@gotcos/glasses-server 6.55.0 → 6.56.1

package/task-runtime/task_runtime.py

@@ -0,0 +1,380 @@
+#!/usr/bin/env python3
+"""Portable read-only task protocol candidate. No production dispatch or writes.
+
+Parser adapted from COS task_rows.py at MU snapshot 1dac83bd; see manifest.
+"""
+from __future__ import annotations
+import argparse
+import hashlib
+import json
+import os
+import re
+import stat
+import string
+import sys
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Optional
+
+PROTOCOL = "cos-control-task-read/1"
+VERSION = "0.1.0"
+MAX_BYTES = 8 * 1024 * 1024
+
+_MARKER_BODY = (
+    r"\[(?:run \d{4}-\d{2}-\d{2} \d{2}:\d{2}|agent running|"
+    r"agent #\d+ (?:done|failed)|agent failed|"
+    r"stage (?:planning|active|review))\]"
+)
+MARKER_RE = re.compile(r"\s*(?:" + _MARKER_BODY + r"\s*)+$")
+MARKER_ANYWHERE_RE = re.compile(_MARKER_BODY)
+# Workflow stage. An UNMARKED row is planning, so the 80 open rows need no
+# migration. Lives in the line, not a sidecar: the task id is a hash of the
+# description, so any id-keyed store orphans itself on the first text edit.
+# NOTE: the trailing \s* sits INSIDE the repeat group. The writer joins markers
+# with spaces (_rebuild_line), but the old regex allowed none between groups, so
+# "[run ...] [agent running]" stripped only the last one and silently dropped the
+# run time on every read. Pre-existing; stage makes that pairing the common case.
+# STAGE_RE only reads a value out of a blob MARKER_RE has already validated, so
+# its own alternation was a second, unreachable copy: mutating it changed nothing
+# under test BECAUSE MARKER_RE's `$`-anchored match rejects "[stage bogus]" first.
+# That is true of the READ path only. The WRITE path is gated separately by
+# STAGES below (task_write.set_stage) and by cos_api_bridge's own literal tuple,
+# so there are three stage vocabularies in this system, not one. Widening the set
+# means editing MARKER_RE, STAGES, and the bridge tuple together.
+STAGE_RE = re.compile(r"\[stage (\w+)\]")
+STAGES = ("planning", "active", "review")
+RUN_AT_RE = re.compile(r"\[run (\d{4}-\d{2}-\d{2} \d{2}:\d{2})\]")
+AGENT_NUM_RE = re.compile(r"\[agent #(\d+) (done|failed)\]")
+INBOX_RE = re.compile(r"^#{1,3}\s*INBOX\s*$", re.IGNORECASE)
+TODAY_RE = re.compile(r"^#{1,3}\s*TODAY\s+(\d{4}-\d{2}-\d{2})\s*$", re.IGNORECASE)
+DELEGATED_HEADING_RE = re.compile(r"^#{1,2}\s*Delegated\b", re.IGNORECASE)
+BOLD_OWNER_RE = re.compile(r"^\*\*(?P<body>(?!Owner:)[^*]+)\*\*:\s*")
+BRACKET_OWNER_RE = re.compile(r"^\[(?P<body>[^\]]+)\]\s+")
+CHECK_RE = re.compile(r"^- \[([ xX~])\]\s*(.*)$")
+PRIORITY_SECTIONS = frozenset(
+    {"inbox", "today", "urgent", "this_week", "backlog", "completed"}
+)
+
+
+@dataclass
+class TaskRow:
+    ref: str
+    id: str
+    domain: str
+    description: str
+    priority: str
+    is_checked: bool
+    archived: bool
+    line_number: int
+    source: Optional[str]
+    owner: Optional[str]
+    delegated: bool
+    needs_review: bool
+    thread: None
+    run_at: Optional[str]
+    agent_state: Optional[str]
+    agent_no: Optional[int]
+    section: str
+    section_day: Optional[str]
+    stage: Optional[str] = None
+    done_when: Optional[str] = None
+
+
+def split_source(line: str) -> tuple[str, Optional[str]]:
+    if "**Source:**" not in line:
+        return line.strip(), None
+    left, right = line.split("**Source:**", 1)
+    return left.strip().rstrip("—").strip(), right.strip()
+
+
+DONE_WHEN_LABEL = "**Done when:**"
+
+
+def split_done_when(text):
+    """Peel a **Done when:** segment off a description or source part.
+
+    Same convention as **Source:** so tasks.md stays readable by hand, and the
+    finish line travels with the row when the text is edited.
+    """
+    if not text or DONE_WHEN_LABEL not in text:
+        return text, None
+    left, right = text.split(DONE_WHEN_LABEL, 1)
+    return left.strip().rstrip("\u2014").strip(), (right.strip() or None)
+
+
+def strip_markers(text: str) -> tuple[str, dict]:
+    """Remove end-of-line agent/run markers. Returns (text, fields)."""
+    fields: dict = {"run_at": None, "agent_state": None, "agent_no": None, "stage": None}
+    if not text:
+        return text, fields
+    match = MARKER_RE.search(text)
+    if not match:
+        return text, fields
+    blob = match.group(0)
+    run = RUN_AT_RE.search(blob)
+    if run:
+        fields["run_at"] = run.group(1)
+    stage = STAGE_RE.search(blob)
+    if stage:
+        fields["stage"] = stage.group(1)
+    numbered = AGENT_NUM_RE.search(blob)
+    if numbered:
+        fields["agent_no"] = int(numbered.group(1))
+        fields["agent_state"] = numbered.group(2)
+    elif "[agent running]" in blob:
+        fields["agent_state"] = "running"
+    elif "[agent failed]" in blob:
+        fields["agent_state"] = "failed"
+    return text[: match.start()].rstrip(), fields
+
+
+def _merge_marker_fields(primary: dict, secondary: dict) -> dict:
+    out = dict(primary)
+    for key, value in secondary.items():
+        if value is not None:
+            out[key] = value
+    return out
+
+
+def classify_heading(stripped: str) -> tuple[Optional[str], Optional[str]]:
+    """Return (section, section_day) for a heading, else (None, None)."""
+    if not stripped.startswith("#"):
+        return None, None
+    inbox = INBOX_RE.match(stripped)
+    if inbox:
+        return "inbox", None
+    today = TODAY_RE.match(stripped)
+    if today:
+        return "today", today.group(1)
+    upper = stripped.upper()
+    if "🔴 URGENT" in stripped or "URGENT" in upper:
+        return "urgent", None
+    if "🟡 THIS WEEK" in stripped or "THIS WEEK" in upper:
+        return "this_week", None
+    if "🟢 BACKLOG" in stripped or "BACKLOG" in upper:
+        return "backlog", None
+    if "✅ COMPLETED" in stripped or "COMPLETED" in upper:
+        return "completed", None
+    return "other", None
+
+
+def _heading_depth(stripped: str) -> int:
+    i = 0
+    while i < len(stripped) and stripped[i] == "#":
+        i += 1
+    return i
+
+
+def parse_owner(text: str) -> tuple[Optional[str], str]:
+    bold = BOLD_OWNER_RE.match(text)
+    if bold:
+        return bold.group("body").strip(), text[bold.end():]
+    bracket = BRACKET_OWNER_RE.match(text)
+    if bracket:
+        return bracket.group("body").strip(), text[bracket.end():]
+    return None, text
+
+
+def owner_tokens(owner: str) -> list[str]:
+    return [part.strip() for part in re.split(r"\s*\+\s*|/", owner) if part.strip()]
+
+
+def owner_includes_operator(owner: Optional[str], operator: Optional[str]) -> bool:
+    if not owner or not operator:
+        return False
+    for token in owner_tokens(owner):
+        parts = token.split("(")[0].strip().split()
+        if parts and parts[0].casefold() == operator.casefold():
+            return True
+    return False
+
+
+def ends_delegated_zone(stripped: str) -> bool:
+    if stripped.startswith("---"):
+        return True
+    return stripped.startswith("#") and _heading_depth(stripped) <= 2
+
+
+def parse_text(text: str, domain: str, operator: Optional[str] = None) -> list[TaskRow]:
+    rows: list[TaskRow] = []
+    current_priority = "backlog"
+    current_section = "other"
+    current_day: Optional[str] = None
+    in_comment = False
+    delegated_zone = False
+    counter = 0
+
+    for line_number, line in enumerate(text.splitlines(), 1):
+        stripped = line.strip()
+        if "<!--" in stripped:
+            in_comment = True
+        if "-->" in stripped:
+            in_comment = False
+            continue
+        if in_comment:
+            continue
+
+        if ends_delegated_zone(stripped):
+            delegated_zone = False
+        if DELEGATED_HEADING_RE.match(stripped):
+            delegated_zone = True
+
+        heading, heading_day = classify_heading(stripped)
+        if heading is not None:
+            current_section = heading
+            if heading != "other":
+                current_priority = heading
+                current_day = heading_day
+            else:
+                current_day = None
+            continue
+
+        checked = CHECK_RE.match(line)
+        if not checked:
+            continue
+
+        mark, raw = checked.group(1), checked.group(2)
+        archived = mark == "~"
+        is_checked = mark.lower() == "x"
+        description, source = split_source(raw)
+        description, desc_markers = strip_markers(description)
+        if source is not None:
+            source, src_markers = strip_markers(source)
+            markers = _merge_marker_fields(desc_markers, src_markers)
+        else:
+            markers = desc_markers
+
+        description, dw_desc = split_done_when(description)
+        if source is not None:
+            source, dw_src = split_done_when(source)
+        else:
+            dw_src = None
+        done_when = dw_desc or dw_src
+
+        needs_review = "[REVIEW]" in description
+        if needs_review:
+            description = description.replace("[REVIEW]", "").strip()
+
+        owner, description = parse_owner(description)
+        description = description.strip()
+        delegated = delegated_zone or (
+            owner is not None and not owner_includes_operator(owner, operator)
+        )
+        priority = "completed" if is_checked else (
+            current_section if current_section in PRIORITY_SECTIONS
+            else current_priority
+        )
+        counter += 1
+        rows.append(TaskRow(
+            ref=f"{domain}-{counter}",
+            id="",
+            domain=domain,
+            description=description,
+            priority=priority,
+            is_checked=is_checked,
+            archived=archived,
+            line_number=line_number,
+            source=source,
+            owner=owner,
+            delegated=delegated,
+            needs_review=needs_review,
+            thread=None,
+            run_at=markers["run_at"],
+            agent_state=markers["agent_state"],
+            agent_no=markers["agent_no"],
+            section=current_section,
+            section_day=current_day if current_section == "today" else None,
+            stage=markers["stage"],
+            done_when=done_when,
+        ))
+
+    _assign_ids(domain, rows)
+    return rows
+
+
+def _assign_ids(domain: str, rows: list[TaskRow]) -> None:
+
+    seen: dict[str, int] = {}
+    for row in rows:
+        norm = normalize(row.description)
+        ordinal = seen.get(norm, 0)
+        seen[norm] = ordinal + 1
+        row.id = hashlib.sha256(
+            f"{domain}/tasks.md|{norm}|{ordinal}".encode()
+        ).hexdigest()[:12]
+
+
+def normalize(text: str) -> str:
+    text, _ = strip_markers(text)
+    return " ".join(text.lower().translate(str.maketrans("", "", string.punctuation)).split())
+
+
+def capabilities() -> dict:
+    return {"protocol": PROTOCOL, "version": VERSION, "commands": ["capabilities", "domains", "task-rows"],
+            "readOnly": True, "writes": False, "dispatch": False, "migration": False,
+            "identity": {"kind": "legacy-description-hash", "stable": False},
+            "limits": {"maxTaskFileBytes": MAX_BYTES}, "requiresPrivateCheckout": False}
+
+
+def read_domain(root_fd: int, domain: str) -> str:
+    if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{0,127}", domain):
+        raise ValueError("invalid_domain")
+    dfd = os.open(domain, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=root_fd)
+    try:
+        fd = os.open("tasks.md", os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=dfd)
+        try:
+            before = os.fstat(fd)
+            if not stat.S_ISREG(before.st_mode): raise ValueError("not_regular_file")
+            if before.st_size > MAX_BYTES: raise ValueError("task_file_too_large")
+            with os.fdopen(fd, "rb", closefd=False) as stream:
+                data = stream.read(MAX_BYTES + 1)
+            after = os.fstat(fd)
+            if len(data) > MAX_BYTES: raise ValueError("task_file_too_large")
+            if (before.st_size, before.st_mtime_ns) != (after.st_size, after.st_mtime_ns):
+                raise ValueError("source_changed_retry")
+            return data.decode("utf-8")
+        finally: os.close(fd)
+    finally: os.close(dfd)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("command", choices=["capabilities", "domains", "task-rows"])
+    parser.add_argument("--root")
+    parser.add_argument("--domain")
+    parser.add_argument("--operator", help="Optional first-name owner match; absence conservatively marks named owners delegated")
+    args = parser.parse_args()
+    try:
+        if args.command == "capabilities":
+            out = capabilities()
+        else:
+            if not args.root or not Path(args.root).is_absolute(): raise ValueError("absolute_root_required")
+            # Explicit root only. No env fallback, home discovery or private checkout.
+            root_fd = os.open(args.root, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+            try:
+                if args.command == "domains":
+                    domains = []
+                    for domain in sorted(os.listdir(root_fd)):
+                        if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{0,127}", domain): continue
+                        try: read_domain(root_fd, domain)
+                        except (OSError, ValueError, UnicodeError): continue
+                        domains.append(domain)
+                    out = {"protocol": PROTOCOL, "domains": domains}
+                else:
+                    if not args.domain: raise ValueError("domain_required")
+                    source = read_domain(root_fd, args.domain)
+                    out = {"protocol": PROTOCOL, "domain": args.domain,
+                           "sourceRevision": hashlib.sha256(source.encode("utf-8")).hexdigest(),
+                           "identity": capabilities()["identity"],
+                           "rows": [asdict(row) for row in parse_text(source, args.domain, args.operator)]}
+            finally: os.close(root_fd)
+        print(json.dumps(out, ensure_ascii=False))
+        return 0
+    except (OSError, ValueError, UnicodeError) as error:
+        code = str(error) if isinstance(error, ValueError) and not isinstance(error, UnicodeError) else "source_unavailable"
+        print(json.dumps({"protocol": PROTOCOL, "error": {"code": code}}))
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/work-task-runtime/cos_atomic.py

@@ -0,0 +1,90 @@
+"""Atomic file write helpers.
+
+All COS state files that use JSON/JSONL must write atomically: write to a
+temp sibling, then `os.replace` into place. A torn write (truncated file
+after an open-write-close that crashed mid-way) is the Jan-31 incident
+class — vector_state.json lost 744 entries because a crash hit between
+truncate and final write.
+
+Use `atomic_write_text` for text/JSON payloads and `atomic_write_json` as
+a thin convenience wrapper. Both hold no lock — callers that need
+cross-process serialization must layer their own locking around the call
+(see lightrag_indexer._queue_lock for an example).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import uuid
+from pathlib import Path
+from typing import Any
+
+
+def atomic_write_text(
+    path: Path,
+    text: str,
+    encoding: str = "utf-8",
+    *,
+    durable: bool = False,
+) -> None:
+    """Write `text` to `path` via tmp + os.replace.
+
+    On POSIX, `os.replace` is atomic within a filesystem — the destination
+    either contains the old content or the new, never a torn in-between.
+
+    The tmp filename is suffixed with pid+uuid so concurrent callers on
+    the same path do not clobber each other's tmp content before replace.
+    If the write raises, the orphan tmp is best-effort deleted so failed
+    runs do not leave litter behind.
+
+    `durable=True` fsyncs the tmp fd before replace and the parent directory
+    after. Default stays the historical no-fsync path.
+    """
+    tmp = path.with_suffix(f"{path.suffix}.tmp.{os.getpid()}.{uuid.uuid4().hex[:8]}")
+    try:
+        data = text.encode(encoding)
+        if durable:
+            fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o644)
+            try:
+                offset = 0
+                while offset < len(data):
+                    try:
+                        written = os.write(fd, data[offset:])
+                    except InterruptedError:
+                        continue
+                    if written <= 0:
+                        raise OSError("atomic write made no progress")
+                    offset += written
+                os.fsync(fd)
+            finally:
+                os.close(fd)
+        else:
+            tmp.write_text(text, encoding=encoding)
+        os.replace(tmp, path)
+        if durable:
+            dir_fd = os.open(str(path.parent), os.O_RDONLY)
+            try:
+                os.fsync(dir_fd)
+            finally:
+                os.close(dir_fd)
+    except Exception:
+        try:
+            tmp.unlink(missing_ok=True)
+        except OSError:
+            pass
+        raise
+
+
+def atomic_write_json(
+    path: Path,
+    data: Any,
+    indent: int | None = 2,
+    encoding: str = "utf-8",
+    *,
+    durable: bool = False,
+) -> None:
+    """Serialize `data` to JSON and write atomically."""
+    atomic_write_text(
+        path, json.dumps(data, indent=indent), encoding=encoding, durable=durable
+    )

package/work-task-runtime/manifest.json

@@ -0,0 +1,33 @@
+{
+  "version": 1,
+  "protocol": "cos-control-task-write/1",
+  "pythonMinimum": "3.10",
+  "sourceCommit": "177d0bd875f446f5e3d57de52983d5ab4e679915",
+  "sourceHashes": {
+    "task_rows.py": "58b568fd4081072eddc3110b4c3397f5e5048ede9e052391e1d09f919e8c2e7d",
+    "task_write.py": "4d1d4c51cf5ec6fa75f941c2ce1aee05952fde9a6bac89be4fca51b0ffd37981",
+    "task_work_metadata.py": "534c45910e2109ac1e18eeb236c6b286d8a899f96c7a153d0187aee5839854a5",
+    "task_checkout.py": "56c94c5b28282398abc1f8daea9d910e64228afb8ac8cfae89b54117a7e30b86",
+    "cos_atomic.py": "055f7d6bc3093aeec7b051f87cb68c543637603a538f383a614c1903bd1b503e",
+    "cos_api_bridge.py": "1e17960332e8b778c8e5923de355f4395c9244692cd4d988ccd944c6a30575ef",
+    "task_dedup.py": "5331fdea01c293ecd2773726acea110e9339ff26e72e5bcdce66777ab518bfe8"
+  },
+  "adaptations": [
+    "Only canonical task command handlers extracted; no private bridge imports",
+    "Exact canonical normalization extracted without LLM dependencies",
+    "Generic configured operator replaces author-specific owner match",
+    "Bounded no-follow source reads and lock opens",
+    "Descriptor-pinned domain working directory and lock opens supplied by task_bridge.py"
+  ],
+  "files": {
+    "cos_atomic.py": "0da53eecaf07331b008c10b1e06c39701ecc3291c511fd0779e35795b3b22534",
+    "runtime_io.py": "e5b191b6af3a4966f517ecd05d3dcae9f4136a9e99cf36d7102303ca55ae928d",
+    "task_bridge.py": "8ec1f6533710c3de2c51e518586d2f6b120f90f7c3773480a08d53544ac07fd4",
+    "task_checkout.py": "669af045b2f64b9879df03aacae7a4550b46291974ed2df2ba2ed0775c1be78f",
+    "task_commands.py": "7e843b9164112d610190385df8e41d6044d6546d4ece92d09a60b6e4ad33cc75",
+    "task_dedup.py": "745971722898a3de520f8bb5246d714c70f3189dbe53bf8f42feafaaf241a51b",
+    "task_rows.py": "9e48375d9d6ee5d29bf3cc1f92bdf1182a6eea40ee305ff1fe1632b9f3a9fcf7",
+    "task_work_metadata.py": "534c45910e2109ac1e18eeb236c6b286d8a899f96c7a153d0187aee5839854a5",
+    "task_write.py": "238b869fac49c8e01bca72a1f28ffab74c7f94938e2323246936aec0241bbd16"
+  }
+}

package/work-task-runtime/runtime_io.py

@@ -0,0 +1,27 @@
+"""Bounded, no-follow source I/O used by the portable canonical parser/writer."""
+import os, stat
+MAX_SOURCE=8*1024*1024
+
+def safe_read_text(path):
+    fd=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK)
+    try:
+        before=os.fstat(fd)
+        if not stat.S_ISREG(before.st_mode) or before.st_size>MAX_SOURCE: raise ValueError('Unsafe or oversized task source')
+        parts=[]; count=0
+        while count<=MAX_SOURCE:
+            chunk=os.read(fd,min(65536,MAX_SOURCE+1-count))
+            if not chunk: break
+            parts.append(chunk); count+=len(chunk)
+        after=os.fstat(fd)
+        if count>MAX_SOURCE or count!=before.st_size or (before.st_size,before.st_mtime_ns)!=(after.st_size,after.st_mtime_ns): raise ValueError('Task source changed while reading')
+        return b''.join(parts).decode('utf-8')
+    finally: os.close(fd)
+
+LOCK_FD=None
+def open_lock(path, flags, mode=0o600):
+    if LOCK_FD is None: raise ValueError('No pinned lock directory')
+    fd=os.open(path.name,flags|os.O_NOFOLLOW|os.O_NONBLOCK,mode,dir_fd=LOCK_FD)
+    info=os.fstat(fd)
+    if not stat.S_ISREG(info.st_mode) or info.st_size>1048576:
+        os.close(fd); raise ValueError('Unsafe lock store')
+    return fd

package/work-task-runtime/task_bridge.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Portable bridge over canonical tasks.md; no provider invocation or second store."""
+import argparse, io, json, os, stat, sys
+from pathlib import Path
+# -I excludes cwd/site configuration. Add only our installed, hash-verified code.
+sys.path.insert(0,str(Path(__file__).resolve().parent))
+from runtime_io import safe_read_text
+
+def safe_name(name):
+    return isinstance(name,str) and 0<len(name)<=64 and name==name.strip() and not name.startswith('.') and not any(c in name for c in '/\\\0') and not any(ord(c)<32 or ord(c)==127 for c in name)
+
+def directory(path, create=False):
+    path=Path(path)
+    if not path.is_absolute() or '..' in path.parts: raise ValueError('Absolute canonical root required')
+    fd=os.open('/',os.O_RDONLY|os.O_DIRECTORY)
+    try:
+        for part in path.parts[1:]:
+            if create:
+                try: os.mkdir(part,0o700,dir_fd=fd)
+                except FileExistsError: pass
+            child=os.open(part,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=fd)
+            os.close(fd);fd=child
+        return fd
+    except BaseException: os.close(fd);raise
+
+def main():
+    if sys.version_info<(3,10): raise ValueError("Python 3.10 or later required")
+    parser=argparse.ArgumentParser();parser.add_argument('--root',required=True);parser.add_argument('--lock-store',required=True);parser.add_argument('--domains',required=True);parser.add_argument('--operator',default='');parser.add_argument('command');parser.add_argument('args',nargs=argparse.REMAINDER)
+    opts=parser.parse_args(); domains=json.loads(opts.domains)
+    if not isinstance(domains,list) or not domains or len(domains)>256 or not all(safe_name(d) for d in domains): raise ValueError('Invalid domain inventory')
+    raw=sys.stdin.buffer.read(32769)
+    if len(raw)>32768: raise ValueError('Task input exceeds supported limit')
+    sys.stdin=io.StringIO(raw.decode('utf-8'))
+    commands={'task-rows':'cmd_task_rows','task-capture':'cmd_task_capture','task-set-text':'cmd_task_set_text','task-set-run-at':'cmd_task_set_run_at','task-set-marker':'cmd_task_set_marker','task-set-stage':'cmd_task_set_stage','task-set-done-when':'cmd_task_set_done_when','task-move':'cmd_task_move','task-check':'cmd_task_check','task-set-work-stage':'cmd_task_work_write','task-link-meeting':'cmd_task_work_write'}
+    if opts.command not in commands and opts.command!='task-work-capabilities': raise ValueError('Unsupported task command')
+    rootfd=directory(opts.root,create=True); domainfds={}; lockfd=None
+    try:
+        # Descriptor pinning prevents ancestor rename/symlink replacement from
+        # redirecting canonical source reads or atomic replacement writes.
+        def domain_path(domain):
+            if domain not in domains or not safe_name(domain): raise ValueError('Unknown task domain')
+            if domain not in domainfds:
+                try: os.mkdir(domain,0o700,dir_fd=rootfd)
+                except FileExistsError: pass
+                domainfds[domain]=os.open(domain,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=rootfd)
+            os.fchdir(domainfds[domain])
+            return Path('tasks.md')
+        lock=Path(opts.lock_store)
+        if not lock.is_absolute() or not safe_name(lock.name.lstrip('.')): raise ValueError('Invalid lock path')
+        lockfd=directory(lock.parent,create=True)
+        lockpath=lock
+        import runtime_io
+        runtime_io.LOCK_FD=lockfd
+        try:
+            info=os.stat(lock.name,dir_fd=lockfd,follow_symlinks=False)
+            if not stat.S_ISREG(info.st_mode) or info.st_size>1048576: raise ValueError('Unsafe lock store')
+        except FileNotFoundError: pass
+        os.environ['COS_TASK_LOCK_STORE']=str(lockpath);os.environ['COS_TASK_OPERATOR']=opts.operator
+        import task_rows
+        task_rows.full_domains=lambda:tuple(domains);task_rows.domain_path=domain_path
+        # Canonical aliases should not re-route a custom domain named sr or hc.
+        task_rows.SHORT_TO_FULL={k:v for k,v in task_rows.SHORT_TO_FULL.items() if k not in domains}
+        import task_write
+        task_write.domain_path=domain_path
+        original_write=task_write._guarded_write
+        def guarded(domain,identity,path,text):
+            if len(text.encode())>8*1024*1024: raise ValueError('Task source exceeds supported limit')
+            original_write(domain,identity,path,text)
+        task_write._guarded_write=guarded
+        import task_commands
+        if opts.command=='task-work-capabilities': print(json.dumps({'version':1,'protocol':'cos-control-task-write/1'}));return
+        if not opts.args or opts.args[0] not in domains: raise ValueError('Unknown task domain')
+        path=domain_path(opts.args[0])
+        try: safe_read_text(path)
+        except FileNotFoundError: pass
+        fn=getattr(task_commands,commands[opts.command])
+        if opts.command=='task-link-meeting':fn(opts.args,linking=True)
+        else:fn(opts.args)
+    finally:
+        for fd in domainfds.values():os.close(fd)
+        if lockfd is not None:os.close(lockfd)
+        os.close(rootfd)
+
+if __name__=='__main__':
+    try: main()
+    except Exception:
+        print(json.dumps({'error':{'code':'task_runtime_unavailable','message':'Task source or portable runtime is unavailable. Check configuration before retrying.'}}))