clear(&self, request_id: &RequestId) {
         let mut map = self.requests.write().await;
-        map.remove(http_request_id);
+        map.remove(request_id);
     }
 }
 
@@ -574,7 +575,7 @@ impl McpClient {
     /// per request and owning its manager. Sharing a manager across runs — warm
     /// MCP reuse, #578 — makes this answer last-writer-wins, and wants per-run
     /// tool instances or a rig-side change rather than another field here.
-    pub async fn run_id(&self) -> Option<Arc<str>> {
+    pub async fn run_id(&self) -> Option<RequestId> {
         match crate::run_context::current_run_id() {
             Some(id) => Some(id),
             None => self
@@ -582,7 +583,7 @@ impl McpClient {
                 .read()
                 .await
                 .as_ref()
-                .map(|call| Arc::clone(call.run.id())),
+                .map(|call| call.run.id().clone()),
         }
     }
 
@@ -592,18 +593,18 @@ impl McpClient {
     /// A client serving a different request, or none, yields the single-agent
     /// context — the same value the SSE handler stamps on a frame that arrives
     /// without an agent.
-    async fn call_for(&self, request_id: &str) -> Option<CallContext> {
+    async fn call_for(&self, request_id: &RequestId) -> Option<CallContext> {
         self.bound_call
             .read()
             .await
             .as_ref()
-            .filter(|call| call.run.id().as_ref() == request_id)
+            .filter(|call| call.run.id() == request_id)
             .cloned()
     }
 
     /// Ties a progress token to the call that minted it, so notifications
     /// arriving on the transport task can be routed back.
-    async fn own_progress_token(&self, token: ProgressToken, request_id: &str) {
+    async fn own_progress_token(&self, token: ProgressToken, request_id: &RequestId) {
         // An unowned token still resolves through the bound call when there is
         // one, so leaving it unowned loses nothing a stand-in would have kept.
         match self.call_for(request_id).await {
@@ -611,7 +612,7 @@ impl McpClient {
                 owners_of(&self.token_owners).insert(token, call);
             }
             None => tracing::debug!(
-                request_id,
+                %request_id,
                 "no call bound to this client, so its progress token stays unowned"
             ),
         }
@@ -653,13 +654,13 @@ impl McpClient {
         arguments: HashMap<String, Value>,
         approver_overrides: Option<ApproverHeaders>,
     ) -> Result<String> {
-        if let Some(http_request_id) = self.run_id().await {
+        if let Some(request_id) = self.run_id().await {
             info!(
-                "Tool '{}' executing WITH automatic tracking (http_request_id={})",
-                tool_name, http_request_id
+                "Tool '{}' executing WITH automatic tracking (request_id={})",
+                tool_name, request_id
             );
             return self
-                .call_tool_tracked(tool_name, arguments, &http_request_id, approver_overrides)
+                .call_tool_tracked(tool_name, arguments, &request_id, approver_overrides)
                 .await;
         }
 
@@ -881,12 +882,12 @@ impl McpClient {
         &self,
         tool_name: &str,
         arguments: HashMap<String, Value>,
-        http_request_id: &str,
+        request_id: &RequestId,
         approver_overrides: Option<ApproverHeaders>,
     ) -> Result<String> {
         debug!(
-            "Calling tool '{}' with tracking (http_request_id={})",
-            tool_name, http_request_id
+            "Calling tool '{}' with tracking (request_id={})",
+            tool_name, request_id
         );
 
         let args_map: Map<String, Value> = arguments.into_iter().collect();
@@ -910,7 +911,7 @@ impl McpClient {
         //
         // Unconditional, unlike the paths that discover their run: this one is
         // handed the request id by its caller.
-        self.own_progress_token(handle.progress_token.clone(), http_request_id)
+        self.own_progress_token(handle.progress_token.clone(), request_id)
             .await;
         // Held from here so a run cancelled mid-await, which drops this future
         // before it returns, still releases the entry.
@@ -922,11 +923,11 @@ impl McpClient {
         // Track this request for potential cancellation
         let mcp_request_id = handle.id.clone();
         self.in_flight
-            .register(http_request_id, mcp_request_id.clone())
+            .register(request_id, mcp_request_id.clone())
             .await;
         debug!(
-            "Registered MCP request {:?} for HTTP request {}",
-            mcp_request_id, http_request_id
+            "Registered MCP request {:?} for request {}",
+            mcp_request_id, request_id
         );
 
         // Emit tool_start event with progress_token for UI correlation.
@@ -934,7 +935,7 @@ impl McpClient {
         // We peek (not pop) here - the pop happens in on_tool_result to ensure
         // push/pop pairing for ALL tools (MCP and non-MCP like vector stores).
         let progress_token = Some(handle.progress_token.clone());
-        let call = self.call_for(http_request_id).await;
+        let call = self.call_for(request_id).await;
         if let Some(call) = &call
             && let Some(tool_call_id) = call.run.peek_tool_call()
         {
@@ -963,16 +964,14 @@ impl McpClient {
             // `ObserverWrapper`, so the missing `aura.tool_start` is by design.
             debug!(
                 "No tool_call_id in queue for tool '{}' on request '{}' - hook not attached (orchestration) or queue mismatch",
-                tool_name, http_request_id
+                tool_name, request_id
             );
         }
 
         // Await the tool result
         let result = handle.await_response().await;
 
-        self.in_flight
-            .remove(http_request_id, &mcp_request_id)
-            .await;
+        self.in_flight.remove(request_id, &mcp_request_id).await;
 
         match result {
             Ok(rmcp::model::ServerResult::CallToolResult(call_result)) => {
@@ -988,37 +987,37 @@ impl McpClient {
         }
     }
 
-    /// Cancel all in-flight MCP requests for an HTTP request.
-    pub async fn cancel_all_for_request(&self, http_request_id: &str, reason: &str) -> usize {
-        let mcp_request_ids = self.in_flight.get_all(http_request_id).await;
+    /// Cancel all in-flight MCP requests for a request.
+    pub async fn cancel_all_for_request(&self, request_id: &RequestId, reason: &str) -> usize {
+        let mcp_request_ids = self.in_flight.get_all(request_id).await;
 
         if mcp_request_ids.is_empty() {
             debug!(
-                "No in-flight MCP requests to cancel for HTTP request {}",
-                http_request_id
+                "No in-flight MCP requests to cancel for request {}",
+                request_id
             );
             return 0;
         }
 
         info!(
-            "Cancelling {} in-flight MCP request(s) for HTTP request {}: {}",
+            "Cancelling {} in-flight MCP request(s) for request {}: {}",
             mcp_request_ids.len(),
-            http_request_id,
+            request_id,
             reason
         );
 
         let peer = self.client.peer();
         let mut cancelled_count = 0;
 
-        for request_id in &mcp_request_ids {
+        for mcp_request_id in &mcp_request_ids {
             debug!(
                 "Sending notifications/cancelled for MCP request {:?}",
-                request_id
+                mcp_request_id
             );
             match tokio::time::timeout(
                 CANCEL_NOTIFICATION_TIMEOUT,
                 peer.notify_cancelled(CancelledNotificationParam {
-                    request_id: request_id.clone(),
+                    request_id: mcp_request_id.clone(),
                     reason: Some(reason.to_string()),
                 }),
             )
@@ -1028,19 +1027,19 @@ impl McpClient {
                 Ok(Err(e)) => {
                     warn!(
                         "Failed to send cancellation notification for {:?}: {}",
-                        request_id, e
+                        mcp_request_id, e
                     );
                 }
                 Err(_) => {
                     warn!(
                         "Timeout sending cancellation notification for {:?}",
-                        request_id
+                        mcp_request_id
                     );
                 }
             }
         }
 
-        self.in_flight.clear(http_request_id).await;
+        self.in_flight.clear(request_id).await;
 
         cancelled_count
     }
@@ -1057,20 +1056,20 @@ impl McpClient {
     }
 
     /// Cancel all in-flight requests and close the connection.
-    pub async fn cancel_and_close(&self, http_request_id: &str, reason: &str) -> usize {
-        let count = self.cancel_all_for_request(http_request_id, reason).await;
+    pub async fn cancel_and_close(&self, request_id: &RequestId, reason: &str) -> usize {
+        let count = self.cancel_all_for_request(request_id, reason).await;
 
         // Drop this call's token ownership so straggler notifications stop
         // routing, then clear the binding.
-        owners_of(&self.token_owners).retain(|_, call| call.run.id().as_ref() != http_request_id);
+        owners_of(&self.token_owners).retain(|_, call| call.run.id() != request_id);
         self.clear_current_call().await;
 
         // Forcefully close connection - server is ignoring cancellation anyway
         self.close_connection();
 
         info!(
-            "Cancelled {} request(s) and closed MCP connection for HTTP request {}",
-            count, http_request_id
+            "Cancelled {} request(s) and closed MCP connection for request {}",
+            count, request_id
         );
 
         count
@@ -1087,9 +1086,9 @@ pub(crate) mod tests {
     use super::*;
     use crate::approver_headers::tests::captured_overrides;
 
-    fn owner(request_id: &str) -> CallContext {
+    fn owner(request_id: &RequestId) -> CallContext {
         CallContext {
-            run: crate::run_context::RunContext::detached(request_id),
+            run: crate::run_context::RunContext::detached(request_id.clone()),
             agent: AgentContext::single_agent(),
         }
     }
@@ -1103,7 +1102,7 @@ pub(crate) mod tests {
             Arc::new(Mutex::new(HashMap::new()));
         let token = ProgressToken(rmcp::model::NumberOrString::Number(7));
 
-        owners_of(&owners).insert(token.clone(), owner("req_1"));
+        owners_of(&owners).insert(token.clone(), owner(&RequestId::generate()));
         {
             let _guard = ProgressTokenGuard {
                 owners: Arc::clone(&owners),
@@ -1127,8 +1126,8 @@ pub(crate) mod tests {
         let mine = ProgressToken(rmcp::model::NumberOrString::Number(1));
         let theirs = ProgressToken(rmcp::model::NumberOrString::Number(2));
 
-        owners_of(&owners).insert(mine.clone(), owner("req_1"));
-        owners_of(&owners).insert(theirs.clone(), owner("req_2"));
+        owners_of(&owners).insert(mine.clone(), owner(&RequestId::generate()));
+        owners_of(&owners).insert(theirs.clone(), owner(&RequestId::generate()));
 
         drop(ProgressTokenGuard {
             owners: Arc::clone(&owners),
@@ -1142,14 +1141,14 @@ pub(crate) mod tests {
     #[tokio::test]
     async fn test_in_flight_requests_tracking() {
         let tracker = InFlightRequests::new();
-        let http_id = "http-123";
-        let mcp_id = RequestId::Number(1);
+        let http_id = RequestId::generate();
+        let mcp_id = McpRequestId::Number(1);
 
-        tracker.register(http_id, mcp_id.clone()).await;
-        assert_eq!(tracker.get_all(http_id).await.len(), 1);
+        tracker.register(&http_id, mcp_id.clone()).await;
+        assert_eq!(tracker.get_all(&http_id).await.len(), 1);
 
-        tracker.remove(http_id, &mcp_id).await;
-        assert_eq!(tracker.get_all(http_id).await.len(), 0);
+        tracker.remove(&http_id, &mcp_id).await;
+        assert_eq!(tracker.get_all(&http_id).await.len(), 0);
     }
 
     /// `post_message` must (a) forward the negotiated `mcp-session-id` header on
@@ -1392,7 +1391,7 @@ pub(crate) mod tests {
         let Some(id) = message
             .get("id")
             .cloned()
-            .and_then(|id| serde_json::from_value::<RequestId>(id).ok())
+            .and_then(|id| serde_json::from_value::<McpRequestId>(id).ok())
         else {
             return ("202 Accepted", Vec::new(), String::new());
         };
@@ -1627,30 +1626,31 @@ pub(crate) mod tests {
     async fn a_call_answers_only_for_the_request_that_named_it() {
         let (_server, client) = client_and_server(&requester_headers()).await;
         let worker = AgentContext::worker("log_worker", None, "coordinator");
+        let request_id = RequestId::generate();
 
         assert!(
-            client.call_for("req-1").await.is_none(),
+            client.call_for(&request_id).await.is_none(),
             "an unbound client has no call to attribute work to"
         );
 
         client
             .bind_call(
-                crate::run_context::RunContext::detached("req-1"),
+                crate::run_context::RunContext::detached(request_id.clone()),
                 worker.clone(),
             )
             .await;
         assert_eq!(
-            client.call_for("req-1").await.map(|call| call.agent),
+            client.call_for(&request_id).await.map(|call| call.agent),
             Some(worker)
         );
         assert!(
-            client.call_for("req-2").await.is_none(),
+            client.call_for(&RequestId::generate()).await.is_none(),
             "another request's id must not pick up this call"
         );
 
         client.clear_current_call().await;
         assert!(
-            client.call_for("req-1").await.is_none(),
+            client.call_for(&request_id).await.is_none(),
             "clearing the call drops it with the request id"
         );
     }
@@ -1665,13 +1665,14 @@ pub(crate) mod tests {
 
         assert_eq!(client.run_id().await, None, "no scope, nothing bound");
 
+        let bound = RequestId::generate();
         client
             .bind_call(
-                crate::run_context::RunContext::detached("req_bound"),
+                crate::run_context::RunContext::detached(bound.clone()),
                 AgentContext::single_agent(),
             )
             .await;
-        assert_eq!(client.run_id().await.as_deref(), Some("req_bound"));
+        assert_eq!(client.run_id().await, Some(bound));
     }
 
     /// A scope still wins, so a call made inside one is attributed to that run
@@ -1681,18 +1682,19 @@ pub(crate) mod tests {
         let (_server, client) = client_and_server(&requester_headers()).await;
         client
             .bind_call(
-                crate::run_context::RunContext::detached("req_bound"),
+                crate::run_context::RunContext::detached(crate::domain::RequestId::generate()),
                 AgentContext::single_agent(),
             )
             .await;
 
+        let scoped = RequestId::generate();
         let seen = crate::run_context::with_run(
-            crate::run_context::RunContext::detached("req_scoped"),
+            crate::run_context::RunContext::detached(scoped.clone()),
             async { client.run_id().await },
         )
         .await;
 
-        assert_eq!(seen.as_deref(), Some("req_scoped"));
+        assert_eq!(seen, Some(scoped));
     }
 
     /// Being inside a run selects the tracked branch, so this is the same entry
@@ -1712,7 +1714,7 @@ pub(crate) mod tests {
             .expect("the untracked call succeeds");
 
         crate::run_context::with_run(
-            crate::run_context::RunContext::detached("http-req-1"),
+            crate::run_context::RunContext::detached(crate::domain::RequestId::generate()),
             async {
                 client
                     .call_tool(
diff --git a/crates/aura/src/mcp/manager.rs b/crates/aura/src/mcp/manager.rs
index b206b9030..8709c9106 100644
--- a/crates/aura/src/mcp/manager.rs
+++ b/crates/aura/src/mcp/manager.rs
@@ -738,38 +738,42 @@ impl McpManager {
         info!("  Total tools available: {}", total_tools);
     }
 
-    /// Cancel all in-flight MCP requests for an HTTP request.
-    pub async fn cancel_all_for_request(&self, http_request_id: &str, reason: &str) -> usize {
+    /// Cancel all in-flight MCP requests for a request.
+    pub async fn cancel_all_for_request(
+        &self,
+        request_id: &crate::domain::RequestId,
+        reason: &str,
+    ) -> usize {
         let mut total_cancelled = 0;
 
         for (server_name, client) in &self.streamable_clients {
-            let cancelled = client.cancel_all_for_request(http_request_id, reason).await;
+            let cancelled = client.cancel_all_for_request(request_id, reason).await;
             if cancelled > 0 {
                 info!(
-                    "Cancelled {} request(s) on MCP server '{}' for HTTP request {}",
-                    cancelled, server_name, http_request_id
+                    "Cancelled {} request(s) on MCP server '{}' for request {}",
+                    cancelled, server_name, request_id
                 );
             }
             total_cancelled += cancelled;
         }
 
         for (server_name, client) in &self.sse_clients {
-            let cancelled = client.cancel_all_for_request(http_request_id, reason).await;
+            let cancelled = client.cancel_all_for_request(request_id, reason).await;
             if cancelled > 0 {
                 info!(
-                    "Cancelled {} request(s) on SSE MCP server '{}' for HTTP request {}",
-                    cancelled, server_name, http_request_id
+                    "Cancelled {} request(s) on SSE MCP server '{}' for request {}",
+                    cancelled, server_name, request_id
                 );
             }
             total_cancelled += cancelled;
         }
 
         for (server_name, client) in &self.stdio_clients {
-            let cancelled = client.cancel_all_for_request(http_request_id, reason).await;
+            let cancelled = client.cancel_all_for_request(request_id, reason).await;
             if cancelled > 0 {
                 info!(
-                    "Cancelled {} request(s) on STDIO MCP server '{}' for HTTP request {}",
-                    cancelled, server_name, http_request_id
+                    "Cancelled {} request(s) on STDIO MCP server '{}' for request {}",
+                    cancelled, server_name, request_id
                 );
             }
             total_cancelled += cancelled;
@@ -780,37 +784,41 @@ impl McpManager {
 
     /// Cancel in-flight requests and close all MCP client connections.
     /// After calling this, all MCP clients become unusable until reinitialized.
-    pub async fn cancel_and_close_all(&self, http_request_id: &str, reason: &str) -> usize {
+    pub async fn cancel_and_close_all(
+        &self,
+        request_id: &crate::domain::RequestId,
+        reason: &str,
+    ) -> usize {
         let mut total_cancelled = 0;
 
         for (server_name, client) in &self.streamable_clients {
-            let cancelled = client.cancel_and_close(http_request_id, reason).await;
+            let cancelled = client.cancel_and_close(request_id, reason).await;
             if cancelled > 0 {
                 info!(
-                    "Cancelled {} request(s) and closed MCP server '{}' for HTTP request {}",
-                    cancelled, server_name, http_request_id
+                    "Cancelled {} request(s) and closed MCP server '{}' for request {}",
+                    cancelled, server_name, request_id
                 );
             }
             total_cancelled += cancelled;
         }
 
         for (server_name, client) in &self.sse_clients {
-            let cancelled = client.cancel_and_close(http_request_id, reason).await;
+            let cancelled = client.cancel_and_close(request_id, reason).await;
             if cancelled > 0 {
                 info!(
-                    "Cancelled {} request(s) and closed SSE MCP server '{}' for HTTP request {}",
-                    cancelled, server_name, http_request_id
+                    "Cancelled {} request(s) and closed SSE MCP server '{}' for request {}",
+                    cancelled, server_name, request_id
                 );
             }
             total_cancelled += cancelled;
         }
 
         for (server_name, client) in &self.stdio_clients {
-            let cancelled = client.cancel_and_close(http_request_id, reason).await;
+            let cancelled = client.cancel_and_close(request_id, reason).await;
             if cancelled > 0 {
                 info!(
-                    "Cancelled {} request(s) and closed STDIO MCP server '{}' for HTTP request {}",
-                    cancelled, server_name, http_request_id
+                    "Cancelled {} request(s) and closed STDIO MCP server '{}' for request {}",
+                    cancelled, server_name, request_id
                 );
             }
             total_cancelled += cancelled;
@@ -819,6 +827,14 @@ impl McpManager {
         total_cancelled
     }
 
+    /// Close every connection, for a manager no request ran through.
+    pub async fn close_all(&self) {
+        for client in self.clients() {
+            client.clear_current_call().await;
+            client.close_connection();
+        }
+    }
+
     /// Every connected client, across all three transports.
     fn clients(&self) -> impl Iterator<Item = &McpClient> {
         self.streamable_clients
diff --git a/crates/aura/src/mcp/progress.rs b/crates/aura/src/mcp/progress.rs
index 888f937e5..bf3f2b99d 100644
--- a/crates/aura/src/mcp/progress.rs
+++ b/crates/aura/src/mcp/progress.rs
@@ -172,7 +172,7 @@ impl ClientHandler for ProgressEnabledHandler {
             let call = self.owner_of(&params.progress_token).await;
 
             if let Some(CallContext { run, agent }) = call {
-                let req_id = run.id().as_ref();
+                let req_id = run.id();
 
                 let routed = run
                     .emit(AgentEvent::new(
@@ -231,9 +231,14 @@ mod tests {
         ProgressToken(NumberOrString::Number(n))
     }
 
-    fn call(request_id: &str) -> CallContext {
+    /// The same label always names the same run.
+    fn run_id(label: &str) -> crate::domain::RequestId {
+        crate::domain::RequestId::for_a2a_task(label)
+    }
+
+    fn call(label: &str) -> CallContext {
         CallContext {
-            run: crate::run_context::RunContext::detached(request_id),
+            run: crate::run_context::RunContext::detached(run_id(label)),
             agent: aura_events::AgentContext::single_agent(),
         }
     }
@@ -317,7 +322,7 @@ mod tests {
                 .owner_of(&token(1))
                 .await
                 .map(|call| call.run.id().to_string()),
-            Some("run_a".to_string()),
+            Some(run_id("run_a").to_string()),
             "an unclaimed token belongs to the call this client serves"
         );
 
@@ -328,7 +333,7 @@ mod tests {
                 .owner_of(&token(1))
                 .await
                 .map(|call| call.run.id().to_string()),
-            Some("run_a_tool".to_string()),
+            Some(run_id("run_a_tool").to_string()),
             "a claim is more precise than the binding"
         );
     }
@@ -344,14 +349,14 @@ mod tests {
                 .owner_of(&token(1))
                 .await
                 .map(|c| c.run.id().to_string()),
-            Some("run_a".to_string())
+            Some(run_id("run_a").to_string())
         );
         assert_eq!(
             handler
                 .owner_of(&token(2))
                 .await
                 .map(|c| c.run.id().to_string()),
-            Some("run_b".to_string())
+            Some(run_id("run_b").to_string())
         );
     }
 
@@ -370,7 +375,7 @@ mod tests {
                 .owner_of(&token(7))
                 .await
                 .map(|c| c.run.id().to_string()),
-            Some("run_a_tool".to_string())
+            Some(run_id("run_a_tool").to_string())
         );
 
         owners.lock().unwrap().remove(&token(7));
@@ -379,7 +384,7 @@ mod tests {
                 .owner_of(&token(7))
                 .await
                 .map(|c| c.run.id().to_string()),
-            Some("run_a".to_string()),
+            Some(run_id("run_a").to_string()),
             "the binding outlives the tokens of the calls it serves"
         );
 
diff --git a/crates/aura/src/orchestration/factory.rs b/crates/aura/src/orchestration/factory.rs
index 9043b3735..65f1c6421 100644
--- a/crates/aura/src/orchestration/factory.rs
+++ b/crates/aura/src/orchestration/factory.rs
@@ -100,7 +100,7 @@ impl OrchestratorFactory {
         let (event_tx, event_rx) =
             tokio::sync::mpsc::channel::<Result<StreamItem, StreamError>>(100);
 
-        let run_id = std::sync::Arc::clone(run.id());
+        let run_id = run.id().clone();
         let RunTokens { cancel, finished } = tokens;
         let cancel_token_clone = cancel.clone();
         // Marks the run finished on every exit path, which is what lets the
@@ -174,7 +174,7 @@ impl OrchestratorFactory {
                         tracing::info!("Orchestration cancelled");
                         if let Some(ref mcp_manager) = orchestrator.mcp_manager {
                             let cancelled = mcp_manager
-                                .cancel_and_close_all(run_id.as_ref(), "Client disconnected or timeout")
+                                .cancel_and_close_all(&run_id, "Client disconnected or timeout")
                                 .await;
                             if cancelled > 0 {
                                 tracing::info!("Cancelled {} MCP request(s) during orchestration shutdown", cancelled);
@@ -216,7 +216,7 @@ impl StreamingAgent for OrchestratorFactory {
         query: &str,
         chat_history: Vec<rig::completion::Message>,
         options: crate::streaming::RunOptions,
-        request_id: &str,
+        request_id: &crate::domain::RequestId,
     ) -> crate::streaming::AgentRun {
         let (timeout, cancel) = options.into_parts();
         let cancel_token = cancel.unwrap_or_default();
@@ -229,7 +229,7 @@ impl StreamingAgent for OrchestratorFactory {
                 timeout,
                 cancel_token.clone(),
                 finished.clone(),
-                request_id.to_string(),
+                request_id.clone(),
             );
             finished
         });
@@ -239,7 +239,7 @@ impl StreamingAgent for OrchestratorFactory {
         // all orchestration LLM turns.
         let usage_state = crate::UsageState::new();
         let (run, run_events) =
-            crate::run_context::RunContext::channel_on(request_id, cancel_token.clone());
+            crate::run_context::RunContext::channel_on(request_id.clone(), cancel_token.clone());
         let stream = self.spawn_orchestration_stream(
             query.to_string(),
             chat_history,
@@ -263,7 +263,11 @@ impl StreamingAgent for OrchestratorFactory {
         crate::streaming::AgentRun::new(stream, cancel_token, usage_state).observed_by(run_events)
     }
 
-    async fn cancel_and_close_mcp(&self, _request_id: &str, _reason: &str) -> usize {
+    async fn cancel_and_close_mcp(
+        &self,
+        _request_id: &crate::domain::RequestId,
+        _reason: &str,
+    ) -> usize {
         // No-op: cancellation is handled inside the spawned task via cancel_token.
         0
     }
diff --git a/crates/aura/src/orchestration/mod.rs b/crates/aura/src/orchestration/mod.rs
index 53ae4158e..f6f6419ac 100644
--- a/crates/aura/src/orchestration/mod.rs
+++ b/crates/aura/src/orchestration/mod.rs
@@ -27,7 +27,7 @@
 //! # Example Usage
 //!
 //! ```ignore
-//! use aura::{RigBuilder, StreamingAgent};
+//! use aura::{RequestId, RigBuilder, StreamingAgent};
 //! use aura_config::load_config_from_str;
 //!
 //! // `RigBuilder` returns an `Orchestrator` (wrapped as `StreamingAgent`) when
@@ -37,7 +37,9 @@
 //!     .build_streaming_agent_with_headers(None, None, None)
 //!     .await?;
 //!
-//! let run = agent.stream(query, history, RunOptions::default(), "req_123").await;
+//! let run = agent
+//!     .stream(query, history, RunOptions::default(), &RequestId::generate())
+//!     .await;
 //! let stream = run.into_events();
 //! ```
 
@@ -82,7 +84,7 @@ pub use tools::ReadArtifactTool;
 pub use tools::wait_for::{StopReason, WaitForError, WaitForOutput, WaitForTool};
 pub use tools::{SubmitResultDecision, SubmitResultOutput, SubmitResultTool};
 
-pub(crate) use park::{CallKey, ParkGuard, RecordedDecisions, run_owner_id};
+pub(crate) use park::{CallKey, ParkGuard, RecordedDecisions};
 // The worker-model injection seam: `provider_agent.rs`'s cfg(test) variant
 // wraps the rig's scripted agent type.
 pub use prompt_constants::{context, fields, sections};
diff --git a/crates/aura/src/orchestration/orchestrator.rs b/crates/aura/src/orchestration/orchestrator.rs
index 1f643eb23..0ed47bf3c 100644
--- a/crates/aura/src/orchestration/orchestrator.rs
+++ b/crates/aura/src/orchestration/orchestrator.rs
@@ -200,7 +200,7 @@ pub(super) fn spawn_timeout_watcher(
     timeout: Duration,
     cancel_token: CancellationToken,
     finished: CancellationToken,
-    request_id: String,
+    request_id: crate::domain::RequestId,
 ) -> tokio::task::JoinHandle<()> {
     tokio::spawn(async move {
         tokio::select! {
@@ -615,6 +615,11 @@ impl Orchestrator {
         let orchestrator_id = uuid::Uuid::new_v4().to_string();
 
         let run_id_str = persistence.lock().await.run_id().to_string();
+        let run_id = run_id_str.parse::<super::RunId>().map_err(
+            |e| -> Box<dyn std::error::Error + Send + Sync> {
+                format!("orchestration run id '{run_id_str}' is not a valid UUID: {e}").into()
+            },
+        )?;
         // One guard per park-mode run; `ParkGuard` documents arming and drop.
         let park_guard = agent_config
             .hitl
@@ -622,7 +627,7 @@ impl Orchestrator {
             .filter(|hitl| hitl.park_enabled)
             .and_then(|hitl| match &*hitl.route {
                 crate::hitl::DecisionRoute::Conversational { registry, .. } => {
-                    Some(ParkGuard::new(registry.clone(), run_id_str.clone()))
+                    Some(ParkGuard::new(registry.clone(), run_id))
                 }
                 crate::hitl::DecisionRoute::Webhook { .. } => None,
             });
@@ -942,7 +947,7 @@ impl Orchestrator {
                 task: super::TaskIdentity::new(task_id, worker_name.map(String::from)),
                 session_id: session_id_owned.map(crate::config::SessionId::new),
             };
-            let request_id = worker_config.request_id.clone().unwrap_or_default();
+            let request_id = worker_config.request_id.clone();
             let mut gate = crate::hitl::HitlApprovalWrapper::new(
                 hitl.patterns.clone(),
                 hitl.route.clone(),
@@ -5331,6 +5336,14 @@ Assign tasks to the worker whose tools best match the required operations."#,
         let crate::hitl::DecisionRoute::Conversational { registry, .. } = &*hitl.route else {
             return;
         };
+        // Persistence mints run ids as UUIDs, so a parse failure is a bug.
+        let Ok(run_id) = run_id.parse::<super::RunId>() else {
+            tracing::error!(
+                run_id,
+                "orchestration run id is not a UUID; its parked approvals were not swept"
+            );
+            return;
+        };
         super::park::cancel_run_approvals(registry, run_id, crate::run_context::current_run())
             .await
             .ok();
@@ -6559,7 +6572,7 @@ mod tests {
             Duration::from_secs(300),
             cancel_token.clone(),
             finished.clone(),
-            "test-normal".to_string(),
+            crate::domain::RequestId::generate(),
         );
 
         finished.cancel();
@@ -6583,7 +6596,7 @@ mod tests {
             Duration::from_secs(60),
             cancel_token.clone(),
             CancellationToken::new(),
-            "test-timeout".to_string(),
+            crate::domain::RequestId::generate(),
         );
 
         tokio::time::advance(Duration::from_secs(61)).await;
@@ -7547,8 +7560,8 @@ mod tests {
         };
         use crate::session_store::{InMemoryApprovalStore, InMemoryEventBus};
 
-        let request_id = format!("req_cancel_{}", uuid::Uuid::new_v4().simple());
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+        let request_id = crate::domain::RequestId::generate();
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
 
         let store: Arc<dyn crate::session_store::ApprovalStore> =
             Arc::new(InMemoryApprovalStore::new());
@@ -7579,7 +7592,9 @@ mod tests {
                         version: PROTOCOL_VERSION,
                         instance_id: "test-instance".to_string(),
                         decision_id,
-                        request_id: "run:test".to_string(),
+                        owner: crate::hitl::ApprovalOwner::Run(
+                            "0191e8c0-0000-7000-8000-000000000001".parse().unwrap(),
+                        ),
                         scope: AgentScope::Single { session_id: None },
                         origin: ApprovalOrigin::ConfigGate {
                             matched_pattern: "kubectl_*".to_string(),
@@ -7679,7 +7694,7 @@ mod tests {
             }),
             memory_dir: Some(memory_dir.to_string_lossy().into_owned()),
             session_id: Some("park-sess".to_string()),
-            request_id: Some(format!("req_park_{}", uuid::Uuid::new_v4().simple())),
+            request_id: Some(crate::domain::RequestId::generate()),
             ..AgentRuntimeConfig::default()
         };
         let orchestrator = Orchestrator::new(config).await.unwrap();
@@ -7709,7 +7724,7 @@ mod tests {
                         version: crate::hitl::PROTOCOL_VERSION,
                         instance_id: "test-instance".to_string(),
                         decision_id,
-                        request_id: format!("run:{run_id}"),
+                        owner: crate::hitl::ApprovalOwner::Run(run_id.parse().unwrap()),
                         scope: crate::hitl::AgentScope::Single { session_id: None },
                         origin: crate::hitl::ApprovalOrigin::ConfigGate {
                             matched_pattern: "kubectl_*".to_string(),
@@ -7931,8 +7946,8 @@ mod tests {
             .agent_config
             .request_id
             .clone()
-            .unwrap_or_default();
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+            .expect("the config names its request");
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
         // Arming inside the scope is what gives the guard the run its drop
         // sweep reports to.
         crate::run_context::with_run(Arc::clone(&run), arm_guard(&orchestrator, &plan)).await;
@@ -8026,8 +8041,8 @@ mod tests {
             .agent_config
             .request_id
             .clone()
-            .unwrap_or_default();
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+            .expect("the config names its request");
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
 
         // The human decides the first call before the commit is attempted.
         let decided = pending[0].decision_id;
@@ -8118,8 +8133,8 @@ mod tests {
             .agent_config
             .request_id
             .clone()
-            .unwrap_or_default();
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+            .expect("the config names its request");
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
         crate::run_context::with_run(Arc::clone(&run), arm_guard(&orchestrator, &plan)).await;
 
         let (event_tx, mut event_rx) = tokio::sync::mpsc::channel(32);
@@ -8219,7 +8234,7 @@ mod tests {
         Orchestrator,
         Arc<crate::session_store::InMemoryApprovalStore>,
         crate::hitl::PendingApprovals,
-        String,
+        crate::domain::RequestId,
     ) {
         use crate::hitl::PendingApprovals;
         use crate::session_store::{InMemoryApprovalStore, InMemoryEventBus};
@@ -8242,7 +8257,7 @@ mod tests {
                 skills: None,
             },
         )]);
-        let request_id = format!("req_orphan_{}", uuid::Uuid::new_v4().simple());
+        let request_id = crate::domain::RequestId::generate();
         let config = AgentRuntimeConfig {
             hitl: Some(crate::hitl::HitlRuntime {
                 patterns: Arc::from(["echo_tool".into()]),
@@ -8366,7 +8381,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let (orchestrator, store, _registry, request_id) =
             override_park_orchestrator(dir.path(), 1).await;
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
 
         // Depth 1 gives the loop three turns (the rig's +1 safety net), so
         // the gated call must land on the third: the first two turns burn
@@ -8425,7 +8440,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let (orchestrator, store, _registry, request_id) =
             override_park_orchestrator(dir.path(), 4).await;
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
 
         let (_model, gated_invocations) =
             gated_worker_override(vec![ScriptedTurn::tool_calls_then_stream_failure(vec![
@@ -8545,7 +8560,7 @@ mod tests {
             }),
             memory_dir: Some(memory_dir.to_string_lossy().into_owned()),
             session_id: Some(session_id.to_string()),
-            request_id: Some(format!("req_resume_{}", uuid::Uuid::new_v4().simple())),
+            request_id: Some(crate::domain::RequestId::generate()),
             orchestration: Some(OrchestrationConfig {
                 enabled: true,
                 workers,
diff --git a/crates/aura/src/orchestration/overview.rs b/crates/aura/src/orchestration/overview.rs
index 6e7a9f5f7..a06bba88f 100644
--- a/crates/aura/src/orchestration/overview.rs
+++ b/crates/aura/src/orchestration/overview.rs
@@ -105,9 +105,7 @@ async fn discover_tools(
         })
         .collect();
 
-    manager
-        .cancel_and_close_all("aura-info", "tool detail collected")
-        .await;
+    manager.close_all().await;
     per_server
 }
 
diff --git a/crates/aura/src/orchestration/park/commit.rs b/crates/aura/src/orchestration/park/commit.rs
index c385962a6..ae7e5ff68 100644
--- a/crates/aura/src/orchestration/park/commit.rs
+++ b/crates/aura/src/orchestration/park/commit.rs
@@ -9,7 +9,8 @@ use serde_json::json;
 use sha2::{Digest, Sha256};
 
 use crate::config::AgentRuntimeConfig;
-use crate::hitl::{DecisionId, PendingApprovals};
+use crate::hitl::{ApprovalOwner, DecisionId, PendingApprovals};
+use crate::orchestration::RunId;
 use crate::orchestration::persistence::is_safe_path_component;
 use crate::orchestration::types::{PendingCall, Plan, TaskState};
 
@@ -47,12 +48,6 @@ pub(crate) struct ParkCommitOutcome {
     pub refreshed: RefreshedAwaiting,
 }
 
-/// The run-scoped owner id every approval parked by `run_id` is registered
-/// under.
-pub(crate) fn run_owner_id(run_id: &str) -> String {
-    format!("run:{run_id}")
-}
-
 /// Narrow the plan's awaiting tasks to the calls still parked and undecided,
 /// with the earliest surviving ticket expiry. A store fault fails the
 /// refresh, and with it the commit, rather than dropping a still-decidable
@@ -217,13 +212,12 @@ pub(crate) async fn publish(
 /// caller rather than the ambient one.
 pub(crate) fn cancel_run_approvals(
     registry: &PendingApprovals,
-    run_id: &str,
+    run_id: RunId,
     run: Option<std::sync::Arc<crate::run_context::RunContext>>,
 ) -> tokio::task::JoinHandle<()> {
     let registry = registry.clone();
-    let run_id = run_id.to_string();
     tokio::task::spawn(async move {
-        for parked in registry.cancel_request(&run_owner_id(&run_id)).await {
+        for parked in registry.cancel_request(&ApprovalOwner::Run(run_id)).await {
             let cancelled = crate::hitl::completed_cancelled_event(
                 parked.request.decision_id,
                 &parked.request.scope,
@@ -315,7 +309,7 @@ mod tests {
 
     fn parked_approval(
         decision_id: DecisionId,
-        owner: &str,
+        owner: &ApprovalOwner,
         expires_at: chrono::DateTime<chrono::Utc>,
     ) -> ParkedApproval {
         ParkedApproval {
@@ -323,7 +317,7 @@ mod tests {
                 version: PROTOCOL_VERSION,
                 instance_id: "test-instance".to_string(),
                 decision_id,
-                request_id: owner.to_string(),
+                owner: owner.clone(),
                 scope: AgentScope::Single { session_id: None },
                 origin: ApprovalOrigin::ConfigGate {
                     matched_pattern: "kubectl_*".to_string(),
@@ -461,7 +455,7 @@ mod tests {
     #[tokio::test]
     async fn refresh_drops_decided_and_takes_earliest_expiry() {
         let (registry, _store) = conv_registry();
-        let owner = "run:0191e8c0-eeee-7000-8000-000000000003";
+        let owner = ApprovalOwner::Run("0191e8c0-eeee-7000-8000-000000000003".parse().unwrap());
         let now = chrono::Utc::now();
         let decided = DecisionId::generate();
         let removed = DecisionId::generate();
@@ -471,7 +465,7 @@ mod tests {
         registry
             .register_durable(parked_approval(
                 decided,
-                owner,
+                &owner,
                 now + chrono::Duration::hours(2),
             ))
             .await
@@ -479,7 +473,7 @@ mod tests {
         registry
             .register_durable(parked_approval(
                 removed,
-                owner,
+                &owner,
                 now + chrono::Duration::hours(2),
             ))
             .await
@@ -487,7 +481,7 @@ mod tests {
         registry
             .register_durable(parked_approval(
                 earliest,
-                owner,
+                &owner,
                 now + chrono::Duration::minutes(30),
             ))
             .await
@@ -495,7 +489,7 @@ mod tests {
         registry
             .register_durable(parked_approval(
                 latest,
-                owner,
+                &owner,
                 now + chrono::Duration::hours(1),
             ))
             .await
@@ -556,10 +550,10 @@ mod tests {
     #[tokio::test]
     async fn sweep_publishes_cancelled_for_undecided_sibling_only() {
         let (registry, store) = conv_registry();
-        let run_id = "0191e8c0-ffff-7000-8000-000000000006";
-        let owner = run_owner_id(run_id);
-        let request_id = format!("req_sweep_{}", uuid::Uuid::new_v4().simple());
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+        let run_id: RunId = "0191e8c0-ffff-7000-8000-000000000006".parse().unwrap();
+        let owner = ApprovalOwner::Run(run_id);
+        let request_id = crate::domain::RequestId::generate();
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
 
         let now = chrono::Utc::now();
         let decided = DecisionId::generate();
@@ -624,10 +618,10 @@ mod tests {
     #[tokio::test]
     async fn sweep_publishes_one_event_per_cleared_ticket() {
         let (registry, store) = conv_registry();
-        let run_id = "0191e8c0-aaaa-7000-8000-000000000007";
-        let owner = run_owner_id(run_id);
-        let request_id = format!("req_sweep_{}", uuid::Uuid::new_v4().simple());
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+        let run_id: RunId = "0191e8c0-aaaa-7000-8000-000000000007".parse().unwrap();
+        let owner = ApprovalOwner::Run(run_id);
+        let request_id = crate::domain::RequestId::generate();
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
 
         let now = chrono::Utc::now();
         let first = DecisionId::generate();
@@ -682,8 +676,8 @@ mod tests {
     #[tokio::test]
     async fn late_resolve_after_sweep_is_not_found() {
         let (registry, _store) = conv_registry();
-        let run_id = "0191e8c0-bbbb-7000-8000-000000000008";
-        let owner = run_owner_id(run_id);
+        let run_id: RunId = "0191e8c0-bbbb-7000-8000-000000000008".parse().unwrap();
+        let owner = ApprovalOwner::Run(run_id);
         let now = chrono::Utc::now();
         let ticket = DecisionId::generate();
         registry
diff --git a/crates/aura/src/orchestration/park/continuation.rs b/crates/aura/src/orchestration/park/continuation.rs
index 9c890cb91..4dc1ade48 100644
--- a/crates/aura/src/orchestration/park/continuation.rs
+++ b/crates/aura/src/orchestration/park/continuation.rs
@@ -387,7 +387,9 @@ mod tests {
                 version: PROTOCOL_VERSION,
                 instance_id: "test-instance".to_string(),
                 decision_id,
-                request_id: "run:test".to_string(),
+                owner: crate::hitl::ApprovalOwner::Run(
+                    "0191e8c0-aaaa-7000-8000-00000000c0de".parse().unwrap(),
+                ),
                 scope: AgentScope::Worker {
                     run_id: "0191e8c0-aaaa-7000-8000-00000000c0de".parse().unwrap(),
                     task: crate::orchestration::types::TaskIdentity::new(3, None),
diff --git a/crates/aura/src/orchestration/park/guard.rs b/crates/aura/src/orchestration/park/guard.rs
index 2297b3c19..23e7227cc 100644
--- a/crates/aura/src/orchestration/park/guard.rs
+++ b/crates/aura/src/orchestration/park/guard.rs
@@ -4,13 +4,14 @@ use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 
 use crate::hitl::PendingApprovals;
+use crate::orchestration::RunId;
 
 use super::commit::cancel_run_approvals;
 
 /// Arms the unpublished-end sweep once the run has parked a call.
 pub(crate) struct ParkGuard {
     registry: PendingApprovals,
-    run_id: String,
+    run_id: RunId,
     run: Option<Arc<crate::run_context::RunContext>>,
     published: AtomicBool,
     armed: AtomicBool,
@@ -18,7 +19,7 @@ pub(crate) struct ParkGuard {
 
 impl ParkGuard {
     /// Create the guard for a run; inert until the first [`Self::record`].
-    pub(crate) fn new(registry: PendingApprovals, run_id: String) -> Arc<Self> {
+    pub(crate) fn new(registry: PendingApprovals, run_id: RunId) -> Arc<Self> {
         Arc::new(Self {
             registry,
             run_id,
@@ -54,14 +55,14 @@ impl Drop for ParkGuard {
             return;
         }
         let registry = self.registry.clone();
-        let run_id = self.run_id.clone();
+        let run_id = self.run_id;
         let run = self.run.clone();
         // Drop cannot await; the sweep spawns its own task on the runtime
         // that dropped the guard. Off-runtime drops (a test teardown) log
         // and skip.
         match tokio::runtime::Handle::try_current() {
             Ok(_) => {
-                cancel_run_approvals(&registry, &run_id, run);
+                cancel_run_approvals(&registry, run_id, run);
             }
             Err(_) => {
                 tracing::warn!(
@@ -80,10 +81,10 @@ mod tests {
 
     use super::*;
     use crate::hitl::{
-        AgentScope, ApprovalItem, ApprovalOrigin, ApprovalRequest, DecisionId, PROTOCOL_VERSION,
-        ParkedApproval, PendingApprovals,
+        AgentScope, ApprovalItem, ApprovalOrigin, ApprovalOwner, ApprovalRequest, DecisionId,
+        PROTOCOL_VERSION, ParkedApproval, PendingApprovals,
     };
-    use crate::orchestration::{RunId, TaskIdentity, run_owner_id};
+    use crate::orchestration::{RunId, TaskIdentity};
     use crate::session_store::{ApprovalStore, InMemoryApprovalStore, InMemoryEventBus};
 
     fn registry_with_store() -> (PendingApprovals, Arc<InMemoryApprovalStore>) {
@@ -105,7 +106,7 @@ mod tests {
 
     fn durable_approval(
         decision_id: DecisionId,
-        owner: &str,
+        owner: ApprovalOwner,
         scope: &AgentScope,
     ) -> ParkedApproval {
         ParkedApproval {
@@ -113,7 +114,7 @@ mod tests {
                 version: PROTOCOL_VERSION,
                 instance_id: "test-instance".to_string(),
                 decision_id,
-                request_id: owner.to_string(),
+                owner,
                 scope: scope.clone(),
                 origin: ApprovalOrigin::ConfigGate {
                     matched_pattern: "kubectl_*".to_string(),
@@ -144,22 +145,22 @@ mod tests {
     async fn unpublished_guard_drop_cancels_run_approvals() {
         let (registry, store) = registry_with_store();
         let run_id: RunId = "0191e8c0-2222-7000-8000-000000000042".parse().unwrap();
-        let request_id = format!("req_guard_{}", uuid::Uuid::new_v4().simple());
-        let (run, mut events) = crate::run_context::RunContext::channel(request_id.as_str());
+        let request_id = crate::domain::RequestId::generate();
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
 
         let scope = worker_scope(run_id);
         let decision_id = DecisionId::generate();
         registry
             .register_durable(durable_approval(
                 decision_id,
-                &format!("run:{run_id}"),
+                ApprovalOwner::Run(run_id),
                 &scope,
             ))
             .await
             .unwrap();
 
         let guard = crate::run_context::with_run(Arc::clone(&run), async {
-            ParkGuard::new(registry.clone(), run_id.to_string())
+            ParkGuard::new(registry.clone(), run_id)
         })
         .await;
         guard.record(std::slice::from_ref(&parked_call(decision_id)));
@@ -199,13 +200,13 @@ mod tests {
         registry
             .register_durable(durable_approval(
                 decision_id,
-                &format!("run:{run_id}"),
+                ApprovalOwner::Run(run_id),
                 &scope,
             ))
             .await
             .unwrap();
 
-        let guard = ParkGuard::new(registry.clone(), run_id.to_string());
+        let guard = ParkGuard::new(registry.clone(), run_id);
         guard.record(std::slice::from_ref(&parked_call(decision_id)));
         guard.mark_published();
         drop(guard);
@@ -227,13 +228,13 @@ mod tests {
         registry
             .register_durable(durable_approval(
                 other,
-                &run_owner_id(&run_id.to_string()),
+                ApprovalOwner::Run(run_id),
                 &worker_scope(run_id),
             ))
             .await
             .unwrap();
 
-        let guard = ParkGuard::new(registry.clone(), run_id.to_string());
+        let guard = ParkGuard::new(registry.clone(), run_id);
         drop(guard);
 
         tokio::time::sleep(Duration::from_millis(25)).await;
diff --git a/crates/aura/src/orchestration/park/mod.rs b/crates/aura/src/orchestration/park/mod.rs
index 75cbe42dc..2d22f90c0 100644
--- a/crates/aura/src/orchestration/park/mod.rs
+++ b/crates/aura/src/orchestration/park/mod.rs
@@ -7,9 +7,7 @@ mod document;
 mod guard;
 mod recorded_decisions;
 
-pub(crate) use commit::{
-    ParkCommitInputs, cancel_run_approvals, commit_from_run_state, run_owner_id,
-};
+pub(crate) use commit::{ParkCommitInputs, cancel_run_approvals, commit_from_run_state};
 // The rehydrate entry points: consumed by commit 3's tests; the P45 resume
 // endpoint consumes them in production.
 #[allow(unused_imports)]
diff --git a/crates/aura/src/orchestration/persistence_wrapper.rs b/crates/aura/src/orchestration/persistence_wrapper.rs
index 5e831631d..cf7d4e0da 100644
--- a/crates/aura/src/orchestration/persistence_wrapper.rs
+++ b/crates/aura/src/orchestration/persistence_wrapper.rs
@@ -880,11 +880,7 @@ mod tests {
         use crate::tool_wrapper::ComposedWrapper;
 
         let tmp = tempfile::TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-compose-1")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
         let counter = TiktokenCounter::default_counter();
         let budget = ContextBudget::new(128_000, 0.20, 0, Arc::new(counter));
 
@@ -1449,19 +1445,19 @@ mod tests {
             session_id: None,
         };
 
-        let request_id = format!("req_w2_{}", uuid::Uuid::new_v4().simple());
+        let request_id = crate::domain::RequestId::generate();
 
         let gate = Arc::new(HitlApprovalWrapper::new(
             Arc::from(["kubectl_*".into()]),
             route,
             scope,
-            request_id.clone(),
+            Some(request_id.clone()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         ));
         // `WrappedTool` runs `pre_call` in its own task, which no scope
         // crosses, so the gate is bound the way `stream` binds it.
-        let (run, mut rx) = crate::run_context::RunContext::channel(request_id.as_str());
+        let (run, mut rx) = crate::run_context::RunContext::channel(request_id.clone());
         gate.bind_run(run);
         let gate: Arc<dyn ToolWrapper> = gate;
         let persistence: Arc<dyn ToolWrapper> = Arc::new(test_wrapper(Arc::new(Mutex::new(
diff --git a/crates/aura/src/orchestration/test_rig.rs b/crates/aura/src/orchestration/test_rig.rs
index c95b2128c..870e01c3c 100644
--- a/crates/aura/src/orchestration/test_rig.rs
+++ b/crates/aura/src/orchestration/test_rig.rs
@@ -742,7 +742,7 @@ pub(crate) async fn park_orchestrator_in(
         }),
         memory_dir: Some(memory_dir.to_string_lossy().into_owned()),
         session_id: Some("park-sess".to_string()),
-        request_id: Some(format!("req_rig_{}", uuid::Uuid::new_v4().simple())),
+        request_id: Some(crate::domain::RequestId::generate()),
         orchestration: Some(super::OrchestrationConfig {
             enabled: true,
             workers,
diff --git a/crates/aura/src/request_cancellation.rs b/crates/aura/src/request_cancellation.rs
index 2a224003e..5d09119ee 100644
--- a/crates/aura/src/request_cancellation.rs
+++ b/crates/aura/src/request_cancellation.rs
@@ -5,8 +5,6 @@
 
 use tokio_util::sync::{CancellationToken, WaitForCancellationFuture};
 
-pub type RequestId = String;
-
 /// A run's cancellation signal. Fired by the handler on client disconnect,
 /// timeout, or server shutdown. Observed by MCP notifications, HITL approval
 /// gates, and resource cleanup.
diff --git a/crates/aura/src/rig_builder.rs b/crates/aura/src/rig_builder.rs
index d98fd82e5..95194d99c 100644
--- a/crates/aura/src/rig_builder.rs
+++ b/crates/aura/src/rig_builder.rs
@@ -155,7 +155,7 @@ impl RigBuilder {
         req_headers: Option<&HashMap<String, String>>,
         additional_tools: Vec<Box<dyn rig::tool::ToolDyn>>,
         client_tools: Option<Vec<ClientTool>>,
-        request_id: Option<String>,
+        request_id: Option<crate::domain::RequestId>,
         session_id: Option<String>,
     ) -> Result<Agent, BuilderError> {
         let mut agent_config = self.discovered_agent_config(req_headers)?;
@@ -183,7 +183,7 @@ impl RigBuilder {
         req_headers: Option<&HashMap<String, String>>,
         session_id: Option<String>,
         client_tools: Option<Vec<ClientTool>>,
-        request_id: Option<String>,
+        request_id: Option<crate::domain::RequestId>,
     ) -> Result<Arc<dyn StreamingAgent>, BuilderError> {
         self.build_streaming_agent_with_tools(
             req_headers,
@@ -204,7 +204,7 @@ impl RigBuilder {
         req_headers: Option<&HashMap<String, String>>,
         session_id: Option<String>,
         client_tools: Option<Vec<ClientTool>>,
-        request_id: Option<String>,
+        request_id: Option<crate::domain::RequestId>,
         run_tools: RunToolFactory,
     ) -> Result<Arc<dyn StreamingAgent>, BuilderError> {
         let mut agent_config = self.discovered_agent_config(req_headers)?;
diff --git a/crates/aura/src/run_context.rs b/crates/aura/src/run_context.rs
index acba9c87f..9597efe2c 100644
--- a/crates/aura/src/run_context.rs
+++ b/crates/aura/src/run_context.rs
@@ -23,12 +23,14 @@ use tokio::sync::mpsc;
 
 use aura_events::ToolCallId;
 
+use crate::domain::RequestId;
+
 /// Events a run may buffer before its observer reads them.
 pub const EVENT_CHANNEL_CAPACITY: usize = 1024;
 
 /// One run — what its own work needs to correlate, and where its events go.
 pub struct RunContext {
-    id: Arc<str>,
+    id: RequestId,
     tool_calls: Mutex<VecDeque<ToolCallId>>,
     events: mpsc::Sender<AgentEvent>,
     cancel: CancellationToken,
@@ -39,7 +41,7 @@ const MAX_PENDING_TOOL_CALLS: usize = 256;
 
 impl RunContext {
     /// A run and the receiver its observer reads, on a token of its own.
-    pub fn channel(id: impl Into<Arc<str>>) -> (Arc<Self>, mpsc::Receiver<AgentEvent>) {
+    pub fn channel(id: RequestId) -> (Arc<Self>, mpsc::Receiver<AgentEvent>) {
         Self::channel_on(id, CancellationToken::new())
     }
 
@@ -47,12 +49,12 @@ impl RunContext {
     /// to stop on — a child of its own caller's, so one run ending leaves the
     /// others alone.
     pub fn channel_on(
-        id: impl Into<Arc<str>>,
+        id: RequestId,
         cancel: CancellationToken,
     ) -> (Arc<Self>, mpsc::Receiver<AgentEvent>) {
         let (events, receiver) = mpsc::channel(EVENT_CHANNEL_CAPACITY);
         let run = Arc::new(Self {
-            id: id.into(),
+            id,
             tool_calls: Mutex::new(VecDeque::new()),
             events,
             cancel,
@@ -64,7 +66,7 @@ impl RunContext {
     /// reading what it emits. Production names a run it can reach an observer
     /// through, or names none.
     #[cfg(test)]
-    pub fn detached(id: impl Into<Arc<str>>) -> Arc<Self> {
+    pub fn detached(id: RequestId) -> Arc<Self> {
         Self::channel(id).0
     }
 
@@ -84,7 +86,7 @@ impl RunContext {
         delivered
     }
 
-    pub fn id(&self) -> &Arc<str> {
+    pub fn id(&self) -> &RequestId {
         &self.id
     }
 
@@ -190,8 +192,8 @@ pub fn current_run() -> Option<Arc<RunContext>> {
     RUN.try_with(Arc::clone).ok()
 }
 
-pub fn current_run_id() -> Option<Arc<str>> {
-    RUN.try_with(|run| Arc::clone(run.id())).ok()
+pub fn current_run_id() -> Option<RequestId> {
+    RUN.try_with(|run| run.id().clone()).ok()
 }
 
 /// Runs `f` with `run` in scope. Task-locals do not cross `tokio::spawn`, so
@@ -226,7 +228,7 @@ impl<S: Stream + Unpin> Stream for ScopedStream<S> {
 /// Runs `f` with a fresh run in scope and returns what it emitted, for a test
 /// that asserts on a run's events without standing up an observer.
 #[cfg(test)]
-pub(crate) async fn observing<F: Future>(id: &str, f: F) -> (F::Output, Vec<AgentEvent>) {
+pub(crate) async fn observing<F: Future>(id: RequestId, f: F) -> (F::Output, Vec<AgentEvent>) {
     let (run, mut events) = RunContext::channel(id);
     let out = with_run(run, f).await;
 
@@ -242,17 +244,18 @@ mod tests {
     use super::*;
     use futures::StreamExt;
 
-    fn run(id: &str) -> Arc<RunContext> {
-        RunContext::detached(id)
+    fn run() -> Arc<RunContext> {
+        RunContext::detached(RequestId::generate())
     }
 
     #[tokio::test]
     async fn a_scope_established_inside_a_spawn_holds() {
-        let (run, _rx) = RunContext::channel("spawned");
+        let id = RequestId::generate();
+        let (run, _rx) = RunContext::channel(id.clone());
         let seen = tokio::spawn(with_run(run, async { current_run_id() }))
             .await
             .unwrap();
-        assert_eq!(seen.as_deref(), Some("spawned"));
+        assert_eq!(seen, Some(id));
     }
 
     /// A run built on the caller's token stops when the caller does. The work
@@ -262,7 +265,7 @@ mod tests {
     #[tokio::test]
     async fn a_run_stops_on_the_token_it_was_built_on() {
         let caller = CancellationToken::new();
-        let (run, _events) = RunContext::channel_on("run_on_token", caller.clone());
+        let (run, _events) = RunContext::channel_on(RequestId::generate(), caller.clone());
         assert!(!run.cancel_token().is_cancelled());
 
         caller.cancel();
@@ -273,8 +276,8 @@ mod tests {
     /// cancels something else.
     #[tokio::test]
     async fn a_run_given_no_token_has_its_own() {
-        let (a, _ea) = RunContext::channel("run_a");
-        let (b, _eb) = RunContext::channel("run_b");
+        let (a, _ea) = RunContext::channel(RequestId::generate());
+        let (b, _eb) = RunContext::channel(RequestId::generate());
 
         a.cancel_token().cancel();
         assert!(a.cancel_token().is_cancelled());
@@ -292,34 +295,37 @@ mod tests {
 
     #[tokio::test]
     async fn a_scope_supplies_the_run() {
-        let seen = with_run(run("run_1"), async { current_run_id() }).await;
-        assert_eq!(seen.as_deref(), Some("run_1"));
+        let run = run();
+        let id = run.id().clone();
+        let seen = with_run(run, async { current_run_id() }).await;
+        assert_eq!(seen, Some(id));
     }
 
     #[tokio::test]
     async fn concurrent_runs_do_not_see_each_other() {
-        let a = tokio::spawn(with_run(run("run_a"), async {
+        let (run_a, run_b) = (run(), run());
+        let (id_a, id_b) = (run_a.id().clone(), run_b.id().clone());
+        let a = tokio::spawn(with_run(run_a, async {
             tokio::task::yield_now().await;
             current_run_id()
         }));
-        let b = tokio::spawn(with_run(run("run_b"), async {
+        let b = tokio::spawn(with_run(run_b, async {
             tokio::task::yield_now().await;
             current_run_id()
         }));
 
-        assert_eq!(a.await.unwrap().as_deref(), Some("run_a"));
-        assert_eq!(b.await.unwrap().as_deref(), Some("run_b"));
+        assert_eq!(a.await.unwrap(), Some(id_a));
+        assert_eq!(b.await.unwrap(), Some(id_b));
     }
 
     #[tokio::test]
     async fn a_scoped_stream_carries_the_run_into_each_poll() {
+        let run = run();
+        let id = run.id().clone();
         let inner = futures::stream::iter(0..3).map(|_| current_run_id());
-        let seen: Vec<_> = scope_stream(run("run_s"), inner).collect().await;
+        let seen: Vec<_> = scope_stream(run, inner).collect().await;
 
-        assert_eq!(
-            seen.iter().map(|id| id.as_deref()).collect::<Vec<_>>(),
-            vec![Some("run_s"); 3]
-        );
+        assert_eq!(seen, vec![Some(id); 3]);
     }
 
     /// Orchestration drives workers with `FuturesUnordered` inside the run's
@@ -329,7 +335,9 @@ mod tests {
     async fn workers_driven_as_futures_keep_the_run() {
         use futures::stream::FuturesUnordered;
 
-        let seen = with_run(run("run_w"), async {
+        let run = run();
+        let id = run.id().clone();
+        let seen = with_run(run, async {
             let mut workers: FuturesUnordered<_> = (0..3)
                 .map(|_| async {
                     tokio::task::yield_now().await;
@@ -345,17 +353,14 @@ mod tests {
         })
         .await;
 
-        assert_eq!(
-            seen.iter().map(|id| id.as_deref()).collect::<Vec<_>>(),
-            vec![Some("run_w"); 3]
-        );
+        assert_eq!(seen, vec![Some(id); 3]);
     }
 
     /// A spawned task does not inherit its parent's scope, which is why every
     /// orchestration worker establishes its own.
     #[tokio::test]
     async fn a_spawned_task_does_not_inherit_the_scope() {
-        let seen = with_run(run("run_p"), async {
+        let seen = with_run(run(), async {
             tokio::spawn(async { current_run_id() }).await.unwrap()
         })
         .await;
@@ -365,7 +370,7 @@ mod tests {
 
     #[test]
     fn a_run_with_no_calls_in_flight_has_nothing_to_report() {
-        let run = run("run_empty");
+        let run = run();
         assert_eq!(run.peek_tool_call(), None);
         assert_eq!(run.pop_tool_call(), None);
     }
@@ -374,7 +379,7 @@ mod tests {
     /// matches the order the calls were announced.
     #[test]
     fn tool_calls_come_back_in_the_order_they_were_pushed() {
-        let run = run("run_fifo");
+        let run = run();
         run.push_tool_call("call_1");
         run.push_tool_call("call_2");
 
@@ -391,8 +396,8 @@ mod tests {
 
     #[test]
     fn one_runs_calls_are_invisible_to_another() {
-        let a = run("run_a");
-        let b = run("run_b");
+        let a = run();
+        let b = run();
         a.push_tool_call("call_a");
 
         assert_eq!(b.peek_tool_call(), None);
@@ -403,7 +408,7 @@ mod tests {
     /// one, so a call recorded inside the scope has to be the same run's.
     #[tokio::test]
     async fn a_call_recorded_in_scope_is_visible_to_the_run() {
-        let run = run("run_hook");
+        let run = run();
 
         with_run(Arc::clone(&run), async {
             current_run()
@@ -422,7 +427,7 @@ mod tests {
     /// The order holds across a longer run, not only a pair.
     #[test]
     fn a_long_sequence_keeps_its_order() {
-        let run = run("run_many");
+        let run = run();
         for i in 0..64 {
             run.push_tool_call(format!("call_{i}"));
         }
diff --git a/crates/aura/src/scratchpad/storage.rs b/crates/aura/src/scratchpad/storage.rs
index a524ed35f..627af9476 100644
--- a/crates/aura/src/scratchpad/storage.rs
+++ b/crates/aura/src/scratchpad/storage.rs
@@ -140,16 +140,6 @@ impl ScratchpadStorage {
         })
     }
 
-    /// Create storage with a specific base directory (for testing).
-    pub async fn with_base_dir(base: &Path, request_id: &str) -> std::io::Result<Self> {
-        let dir = base.join(request_id);
-        fs::create_dir_all(&dir).await?;
-        Ok(Self {
-            read_root: dir.clone(),
-            dir,
-        })
-    }
-
     /// Widen the read boundary to `read_root` (must be an ancestor of `dir`).
     ///
     /// Reads via [`validate_path`](Self::validate_path) are then permitted
@@ -621,9 +611,7 @@ mod tests {
     #[tokio::test]
     async fn test_write_and_read() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-1")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         let content = r#"{"key": "value"}"#;
         let result = storage.write_output("call-1", content).await.unwrap();
@@ -640,9 +628,7 @@ mod tests {
     #[tokio::test]
     async fn test_text_format_detection() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-2")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         let result = storage
             .write_output("call-1", "plain text output")
@@ -700,9 +686,7 @@ mod tests {
     #[tokio::test]
     async fn test_companion_extraction() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-comp")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         // JSON with a large markdown string value
         let md_content = (0..15)
@@ -736,9 +720,7 @@ mod tests {
     #[tokio::test]
     async fn test_companion_path_traversal_is_sanitized() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-traversal")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         // A malicious tool output with a JSON key that tries to escape the
         // scratchpad directory. Content is large enough to trigger companion
@@ -789,9 +771,7 @@ mod tests {
     #[tokio::test]
     async fn test_companion_not_extracted_for_small_strings() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-small")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         let json = serde_json::json!({"status": "ok", "note": "### Title\n- short"});
         let result = storage
@@ -804,9 +784,7 @@ mod tests {
     #[tokio::test]
     async fn test_companion_extraction_escaped_json() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-esc")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         // Build an inner JSON object with enough keys to exceed COMPANION_MIN_LINES
         // when pretty-printed
@@ -848,9 +826,7 @@ mod tests {
     #[tokio::test]
     async fn test_validate_path_ok() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-3")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         let result = storage.validate_path("call-1.json").await;
         assert!(result.is_ok());
@@ -924,9 +900,7 @@ mod tests {
     #[tokio::test]
     async fn test_with_read_root_ignores_non_ancestor() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-rr")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
         let dir = storage.dir().to_path_buf();
         let unrelated = tmp.path().join("unrelated");
         let storage = storage.with_read_root(unrelated);
@@ -937,9 +911,7 @@ mod tests {
     #[tokio::test]
     async fn test_validate_path_traversal_rejected() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-4")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         let result = storage.validate_path("../../etc/passwd").await;
         assert!(result.is_err());
@@ -961,9 +933,7 @@ mod tests {
         let secret = outside_tmp.path().join("secret.txt");
         std::fs::write(&secret, "out of bounds").unwrap();
 
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-symlink")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
         // Plant a symlink inside the scratchpad dir that points at `secret`.
         let symlink_path = storage.dir().join("link.txt");
         std::os::unix::fs::symlink(&secret, &symlink_path).unwrap();
@@ -983,9 +953,7 @@ mod tests {
     #[tokio::test]
     async fn test_validate_path_nonexistent_path_passes() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-nx")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
         let result = storage.validate_path("not_yet_written.json").await;
         assert!(
             result.is_ok(),
@@ -1000,9 +968,7 @@ mod tests {
         use std::os::unix::fs::PermissionsExt;
 
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-io")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
         let sub = storage.dir().join("locked");
         std::fs::create_dir(&sub).unwrap();
         std::fs::write(sub.join("f.txt"), "x").unwrap();
@@ -1031,9 +997,7 @@ mod tests {
     async fn test_validate_path_dangling_symlink_rejected() {
         let tmp = TempDir::new().unwrap();
         let outside = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-dangle")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         let link = storage.dir().join("dangle.txt");
         std::os::unix::fs::symlink(outside.path().join("planted.txt"), &link).unwrap();
@@ -1051,9 +1015,7 @@ mod tests {
     async fn test_validate_path_symlinked_ancestor_rejected() {
         let tmp = TempDir::new().unwrap();
         let outside = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-alias")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         // `alias` points at a real directory outside the read root.
         let alias = storage.dir().join("alias");
@@ -1071,9 +1033,7 @@ mod tests {
     #[cfg(unix)]
     async fn test_validate_path_in_root_symlink_ancestor_accepted() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-inlink")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         let real = storage.dir().join("real");
         std::fs::create_dir(&real).unwrap();
@@ -1089,9 +1049,7 @@ mod tests {
     #[tokio::test]
     async fn test_list_files() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-5")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         storage.write_output("a", "content a").await.unwrap();
         storage.write_output("b", r#"{"x":1}"#).await.unwrap();
@@ -1105,9 +1063,7 @@ mod tests {
     #[tokio::test]
     async fn test_cleanup() {
         let tmp = TempDir::new().unwrap();
-        let storage = ScratchpadStorage::with_base_dir(tmp.path(), "req-6")
-            .await
-            .unwrap();
+        let storage = ScratchpadStorage::in_dir(tmp.path()).await.unwrap();
 
         storage.write_output("c", "data").await.unwrap();
         assert!(storage.dir().exists());
diff --git a/crates/aura/src/scratchpad/tools.rs b/crates/aura/src/scratchpad/tools.rs
index 202c101c1..f3019daed 100644
--- a/crates/aura/src/scratchpad/tools.rs
+++ b/crates/aura/src/scratchpad/tools.rs
@@ -1817,11 +1817,7 @@ mod tests {
 
     async fn setup() -> (TempDir, Arc<ScratchpadStorage>, ContextBudget) {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "test-req")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
         let counter = TiktokenCounter::default_counter();
         let budget = ContextBudget::new(100_000, 0.20, 0, std::sync::Arc::new(counter));
         (tmp, storage, budget)
diff --git a/crates/aura/src/scratchpad/wrapper.rs b/crates/aura/src/scratchpad/wrapper.rs
index 07a2c7f45..4909999b9 100644
--- a/crates/aura/src/scratchpad/wrapper.rs
+++ b/crates/aura/src/scratchpad/wrapper.rs
@@ -254,11 +254,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_intercepts_via_resolved_tool_name() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-glob")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         // The map post-resolution lists the bare tool name → threshold.
         // Glob expansion happens at boot; the wrapper just does HashMap::get.
@@ -299,11 +295,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_pointer_is_deterministic_for_identical_output() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-deterministic")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("echo_large".to_string(), 10)]);
         let counter = TiktokenCounter::default_counter();
@@ -331,11 +323,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_intercepts_large_output() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-1")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("search_knowledge_base".to_string(), 10)]);
 
@@ -382,11 +370,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_strips_persistence_footer_before_write() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-footer")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("execute_range_query".to_string(), 10)]);
         let counter = TiktokenCounter::default_counter();
@@ -436,11 +420,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_passes_through_small_output() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-2")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("search_knowledge_base".to_string(), 1000)]);
 
@@ -474,11 +454,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_ignores_non_scratchpad_tools() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-3")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("search_knowledge_base".to_string(), 100)]);
 
@@ -502,11 +478,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_passes_through_skill_tool_outputs() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-skills")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("search_knowledge_base".to_string(), 10)]);
 
@@ -534,11 +506,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_intercepts_at_exact_threshold() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-boundary")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let counter = TiktokenCounter::default_counter();
 
@@ -584,11 +552,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_records_intercepted_tokens() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-counter")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("counted_tool".to_string(), 10)]);
         let counter = TiktokenCounter::default_counter();
@@ -622,11 +586,7 @@ mod tests {
         // Point storage at a non-existent directory that we then remove,
         // so the write will fail with an I/O error.
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-fail")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         // Remove the directory so writes fail
         std::fs::remove_dir_all(storage.dir()).unwrap();
@@ -679,11 +639,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_json_companion_pointer_recommends_get_in() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-json-comp")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("nested_call".to_string(), 10)]);
         let counter = TiktokenCounter::default_counter();
@@ -742,11 +698,7 @@ mod tests {
     #[tokio::test]
     async fn test_wrapper_companion_files_in_pointer() {
         let tmp = TempDir::new().unwrap();
-        let storage = Arc::new(
-            ScratchpadStorage::with_base_dir(tmp.path(), "req-wrap-comp")
-                .await
-                .unwrap(),
-        );
+        let storage = Arc::new(ScratchpadStorage::in_dir(tmp.path()).await.unwrap());
 
         let tools = HashMap::from([("analyze_logs".to_string(), 10)]);
 
diff --git a/crates/aura/src/session_store/fault_store.rs b/crates/aura/src/session_store/fault_store.rs
index 57cadf335..b22d3a61c 100644
--- a/crates/aura/src/session_store/fault_store.rs
+++ b/crates/aura/src/session_store/fault_store.rs
@@ -5,7 +5,7 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use async_trait::async_trait;
 
 use super::{ApprovalStore, InMemoryApprovalStore, SessionStoreError};
-use crate::hitl::{ApprovalDecision, DecisionId, ParkedApproval, ResolveError};
+use crate::hitl::{ApprovalDecision, ApprovalOwner, DecisionId, ParkedApproval, ResolveError};
 
 /// Delegates to an in-memory store; each `fail_*` flag makes that operation
 /// answer `SessionStoreError::Request` (the `*_once` flag fires one time).
@@ -73,8 +73,8 @@ impl ApprovalStore for FaultInjectingStore {
 
     async fn cancel_request(
         &self,
-        request_id: &str,
+        owner: &ApprovalOwner,
     ) -> Result<Vec<ParkedApproval>, SessionStoreError> {
-        self.inner.cancel_request(request_id).await
+        self.inner.cancel_request(owner).await
     }
 }
diff --git a/crates/aura/src/session_store/file.rs b/crates/aura/src/session_store/file.rs
index 215688fa4..edeb7b513 100644
--- a/crates/aura/src/session_store/file.rs
+++ b/crates/aura/src/session_store/file.rs
@@ -53,7 +53,7 @@ use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
 use tokio::task::{JoinError, spawn_blocking};
 
-use crate::hitl::{ApprovalDecision, DecisionId, ParkedApproval, ResolveError};
+use crate::hitl::{ApprovalDecision, ApprovalOwner, DecisionId, ParkedApproval, ResolveError};
 
 use super::{ApprovalStore, DecisionRecord, ParkedApprovalRecord, SessionStoreError};
 
@@ -259,7 +259,7 @@ impl Inner {
 
     fn cancel_request_sync(
         &self,
-        request_id: &str,
+        owner: &ApprovalOwner,
     ) -> Result<Vec<ParkedApproval>, SessionStoreError> {
         let _guard = self.lock();
         let entries = match fs::read_dir(self.approvals_dir()) {
@@ -294,7 +294,7 @@ impl Inner {
                     continue;
                 }
             };
-            if parked.request.request_id != request_id {
+            if parked.request.owner != *owner {
                 continue;
             }
             // resolve writes the decision before its best-effort approval
@@ -385,11 +385,11 @@ impl ApprovalStore for FileApprovalStore {
 
     async fn cancel_request(
         &self,
-        request_id: &str,
+        owner: &ApprovalOwner,
     ) -> Result<Vec<ParkedApproval>, SessionStoreError> {
         let inner = Arc::clone(&self.inner);
-        let request_id = request_id.to_owned();
-        spawn_blocking(move || inner.cancel_request_sync(&request_id))
+        let owner = owner.clone();
+        spawn_blocking(move || inner.cancel_request_sync(&owner))
             .await
             .map_err(join_err)?
     }
diff --git a/crates/aura/src/session_store/memory.rs b/crates/aura/src/session_store/memory.rs
index ceca707e3..4d84efff6 100644
--- a/crates/aura/src/session_store/memory.rs
+++ b/crates/aura/src/session_store/memory.rs
@@ -8,7 +8,9 @@ use async_trait::async_trait;
 use bytes::Bytes;
 use tokio::sync::broadcast;
 
-use crate::hitl::{ApprovalDecision, DecisionId, ParkedApproval, ResolveError, Timestamp};
+use crate::hitl::{
+    ApprovalDecision, ApprovalOwner, DecisionId, ParkedApproval, ResolveError, Timestamp,
+};
 
 use super::{
     ApprovalStore, EventBus, MAX_SKILL_RECORDS_PER_LOG, SessionStoreError, SkillInvocationRecord,
@@ -111,11 +113,11 @@ impl ApprovalStore for InMemoryApprovalStore {
 
     async fn cancel_request(
         &self,
-        request_id: &str,
+        owner: &ApprovalOwner,
     ) -> Result<Vec<ParkedApproval>, SessionStoreError> {
         let cleared: Vec<ParkedApproval> = self
             .lock()
-            .extract_if(.., |_, parked| parked.request.request_id == request_id)
+            .extract_if(.., |_, parked| parked.request.owner == *owner)
             .map(|(_, parked)| parked)
             .collect();
         Ok(cleared)
@@ -310,18 +312,23 @@ mod tests {
 
     use super::*;
     use crate::config::SessionId;
+    use crate::domain::RequestId;
     use crate::hitl::{
         AgentScope, ApprovalItem, ApprovalOrigin, ApprovalRequest, PROTOCOL_VERSION,
     };
 
-    fn parked(request_id: &str) -> ParkedApproval {
+    fn owner() -> ApprovalOwner {
+        ApprovalOwner::Request(RequestId::generate())
+    }
+
+    fn parked(owner: &ApprovalOwner) -> ParkedApproval {
         let now = chrono::Utc::now();
         ParkedApproval {
             request: ApprovalRequest {
                 version: PROTOCOL_VERSION,
                 instance_id: "test-instance".to_string(),
                 decision_id: DecisionId::generate(),
-                request_id: request_id.to_string(),
+                owner: owner.clone(),
                 scope: AgentScope::Single { session_id: None },
                 origin: ApprovalOrigin::ConfigGate {
                     matched_pattern: "test_*".to_string(),
@@ -342,7 +349,7 @@ mod tests {
     #[tokio::test]
     async fn approval_store_register_get_resolve() {
         let store = InMemoryApprovalStore::new();
-        let entry = parked("req-1");
+        let entry = parked(&owner());
         let id = entry.request.decision_id;
 
         store.register(entry).await.unwrap();
@@ -362,7 +369,7 @@ mod tests {
     #[tokio::test]
     async fn approval_store_resolve_records_readable_decision() {
         let store = InMemoryApprovalStore::new();
-        let entry = parked("req-durable");
+        let entry = parked(&owner());
         let id = entry.request.decision_id;
         store.register(entry).await.unwrap();
 
@@ -385,7 +392,7 @@ mod tests {
     #[tokio::test]
     async fn recorded_decision_is_pruned_after_retention_window() {
         let store = InMemoryApprovalStore::new();
-        let id = parked("req-prune").request.decision_id;
+        let id = parked(&owner()).request.decision_id;
         store.lock_decided().insert(
             id,
             DecidedEntry {
@@ -401,7 +408,7 @@ mod tests {
     #[tokio::test]
     async fn expired_ticket_refuses_resolve() {
         let store = InMemoryApprovalStore::new();
-        let mut entry = parked("req-expired");
+        let mut entry = parked(&owner());
         entry.expires_at = chrono::Utc::now() - chrono::Duration::seconds(1);
         let id = entry.request.decision_id;
         store.register(entry).await.unwrap();
@@ -418,7 +425,7 @@ mod tests {
     #[tokio::test]
     async fn expired_ticket_is_returned_by_get_until_remove() {
         let store = InMemoryApprovalStore::new();
-        let mut entry = parked("req-expired-get");
+        let mut entry = parked(&owner());
         entry.expires_at = chrono::Utc::now() - chrono::Duration::seconds(1);
         let id = entry.request.decision_id;
         store.register(entry).await.unwrap();
@@ -431,14 +438,15 @@ mod tests {
     #[tokio::test]
     async fn approval_store_cancel_request_removes_only_matching() {
         let store = InMemoryApprovalStore::new();
-        let cancel = parked("req-cancel");
+        let cancel_owner = owner();
+        let cancel = parked(&cancel_owner);
         let cancel_id = cancel.request.decision_id;
-        let keep = parked("req-keep");
+        let keep = parked(&owner());
         let keep_id = keep.request.decision_id;
         store.register(cancel).await.unwrap();
         store.register(keep).await.unwrap();
 
-        let cleared = store.cancel_request("req-cancel").await.unwrap();
+        let cleared = store.cancel_request(&cancel_owner).await.unwrap();
 
         assert_eq!(cleared.len(), 1, "only the matching ticket is cleared");
         assert_eq!(cleared[0].request.decision_id, cancel_id);
diff --git a/crates/aura/src/session_store/mod.rs b/crates/aura/src/session_store/mod.rs
index 174bea41a..dd7a88595 100644
--- a/crates/aura/src/session_store/mod.rs
+++ b/crates/aura/src/session_store/mod.rs
@@ -25,7 +25,7 @@ use bytes::Bytes;
 use futures::Stream;
 
 use crate::config::SessionId;
-use crate::hitl::{ApprovalDecision, DecisionId, ParkedApproval, ResolveError};
+use crate::hitl::{ApprovalDecision, ApprovalOwner, DecisionId, ParkedApproval, ResolveError};
 
 #[cfg(test)]
 pub(crate) use fault_store::FaultInjectingStore;
@@ -96,7 +96,7 @@ pub trait ApprovalStore: Send + Sync {
     /// the cancellation applies to.
     async fn cancel_request(
         &self,
-        request_id: &str,
+        owner: &ApprovalOwner,
     ) -> Result<Vec<ParkedApproval>, SessionStoreError>;
 }
 
diff --git a/crates/aura/src/session_store/record.rs b/crates/aura/src/session_store/record.rs
index 48d020650..d11912e6e 100644
--- a/crates/aura/src/session_store/record.rs
+++ b/crates/aura/src/session_store/record.rs
@@ -15,8 +15,8 @@ use serde::{Deserialize, Serialize};
 
 use crate::config::SessionId;
 use crate::hitl::{
-    AgentScope, ApprovalDecision, ApprovalItem, ApprovalOrigin, ApprovalRequest, DecisionId,
-    ParkedApproval, Timestamp,
+    AgentScope, ApprovalDecision, ApprovalItem, ApprovalOrigin, ApprovalOwner, ApprovalRequest,
+    DecisionId, ParkedApproval, Timestamp,
 };
 use crate::orchestration::{RunId, TaskIdentity};
 
@@ -120,7 +120,7 @@ impl From<&ParkedApproval> for ParkedApprovalRecord {
             version: request.version,
             instance_id: request.instance_id.clone(),
             decision_id: request.decision_id,
-            request_id: request.request_id.clone(),
+            request_id: request.owner.to_string(),
             scope: ScopeRecord::from(&request.scope),
             origin: OriginRecord::from(&request.origin),
             items: request.items.clone(),
@@ -139,7 +139,7 @@ impl TryFrom<ParkedApprovalRecord> for ParkedApproval {
                 version: record.version,
                 instance_id: record.instance_id,
                 decision_id: record.decision_id,
-                request_id: record.request_id,
+                owner: parse_owner(&record.request_id)?,
                 scope: record.scope.try_into()?,
                 origin: record.origin.into(),
                 items: record.items,
@@ -233,6 +233,12 @@ impl From<OriginRecord> for ApprovalOrigin {
     }
 }
 
+fn parse_owner(raw: &str) -> Result<ApprovalOwner, InvalidRecord> {
+    ApprovalOwner::parse(raw).ok_or_else(|| InvalidRecord {
+        reason: format!("request_id '{raw}' names no request or run"),
+    })
+}
+
 fn parse_run_id(raw: &str) -> Result<RunId, InvalidRecord> {
     raw.parse().map_err(|e| InvalidRecord {
         reason: format!("run_id '{raw}': {e}"),
@@ -242,6 +248,7 @@ fn parse_run_id(raw: &str) -> Result<RunId, InvalidRecord> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::domain::RequestId;
     use crate::hitl::PROTOCOL_VERSION;
 
     fn parked(scope: AgentScope, origin: ApprovalOrigin) -> ParkedApproval {
@@ -251,7 +258,7 @@ mod tests {
                 version: PROTOCOL_VERSION,
                 instance_id: "test-instance".to_string(),
                 decision_id: DecisionId::generate(),
-                request_id: "req-1".to_string(),
+                owner: ApprovalOwner::Request(RequestId::generate()),
                 scope,
                 origin,
                 items: vec![ApprovalItem {
@@ -318,6 +325,62 @@ mod tests {
         ));
     }
 
+    fn gated(owner: ApprovalOwner) -> ParkedApproval {
+        let mut approval = parked(
+            AgentScope::Single { session_id: None },
+            ApprovalOrigin::ConfigGate {
+                matched_pattern: "*".to_string(),
+                agent_name: "test-agent".to_string(),
+            },
+        );
+        approval.request.owner = owner;
+        approval
+    }
+
+    /// Each owner kind stores as the bare string the webhook payload carries,
+    /// so any instance restores what another parked.
+    #[test]
+    fn owners_store_as_their_bare_string_and_restore() {
+        let run_id: RunId = "0191e8c0-1111-7000-8000-000000000000".parse().unwrap();
+        let request_id = RequestId::generate();
+        for (owner, stored) in [
+            (
+                ApprovalOwner::Request(request_id.clone()),
+                request_id.to_string(),
+            ),
+            (
+                ApprovalOwner::Request(RequestId::for_a2a_task("task-7")),
+                "a2a_task-7".to_string(),
+            ),
+            (
+                ApprovalOwner::Request(RequestId::for_a2a_task("")),
+                "a2a_".to_string(),
+            ),
+            (
+                ApprovalOwner::Run(run_id),
+                "run:0191e8c0-1111-7000-8000-000000000000".to_string(),
+            ),
+            (ApprovalOwner::Unowned, String::new()),
+        ] {
+            let approval = gated(owner);
+            assert_eq!(ParkedApprovalRecord::from(&approval).request_id, stored);
+            assert_round_trip(approval);
+        }
+    }
+
+    #[test]
+    fn a_record_naming_an_unminted_owner_is_rejected() {
+        let mut record =
+            ParkedApprovalRecord::from(&gated(ApprovalOwner::Request(RequestId::generate())));
+        for request_id in ["req-1", "run:not-a-uuid", "run:"] {
+            record.request_id = request_id.to_string();
+            assert!(
+                ParkedApproval::try_from(record.clone()).is_err(),
+                "{request_id:?} restored"
+            );
+        }
+    }
+
     #[test]
     fn scope_tags_are_stable_snake_case() {
         let record = ParkedApprovalRecord::from(&parked(
diff --git a/crates/aura/src/streaming.rs b/crates/aura/src/streaming.rs
index 794f7dfac..bfb226685 100644
--- a/crates/aura/src/streaming.rs
+++ b/crates/aura/src/streaming.rs
@@ -14,12 +14,14 @@
 //!
 //! ```ignore
 //! use aura::streaming::{RunOptions, StreamingAgent};
-//! use aura::{StreamError, StreamItem};
+//! use aura::{RequestId, StreamError, StreamItem};
 //! use futures::StreamExt;
 //!
 //! async fn handle_request(agent: impl StreamingAgent, query: &str) {
 //!     // The default leaves the run unbounded and lets it mint its own token.
-//!     let run = agent.stream(query, vec![], RunOptions::default(), "req_123").await;
+//!     let run = agent
+//!         .stream(query, vec![], RunOptions::default(), &RequestId::generate())
+//!         .await;
 //!     let mut items = run.into_events();
 //!
 //!     // Process stream items (convert to SSE, etc.)
@@ -289,14 +291,18 @@ pub trait StreamingAgent: Send + Sync {
         query: &str,
         chat_history: Vec<Message>,
         options: RunOptions,
-        request_id: &str,
+        request_id: &crate::domain::RequestId,
     ) -> AgentRun;
 
     /// Cancel in-flight MCP requests and close connections.
     ///
     /// Called on client disconnect or timeout to propagate `notifications/cancelled`
     /// to MCP servers. Returns the number of cancelled requests.
-    async fn cancel_and_close_mcp(&self, request_id: &str, reason: &str) -> usize;
+    async fn cancel_and_close_mcp(
+        &self,
+        request_id: &crate::domain::RequestId,
+        reason: &str,
+    ) -> usize;
 
     /// The configured context window size in tokens, `None` when the config
     /// sets no window.
@@ -481,7 +487,7 @@ mod tests {
             agent: aura_events::AgentContext,
             items: Vec<Result<StreamItem, StreamError>>,
         ) -> (Vec<aura_events::AgentContext>, usize, Vec<Payload>) {
-            let (run, mut events) = RunContext::channel("run_tee");
+            let (run, mut events) = RunContext::channel(crate::domain::RequestId::generate());
             let passed = tee_content(run, agent, futures::stream::iter(items))
                 .collect::<Vec<_>>()
                 .await
@@ -564,7 +570,7 @@ mod tests {
         /// the items must still pass.
         #[tokio::test]
         async fn an_unobserved_run_still_streams_its_items() {
-            let (run, events) = RunContext::channel("run_unobserved");
+            let (run, events) = RunContext::channel(crate::domain::RequestId::generate());
             drop(events);
 
             let passed = tee_content(
diff --git a/crates/aura/src/streaming_request_hook.rs b/crates/aura/src/streaming_request_hook.rs
index ab872f267..8c47ab4b1 100644
--- a/crates/aura/src/streaming_request_hook.rs
+++ b/crates/aura/src/streaming_request_hook.rs
@@ -106,7 +106,7 @@ impl Drop for ParkCellRegistration {
 /// correlates nothing until #732. Its tool events stay off the run for the same
 /// reason, and orchestration reports the worker's calls itself.
 fn queue_owner(stream_id: &str) -> Option<Arc<crate::run_context::RunContext>> {
-    current_run().filter(|run| run.id().as_ref() == stream_id)
+    current_run().filter(|run| run.id().as_str() == stream_id)
 }
 
 /// Sends a tool event raised by this stream to the run [`queue_owner`] gives it.
@@ -759,10 +759,16 @@ mod tests {
     /// sibling's id. Only the stream that *is* the run may fill it.
     mod queue_ownership {
         use super::super::{emit_from_stream, queue_owner};
+        use crate::domain::RequestId;
         use crate::run_context::{RunContext, with_run};
         use aura_events::agent::{AgentEvent, AgentEventPayload};
         use aura_events::{ToolCallId, ToolName};
 
+        /// The key a park-mode worker's task attempt streams under.
+        fn attempt_key(id: &RequestId) -> String {
+            format!("{id}:task:0:attempt:1")
+        }
+
         fn requested(id: &str) -> AgentEvent {
             AgentEvent::single_agent(AgentEventPayload::ToolRequested {
                 tool_call_id: ToolCallId::new(id),
@@ -775,10 +781,11 @@ mod tests {
         /// scope, and its tool events must not reach the run as the run's own.
         #[tokio::test]
         async fn only_the_run_s_own_stream_sends_it_tool_events() {
-            let (run, mut events) = RunContext::channel("req_1");
+            let id = RequestId::generate();
+            let (run, mut events) = RunContext::channel(id.clone());
             with_run(run, async {
-                emit_from_stream("req_1:task:0:attempt:1", requested("worker")).await;
-                emit_from_stream("req_1", requested("own")).await;
+                emit_from_stream(&attempt_key(&id), requested("worker")).await;
+                emit_from_stream(id.as_str(), requested("own")).await;
             })
             .await;
 
@@ -796,19 +803,18 @@ mod tests {
 
         #[tokio::test]
         async fn the_run_s_own_stream_owns_the_queue() {
-            let run = RunContext::detached("req_1");
-            let owned = with_run(run, async { queue_owner("req_1").is_some() }).await;
+            let id = RequestId::generate();
+            let run = RunContext::detached(id.clone());
+            let owned = with_run(run, async { queue_owner(id.as_str()).is_some() }).await;
             assert!(owned);
         }
 
         /// An orchestration worker streams under its task attempt.
         #[tokio::test]
         async fn a_worker_s_stream_owns_no_queue() {
-            let run = RunContext::detached("req_1");
-            let owned = with_run(run, async {
-                queue_owner("req_1:task:0:attempt:1").is_some()
-            })
-            .await;
+            let id = RequestId::generate();
+            let run = RunContext::detached(id.clone());
+            let owned = with_run(run, async { queue_owner(&attempt_key(&id)).is_some() }).await;
             assert!(
                 !owned,
                 "a stream that is not the run leaves its queue alone"

From 575bc5abeea0165aaa23ea5beebac0533aa1adcc Mon Sep 17 00:00:00 2001
From: Jacob Hull <jacob@planethull.com>
Date: Tue, 6 Oct 2026 12:26:09 -0700
Subject: [PATCH 2/5] refactor(streaming): key a hook by the stream it serves

StreamingRequestHook takes a StreamKey, either the run's own stream
(Run(RequestId)) or an orchestration task attempt (Attempt). Only a Run
stream owns the run's tool-call queue and sends it tool events, and only
an Attempt has a park cell. Both rules were string comparisons that held
because an attempt key never equals a request id.

Signed-off-by: Jacob Hull <jacob@planethull.com>
---
 crates/aura/src/builder.rs                    |  29 ++--
 crates/aura/src/lib.rs                        |   2 +-
 crates/aura/src/orchestration/orchestrator.rs |   4 +-
 crates/aura/src/orchestration/test_rig.rs     |   4 +-
 crates/aura/src/provider_agent.rs             |  12 +-
 crates/aura/src/streaming_request_hook.rs     | 164 +++++++++++-------
 6 files changed, 136 insertions(+), 79 deletions(-)

diff --git a/crates/aura/src/builder.rs b/crates/aura/src/builder.rs
index d3eb02a4e..89567fbc2 100644
--- a/crates/aura/src/builder.rs
+++ b/crates/aura/src/builder.rs
@@ -1446,7 +1446,7 @@ impl Agent {
     /// # Arguments
     /// * `query` - The user query
     /// * `options` - How the run is bounded and cancelled
-    /// * `request_id` - Unique request ID for MCP tool cancellation context
+    /// * `stream` - Which stream this is: the run itself or a task attempt in it
     ///
     /// # Cancellation
     /// The StreamingRequestHook checks for cancellation at key points during streaming:
@@ -1461,7 +1461,7 @@ impl Agent {
         &self,
         query: &str,
         options: crate::streaming::RunOptions,
-        request_id: &str,
+        stream: crate::StreamKey,
     ) -> crate::streaming::AgentRun {
         self.seed_scratchpad_request_input(query, &[]);
         self.inner
@@ -1469,7 +1469,7 @@ impl Agent {
                 query,
                 self.max_depth,
                 options,
-                request_id,
+                stream,
                 self.scratchpad_budget.clone(),
                 self.client_tool_names.clone(),
             )
@@ -1487,7 +1487,7 @@ impl Agent {
     /// * `query` - The user query
     /// * `chat_history` - Previous conversation messages
     /// * `options` - How the run is bounded and cancelled
-    /// * `request_id` - Unique request ID for MCP tool cancellation context
+    /// * `stream` - Which stream this is: the run itself or a task attempt in it
     ///
     ///
     /// # Cancellation
@@ -1497,7 +1497,7 @@ impl Agent {
         query: &str,
         chat_history: Vec<rig::completion::Message>,
         options: crate::streaming::RunOptions,
-        request_id: &str,
+        stream: crate::StreamKey,
     ) -> crate::streaming::AgentRun {
         self.seed_scratchpad_request_input(query, &chat_history);
         self.inner
@@ -1506,7 +1506,7 @@ impl Agent {
                 chat_history,
                 self.max_depth,
                 options,
-                request_id,
+                stream,
                 self.scratchpad_budget.clone(),
                 self.client_tool_names.clone(),
             )
@@ -1733,11 +1733,20 @@ impl StreamingAgent for Agent {
         }
 
         let started = if chat_history.is_empty() {
-            self.stream_prompt_with_timeout(query, options, request_id.as_str())
-                .await
+            self.stream_prompt_with_timeout(
+                query,
+                options,
+                crate::StreamKey::Run(request_id.clone()),
+            )
+            .await
         } else {
-            self.stream_chat_with_timeout(query, chat_history, options, request_id.as_str())
-                .await
+            self.stream_chat_with_timeout(
+                query,
+                chat_history,
+                options,
+                crate::StreamKey::Run(request_id.clone()),
+            )
+            .await
         };
 
         started
diff --git a/crates/aura/src/lib.rs b/crates/aura/src/lib.rs
index dc1667590..fe9d3212f 100644
--- a/crates/aura/src/lib.rs
+++ b/crates/aura/src/lib.rs
@@ -107,7 +107,7 @@ pub use stream_events::{
     AgentContext, AuraStreamEvent, CorrelationContext, CorrelationContextExt, WorkerPhase,
     format_named_sse,
 };
-pub use streaming_request_hook::{ResponseContent, StreamingRequestHook, UsageState};
+pub use streaming_request_hook::{ResponseContent, StreamKey, StreamingRequestHook, UsageState};
 pub use tool_call_observer::{RetryHint, ToolCallObserver, ToolEvent, ToolOutcome};
 pub use tool_error_detection::{DetectedToolError, ToolResultStatus, detect_tool_error};
 pub use tool_wrapper::{
diff --git a/crates/aura/src/orchestration/orchestrator.rs b/crates/aura/src/orchestration/orchestrator.rs
index 0ed47bf3c..fd122718c 100644
--- a/crates/aura/src/orchestration/orchestrator.rs
+++ b/crates/aura/src/orchestration/orchestrator.rs
@@ -1467,7 +1467,7 @@ impl Orchestrator {
                         prompt,
                         history,
                         crate::streaming::RunOptions::default(),
-                        key,
+                        crate::StreamKey::Attempt(key.to_string()),
                     )
                     .await
                     .into_events(),
@@ -4054,7 +4054,7 @@ Assign tasks to the worker whose tools best match the required operations."#,
                 continuation.history.clone(),
                 worker.max_depth,
                 crate::streaming::RunOptions::default(),
-                &park.key,
+                crate::StreamKey::Attempt(park.key.clone()),
                 worker.scratchpad_budget.clone(),
                 worker.client_tool_names.clone(),
             )
diff --git a/crates/aura/src/orchestration/test_rig.rs b/crates/aura/src/orchestration/test_rig.rs
index 870e01c3c..c7d0c98e8 100644
--- a/crates/aura/src/orchestration/test_rig.rs
+++ b/crates/aura/src/orchestration/test_rig.rs
@@ -621,10 +621,10 @@ pub(crate) async fn drive_worker(
     history: Vec<rig::completion::Message>,
     max_depth: usize,
 ) -> Result<StreamRun, Box<dyn std::error::Error + Send + Sync>> {
-    let request_id = format!("rig_{}", uuid::Uuid::new_v4().simple());
+    let stream = crate::StreamKey::Attempt(format!("rig_{}", uuid::Uuid::new_v4().simple()));
     let (hook, cancel, usage_state) = StreamingRequestHook::with_scratchpad_budget(
         crate::streaming::RunOptions::bounded(Some(Duration::from_secs(60))),
-        request_id,
+        stream,
         None,
         HashSet::new(),
     );
diff --git a/crates/aura/src/provider_agent.rs b/crates/aura/src/provider_agent.rs
index 8cbabf127..6e9d23d8c 100644
--- a/crates/aura/src/provider_agent.rs
+++ b/crates/aura/src/provider_agent.rs
@@ -108,13 +108,13 @@ impl ProviderAgent {
         chat_history: Vec<rig::completion::Message>,
         max_depth: usize,
         options: crate::streaming::RunOptions,
-        request_id: &str,
+        stream: crate::StreamKey,
         scratchpad_budget: Option<ContextBudget>,
         client_tool_names: HashSet<String>,
     ) -> crate::streaming::AgentRun {
         let (hook, cancel_tx, usage_state) = StreamingRequestHook::with_scratchpad_budget(
             options,
-            request_id,
+            stream,
             scratchpad_budget,
             client_tool_names,
         );
@@ -319,13 +319,13 @@ impl ProviderAgent {
         query: &str,
         max_depth: usize,
         options: crate::streaming::RunOptions,
-        request_id: &str,
+        stream: crate::StreamKey,
         scratchpad_budget: Option<ContextBudget>,
         client_tool_names: HashSet<String>,
     ) -> crate::streaming::AgentRun {
         let (hook, cancel_tx, usage_state) = StreamingRequestHook::with_scratchpad_budget(
             options,
-            request_id,
+            stream,
             scratchpad_budget,
             client_tool_names,
         );
@@ -429,13 +429,13 @@ impl ProviderAgent {
         chat_history: Vec<rig::completion::Message>,
         max_depth: usize,
         options: crate::streaming::RunOptions,
-        request_id: &str,
+        stream: crate::StreamKey,
         scratchpad_budget: Option<ContextBudget>,
         client_tool_names: HashSet<String>,
     ) -> crate::streaming::AgentRun {
         let (hook, cancel_tx, usage_state) = StreamingRequestHook::with_scratchpad_budget(
             options,
-            request_id,
+            stream,
             scratchpad_budget,
             client_tool_names,
         );
diff --git a/crates/aura/src/streaming_request_hook.rs b/crates/aura/src/streaming_request_hook.rs
index 8c47ab4b1..51338fc8d 100644
--- a/crates/aura/src/streaming_request_hook.rs
+++ b/crates/aura/src/streaming_request_hook.rs
@@ -20,13 +20,13 @@
 //! # Park mode
 //!
 //! A worker stream in park mode has a [`BlockedCell`] registered under its
-//! request id; `on_completion_call` checks it before every other check.
+//! attempt key; `on_completion_call` checks it before every other check.
 //!
 //! # Usage
 //!
 //! ```ignore
 //! let options = RunOptions::bounded(Some(Duration::from_secs(60)));
-//! let (hook, cancel, usage_state) = StreamingRequestHook::new(options, "req_123");
+//! let (hook, cancel, usage_state) = StreamingRequestHook::new(options, StreamKey::Run(request_id));
 //!
 //! // Pass hook to streaming request
 //! agent.stream_prompt(query).with_hook(hook).multi_turn(depth).await;
@@ -38,6 +38,7 @@
 //! let (prompt, completion, total) = usage_state.get_final_usage();
 //! ```
 
+use crate::domain::RequestId;
 use crate::hooks::{AgentHook, ClientTools, Deadline, Hooks, RunCancelReason};
 use aura_events::agent::{AgentEvent, AgentEventPayload};
 use rig::agent::{CancelSignal, StreamingPromptHook};
@@ -65,10 +66,9 @@ const MAX_PENDING_TOOL_IDS: usize = 256;
 /// Cancel reason the hook stamps when a parked call ends the worker stream.
 pub(crate) const PARK_CANCEL_REASON: &str = "parked";
 
-/// Blocked cells of the worker streams in park mode, keyed by the per-stream
-/// id the orchestrator passes as the hook's `request_id`. The hook is built
-/// inside the streaming layer and cannot take the cell as a parameter, so it
-/// travels through this request-keyed global.
+/// Blocked cells of the worker streams in park mode, keyed by attempt key. The
+/// hook is built inside the streaming layer and cannot take the cell as a
+/// parameter, so it travels through this global.
 static PARK_CELLS: OnceLock<std::sync::RwLock<HashMap<String, Arc<BlockedCell>>>> = OnceLock::new();
 
 fn park_cells() -> &'static std::sync::RwLock<HashMap<String, Arc<BlockedCell>>> {
@@ -97,25 +97,54 @@ impl Drop for ParkCellRegistration {
     }
 }
 
+/// The stream a hook serves.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum StreamKey {
+    /// The run itself.
+    Run(RequestId),
+    /// One orchestration task attempt inside the run.
+    Attempt(String),
+}
+
+impl std::fmt::Display for StreamKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Run(request_id) => request_id.fmt(f),
+            Self::Attempt(key) => f.write_str(key),
+        }
+    }
+}
+
 /// The run whose tool-call queue and tool events this stream may use, which is
 /// the run only when the stream *is* the run.
 ///
 /// MCP reads the queue under the run id, its only identity, so a queue filled
 /// by some other stream of the same run would hand a tool call the id of a
-/// sibling's. An orchestration worker streams under a key of its own and so
-/// correlates nothing until #732. Its tool events stay off the run for the same
-/// reason, and orchestration reports the worker's calls itself.
-fn queue_owner(stream_id: &str) -> Option<Arc<crate::run_context::RunContext>> {
-    current_run().filter(|run| run.id().as_str() == stream_id)
+/// sibling's. An orchestration task attempt correlates nothing until #732. Its
+/// tool events stay off the run for the same reason, and orchestration reports
+/// the worker's calls itself.
+fn queue_owner(stream: &StreamKey) -> Option<Arc<crate::run_context::RunContext>> {
+    match stream {
+        StreamKey::Run(request_id) => current_run().filter(|run| run.id() == request_id),
+        StreamKey::Attempt(_) => None,
+    }
 }
 
 /// Sends a tool event raised by this stream to the run [`queue_owner`] gives it.
-async fn emit_from_stream(stream_id: &str, event: AgentEvent) {
-    if let Some(run) = queue_owner(stream_id) {
+async fn emit_from_stream(stream: &StreamKey, event: AgentEvent) {
+    if let Some(run) = queue_owner(stream) {
         let _ = run.emit(event).await;
     }
 }
 
+/// The blocked cell of a task attempt in park mode. Only attempts park.
+fn park_cell(stream: &StreamKey) -> Option<Arc<BlockedCell>> {
+    match stream {
+        StreamKey::Attempt(key) => park_cell_for(key),
+        StreamKey::Run(_) => None,
+    }
+}
+
 /// The blocked cell for `key`, if this stream is in park mode.
 pub(crate) fn park_cell_for(key: &str) -> Option<Arc<BlockedCell>> {
     park_cells()
@@ -378,8 +407,7 @@ impl ResponseContent {
 pub struct StreamingRequestHook {
     /// Everything watching this run.
     hooks: Hooks,
-    /// Request ID for event correlation
-    request_id: String,
+    stream: StreamKey,
     /// Shared usage state (returned separately for handler access)
     usage_state: UsageState,
     /// Optional per-agent scratchpad budget. When set, the hook feeds the
@@ -389,12 +417,12 @@ pub struct StreamingRequestHook {
 }
 
 impl StreamingRequestHook {
-    /// Create a new streaming request hook for one request.
+    /// Create a new streaming request hook for one stream.
     pub fn new(
         options: crate::streaming::RunOptions,
-        request_id: impl Into<String>,
+        stream: StreamKey,
     ) -> (Self, CancellationToken, UsageState) {
-        Self::with_scratchpad_budget(options, request_id, None, HashSet::new())
+        Self::with_scratchpad_budget(options, stream, None, HashSet::new())
     }
 
     /// Like `new`, but additionally wires a scratchpad `ContextBudget` so the
@@ -403,7 +431,7 @@ impl StreamingRequestHook {
     /// `StreamItem::TurnUsage`).
     pub fn with_scratchpad_budget(
         options: crate::streaming::RunOptions,
-        request_id: impl Into<String>,
+        stream: StreamKey,
         scratchpad_budget: Option<ContextBudget>,
         client_tool_names: HashSet<String>,
     ) -> (Self, CancellationToken, UsageState) {
@@ -415,7 +443,7 @@ impl StreamingRequestHook {
             hooks: Hooks::new()
                 .with(Arc::new(Deadline::new(timeout, cancel.clone())))
                 .with(Arc::new(ClientTools::new(client_tool_names))),
-            request_id: request_id.into(),
+            stream,
             usage_state: usage_state.clone(),
             scratchpad_budget,
         };
@@ -496,11 +524,11 @@ where
         async move {
             // Checked before the hooks: a waiting parked call must get its
             // snapshot whatever else is true.
-            if let Some(cell) = park_cell_for(&self.request_id)
+            if let Some(cell) = park_cell(&self.stream)
                 && cell.snapshot_if_pending(history, prompt)
             {
                 tracing::info!(
-                    request_id = %self.request_id,
+                    stream = %self.stream,
                     "Parked approval pending — cancelling stream (reason: {})",
                     PARK_CANCEL_REASON
                 );
@@ -553,7 +581,7 @@ where
         cancel_sig: CancelSignal,
     ) -> impl Future<Output = ()> + Send {
         let tool_name = tool_name.to_string();
-        let request_id = self.request_id.clone();
+        let stream = self.stream.clone();
         let tool_call_id = id;
         let args_str = args.to_string();
         // Scratchpad exploration tools are suppressed from the event surface
@@ -565,7 +593,7 @@ where
         let publish_event = Self::should_publish_tool_event(&tool_name);
         async move {
             // Stash the call id so the park arm can record it on the cell entry.
-            if let Some(cell) = park_cell_for(&request_id) {
+            if let Some(cell) = park_cell(&stream) {
                 cell.set_current_call_id(tool_call_id.clone());
             }
 
@@ -579,11 +607,11 @@ where
                 // Rig 0.28+ passes correct tool_call_id; register for event correlation
                 if let Some(id) = &tool_call_id {
                     let id = ToolCallId::new(id);
-                    if let Some(run) = queue_owner(&request_id) {
+                    if let Some(run) = queue_owner(&stream) {
                         run.push_tool_call(id.clone());
                     }
                     emit_from_stream(
-                        &request_id,
+                        &stream,
                         AgentEvent::single_agent(AgentEventPayload::ToolRequested {
                             tool_call_id: id,
                             tool_name: ToolName::new(&tool_name),
@@ -593,17 +621,17 @@ where
                     .await;
                 } else {
                     tracing::warn!(
-                        "Tool '{}' called without tool_call_id for request '{}' - event correlation unavailable",
+                        "Tool '{}' called without tool_call_id for stream '{}' - event correlation unavailable",
                         tool_name,
-                        request_id
+                        stream
                     );
                 }
             }
 
             tracing::debug!(
-                "Tool '{}' requested for request '{}' (tool_call_id: {:?})",
+                "Tool '{}' requested for stream '{}' (tool_call_id: {:?})",
                 tool_name,
-                request_id,
+                stream,
                 tool_call_id
             );
 
@@ -620,7 +648,7 @@ where
         cancel_sig: CancelSignal,
     ) -> impl Future<Output = ()> + Send {
         let tool_name = tool_name.to_string();
-        let request_id = self.request_id.clone();
+        let stream = self.stream.clone();
         let tool_call_id = id.clone();
         let had_tool_call_id = id.is_some();
         let usage_state = self.usage_state.clone();
@@ -641,14 +669,14 @@ where
                 // This maintains push/pop symmetry and prevents popping IDs belonging
                 // to other tool calls when a tool arrives without an ID.
                 if had_tool_call_id
-                    && let Some(run) = queue_owner(&request_id)
+                    && let Some(run) = queue_owner(&stream)
                     && run.pop_tool_call().is_none()
                 {
                     tracing::warn!(
-                        "Queue desync: pop returned None for tool '{}' on request '{}' \
+                        "Queue desync: pop returned None for tool '{}' on stream '{}' \
                          (possible duplicate on_tool_result or Rig version issue)",
                         tool_name,
-                        request_id
+                        stream
                     );
                 }
 
@@ -680,7 +708,7 @@ where
         M::StreamingResponse: GetTokenUsage,
     {
         let usage_state = self.usage_state.clone();
-        let request_id = self.request_id.clone();
+        let stream = self.stream.clone();
         let scratchpad_budget = self.scratchpad_budget.clone();
 
         // Extract usage if the response type supports it
@@ -724,7 +752,7 @@ where
                         tool_ids
                     );
                     emit_from_stream(
-                        &request_id,
+                        &stream,
                         AgentEvent::single_agent(AgentEventPayload::ToolUsage {
                             tool_call_ids: tool_ids,
                             usage: TokenUsage {
@@ -738,7 +766,7 @@ where
                 }
 
                 tracing::info!(
-                    request_id = %request_id,
+                    stream = %stream,
                     prompt_tokens = usage.input_tokens,
                     completion_tokens = usage.output_tokens,
                     total_tokens = usage.total_tokens,
@@ -758,15 +786,17 @@ mod tests {
     /// queue filled by another stream of the same run hands a tool call a
     /// sibling's id. Only the stream that *is* the run may fill it.
     mod queue_ownership {
-        use super::super::{emit_from_stream, queue_owner};
+        use super::super::{
+            BlockedCell, ParkCellRegistration, StreamKey, emit_from_stream, park_cell, queue_owner,
+        };
         use crate::domain::RequestId;
         use crate::run_context::{RunContext, with_run};
         use aura_events::agent::{AgentEvent, AgentEventPayload};
         use aura_events::{ToolCallId, ToolName};
+        use std::sync::Arc;
 
-        /// The key a park-mode worker's task attempt streams under.
-        fn attempt_key(id: &RequestId) -> String {
-            format!("{id}:task:0:attempt:1")
+        fn attempt() -> StreamKey {
+            StreamKey::Attempt("orchestrator:task:0:attempt:1".to_string())
         }
 
         fn requested(id: &str) -> AgentEvent {
@@ -784,8 +814,8 @@ mod tests {
             let id = RequestId::generate();
             let (run, mut events) = RunContext::channel(id.clone());
             with_run(run, async {
-                emit_from_stream(&attempt_key(&id), requested("worker")).await;
-                emit_from_stream(id.as_str(), requested("own")).await;
+                emit_from_stream(&attempt(), requested("worker")).await;
+                emit_from_stream(&StreamKey::Run(id), requested("own")).await;
             })
             .await;
 
@@ -805,25 +835,42 @@ mod tests {
         async fn the_run_s_own_stream_owns_the_queue() {
             let id = RequestId::generate();
             let run = RunContext::detached(id.clone());
-            let owned = with_run(run, async { queue_owner(id.as_str()).is_some() }).await;
+            let owned = with_run(run, async { queue_owner(&StreamKey::Run(id)).is_some() }).await;
             assert!(owned);
         }
 
         /// An orchestration worker streams under its task attempt.
         #[tokio::test]
         async fn a_worker_s_stream_owns_no_queue() {
-            let id = RequestId::generate();
-            let run = RunContext::detached(id.clone());
-            let owned = with_run(run, async { queue_owner(&attempt_key(&id)).is_some() }).await;
+            let run = RunContext::detached(RequestId::generate());
+            let owned = with_run(run, async { queue_owner(&attempt()).is_some() }).await;
             assert!(
                 !owned,
                 "a stream that is not the run leaves its queue alone"
             );
         }
 
+        #[tokio::test]
+        async fn a_stream_of_another_run_owns_no_queue() {
+            let run = RunContext::detached(RequestId::generate());
+            let other = StreamKey::Run(RequestId::generate());
+            let owned = with_run(run, async { queue_owner(&other).is_some() }).await;
+            assert!(!owned);
+        }
+
         #[tokio::test]
         async fn no_run_owns_nothing() {
-            assert!(queue_owner("req_1").is_none());
+            assert!(queue_owner(&StreamKey::Run(RequestId::generate())).is_none());
+        }
+
+        /// Park cells belong to task attempts, so a run's own stream finds none
+        /// even under a key spelled like its request id.
+        #[test]
+        fn a_run_s_own_stream_has_no_park_cell() {
+            let id = RequestId::generate();
+            let _registration =
+                ParkCellRegistration::new(id.as_str(), Arc::new(BlockedCell::default()));
+            assert!(park_cell(&StreamKey::Run(id)).is_none());
         }
     }
 
@@ -845,7 +892,7 @@ mod tests {
 
         let (hook, _cancel, _usage) = StreamingRequestHook::new(
             crate::streaming::RunOptions::bounded(Some(Duration::from_secs(300))),
-            "req_registered",
+            StreamKey::Run(RequestId::generate()),
         );
         assert!(
             hook.should_cancel().is_none(),
@@ -858,12 +905,13 @@ mod tests {
 
     #[test]
     fn test_streaming_request_hook_creation() {
+        let stream = StreamKey::Run(RequestId::generate());
         let (hook, _tx, _usage_state) = StreamingRequestHook::new(
             crate::streaming::RunOptions::bounded(Some(Duration::from_secs(60))),
-            "test_req_1",
+            stream.clone(),
         );
         assert!(hook.should_cancel().is_none());
-        assert_eq!(hook.request_id, "test_req_1");
+        assert_eq!(hook.stream, stream);
     }
 
     // ---------------------------------------------------------------------
@@ -904,7 +952,7 @@ mod tests {
     fn test_external_cancellation() {
         let (hook, cancel, _usage_state) = StreamingRequestHook::new(
             crate::streaming::RunOptions::bounded(Some(Duration::from_secs(60))),
-            "test_req_2",
+            StreamKey::Run(RequestId::generate()),
         );
         assert!(hook.should_cancel().is_none());
 
@@ -917,7 +965,7 @@ mod tests {
         // Create hook with very short timeout
         let (hook, _tx, _usage_state) = StreamingRequestHook::new(
             crate::streaming::RunOptions::bounded(Some(Duration::from_millis(1))),
-            "test_req_3",
+            StreamKey::Run(RequestId::generate()),
         );
 
         // Wait for timeout
@@ -929,7 +977,7 @@ mod tests {
     fn test_usage_state_creation() {
         let (_hook, _tx, usage_state) = StreamingRequestHook::new(
             crate::streaming::RunOptions::bounded(Some(Duration::from_secs(60))),
-            "test_req_4",
+            StreamKey::Run(RequestId::generate()),
         );
 
         // Initially all zeros
@@ -1058,7 +1106,7 @@ mod tests {
     fn test_usage_state_shared_between_clones() {
         let (_hook, _tx, usage_state) = StreamingRequestHook::new(
             crate::streaming::RunOptions::bounded(Some(Duration::from_secs(60))),
-            "test_req_5",
+            StreamKey::Run(RequestId::generate()),
         );
         let usage_state_clone = usage_state.clone();
 
@@ -1121,11 +1169,11 @@ mod tests {
     fn test_with_scratchpad_budget_none_matches_new() {
         let (hook_a, _, _) = StreamingRequestHook::new(
             crate::streaming::RunOptions::bounded(Some(Duration::from_secs(60))),
-            "req_a",
+            StreamKey::Run(RequestId::generate()),
         );
         let (hook_b, _, _) = StreamingRequestHook::with_scratchpad_budget(
             crate::streaming::RunOptions::bounded(Some(Duration::from_secs(60))),
-            "req_b",
+            StreamKey::Run(RequestId::generate()),
             None,
             HashSet::new(),
         );
@@ -1141,7 +1189,7 @@ mod tests {
         let budget = ContextBudget::new(128_000, 0.20, 0, counter);
         let (hook, _, _) = StreamingRequestHook::with_scratchpad_budget(
             crate::streaming::RunOptions::bounded(Some(Duration::from_secs(60))),
-            "req_with_budget",
+            StreamKey::Run(RequestId::generate()),
             Some(budget.clone()),
             HashSet::new(),
         );

From 5abaaa5eda02c7f446b815736f292e5892457411 Mon Sep 17 00:00:00 2001
From: Jacob Hull <jacob@planethull.com>
Date: Tue, 6 Oct 2026 14:14:44 -0700
Subject: [PATCH 3/5] refactor(hitl): own a live approval by its run's request

The HITL gate and RequestApprovalTool read the owner of a live approval
from the run they are bound to, whose id is the request id. They no
longer take a request id of their own. AgentRuntimeConfig.request_id is
removed, along with the request_id parameter of RigBuilder::build_agent,
build_streaming_agent_with_headers, and build_streaming_agent_with_tools
that only fed it.

Agent::stream_prompt_with_timeout and stream_chat_with_timeout build no
run, so approvals raised through them would have no owner. They are
crate-private, which leaves StreamingAgent::stream as the public way to
stream an agent.

The orchestrator parses its run's id once and holds it as a RunId,
along with its persistence's session id. The park guard, the worker
approval scope, and the sweep of a run's parked approvals all read them
there, so worker_scope is synchronous and create_worker builds its scope
through it.

An agent that streams with a request id now owns its approvals under
that id, including one built through AgentBuilder. A gate with no run
bound raises unowned approvals.

Signed-off-by: Jacob Hull <jacob@planethull.com>
---
 .../aura-web-server/src/a2a/agent_executor.rs |   1 -
 crates/aura-web-server/src/handlers.rs        |  10 +-
 crates/aura-web-server/src/slack/runner.rs    |   8 +-
 crates/aura/src/builder.rs                    |  41 +++---
 crates/aura/src/config.rs                     |   7 --
 crates/aura/src/hitl/decision.rs              |  14 +++
 crates/aura/src/hitl/gate.rs                  | 113 ++++++++++-------
 crates/aura/src/hitl/tool.rs                  |  23 +---
 crates/aura/src/orchestration/orchestrator.rs | 119 ++++++------------
 .../src/orchestration/persistence_wrapper.rs  |   1 -
 crates/aura/src/orchestration/test_rig.rs     |   1 -
 crates/aura/src/rig_builder.rs                |  15 +--
 12 files changed, 151 insertions(+), 202 deletions(-)

diff --git a/crates/aura-web-server/src/a2a/agent_executor.rs b/crates/aura-web-server/src/a2a/agent_executor.rs
index e4e1b6be9..e3a211a38 100644
--- a/crates/aura-web-server/src/a2a/agent_executor.rs
+++ b/crates/aura-web-server/src/a2a/agent_executor.rs
@@ -295,7 +295,6 @@ impl AgentExecutor for AuraAgentExecutor {
                     Some(&req_headers),
                     session_id,
                     None,
-                    Some(request_id.clone()),
                     run_tools,
                 )
                 .await
diff --git a/crates/aura-web-server/src/handlers.rs b/crates/aura-web-server/src/handlers.rs
index 7e79ecd70..849b29c70 100644
--- a/crates/aura-web-server/src/handlers.rs
+++ b/crates/aura-web-server/src/handlers.rs
@@ -176,7 +176,6 @@ async fn build_agent_for_request(
     req_headers: &HashMap<String, String>,
     additional_tools: Vec<Box<dyn aura::ToolDyn>>,
     client_tools: Option<&[ClientToolDefinition]>,
-    request_id: RequestId,
     session_id: String,
 ) -> Result<Arc<aura::Agent>, PrepareError> {
     let client_tool_defs =
@@ -186,7 +185,6 @@ async fn build_agent_for_request(
             Some(req_headers),
             additional_tools,
             client_tool_defs,
-            Some(request_id),
             Some(session_id),
         )
         .await
@@ -213,7 +211,7 @@ pub struct RequestSetup {
     /// emit `finish_reason: "tool_calls"` instead of `"stop"` when the LLM
     /// invokes a passthrough tool.
     pub has_client_tools: bool,
-    /// Request id (`req_…`) shared by the agent build and the completion stream.
+    /// The request's id.
     pub request_id: RequestId,
     /// OpenAI-compatible `user` field, for the `user.id` span attribute.
     pub user_id: Option<String>,
@@ -243,10 +241,6 @@ pub async fn prepare_request(
     // `finish_reason: "tool_calls"` when one fires.
     let has_client_tools = req.tools.is_some();
 
-    // Generate the request id up front so the agent build (single-agent or
-    // orchestration) shares one value with the completion stream. The HITL gate
-    // and approval events stamp this id; previously it was minted later in
-    // `build_completion_config`, after the agent was already built.
     let request_id = RequestId::generate();
 
     // Find the matching config: single-config passthrough > explicit model > DEFAULT_AGENT
@@ -323,7 +317,6 @@ pub async fn prepare_request(
                     Some(req_headers_map),
                     Some(chat_session_id.to_string()),
                     client_tools_vec.clone(),
-                    Some(request_id.clone()),
                     run_tools,
                 )
                 .await
@@ -351,7 +344,6 @@ pub async fn prepare_request(
                 req_headers_map,
                 additional_tools,
                 client_tools,
-                request_id.clone(),
                 chat_session_id.to_string(),
             )
             .await?;
diff --git a/crates/aura-web-server/src/slack/runner.rs b/crates/aura-web-server/src/slack/runner.rs
index 4e1cbf0b1..c07641204 100644
--- a/crates/aura-web-server/src/slack/runner.rs
+++ b/crates/aura-web-server/src/slack/runner.rs
@@ -359,13 +359,7 @@ impl SlackIngress {
         );
         let agent = RigBuilder::new(config, self.state.pending_approvals.clone())
             .with_hitl_hmac(self.state.hitl_webhook_hmac.clone())
-            .build_streaming_agent_with_tools(
-                None,
-                Some(session_id),
-                None,
-                Some(request_id.clone()),
-                tools,
-            )
+            .build_streaming_agent_with_tools(None, Some(session_id), None, tools)
             .await
             .map_err(|e| RunError::Build(e.to_string()))?;
 
diff --git a/crates/aura/src/builder.rs b/crates/aura/src/builder.rs
index 89567fbc2..1ea501938 100644
--- a/crates/aura/src/builder.rs
+++ b/crates/aura/src/builder.rs
@@ -332,12 +332,10 @@ impl Agent {
                     .clone()
                     .map(crate::config::SessionId::new),
             };
-            let request_id = config_owned.request_id.clone();
             let wrapper = Arc::new(crate::hitl::HitlApprovalWrapper::new(
                 hitl.patterns.clone(),
                 hitl.route.clone(),
                 scope.clone(),
-                request_id.clone(),
                 config_owned.agent.name.clone(),
                 config_owned.instance_id.clone(),
             ));
@@ -352,7 +350,6 @@ impl Agent {
             let approval_tool = crate::hitl::RequestApprovalTool::new(
                 hitl.route.clone(),
                 scope,
-                request_id,
                 config_owned.agent.name.clone(),
                 config_owned.instance_id.clone(),
             );
@@ -1218,7 +1215,8 @@ impl Agent {
 
     /// Process a query with the agent (no chat history).
     ///
-    /// Uses the streaming pipeline internally and collects the result.
+    /// Collects [`Self::stream_prompt`], which documents how its HITL
+    /// approvals are owned.
     #[tracing::instrument(name = "agent.prompt", skip(self), fields(model = %self.model))]
     pub async fn prompt(
         &self,
@@ -1243,7 +1241,8 @@ impl Agent {
 
     /// Process a chat query with conversation history.
     ///
-    /// Uses the streaming pipeline internally and collects the result.
+    /// Collects [`Self::stream_chat`], which documents how its HITL approvals
+    /// are owned.
     #[tracing::instrument(name = "agent.chat", skip(self, chat_history), fields(model = %self.model, history_len = chat_history.len()))]
     pub async fn chat(
         &self,
@@ -1324,6 +1323,9 @@ impl Agent {
     }
 
     /// Stream a query with the agent (no chat history) - returns true streaming response with multi-turn tool support
+    ///
+    /// Starts no run, so HITL approvals raised here have no owner and their
+    /// events reach no observer. [`StreamingAgent::stream`] starts one.
     pub async fn stream_prompt(
         &self,
         query: &str,
@@ -1333,6 +1335,9 @@ impl Agent {
     }
 
     /// Stream a chat query with conversation history - returns true streaming response with multi-turn tool support
+    ///
+    /// Starts no run, so HITL approvals raised here have no owner and their
+    /// events reach no observer. [`StreamingAgent::stream`] starts one.
     pub async fn stream_chat(
         &self,
         query: &str,
@@ -1349,6 +1354,9 @@ impl Agent {
     ///
     /// Unlike `stream_chat()` which uses `self.max_depth`, this allows callers
     /// to specify depth. Used by orchestration phases that need tighter bounds.
+    ///
+    /// Starts no run, so HITL approvals raised here have no owner and their
+    /// events reach no observer. [`StreamingAgent::stream`] starts one.
     #[tracing::instrument(name = "agent.stream_chat", skip(self, chat_history),
         fields(model = %self.model, history_len = chat_history.len(), max_depth))]
     pub async fn stream_chat_with_depth(
@@ -1457,7 +1465,7 @@ impl Agent {
     /// - After each streaming completion (captures usage, emits aura.tool_usage)
     ///
     /// To cancel externally (e.g., on client disconnect), cancel the run's token.
-    pub async fn stream_prompt_with_timeout(
+    pub(crate) async fn stream_prompt_with_timeout(
         &self,
         query: &str,
         options: crate::streaming::RunOptions,
@@ -1492,7 +1500,7 @@ impl Agent {
     ///
     /// # Cancellation
     /// See `stream_prompt_with_timeout` for cancellation details.
-    pub async fn stream_chat_with_timeout(
+    pub(crate) async fn stream_chat_with_timeout(
         &self,
         query: &str,
         chat_history: Vec<rig::completion::Message>,
@@ -2280,7 +2288,6 @@ mod tests {
         /// because rig calls the tool on its server task and no scope reaches
         /// there.
         fn gated_config(
-            request_id: &crate::domain::RequestId,
             pattern: &str,
             run: Arc<crate::run_context::RunContext>,
         ) -> AgentRuntimeConfig {
@@ -2291,7 +2298,6 @@ mod tests {
                     timeout: Duration::from_millis(50),
                 }),
                 AgentScope::Single { session_id: None },
-                Some(request_id.to_owned()),
                 "test-agent".to_owned(),
                 "test-instance-id".to_owned(),
             );
@@ -2304,13 +2310,12 @@ mod tests {
 
         async fn compose_gated_agent(
             server: &RecordingMcpServer,
-            request_id: &crate::domain::RequestId,
             pattern: &str,
             namespace: &str,
             tool: &str,
             run: Arc<crate::run_context::RunContext>,
         ) -> rig::agent::Agent<UnpromptedModel> {
-            let config = gated_config(request_id, pattern, run);
+            let config = gated_config(pattern, run);
             let manager = Some(Arc::new(manager_serving(server, namespace, tool).await));
             let state = BuilderState::Initial(rig::agent::AgentBuilder::new(UnpromptedModel));
             Agent::add_all_tools(state, &config, &manager, Vec::new())
@@ -2327,15 +2332,7 @@ mod tests {
             let request_id = crate::domain::RequestId::generate();
             let server = RecordingMcpServer::start().await;
             let (run, mut rx) = crate::run_context::RunContext::channel(request_id.clone());
-            let agent = compose_gated_agent(
-                &server,
-                &request_id,
-                "github:*",
-                "github",
-                "list_repos",
-                run,
-            )
-            .await;
+            let agent = compose_gated_agent(&server, "github:*", "github", "list_repos", run).await;
 
             // The parked approval expires unanswered; the call's own outcome is
             // not what this test is about.
@@ -2367,9 +2364,7 @@ mod tests {
             let request_id = crate::domain::RequestId::generate();
             let server = RecordingMcpServer::start().await;
             let (run, mut rx) = crate::run_context::RunContext::channel(request_id.clone());
-            let agent =
-                compose_gated_agent(&server, &request_id, "github:*", "k8s", "list_repos", run)
-                    .await;
+            let agent = compose_gated_agent(&server, "github:*", "k8s", "list_repos", run).await;
 
             agent
                 .tool_server_handle
diff --git a/crates/aura/src/config.rs b/crates/aura/src/config.rs
index d0658ff0f..fbcd345ce 100644
--- a/crates/aura/src/config.rs
+++ b/crates/aura/src/config.rs
@@ -135,11 +135,6 @@ pub struct AgentRuntimeConfig {
     /// `None` disables approval gating.
     pub hitl: Option<HitlRuntime>,
 
-    /// Request id (`req_…`) for this build, used to stamp HITL approval requests
-    /// and route their SSE events. Threaded from the web server so the
-    /// single-agent and orchestration paths share one value.
-    pub request_id: Option<crate::domain::RequestId>,
-
     /// Computed instance UUID for this agent, derived from agent config and
     /// host identity. Threaded into HITL approval requests so webhook
     /// receivers can identify which instance raised each approval.
@@ -180,7 +175,6 @@ impl Clone for AgentRuntimeConfig {
             turn_nudge: self.turn_nudge.clone(),
             orchestration_submit_result: self.orchestration_submit_result.clone(),
             hitl: self.hitl.clone(),
-            request_id: self.request_id.clone(),
             instance_id: self.instance_id.clone(),
             hitl_request_approval_tool: self.hitl_request_approval_tool.clone(),
             skill_recorder: self.skill_recorder.clone(),
@@ -225,7 +219,6 @@ impl std::fmt::Debug for AgentRuntimeConfig {
                     .map(|_| "<submit_result>"),
             )
             .field("hitl", &self.hitl.as_ref().map(|_| "<hitl>"))
-            .field("request_id", &self.request_id)
             .field("instance_id", &self.instance_id)
             .field(
                 "hitl_request_approval_tool",
diff --git a/crates/aura/src/hitl/decision.rs b/crates/aura/src/hitl/decision.rs
index 19ad5854d..70fe6b353 100644
--- a/crates/aura/src/hitl/decision.rs
+++ b/crates/aura/src/hitl/decision.rs
@@ -78,6 +78,20 @@ impl ApprovalOwner {
     }
 }
 
+/// The owner of an approval raised live in `run`, and the token its wait stops
+/// on.
+pub(crate) fn live_approval_context(
+    run: Option<&crate::run_context::RunContext>,
+) -> (ApprovalOwner, RequestCancelToken) {
+    match run {
+        Some(run) => (
+            ApprovalOwner::Request(run.id().clone()),
+            RequestCancelToken::from(run.cancel_token().clone()),
+        ),
+        None => (ApprovalOwner::Unowned, RequestCancelToken::unbound()),
+    }
+}
+
 impl fmt::Display for ApprovalOwner {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
diff --git a/crates/aura/src/hitl/gate.rs b/crates/aura/src/hitl/gate.rs
index 73a7fd590..2f73265eb 100644
--- a/crates/aura/src/hitl/gate.rs
+++ b/crates/aura/src/hitl/gate.rs
@@ -12,11 +12,12 @@ use aura_config::GlobPattern;
 use rig::tool::ToolError;
 use serde_json::Value;
 
-use super::decision::{AgentScope, ApprovalOrigin, ApprovalOutcome, ApprovalOwner, DecisionId};
+use super::decision::{
+    AgentScope, ApprovalOrigin, ApprovalOutcome, ApprovalOwner, DecisionId, live_approval_context,
+};
 use super::protocol::{ApprovalItem, ApprovalRequest, PROTOCOL_VERSION};
 use super::registry::{ParkedApproval, PendingApprovals};
 use super::route::{ApprovalError, DecisionRoute, GateDecision};
-use crate::domain::RequestId;
 use crate::orchestration::{BlockedCell, CallKey, ParkGuard, PendingCall, RecordedDecisions};
 use crate::tool_wrapper::{PreCallOutcome, ToolCallContext, ToolWrapper};
 
@@ -45,7 +46,6 @@ pub struct HitlApprovalWrapper {
     route: Arc<DecisionRoute>,
     /// Who this wrapper speaks for, stamped onto every request it raises.
     scope: AgentScope,
-    request_id: Option<RequestId>,
     /// The run whose observer sees this gate's approvals.
     run: crate::run_context::BoundRun,
     /// `[agent].name` of the config that built this agent.
@@ -67,7 +67,6 @@ impl HitlApprovalWrapper {
         patterns: Arc<[GlobPattern]>,
         route: Arc<DecisionRoute>,
         scope: AgentScope,
-        request_id: Option<RequestId>,
         agent_name: String,
         instance_id: String,
     ) -> Self {
@@ -75,7 +74,6 @@ impl HitlApprovalWrapper {
             patterns,
             route,
             scope,
-            request_id,
             // A worker's gate is built inside its run; a single agent's is
             // built before one exists and is bound by `stream`.
             run: crate::run_context::BoundRun::captured(),
@@ -102,10 +100,9 @@ impl HitlApprovalWrapper {
             Some(run) => {
                 run.emit(event).await;
             }
-            None => tracing::warn!(
-                request_id = ?self.request_id,
-                "no run bound to this gate; its approval reaches no observer"
-            ),
+            None => {
+                tracing::warn!("no run bound to this gate; its approval reaches no observer")
+            }
         }
     }
 
@@ -317,14 +314,13 @@ impl ToolWrapper for HitlApprovalWrapper {
         if let Some(park) = &self.park {
             return self.park_pre_call(park, matched, args, ctx).await;
         }
+        let run = self.run();
+        let (owner, cancel) = live_approval_context(run.as_deref());
         let request = ApprovalRequest {
             version: PROTOCOL_VERSION,
             instance_id: self.instance_id.clone(),
             decision_id: DecisionId::generate(),
-            owner: self
-                .request_id
-                .clone()
-                .map_or(ApprovalOwner::Unowned, ApprovalOwner::Request),
+            owner,
             scope: self.scope.clone(),
             origin: ApprovalOrigin::ConfigGate {
                 matched_pattern: matched.to_string(),
@@ -337,15 +333,9 @@ impl ToolWrapper for HitlApprovalWrapper {
                 tool_call_intent: ctx.tool_call_intent.clone(),
             }],
         };
-        let cancel = self
-            .run()
-            .map(|run| {
-                crate::request_cancellation::RequestCancelToken::from(run.cancel_token().clone())
-            })
-            .unwrap_or_else(crate::request_cancellation::RequestCancelToken::unbound);
         // `DecisionRoute` emits the lifecycle itself; the scope is how those
         // events find the run, since rig calls this off it.
-        let decision = match self.run() {
+        let decision = match run {
             Some(run) => {
                 crate::run_context::with_run(run, self.route.decide_for_gate(request, &cancel))
                     .await
@@ -402,7 +392,6 @@ mod tests {
                 timeout: Duration::from_secs(1),
             }),
             AgentScope::Single { session_id: None },
-            Some(crate::domain::RequestId::generate()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         );
@@ -426,7 +415,6 @@ mod tests {
                 timeout: Duration::from_secs(1),
             }),
             AgentScope::Single { session_id: None },
-            Some(crate::domain::RequestId::generate()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         );
@@ -464,7 +452,6 @@ mod tests {
                 timeout: Duration::from_secs(2),
             }),
             AgentScope::Single { session_id: None },
-            Some(crate::domain::RequestId::generate()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         );
@@ -560,14 +547,12 @@ mod tests {
         fn parked_gate(
             registry: &PendingApprovals,
             route: &Arc<DecisionRoute>,
-            request_id: &crate::domain::RequestId,
             cell: &Arc<crate::orchestration::BlockedCell>,
         ) -> HitlApprovalWrapper {
             HitlApprovalWrapper::new(
                 Arc::from(["kubectl_*".into()]),
                 route.clone(),
                 worker_scope(),
-                Some(request_id.clone()),
                 "test-agent".to_string(),
                 "test-instance".to_string(),
             )
@@ -592,7 +577,7 @@ mod tests {
             );
             let route = conv_route_over(registry.clone(), Duration::from_secs(60));
             let cell = Arc::new(crate::orchestration::BlockedCell::default());
-            let gate = parked_gate(&registry, &route, &request_id, &cell);
+            let gate = parked_gate(&registry, &route, &cell);
 
             let args = serde_json::json!({ "namespace": "prod" });
             let ctx = ToolCallContext::new("kubectl_apply");
@@ -630,7 +615,7 @@ mod tests {
             let route = conv_route_over(registry.clone(), Duration::from_secs(120));
             let cell = Arc::new(crate::orchestration::BlockedCell::default());
             cell.set_current_call_id(Some("call_7".to_string()));
-            let gate = parked_gate(&registry, &route, &request_id, &cell);
+            let gate = parked_gate(&registry, &route, &cell);
 
             let args = serde_json::json!({ "namespace": "prod" });
             let ctx = ToolCallContext::new("kubectl_apply");
@@ -698,12 +683,7 @@ mod tests {
         async fn two_gated_calls_append_two_cell_entries() {
             let (registry, route) = conv_route(Duration::from_secs(60));
             let cell = Arc::new(crate::orchestration::BlockedCell::default());
-            let gate = parked_gate(
-                &registry,
-                &route,
-                &crate::domain::RequestId::generate(),
-                &cell,
-            );
+            let gate = parked_gate(&registry, &route, &cell);
 
             let first = gate
                 .pre_call(
@@ -739,12 +719,7 @@ mod tests {
         async fn ungated_tool_proceeds_without_parking() {
             let (registry, route) = conv_route(Duration::from_secs(60));
             let cell = Arc::new(crate::orchestration::BlockedCell::default());
-            let gate = parked_gate(
-                &registry,
-                &route,
-                &crate::domain::RequestId::generate(),
-                &cell,
-            );
+            let gate = parked_gate(&registry, &route, &cell);
 
             let outcome = gate
                 .pre_call(&serde_json::json!({}), &ToolCallContext::new("ls"))
@@ -772,7 +747,6 @@ mod tests {
                 Arc::from(["kubectl_*".into()]),
                 route,
                 worker_scope(),
-                Some(crate::domain::RequestId::generate()),
                 "test-agent".to_string(),
                 "test-instance".to_string(),
             )
@@ -840,7 +814,6 @@ mod tests {
                 Arc::from(["kubectl_*".into()]),
                 route,
                 AgentScope::Single { session_id: None },
-                Some(crate::domain::RequestId::generate()),
                 "test-agent".to_string(),
                 "test-instance".to_string(),
             )
@@ -996,7 +969,6 @@ mod tests {
             Arc::from(["kubectl_*".into()]),
             route,
             AgentScope::Single { session_id: None },
-            Some(crate::domain::RequestId::generate()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         ));
@@ -1047,6 +1019,62 @@ mod tests {
         );
     }
 
+    /// A live approval belongs to the request whose run the gate serves, so
+    /// sweeping that request cancels it.
+    #[tokio::test]
+    async fn a_live_approval_is_owned_by_the_request_of_the_gate_s_run() {
+        let store = Arc::new(crate::session_store::InMemoryApprovalStore::new());
+        let registry = PendingApprovals::with_backend(
+            store.clone(),
+            Arc::new(crate::session_store::InMemoryEventBus::new()),
+        );
+        let gate = HitlApprovalWrapper::new(
+            Arc::from(["kubectl_*".into()]),
+            Arc::new(DecisionRoute::Conversational {
+                registry: registry.clone(),
+                timeout: Duration::from_secs(3_600),
+            }),
+            AgentScope::Single { session_id: None },
+            "test-agent".to_string(),
+            "test-instance-id".to_string(),
+        );
+        let request_id = crate::domain::RequestId::generate();
+        let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
+        gate.bind_run(run);
+
+        let call = tokio::spawn(async move {
+            let args = serde_json::json!({ "namespace": "prod" });
+            gate.pre_call(&args, &ToolCallContext::new("kubectl_apply"))
+                .await
+        });
+        let decision_id = match tokio::time::timeout(Duration::from_secs(5), events.recv())
+            .await
+            .expect("the gate raises the approval")
+            .expect("the run's channel stays open")
+            .payload
+        {
+            aura_events::agent::AgentEventPayload::ApprovalRequested(event) => {
+                DecisionId::parse(&event.decision_id).expect("valid decision id")
+            }
+            other => panic!("expected Requested, got {other:?}"),
+        };
+
+        let owner = ApprovalOwner::Request(request_id);
+        let parked = crate::session_store::ApprovalStore::get(&*store, &decision_id)
+            .await
+            .unwrap()
+            .expect("the approval is registered");
+        assert_eq!(parked.request.owner, owner);
+
+        registry.cancel_request(&owner).await;
+        let err = tokio::time::timeout(Duration::from_secs(5), call)
+            .await
+            .expect("sweeping the request releases the call")
+            .expect("the call task did not panic")
+            .expect_err("a cancelled approval fails the call closed");
+        assert!(err.to_string().contains("approval cancelled"), "got: {err}");
+    }
+
     #[test]
     fn approval_result_mapping_timeout_cancel_and_channel_fault_are_errors() {
         let timed_out = approval_result_to_pre_call(Ok(GateDecision::TimedOut {
@@ -1239,7 +1267,6 @@ mod tests {
                 Arc::from(["kubectl_*".into()]),
                 Arc::new(route),
                 AgentScope::Single { session_id: None },
-                Some(request_id.clone()),
                 "test-agent".to_string(),
                 "test-instance-id".to_string(),
             );
diff --git a/crates/aura/src/hitl/tool.rs b/crates/aura/src/hitl/tool.rs
index e217a5be8..4d9211446 100644
--- a/crates/aura/src/hitl/tool.rs
+++ b/crates/aura/src/hitl/tool.rs
@@ -14,11 +14,11 @@ use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
 use super::decision::{
-    AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOutcome, ApprovalOwner, DecisionId,
+    AgentScope, ApprovalDecision, ApprovalOrigin, ApprovalOutcome, DecisionId,
+    live_approval_context,
 };
 use super::protocol::{ApprovalItem, ApprovalRequest, PROTOCOL_VERSION};
 use super::route::{ApprovalError, DecisionRoute};
-use crate::domain::RequestId;
 
 /// The `request_approval` tool. Constructs an
 /// [`ApprovalOrigin::AgentRequested`] and dispatches through the shared
@@ -29,7 +29,6 @@ use crate::domain::RequestId;
 pub struct RequestApprovalTool {
     route: Arc<DecisionRoute>,
     scope: AgentScope,
-    request_id: Option<RequestId>,
     run: Arc<crate::run_context::BoundRun>,
     agent_name: String,
     /// Instance ID of the AURA process that built this tool.
@@ -41,14 +40,12 @@ impl RequestApprovalTool {
     pub fn new(
         route: Arc<DecisionRoute>,
         scope: AgentScope,
-        request_id: Option<RequestId>,
         agent_name: String,
         instance_id: String,
     ) -> Self {
         Self {
             route,
             scope,
-            request_id,
             // A worker's tool is built inside its run; a single agent's is built
             // before one exists and is bound by `stream`.
             run: Arc::new(crate::run_context::BoundRun::captured()),
@@ -163,14 +160,13 @@ impl Tool for RequestApprovalTool {
     async fn call(&self, args: Self::Args) -> Result<Self::Output, Self::Error> {
         // Blank reasoning collapses to absent, consistent with the config_gate path.
         let tool_call_intent = normalize_tool_call_intent(args.tool_call_intent.as_deref());
+        let run = self.run();
+        let (owner, cancel) = live_approval_context(run.as_deref());
         let request = ApprovalRequest {
             version: PROTOCOL_VERSION,
             instance_id: self.instance_id.clone(),
             decision_id: DecisionId::generate(),
-            owner: self
-                .request_id
-                .clone()
-                .map_or(ApprovalOwner::Unowned, ApprovalOwner::Request),
+            owner,
             scope: self.scope.clone(),
             origin: ApprovalOrigin::AgentRequested {
                 reason: args.risk_rationale.clone(),
@@ -183,13 +179,6 @@ impl Tool for RequestApprovalTool {
                 tool_call_intent,
             }],
         };
-        let run = self.run();
-        let cancel = run
-            .as_ref()
-            .map(|run| {
-                crate::request_cancellation::RequestCancelToken::from(run.cancel_token().clone())
-            })
-            .unwrap_or_else(crate::request_cancellation::RequestCancelToken::unbound);
         // `DecisionRoute` emits the lifecycle itself; the scope is how those
         // events find the run, since rig calls this off it.
         let decided = match run {
@@ -343,7 +332,6 @@ mod tests {
         let tool = RequestApprovalTool::new(
             route.clone(),
             AgentScope::Single { session_id: None },
-            Some(request_id.clone()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         );
@@ -510,7 +498,6 @@ mod tests {
             let tool = RequestApprovalTool::new(
                 route,
                 AgentScope::Single { session_id: None },
-                Some(request_id.clone()),
                 "test-agent".to_string(),
                 "test-instance-id".to_string(),
             );
diff --git a/crates/aura/src/orchestration/orchestrator.rs b/crates/aura/src/orchestration/orchestrator.rs
index fd122718c..db82bd668 100644
--- a/crates/aura/src/orchestration/orchestrator.rs
+++ b/crates/aura/src/orchestration/orchestrator.rs
@@ -423,6 +423,12 @@ pub struct Orchestrator {
     /// ID for the orchestrator
     orchestrator_id: String,
 
+    /// The run's id.
+    run_id: super::RunId,
+
+    /// The session the run belongs to.
+    session_id: Option<crate::config::SessionId>,
+
     /// Orchestration configuration
     config: OrchestrationConfig,
 
@@ -614,7 +620,15 @@ impl Orchestrator {
 
         let orchestrator_id = uuid::Uuid::new_v4().to_string();
 
-        let run_id_str = persistence.lock().await.run_id().to_string();
+        // Persistence's session, which a disabled persistence leaves `None`
+        // even when the config names one.
+        let (run_id_str, session_id) = {
+            let p = persistence.lock().await;
+            (
+                p.run_id().to_string(),
+                p.session_id().map(crate::config::SessionId::new),
+            )
+        };
         let run_id = run_id_str.parse::<super::RunId>().map_err(
             |e| -> Box<dyn std::error::Error + Send + Sync> {
                 format!("orchestration run id '{run_id_str}' is not a valid UUID: {e}").into()
@@ -646,6 +660,8 @@ impl Orchestrator {
 
         Ok(Self {
             orchestrator_id,
+            run_id,
+            session_id,
             config: orchestration_config,
             agent_config,
             tool_call_observer,
@@ -932,27 +948,11 @@ impl Orchestrator {
         // front-to-back. The gate only implements `pre_call`, so prepending it
         // leaves the documented `transform_output` ordering above untouched.
         if let Some(hitl) = worker_config.hitl.clone() {
-            let (run_id_str, session_id_owned) = {
-                let p = self.persistence.lock().await;
-                (p.run_id().to_string(), p.session_id().map(String::from))
-            };
-            let run_id = run_id_str.parse::<super::RunId>().map_err(
-                |e| -> Box<dyn std::error::Error + Send + Sync> {
-                    format!("HITL: orchestration run id '{run_id_str}' is not a valid UUID: {e}")
-                        .into()
-                },
-            )?;
-            let scope = crate::hitl::AgentScope::Worker {
-                run_id,
-                task: super::TaskIdentity::new(task_id, worker_name.map(String::from)),
-                session_id: session_id_owned.map(crate::config::SessionId::new),
-            };
-            let request_id = worker_config.request_id.clone();
+            let scope = self.worker_scope(task_id, worker_name);
             let mut gate = crate::hitl::HitlApprovalWrapper::new(
                 hitl.patterns.clone(),
                 hitl.route.clone(),
                 scope.clone(),
-                request_id.clone(),
                 worker_config.agent.name.clone(),
                 worker_config.instance_id.clone(),
             );
@@ -973,7 +973,6 @@ impl Orchestrator {
             worker_config.hitl_request_approval_tool = Some(crate::hitl::RequestApprovalTool::new(
                 hitl.route.clone(),
                 scope,
-                request_id,
                 worker_config.agent.name.clone(),
                 worker_config.instance_id.clone(),
             ));
@@ -1157,26 +1156,14 @@ impl Orchestrator {
         })
     }
 
-    /// The worker approval scope stamped on a task's approvals — the same
-    /// shape `create_worker` builds for the gate and the park guard's
-    /// cancellation events.
-    async fn worker_scope(
-        &self,
-        task_id: usize,
-        worker_name: Option<&str>,
-    ) -> Option<crate::hitl::AgentScope> {
-        let (run_id, session_id) = {
-            let p = self.persistence.lock().await;
-            (p.run_id().to_string(), p.session_id().map(String::from))
-        };
-        run_id
-            .parse::<super::RunId>()
-            .ok()
-            .map(|run_id| crate::hitl::AgentScope::Worker {
-                run_id,
-                task: super::TaskIdentity::new(task_id, worker_name.map(String::from)),
-                session_id: session_id.map(crate::config::SessionId::new),
-            })
+    /// The approval scope of a worker's task, stamped on its gate's approvals
+    /// and on their cancellation events.
+    fn worker_scope(&self, task_id: usize, worker_name: Option<&str>) -> crate::hitl::AgentScope {
+        crate::hitl::AgentScope::Worker {
+            run_id: self.run_id,
+            task: super::TaskIdentity::new(task_id, worker_name.map(String::from)),
+            session_id: self.session_id.clone(),
+        }
     }
 
     /// Orphan cleanup for a parked worker whose stream ended before the hook
@@ -1195,17 +1182,15 @@ impl Orchestrator {
         let crate::hitl::DecisionRoute::Conversational { registry, .. } = &*hitl.route else {
             return;
         };
-        let scope = self.worker_scope(task_id, worker_name).await;
+        let scope = self.worker_scope(task_id, worker_name);
         for call in pending {
             registry.remove(&call.decision_id).await;
-            if let Some(ref scope) = scope {
-                crate::run_context::emit(crate::hitl::completed_cancelled_event(
-                    call.decision_id,
-                    scope,
-                    Duration::ZERO,
-                ))
-                .await;
-            }
+            crate::run_context::emit(crate::hitl::completed_cancelled_event(
+                call.decision_id,
+                &scope,
+                Duration::ZERO,
+            ))
+            .await;
             tracing::warn!(
                 decision_id = %call.decision_id,
                 tool = %call.tool_name,
@@ -5252,7 +5237,7 @@ Assign tasks to the worker whose tools best match the required operations."#,
                 run_id = %run_id,
                 "park commit impossible: no memory_dir configured; cancelling approvals",
             );
-            self.cancel_run_parked_approvals(&run_id).await;
+            self.cancel_run_parked_approvals().await;
             return Err(format!(
                 "Run {run_id} parked but no memory_dir is configured, so no \
                  checkpoint can be written. The run's pending approvals were cancelled.",
@@ -5317,7 +5302,7 @@ Assign tasks to the worker whose tools best match the required operations."#,
                     error = %e,
                     "park commit failed; cancelling the run's approvals",
                 );
-                self.cancel_run_parked_approvals(&run_id).await;
+                self.cancel_run_parked_approvals().await;
                 Err(format!(
                     "Park commit failed for run {run_id}: {e}. The run's pending \
                      approvals were cancelled.",
@@ -5329,22 +5314,14 @@ Assign tasks to the worker whose tools best match the required operations."#,
 
     /// Sweep the run's parked approvals by owner id, so no decidable
     /// approval outlives a run that has no checkpoint.
-    async fn cancel_run_parked_approvals(&self, run_id: &str) {
+    async fn cancel_run_parked_approvals(&self) {
         let Some(hitl) = self.agent_config.hitl.clone() else {
             return;
         };
         let crate::hitl::DecisionRoute::Conversational { registry, .. } = &*hitl.route else {
             return;
         };
-        // Persistence mints run ids as UUIDs, so a parse failure is a bug.
-        let Ok(run_id) = run_id.parse::<super::RunId>() else {
-            tracing::error!(
-                run_id,
-                "orchestration run id is not a UUID; its parked approvals were not swept"
-            );
-            return;
-        };
-        super::park::cancel_run_approvals(registry, run_id, crate::run_context::current_run())
+        super::park::cancel_run_approvals(registry, self.run_id, crate::run_context::current_run())
             .await
             .ok();
     }
@@ -7576,7 +7553,6 @@ mod tests {
                 }),
                 park_enabled: true,
             }),
-            request_id: Some(request_id.clone()),
             ..AgentRuntimeConfig::default()
         };
         let orchestrator = Orchestrator::new(config).await.unwrap();
@@ -7694,7 +7670,6 @@ mod tests {
             }),
             memory_dir: Some(memory_dir.to_string_lossy().into_owned()),
             session_id: Some("park-sess".to_string()),
-            request_id: Some(crate::domain::RequestId::generate()),
             ..AgentRuntimeConfig::default()
         };
         let orchestrator = Orchestrator::new(config).await.unwrap();
@@ -7942,11 +7917,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let (orchestrator, store, registry, run_id) = park_orchestrator(dir.path()).await;
         let (plan, records, pending) = awaiting_plan_with_parked_calls(&registry, &run_id).await;
-        let request_id = orchestrator
-            .agent_config
-            .request_id
-            .clone()
-            .expect("the config names its request");
+        let request_id = crate::domain::RequestId::generate();
         let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
         // Arming inside the scope is what gives the guard the run its drop
         // sweep reports to.
@@ -8037,11 +8008,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let (orchestrator, store, registry, run_id) = park_orchestrator(dir.path()).await;
         let (plan, records, pending) = awaiting_plan_with_parked_calls(&registry, &run_id).await;
-        let request_id = orchestrator
-            .agent_config
-            .request_id
-            .clone()
-            .expect("the config names its request");
+        let request_id = crate::domain::RequestId::generate();
         let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
 
         // The human decides the first call before the commit is attempted.
@@ -8129,11 +8096,7 @@ mod tests {
         let (orchestrator, registry, run_id) =
             park_orchestrator_over(store.clone(), dir.path()).await;
         let (plan, records, pending) = awaiting_plan_with_parked_calls(&registry, &run_id).await;
-        let request_id = orchestrator
-            .agent_config
-            .request_id
-            .clone()
-            .expect("the config names its request");
+        let request_id = crate::domain::RequestId::generate();
         let (run, mut events) = crate::run_context::RunContext::channel(request_id.clone());
         crate::run_context::with_run(Arc::clone(&run), arm_guard(&orchestrator, &plan)).await;
 
@@ -8269,7 +8232,6 @@ mod tests {
             }),
             memory_dir: Some(memory_dir.to_string_lossy().into_owned()),
             session_id: Some("orphan-sess".to_string()),
-            request_id: Some(request_id.clone()),
             orchestration: Some(OrchestrationConfig {
                 enabled: true,
                 workers,
@@ -8560,7 +8522,6 @@ mod tests {
             }),
             memory_dir: Some(memory_dir.to_string_lossy().into_owned()),
             session_id: Some(session_id.to_string()),
-            request_id: Some(crate::domain::RequestId::generate()),
             orchestration: Some(OrchestrationConfig {
                 enabled: true,
                 workers,
diff --git a/crates/aura/src/orchestration/persistence_wrapper.rs b/crates/aura/src/orchestration/persistence_wrapper.rs
index cf7d4e0da..6181103db 100644
--- a/crates/aura/src/orchestration/persistence_wrapper.rs
+++ b/crates/aura/src/orchestration/persistence_wrapper.rs
@@ -1451,7 +1451,6 @@ mod tests {
             Arc::from(["kubectl_*".into()]),
             route,
             scope,
-            Some(request_id.clone()),
             "test-agent".to_string(),
             "test-instance-id".to_string(),
         ));
diff --git a/crates/aura/src/orchestration/test_rig.rs b/crates/aura/src/orchestration/test_rig.rs
index c7d0c98e8..e7d4c81fc 100644
--- a/crates/aura/src/orchestration/test_rig.rs
+++ b/crates/aura/src/orchestration/test_rig.rs
@@ -742,7 +742,6 @@ pub(crate) async fn park_orchestrator_in(
         }),
         memory_dir: Some(memory_dir.to_string_lossy().into_owned()),
         session_id: Some("park-sess".to_string()),
-        request_id: Some(crate::domain::RequestId::generate()),
         orchestration: Some(super::OrchestrationConfig {
             enabled: true,
             workers,
diff --git a/crates/aura/src/rig_builder.rs b/crates/aura/src/rig_builder.rs
index 95194d99c..f3a74764f 100644
--- a/crates/aura/src/rig_builder.rs
+++ b/crates/aura/src/rig_builder.rs
@@ -155,12 +155,10 @@ impl RigBuilder {
         req_headers: Option<&HashMap<String, String>>,
         additional_tools: Vec<Box<dyn rig::tool::ToolDyn>>,
         client_tools: Option<Vec<ClientTool>>,
-        request_id: Option<crate::domain::RequestId>,
         session_id: Option<String>,
     ) -> Result<Agent, BuilderError> {
         let mut agent_config = self.discovered_agent_config(req_headers)?;
         resolve_mcp_headers(&mut agent_config, req_headers);
-        agent_config.request_id = request_id;
         agent_config.session_id = session_id;
         agent_config.skill_recorder = self.skill_recorder.clone();
         Agent::new(&agent_config, additional_tools, client_tools)
@@ -183,16 +181,9 @@ impl RigBuilder {
         req_headers: Option<&HashMap<String, String>>,
         session_id: Option<String>,
         client_tools: Option<Vec<ClientTool>>,
-        request_id: Option<crate::domain::RequestId>,
     ) -> Result<Arc<dyn StreamingAgent>, BuilderError> {
-        self.build_streaming_agent_with_tools(
-            req_headers,
-            session_id,
-            client_tools,
-            request_id,
-            no_run_tools(),
-        )
-        .await
+        self.build_streaming_agent_with_tools(req_headers, session_id, client_tools, no_run_tools())
+            .await
     }
 
     /// [`Self::build_streaming_agent_with_headers`] plus `run_tools`: a
@@ -204,13 +195,11 @@ impl RigBuilder {
         req_headers: Option<&HashMap<String, String>>,
         session_id: Option<String>,
         client_tools: Option<Vec<ClientTool>>,
-        request_id: Option<crate::domain::RequestId>,
         run_tools: RunToolFactory,
     ) -> Result<Arc<dyn StreamingAgent>, BuilderError> {
         let mut agent_config = self.discovered_agent_config(req_headers)?;
         resolve_mcp_headers(&mut agent_config, req_headers);
         agent_config.session_id = session_id;
-        agent_config.request_id = request_id;
         agent_config.skill_recorder = self.skill_recorder.clone();
 
         build_streaming_agent_with_tools(&agent_config, client_tools, run_tools)

From 598095b8a75f15e832211daadba70cd8b746a9f5 Mon Sep 17 00:00:00 2001
From: Jacob Hull <jacob@planethull.com>
Date: Tue, 6 Oct 2026 13:42:24 -0700
Subject: [PATCH 4/5] fix(hitl): cancel a run's approvals when the run ends

A run cancels the approvals it raised, in the registry and the store,
when its event stream drops. AgentRun carries the sweep, and
Agent::stream and the orchestrator factory attach it whenever the HITL
route parks approvals in a registry.

Chat completions, A2A tasks, and Slack runs all stream through
StreamingAgent::stream, so each gets the cleanup. A2A tasks and Slack
runs previously left their approvals decidable until they expired. The
chat handler's RequestResourceGuard and CompletionConfig's
pending_approvals, which only fed it, are removed.

TaskCancelEntry drops its request_id, since cancel() derives it from the
task id.

Signed-off-by: Jacob Hull <jacob@planethull.com>
---
 .../aura-web-server/src/a2a/agent_executor.rs | 18 +---
 crates/aura-web-server/src/handlers.rs        | 46 ----------
 crates/aura/src/builder.rs                    |  4 +
 crates/aura/src/hitl/gate.rs                  |  4 +
 crates/aura/src/hitl/mod.rs                   |  1 +
 crates/aura/src/hitl/registry.rs              | 75 ++++++++++++++++
 crates/aura/src/hitl/route.rs                 |  8 ++
 crates/aura/src/orchestration/factory.rs      |  7 +-
 crates/aura/src/streaming.rs                  | 88 ++++++++++++++++++-
 9 files changed, 188 insertions(+), 63 deletions(-)

diff --git a/crates/aura-web-server/src/a2a/agent_executor.rs b/crates/aura-web-server/src/a2a/agent_executor.rs
index e3a211a38..f5ef2d215 100644
--- a/crates/aura-web-server/src/a2a/agent_executor.rs
+++ b/crates/aura-web-server/src/a2a/agent_executor.rs
@@ -46,7 +46,6 @@ pub struct AuraAgentExecutor {
 struct TaskCancelEntry {
     token: CancellationToken,
     agent: Option<Arc<dyn StreamingAgent>>,
-    request_id: RequestId,
 }
 
 /// Whether `cancel()` got to a task before the code asking.
@@ -270,7 +269,6 @@ impl AgentExecutor for AuraAgentExecutor {
             }));
 
             let request_id = RequestId::for_a2a_task(&task_id);
-
             // Registered before the agent build and history fetch, both of which
             // await, so a cancelTask during those has a token to cancel. Its
             // guard comes first, because those paths can return early.
@@ -284,7 +282,6 @@ impl AgentExecutor for AuraAgentExecutor {
                 TaskCancelEntry {
                     token: cancel_token.clone(),
                     agent: None,
-                    request_id: request_id.clone(),
                 },
             );
 
@@ -577,8 +574,10 @@ impl AgentExecutor for AuraAgentExecutor {
                 // orchestration mode (workers manage their own MCP cancellation).
                 // A run cancelled before its agent was built has no MCP calls yet.
                 if let Some(agent) = &entry.agent {
+                    // The task id determines the run's request id, so it is
+                    // rebuilt here rather than stored.
                     agent
-                        .cancel_and_close_mcp(&entry.request_id, "A2A cancelTask")
+                        .cancel_and_close_mcp(&RequestId::for_a2a_task(&task_id), "A2A cancelTask")
                         .await;
                 }
                 entry.token.cancel();
@@ -908,7 +907,6 @@ mod tests {
     #[test]
     fn dropping_the_cancel_guard_releases_the_entry() {
         let task_id = format!("t_{}", uuid::Uuid::new_v4());
-        let request_id = RequestId::for_a2a_task(&task_id);
         let state: Arc<TaskCancelState> = Arc::new(Mutex::new(HashMap::new()));
 
         let guard = TaskCancelGuard {
@@ -920,7 +918,6 @@ mod tests {
             TaskCancelEntry {
                 token: CancellationToken::new(),
                 agent: Some(Arc::new(MockAgent::pending())),
-                request_id: request_id.clone(),
             },
         );
         assert!(lock_cancel_state(&state).contains_key(&task_id));
@@ -942,7 +939,6 @@ mod tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: RequestId::for_a2a_task(&task_id),
                 },
             );
             (state, task_id)
@@ -1003,7 +999,6 @@ mod tests {
             TaskCancelEntry {
                 token: CancellationToken::new(),
                 agent: None,
-                request_id: RequestId::for_a2a_task("t"),
             },
         );
         lock_cancel_state(&state).remove("t");
@@ -1019,7 +1014,6 @@ mod tests {
     #[test]
     fn claiming_the_agent_reports_a_cancel_that_already_ran() {
         let task_id = format!("t_{}", uuid::Uuid::new_v4());
-        let request_id = RequestId::for_a2a_task(&task_id);
         let state: Arc<TaskCancelState> = Arc::new(Mutex::new(HashMap::new()));
         let agent: Arc<dyn StreamingAgent> = Arc::new(MockAgent::pending());
 
@@ -1028,7 +1022,6 @@ mod tests {
             TaskCancelEntry {
                 token: CancellationToken::new(),
                 agent: None,
-                request_id,
             },
         );
 
@@ -1050,7 +1043,6 @@ mod tests {
     #[test]
     fn an_early_return_before_the_run_releases_the_entry() {
         let task_id = format!("t_{}", uuid::Uuid::new_v4());
-        let request_id = RequestId::for_a2a_task(&task_id);
         let state: Arc<TaskCancelState> = Arc::new(Mutex::new(HashMap::new()));
 
         {
@@ -1063,7 +1055,6 @@ mod tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: request_id.clone(),
                 },
             );
             // The build fails here and the generator returns.
@@ -1318,7 +1309,6 @@ mod loom_tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: RequestId::for_a2a_task("t1"),
                 },
             );
 
@@ -1371,7 +1361,6 @@ mod loom_tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: RequestId::for_a2a_task("t1"),
                 },
             );
 
@@ -1422,7 +1411,6 @@ mod loom_tests {
                 TaskCancelEntry {
                     token: CancellationToken::new(),
                     agent: None,
-                    request_id: RequestId::for_a2a_task("t1"),
                 },
             );
 
diff --git a/crates/aura-web-server/src/handlers.rs b/crates/aura-web-server/src/handlers.rs
index 849b29c70..dc0906e35 100644
--- a/crates/aura-web-server/src/handlers.rs
+++ b/crates/aura-web-server/src/handlers.rs
@@ -1,6 +1,5 @@
 use a2a::VERSION;
 use aura::RigBuilder;
-use aura::hitl::ApprovalOwner;
 use aura::{RequestId, ResponseContent, StreamingAgent, UsageState};
 use aura_events::{AgentInfo, NativeToolOverview, ServerInfo};
 use axum::Json;
@@ -23,46 +22,6 @@ use crate::streaming::{
 };
 use crate::types::*;
 
-/// Guard over a request's pending approvals.
-struct RequestResourceGuard {
-    request_id: RequestId,
-    pending_approvals: aura::hitl::PendingApprovals,
-}
-
-impl RequestResourceGuard {
-    fn new(request_id: RequestId, pending_approvals: aura::hitl::PendingApprovals) -> Self {
-        Self {
-            request_id,
-            pending_approvals,
-        }
-    }
-}
-
-impl Drop for RequestResourceGuard {
-    /// Cancels the request's approvals, on panic as well as on return.
-    fn drop(&mut self) {
-        // Synchronous so parked awaits cancel even when the runtime is
-        // shutting down and the spawn below never polls.
-        let owner = ApprovalOwner::Request(self.request_id.clone());
-        self.pending_approvals.cancel_request_local(&owner);
-
-        // Use try_current to avoid panic during runtime shutdown
-        if let Ok(handle) = tokio::runtime::Handle::try_current() {
-            let pending_approvals = self.pending_approvals.clone();
-            // Instrument with the span current at drop so cleanup events
-            // stay parented to the request's trace.
-            let cleanup = tracing::Instrument::instrument(
-                async move {
-                    pending_approvals.cancel_request(&owner).await;
-                },
-                tracing::Span::current(),
-            );
-            handle.spawn(cleanup);
-        }
-        // If no runtime, cleanup is best-effort (server is shutting down anyway)
-    }
-}
-
 /// Framework-agnostic error returned by `prepare_request` and `build_agent_for_request`.
 /// The axum handler layer converts this to a `Response`; other consumers (e.g. the CLI)
 /// can convert it to their own error type without depending on axum.
@@ -125,7 +84,6 @@ pub struct CompletionConfig {
     pub query_for_otel: String,
     pub message_count: usize,
     pub response_content: ResponseContent,
-    pub pending_approvals: aura::hitl::PendingApprovals,
 }
 
 /// Determines how stream output reaches the client.
@@ -539,7 +497,6 @@ pub fn build_completion_config(
         query_for_otel: setup.query.clone(),
         message_count,
         response_content,
-        pending_approvals: data.pending_approvals.clone(),
     }
 }
 
@@ -555,9 +512,6 @@ pub async fn execute_completion(
 ) {
     let _active_guard = ActiveRequestGuard::new(config.active_requests.clone());
 
-    let _resource_guard =
-        RequestResourceGuard::new(config.request_id.clone(), config.pending_approvals.clone());
-
     let invocation_parameters = aura::logging::llm_invocation_parameters(&setup.config.agent.llm);
     let orchestration_enabled = setup.config.orchestration_enabled();
 
diff --git a/crates/aura/src/builder.rs b/crates/aura/src/builder.rs
index 1ea501938..4cf84a127 100644
--- a/crates/aura/src/builder.rs
+++ b/crates/aura/src/builder.rs
@@ -1757,6 +1757,10 @@ impl StreamingAgent for Agent {
             .await
         };
 
+        let started = match &self.hitl_gate {
+            Some(gate) => started.sweeping_approvals(gate.route(), request_id),
+            None => started,
+        };
         started
             .map_stream(move |stream| {
                 Box::pin(crate::run_context::scope_stream(
diff --git a/crates/aura/src/hitl/gate.rs b/crates/aura/src/hitl/gate.rs
index 2f73265eb..f3040544f 100644
--- a/crates/aura/src/hitl/gate.rs
+++ b/crates/aura/src/hitl/gate.rs
@@ -84,6 +84,10 @@ impl HitlApprovalWrapper {
         }
     }
 
+    pub(crate) fn route(&self) -> &DecisionRoute {
+        &self.route
+    }
+
     /// Names the run this gate's approvals belong to.
     pub fn bind_run(&self, run: Arc<crate::run_context::RunContext>) {
         self.run.bind(run);
diff --git a/crates/aura/src/hitl/mod.rs b/crates/aura/src/hitl/mod.rs
index 240fa1851..c77e83464 100644
--- a/crates/aura/src/hitl/mod.rs
+++ b/crates/aura/src/hitl/mod.rs
@@ -44,6 +44,7 @@ pub use decision::{
 pub(crate) use events::completed_cancelled_event;
 pub use gate::HitlApprovalWrapper;
 pub use protocol::{ApprovalDecisionWire, ApprovalItem, ApprovalRequest, PROTOCOL_VERSION};
+pub(crate) use registry::SweepApprovalsOnDrop;
 pub use registry::{ParkedApproval, PendingApprovals, ResolveError};
 pub use route::{
     ApprovalError, DecisionRoute, HitlRuntime, PlaintextWebhookUrlError, WebhookClient,
diff --git a/crates/aura/src/hitl/registry.rs b/crates/aura/src/hitl/registry.rs
index cc8c80608..c43c98760 100644
--- a/crates/aura/src/hitl/registry.rs
+++ b/crates/aura/src/hitl/registry.rs
@@ -274,6 +274,48 @@ impl PendingApprovals {
             }
         }
     }
+
+    /// A guard that cancels every approval parked under `owner` when it drops.
+    pub(crate) fn sweep_on_drop(&self, owner: ApprovalOwner) -> SweepApprovalsOnDrop {
+        SweepApprovalsOnDrop {
+            registry: self.clone(),
+            owner,
+        }
+    }
+}
+
+/// Guard over the approvals parked under one owner.
+#[must_use = "dropping the guard cancels the approvals at once"]
+pub(crate) struct SweepApprovalsOnDrop {
+    registry: PendingApprovals,
+    owner: ApprovalOwner,
+}
+
+impl Drop for SweepApprovalsOnDrop {
+    /// Cancels the approvals on panic as well as on return.
+    fn drop(&mut self) {
+        // Synchronous so parked awaits cancel even when the runtime is
+        // shutting down and the spawn below never polls.
+        self.registry.cancel_request_local(&self.owner);
+
+        // Use try_current to avoid panic during runtime shutdown
+        if let Ok(handle) = tokio::runtime::Handle::try_current() {
+            let registry = self.registry.clone();
+            let owner = self.owner.clone();
+            // Instrument with the span current at drop so cleanup events
+            // stay parented to the request's trace.
+            let cleanup = tracing::Instrument::instrument(
+                async move {
+                    // Repeats the local pass, which also cancels an approval
+                    // registered after the synchronous one above.
+                    registry.cancel_request(&owner).await;
+                },
+                tracing::Span::current(),
+            );
+            handle.spawn(cleanup);
+        }
+        // If no runtime, cleanup is best-effort (server is shutting down anyway)
+    }
 }
 
 impl Default for PendingApprovals {
@@ -549,6 +591,39 @@ mod tests {
         assert!(store.get(&id).await.unwrap().is_none());
     }
 
+    /// Dropping the guard cancels its owner's approvals in the registry and
+    /// the store, and leaves every other owner's alone.
+    #[tokio::test]
+    async fn a_dropped_sweep_guard_cancels_only_its_owner_s_approvals() {
+        let store: Arc<dyn ApprovalStore> = Arc::new(InMemoryApprovalStore::new());
+        let registry =
+            PendingApprovals::with_backend(store.clone(), Arc::new(InMemoryEventBus::new()));
+        let mine = test_request("req-mine");
+        let mine_id = mine.decision_id;
+        let theirs = test_request("req-theirs");
+        let theirs_id = theirs.decision_id;
+        let mine = registry.register(mine, Duration::from_secs(60)).await;
+        let _theirs = registry.register(theirs, Duration::from_secs(60)).await;
+
+        drop(registry.sweep_on_drop(owner("req-mine")));
+
+        assert_eq!(
+            mine.outcome(&RequestCancelToken::unbound()).await,
+            ApprovalOutcome::Cancelled(CancelReason::SenderDropped)
+        );
+        tokio::time::timeout(Duration::from_secs(5), async {
+            while store.get(&mine_id).await.unwrap().is_some() {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("the guard clears its owner's approval from the store");
+        assert!(
+            store.get(&theirs_id).await.unwrap().is_some(),
+            "another owner's approval stays"
+        );
+    }
+
     #[tokio::test(start_paused = true)]
     async fn cancel_request_drops_matching_entries() {
         let registry = PendingApprovals::new();
diff --git a/crates/aura/src/hitl/route.rs b/crates/aura/src/hitl/route.rs
index e0c77738f..fc63dbb83 100644
--- a/crates/aura/src/hitl/route.rs
+++ b/crates/aura/src/hitl/route.rs
@@ -257,6 +257,14 @@ async fn webhook_round_trip<T>(
 }
 
 impl DecisionRoute {
+    /// The registry approvals park in, which only the conversational route has.
+    pub(crate) fn registry(&self) -> Option<&PendingApprovals> {
+        match self {
+            Self::Conversational { registry, .. } => Some(registry),
+            Self::Webhook { .. } => None,
+        }
+    }
+
     /// Obtain a decision for a config-gated call, carrying any captured
     /// approver header overrides on the approved arm.
     ///
diff --git a/crates/aura/src/orchestration/factory.rs b/crates/aura/src/orchestration/factory.rs
index 65f1c6421..fa0d5ec29 100644
--- a/crates/aura/src/orchestration/factory.rs
+++ b/crates/aura/src/orchestration/factory.rs
@@ -260,7 +260,12 @@ impl StreamingAgent for OrchestratorFactory {
             stream,
         ));
 
-        crate::streaming::AgentRun::new(stream, cancel_token, usage_state).observed_by(run_events)
+        let run = crate::streaming::AgentRun::new(stream, cancel_token, usage_state)
+            .observed_by(run_events);
+        match &self.agent_config.hitl {
+            Some(hitl) => run.sweeping_approvals(&hitl.route, request_id),
+            None => run,
+        }
     }
 
     async fn cancel_and_close_mcp(
diff --git a/crates/aura/src/streaming.rs b/crates/aura/src/streaming.rs
index bfb226685..35b17749c 100644
--- a/crates/aura/src/streaming.rs
+++ b/crates/aura/src/streaming.rs
@@ -93,6 +93,7 @@ pub struct AgentRun {
     cancel: CancellationToken,
     usage: UsageState,
     guard: DropGuard,
+    approvals: Option<crate::hitl::SweepApprovalsOnDrop>,
 }
 
 impl AgentRun {
@@ -110,9 +111,24 @@ impl AgentRun {
             agent_events: None,
             cancel,
             usage,
+            approvals: None,
         }
     }
 
+    /// Cancels the approvals the run raises under `request_id` once its
+    /// events are dropped. A route with no registry parks nothing to cancel.
+    #[must_use]
+    pub(crate) fn sweeping_approvals(
+        mut self,
+        route: &crate::hitl::DecisionRoute,
+        request_id: &crate::domain::RequestId,
+    ) -> Self {
+        self.approvals = route.registry().map(|registry| {
+            registry.sweep_on_drop(crate::hitl::ApprovalOwner::Request(request_id.clone()))
+        });
+        self
+    }
+
     /// Hands the run's events to its observer. A run whose producers emit
     /// through [`crate::run_context::RunContext::emit`] pairs the sender it
     /// scopes with the receiver named here.
@@ -159,7 +175,7 @@ impl AgentRun {
         }
     }
 
-    /// Dropping the returned stream cancels the run.
+    /// Dropping the returned stream cancels the run and its approvals.
     ///
     /// A consumer that goes away without draining — an aborted task, a dropped
     /// stream — would otherwise leave the run spending provider turns nobody
@@ -169,6 +185,7 @@ impl AgentRun {
     pub fn into_events(self) -> BoxStream<'static, Result<StreamItem, StreamError>> {
         Box::pin(CancelOnDrop {
             _guard: self.guard,
+            _approvals: self.approvals,
             inner: self.events,
         })
     }
@@ -241,6 +258,7 @@ fn content_of(item: &StreamItem) -> Option<aura_events::agent::AgentEventPayload
 struct CancelOnDrop<S> {
     inner: S,
     _guard: DropGuard,
+    _approvals: Option<crate::hitl::SweepApprovalsOnDrop>,
 }
 
 impl<S: futures::Stream + Unpin> futures::Stream for CancelOnDrop<S> {
@@ -381,6 +399,74 @@ mod tests {
         assert!(cancel.is_cancelled());
     }
 
+    /// A run's approvals outlive the handle while its stream is held, and
+    /// dropping the stream cancels them in the registry and the store. Another
+    /// request's approvals stay.
+    #[tokio::test]
+    async fn dropping_a_run_s_stream_cancels_its_approvals() {
+        use crate::domain::RequestId;
+        use crate::hitl::{
+            AgentScope, ApprovalOrigin, ApprovalOutcome, ApprovalOwner, ApprovalRequest,
+            CancelReason, DecisionId, DecisionRoute, PROTOCOL_VERSION, PendingApprovals,
+        };
+        use crate::request_cancellation::RequestCancelToken;
+        use crate::session_store::{ApprovalStore, InMemoryApprovalStore, InMemoryEventBus};
+        use std::time::Duration;
+
+        fn request(request_id: RequestId) -> ApprovalRequest {
+            ApprovalRequest {
+                version: PROTOCOL_VERSION,
+                instance_id: "test-instance".to_string(),
+                decision_id: DecisionId::generate(),
+                owner: ApprovalOwner::Request(request_id),
+                scope: AgentScope::Single { session_id: None },
+                origin: ApprovalOrigin::ConfigGate {
+                    matched_pattern: "kubectl_*".to_string(),
+                    agent_name: "test-agent".to_string(),
+                },
+                items: vec![],
+            }
+        }
+
+        let store = Arc::new(InMemoryApprovalStore::new());
+        let registry = PendingApprovals::with_backend(
+            store.clone() as Arc<dyn ApprovalStore>,
+            Arc::new(InMemoryEventBus::new()),
+        );
+        let route = DecisionRoute::Conversational {
+            registry: registry.clone(),
+            timeout: Duration::from_secs(60),
+        };
+        let request_id = RequestId::generate();
+        let mine = request(request_id.clone());
+        let mine_id = mine.decision_id;
+        let theirs = request(RequestId::generate());
+        let theirs_id = theirs.decision_id;
+        let mine = registry.register(mine, Duration::from_secs(60)).await;
+        let _theirs = registry.register(theirs, Duration::from_secs(60)).await;
+
+        let (run, _cancel) = empty_run();
+        let events = run.sweeping_approvals(&route, &request_id).into_events();
+        assert!(
+            store.get(&mine_id).await.unwrap().is_some(),
+            "a held stream keeps the run's approvals"
+        );
+
+        drop(events);
+        assert_eq!(
+            mine.outcome(&RequestCancelToken::unbound()).await,
+            ApprovalOutcome::Cancelled(CancelReason::SenderDropped)
+        );
+        tokio::time::timeout(Duration::from_secs(5), async {
+            while store.get(&mine_id).await.unwrap().is_some() {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("the run's approval leaves the store");
+        assert!(store.get(&theirs_id).await.unwrap().is_some());
+    }
+
     /// An orchestration run is a spawned task feeding a channel. Dropping the
     /// stream stops that task, so a consumer that goes away does not leave it
     /// spending provider turns nobody reads.

From 4be9654d28881adb76f4eab36d46dfcc7de08e8f Mon Sep 17 00:00:00 2001
From: Jacob Hull <jacob@planethull.com>
Date: Tue, 6 Oct 2026 13:55:26 -0700
Subject: [PATCH 5/5] refactor(mcp): remove the unused per-request cancel
 helpers

Agent::cancel_mcp_requests had no callers, and it was the only caller of
McpManager::cancel_all_for_request, so both are removed. Every cancel
goes through cancel_and_close. McpClient::cancel_all_for_request is now
private to it.

Signed-off-by: Jacob Hull <jacob@planethull.com>
---
 crates/aura/src/builder.rs     | 24 -------------------
 crates/aura/src/mcp/client.rs  |  2 +-
 crates/aura/src/mcp/manager.rs | 44 ----------------------------------
 3 files changed, 1 insertion(+), 69 deletions(-)

diff --git a/crates/aura/src/builder.rs b/crates/aura/src/builder.rs
index 4cf84a127..3209fd128 100644
--- a/crates/aura/src/builder.rs
+++ b/crates/aura/src/builder.rs
@@ -1554,30 +1554,6 @@ impl Agent {
         (self.inner.provider_name(), &self.model)
     }
 
-    /// Cancel all in-flight MCP tool requests for a request.
-    ///
-    /// This sends `notifications/cancelled` to all MCP servers that have
-    /// in-flight requests, allowing them to abort long-running operations.
-    /// Call this when a client disconnects or request times out.
-    ///
-    /// # Arguments
-    /// * `request_id` - The request whose MCP calls should be cancelled
-    /// * `reason` - Reason for cancellation (e.g., "client disconnected", "timeout")
-    ///
-    /// # Returns
-    /// Total number of cancellation notifications sent
-    pub async fn cancel_mcp_requests(
-        &self,
-        request_id: &crate::domain::RequestId,
-        reason: &str,
-    ) -> usize {
-        if let Some(mcp_manager) = &self.mcp_manager {
-            mcp_manager.cancel_all_for_request(request_id, reason).await
-        } else {
-            0
-        }
-    }
-
     /// Cancel all in-flight MCP requests and forcefully close connections.
     ///
     /// This sends `notifications/cancelled` to all MCP servers and then
diff --git a/crates/aura/src/mcp/client.rs b/crates/aura/src/mcp/client.rs
index ee6e47d2e..e7544961d 100644
--- a/crates/aura/src/mcp/client.rs
+++ b/crates/aura/src/mcp/client.rs
@@ -988,7 +988,7 @@ impl McpClient {
     }
 
     /// Cancel all in-flight MCP requests for a request.
-    pub async fn cancel_all_for_request(&self, request_id: &RequestId, reason: &str) -> usize {
+    async fn cancel_all_for_request(&self, request_id: &RequestId, reason: &str) -> usize {
         let mcp_request_ids = self.in_flight.get_all(request_id).await;
 
         if mcp_request_ids.is_empty() {
diff --git a/crates/aura/src/mcp/manager.rs b/crates/aura/src/mcp/manager.rs
index 8709c9106..c51ca6d6d 100644
--- a/crates/aura/src/mcp/manager.rs
+++ b/crates/aura/src/mcp/manager.rs
@@ -738,50 +738,6 @@ impl McpManager {
         info!("  Total tools available: {}", total_tools);
     }
 
-    /// Cancel all in-flight MCP requests for a request.
-    pub async fn cancel_all_for_request(
-        &self,
-        request_id: &crate::domain::RequestId,
-        reason: &str,
-    ) -> usize {
-        let mut total_cancelled = 0;
-
-        for (server_name, client) in &self.streamable_clients {
-            let cancelled = client.cancel_all_for_request(request_id, reason).await;
-            if cancelled > 0 {
-                info!(
-                    "Cancelled {} request(s) on MCP server '{}' for request {}",
-                    cancelled, server_name, request_id
-                );
-            }
-            total_cancelled += cancelled;
-        }
-
-        for (server_name, client) in &self.sse_clients {
-            let cancelled = client.cancel_all_for_request(request_id, reason).await;
-            if cancelled > 0 {
-                info!(
-                    "Cancelled {} request(s) on SSE MCP server '{}' for request {}",
-                    cancelled, server_name, request_id
-                );
-            }
-            total_cancelled += cancelled;
-        }
-
-        for (server_name, client) in &self.stdio_clients {
-            let cancelled = client.cancel_all_for_request(request_id, reason).await;
-            if cancelled > 0 {
-                info!(
-                    "Cancelled {} request(s) on STDIO MCP server '{}' for request {}",
-                    cancelled, server_name, request_id
-                );
-            }
-            total_cancelled += cancelled;
-        }
-
-        total_cancelled
-    }
-
     /// Cancel in-flight requests and close all MCP client connections.
     /// After calling this, all MCP clients become unusable until reinitialized.
     pub async fn cancel_and_close_all(