New workflow instances store bd_* task keys, but chat still sends the old keys. Scope and document access now treat those aliases as the same task so a live instance no longer fails closed on an exact string miss.
Co-authored-by: Cursor <cursoragent@cursor.com>
Route run/edit/submit/review/approve to a single duty, drop full-doc
creator bypass, and keep view listing independent of stage narrowing.
Co-authored-by: Cursor <cursoragent@cursor.com>
GetLiveInstance remains active-only; access ABAC now uses
GetGoverningInstanceForAccess so completed/terminated PG rows are not
treated as unrestricted legacy projects, while brand-new projects without
instances stay open for creators.
Co-authored-by: Cursor <cursoragent@cursor.com>
