@linxin666/dsh-client-ui-task-board 0.4.0 → 0.4.2

package/src/core/subtask.ts

@@ -0,0 +1,286 @@
+/**
+ * Subtask lineage: the depth gate, the ancestry/descendant queries, the
+ * cascade participant set one run request opens, the deferred settlement of a
+ * cascade parent, and the execution-target inheritance a subtask resolves at
+ * run time.
+ *
+ * Framework-free (no cordis, no runtime imports) so every rule is
+ * unit-testable in isolation. The Host ledger is the only authority; the
+ * browser mirrors these predicates to enable or disable controls, never to
+ * decide them.
+ */
+import type { ExecutionOutcome, ExecutionRecord, TaskRecord } from './tasks.ts'
+
+/** Lowest configurable subtask depth. */
+export const SUBTASK_DEPTH_MIN = 1
+/** Highest configurable subtask depth. */
+export const SUBTASK_DEPTH_MAX = 3
+/** Deployment default: one level of subtasks, and no subtask of a subtask. */
+export const DEFAULT_SUBTASK_DEPTH = 1
+
+/**
+ * Clamp a configured depth into the supported range. Anything unusable
+ * (absent, non-numeric, not finite) falls back to the default, so a bad
+ * configuration narrows the tree instead of lifting the guard.
+ */
+export function normalizeSubtaskDepth(value: unknown): number {
+  if (typeof value !== "number" || !Number.isFinite(value)) return DEFAULT_SUBTASK_DEPTH
+  const depth = Math.trunc(value)
+  if (depth < SUBTASK_DEPTH_MIN) return SUBTASK_DEPTH_MIN
+  if (depth > SUBTASK_DEPTH_MAX) return SUBTASK_DEPTH_MAX
+  return depth
+}
+
+/** Whether an unknown value is a settled execution outcome. */
+export function isExecutionOutcome(value: unknown): value is ExecutionOutcome {
+  return value === 'succeeded' || value === 'failed' || value === 'cancelled'
+}
+
+function indexOf(tasks: readonly TaskRecord[]): Map<string, TaskRecord> {
+  return new Map(tasks.map(task => [task.id, task]))
+}
+
+/**
+ * Nearest-first ancestor chain of a task. The walk is cycle-safe and bounded
+ * by the ledger size rather than by the deployment maximum: a chain stored
+ * under a larger limit survives that limit being lowered, and restore and
+ * inheritance must still see all of it.
+ */
+export function ancestorChain(tasks: readonly TaskRecord[], task: TaskRecord): TaskRecord[] {
+  const index = indexOf(tasks)
+  const chain: TaskRecord[] = []
+  const seen = new Set<string>([task.id])
+  let current = task.parentId === undefined ? undefined : index.get(task.parentId)
+  while (current !== undefined && chain.length < tasks.length) {
+    if (seen.has(current.id)) break
+    seen.add(current.id)
+    chain.push(current)
+    current = current.parentId === undefined ? undefined : index.get(current.parentId)
+  }
+  return chain
+}
+
+/** Root-to-task depth: a root task is 0, its subtask 1, and so on. */
+export function taskDepth(tasks: readonly TaskRecord[], id: string): number {
+  const task = indexOf(tasks).get(id)
+  return task === undefined ? 0 : ancestorChain(tasks, task).length
+}
+
+/** Direct subtasks of a task, in ledger order. */
+export function directSubtasks(tasks: readonly TaskRecord[], id: string): TaskRecord[] {
+  return tasks.filter(task => task.parentId === id)
+}
+
+/**
+ * Descendants of a task in breadth-first order, bounded by maxSubtaskDepth
+ * total depth. The visited set keeps a malformed ledger from looping.
+ */
+export function descendantTasks(tasks: readonly TaskRecord[], id: string, maxSubtaskDepth: number): TaskRecord[] {
+  const visited = new Set<string>([id])
+  const found: TaskRecord[] = []
+  let frontier = [id]
+  for (let depth = 1; depth <= maxSubtaskDepth && frontier.length > 0; depth += 1) {
+    const next: string[] = []
+    for (const parentId of frontier) {
+      for (const task of tasks) {
+        if (task.parentId !== parentId || visited.has(task.id)) continue
+        visited.add(task.id)
+        found.push(task)
+        next.push(task.id)
+      }
+    }
+    frontier = next
+  }
+  return found
+}
+
+/**
+ * Height of a task's own subtree (0 for a leaf), bounded by the hard maximum.
+ * The visited set makes the walk terminate on a cyclic hand-edited ledger
+ * instead of recursing until the stack overflows.
+ */
+export function subtreeHeight(tasks: readonly TaskRecord[], id: string, visited: ReadonlySet<string> = new Set<string>()): number {
+  if (visited.has(id)) return 0
+  const seen = new Set([...visited, id])
+  const children = directSubtasks(tasks, id)
+  if (children.length === 0) return 0
+  let height = 0
+  for (const child of children) height = Math.max(height, 1 + subtreeHeight(tasks, child.id, seen))
+  return Math.min(height, SUBTASK_DEPTH_MAX)
+}
+
+/** Why a parent link was refused; also the source of the Host error text. */
+export type ParentLinkRejection =
+  | 'unknown-task'
+  | 'unknown-parent'
+  | 'archived-parent'
+  | 'self-parent'
+  | 'cycle'
+  | 'depth-exceeded'
+
+export interface ParentLinkCheck {
+  /** True when the link (or the detachment) may be stored. */
+  ok: boolean
+  /** Why it was refused; absent when ok. */
+  reason?: ParentLinkRejection
+}
+
+/**
+ * Whether childId may be attached under parentId. A null parent detaches and
+ * is always allowed for a known task. Otherwise the link must name an
+ * on-board task that is neither the child itself nor one of its descendants,
+ * and the resulting depth (parent depth + 1 + the child own subtree height)
+ * must stay within maxSubtaskDepth.
+ */
+export function checkParentLink(
+  tasks: readonly TaskRecord[],
+  childId: string,
+  parentId: string | null,
+  maxSubtaskDepth: number,
+): ParentLinkCheck {
+  const child = tasks.find(task => task.id === childId)
+  if (child === undefined) return { ok: false, reason: 'unknown-task' }
+  if (parentId === null || parentId === '') return { ok: true }
+  if (parentId === childId) return { ok: false, reason: 'self-parent' }
+  const parent = tasks.find(task => task.id === parentId)
+  if (parent === undefined) return { ok: false, reason: 'unknown-parent' }
+  if (parent.archivedAt !== undefined) return { ok: false, reason: 'archived-parent' }
+  if (descendantTasks(tasks, childId, SUBTASK_DEPTH_MAX).some(task => task.id === parentId)) return { ok: false, reason: 'cycle' }
+  const depth = taskDepth(tasks, parentId) + 1 + subtreeHeight(tasks, childId)
+  if (depth > maxSubtaskDepth) return { ok: false, reason: 'depth-exceeded' }
+  return { ok: true }
+}
+
+/**
+ * The tasks one run request opens executions for: the requested task first,
+ * then its on-board descendants within the configured depth. Archived tasks
+ * never run; a participant that already has an open execution is skipped by
+ * the caller, which cannot start it twice.
+ */
+export function cascadeTargets(
+  tasks: readonly TaskRecord[],
+  rootId: string,
+  maxSubtaskDepth: number,
+): TaskRecord[] {
+  const root = tasks.find(task => task.id === rootId)
+  if (root === undefined) return []
+  return [root, ...descendantTasks(tasks, rootId, maxSubtaskDepth)]
+}
+
+/** One still-open execution belonging to a cascade run group. */
+export interface OpenCascadeChild {
+  taskId: string
+  execution: ExecutionRecord
+}
+
+/** The open execution of a task inside a run group, if it still exists. */
+export function openGroupExecution(task: TaskRecord, runGroupId: string): ExecutionRecord | undefined {
+  return task.executions.find(execution => execution.runGroupId === runGroupId && execution.endedAt === undefined)
+}
+
+/**
+ * The direct subtasks of parentTaskId whose execution in this run group is
+ * still open: the parent remaining waiters. The parent may settle once this
+ * list is empty and its own outcome is known.
+ */
+export function pendingCascadeChildren(
+  tasks: readonly TaskRecord[],
+  parentTaskId: string,
+  runGroupId: string,
+): OpenCascadeChild[] {
+  const pending: OpenCascadeChild[] = []
+  for (const task of tasks) {
+    if (task.parentId !== parentTaskId) continue
+    const execution = openGroupExecution(task, runGroupId)
+    if (execution !== undefined) pending.push({ taskId: task.id, execution })
+  }
+  return pending
+}
+
+/**
+ * Fold a cascade parent own outcome and its children outcomes into one
+ * verdict: failure dominates, then cancellation, then success. The error text
+ * is the first failure, falling back to the first cancellation.
+ */
+export function combineCascadeOutcome(
+  entries: readonly { result: ExecutionOutcome; error?: string }[],
+): { result: ExecutionOutcome; error: string | undefined } {
+  let result: ExecutionOutcome = 'succeeded'
+  let error: string | undefined
+  for (const entry of entries) {
+    if (entry.result === 'failed') {
+      if (result !== 'failed') error = undefined
+      result = 'failed'
+      if (error === undefined && entry.error !== undefined && entry.error !== '') error = entry.error
+      continue
+    }
+    if (entry.result === 'cancelled') {
+      if (result === 'succeeded') result = 'cancelled'
+      if (error === undefined && entry.error !== undefined && entry.error !== '') error = entry.error
+    }
+  }
+  return error === undefined ? { result, error: undefined } : { result, error }
+}
+
+/**
+ * The permission a task would actually run under: its handover bundle's pin
+ * wins over the plain pin field, exactly as the runner resolves it.
+ */
+export function effectiveTaskPermission(task: TaskRecord): TaskRecord['permission'] {
+  return task.handover?.permission ?? task.permission
+}
+
+/**
+ * Resolve the execution targets a (sub)task actually runs with: its own value
+ * wins, and an unset target inherits the nearest ancestor up to the root.
+ * Workspace, agent preset and model inherit the ancestor's PIN only — a
+ * handover bundle is a per-card continuation artefact and is never inherited.
+ * The permission inherits the ancestor's EFFECTIVE binding, and its human
+ * confirmation travels with it, so a subtask of an already-confirmed elevated
+ * card is runnable while a subtask's own unconfirmed binding stays gated.
+ */
+/**
+ * The immutable teammate name for one team-mode member. Teammate names are
+ * lower-kebab-case and must stay unique for the lifetime of the Team, so the
+ * run-group token is appended: two runs of the same tree never collide. A title
+ * with no ASCII word characters (a CJK title, for example) keeps a stable
+ * generic prefix and is still distinguished by the token.
+ * @param title - the member task's title.
+ * @param token - the run group id (the task id when no group is recorded).
+ * @returns the teammate name handed to the Agent Teams service.
+ */
+export function teammateName(title: string, token: string): string {
+  const slug = title.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32).replace(/-+$/g, '')
+  const suffix = token.replace(/[^a-z0-9]/gi, '').slice(0, 8).toLowerCase()
+  return `${slug === '' ? 'subtask' : slug}-${suffix === '' ? 'run' : suffix}`
+}
+
+export function resolveExecutionTargets(
+  task: TaskRecord,
+  tasks: readonly TaskRecord[],
+  maxSubtaskDepth: number = SUBTASK_DEPTH_MAX,
+): TaskRecord {
+  if (task.parentId === undefined) return task
+  const chain = [task, ...ancestorChain(tasks, task).slice(0, maxSubtaskDepth)]
+  const first = (key: 'workspaceId' | 'mode' | 'model'): string | undefined => {
+    for (const candidate of chain) {
+      const value = candidate[key]
+      if (value !== undefined) return value
+    }
+    return undefined
+  }
+  const own = effectiveTaskPermission(task)
+  // An own binding (pin or handover) keeps its own confirmation stamp; only an
+  // absent one borrows the ancestor's binding AND that ancestor's stamp.
+  const owner = own === undefined
+    ? chain.slice(1).find(candidate => effectiveTaskPermission(candidate) !== undefined)
+    : undefined
+  return {
+    ...task,
+    workspaceId: first('workspaceId'),
+    mode: first('mode'),
+    model: first('model'),
+    permission: own ?? (owner === undefined ? undefined : effectiveTaskPermission(owner)),
+    permissionConfirmedAt: own === undefined ? owner?.permissionConfirmedAt : task.permissionConfirmedAt,
+  }
+}

package/src/core/tasks.ts

@@ -10,6 +10,9 @@ import type { TaskHandover, TaskHandoverInput } from './handover.ts'
 /** Task lifecycle status, one per kanban column. */
 export type TaskStatus = 'backlog' | 'todo' | 'running' | 'done' | 'failed'
 
+/** Settled outcome of one execution attempt. */
+export type ExecutionOutcome = 'succeeded' | 'failed' | 'cancelled'
+
 /**
  * One real execution attempt: the run's own id, the dsh session that ran it
  * (filled once the session is created), and the settled outcome once the
@@ -25,7 +28,7 @@ export interface ExecutionRecord {
   /** When the run settled; absent while still running. */
   endedAt: number | undefined
   /** Outcome once settled. */
-  result: 'succeeded' | 'failed' | 'cancelled' | undefined
+  result: ExecutionOutcome | undefined
   /** Human failure text when the run failed (prompt rejection or agent error). */
   error: string | undefined
   /**
@@ -38,6 +41,20 @@ export interface ExecutionRecord {
   frozenAt?: number
   /** Freeze source session captured from the card snapshot when the run opened. */
   frozenBy?: string
+  /**
+   * Cascade run group shared by the parent execution and every descendant
+   * execution one run request opened. Absent on a plain single-task run.
+   */
+  runGroupId?: string
+  /**
+   * A cascade parent's own session outcome, recorded as soon as its own turn
+   * settles and held while its subtask executions finish. The execution stays
+   * open (no `endedAt`) until the last child settles; the Host monitor skips
+   * an execution whose own outcome is already recorded.
+   */
+  ownResult?: ExecutionOutcome
+  /** Human failure text that arrived with {@link ownResult}. */
+  ownError?: string
 }
 
 /**
@@ -203,6 +220,14 @@ export interface TaskRecord {
   description: string
   /** The prompt sent to dsh when this task is executed. */
   prompt: string
+  /**
+   * Parent task id: present only on a subtask. The Host owns the lineage gate
+   * (see `core/subtask.ts`), which refuses a cycle, an archived parent, and
+   * any link that would exceed `maxSubtaskDepth` — so every chain the Host
+   * wrote under the current setting is at most that many links long. Lowering
+   * the limit later neither rewrites nor deletes an already stored link.
+   */
+  parentId?: string
   /** Current column. */
   status: TaskStatus
   /** Creation instant (ms epoch). */
@@ -244,6 +269,15 @@ export interface TaskRecord {
    * {@link reusableSessionId}).
    */
   reuseSession?: boolean
+  /**
+   * Run this task's subtree as an Agent Team instead of one Host-launched
+   * session per participant: the root becomes the Team Lead session and the
+   * Host spawns one teammate for each direct subtask inside it. Absent or false
+   * keeps the plain concurrent cascade. A deployment that does not serve the
+   * Agent Teams service refuses a team run instead of silently falling back,
+   * and a subtask's own permission pin cannot be honored in this mode.
+   */
+  teamRun?: boolean
   /**
    * Frozen context snapshot for a continuation card; absent on plain tasks.
    * Sanitized before it enters the ledger (redaction, slash-command taint,
@@ -302,6 +336,12 @@ export interface NewTaskInput {
   title: string
   description: string
   prompt: string
+  /**
+   * Parent task id, turning this creation into a subtask. Absent keeps a root
+   * task; the create use case validates the link (existence, depth) and
+   * inherits the parent's unset execution targets.
+   */
+  parentId?: string
   /** Workspace the execution must run in; empty/absent = the recent workspace. */
   workspaceId?: string
   /** Agent preset the execution session must be composed from; empty/absent = deployment default. */
@@ -312,6 +352,8 @@ export interface NewTaskInput {
   model?: string
   /** Reuse the previous execution's session for later runs (issue #1419). */
   reuseSession?: boolean
+  /** Run the subtree as an Agent Team (Team Lead session plus one teammate per direct subtask). */
+  teamRun?: boolean
   /**
    * Optional scheduled-run rule requested at creation time (the new-task
    * dialog): an enable flag plus a 5-field cron expression. The create use
@@ -397,6 +439,7 @@ export function createTask(input: NewTaskInput, now: number, id: string): TaskRe
     title: input.title.trim(),
     description: input.description.trim(),
     prompt: input.prompt.trim(),
+    parentId: normalizeTargetId(input.parentId),
     status: 'todo',
     createdAt: now,
     updatedAt: now,
@@ -406,6 +449,7 @@ export function createTask(input: NewTaskInput, now: number, id: string): TaskRe
     permission: isTaskPermission(input.permission) ? input.permission : undefined,
     model: normalizeTargetId(input.model),
     reuseSession: input.reuseSession === true ? true : undefined,
+  teamRun: input.teamRun === true ? true : undefined,
     ...(input.freeze === undefined ? {} : { freeze: freezeOf(input.freeze, now) }),
     ...(input.handover === undefined ? {} : { handover: { ...input.handover, bundledAt: now } }),
     ...(tags === undefined ? {} : { tags }),
@@ -445,12 +489,15 @@ export function withSchedule(
 /**
  * Open a fresh execution on a task: move it to 'running' and append a
  * running execution record. Returns the new task and the new execution.
+ * @param runGroupId - cascade run group, when this run also opened executions
+ *   for the task's subtasks (see `core/subtask.ts`).
  */
 export function startExecution(
   task: TaskRecord,
   now: number,
   executionId: string,
   initiatedBy?: string,
+  runGroupId?: string,
 ): { task: TaskRecord; execution: ExecutionRecord } {
   const execution: ExecutionRecord = {
     id: executionId,
@@ -459,6 +506,7 @@ export function startExecution(
     endedAt: undefined,
     result: undefined,
     error: undefined,
+    ...(runGroupId === undefined || runGroupId === '' ? {} : { runGroupId }),
     ...(initiatedBy === undefined || initiatedBy === '' ? {} : { initiatedBy }),
     // Capture the card's freeze provenance on the execution record so the
     // audit trail stays queryable even if the snapshot is replaced later.
@@ -486,7 +534,7 @@ export function startExecution(
 export function settleExecution(
   task: TaskRecord,
   executionId: string,
-  outcome: 'succeeded' | 'failed' | 'cancelled',
+  outcome: ExecutionOutcome,
   now: number,
   error: string | undefined,
 ): TaskRecord {

package/src/core/use-cases/task-archive.ts

@@ -1,9 +1,16 @@
 /**
  * Archive/restore task use case: move a task off the main board and back,
- * whatever its status but `running`. The task keeps its status, execution history, and
- * transcript references, while archiving disarms any schedule so it cannot
- * create more execution records until the user restores and re-enables it.
+ * whatever its status but running. The task keeps its status, execution
+ * history, and transcript references, while archiving disarms any schedule so
+ * it cannot create more execution records until the user restores and
+ * re-enables it.
+ *
+ * Subtask trees move as a unit: archiving takes the whole subtree (an on-board
+ * subtask under an archived parent would be unreachable from its parent) and
+ * refuses the whole group while any member is running. Restoring brings the
+ * task, its ancestors and its subtree back together.
  */
+import { DEFAULT_SUBTASK_DEPTH, ancestorChain, descendantTasks, normalizeSubtaskDepth } from '../subtask.ts'
 import type { TaskRecord } from '../tasks.ts'
 import { ARCHIVABLE_STATUSES } from '../tasks.ts'
 
@@ -15,21 +22,37 @@ export interface ArchiveTaskResult {
   archived: boolean
 }
 
+/** The archive/restore id set: the task, its subtree, and (for restore) its ancestors. */
+function groupIds(tasks: readonly TaskRecord[], id: string, maxSubtaskDepth: number, withAncestors: boolean): Set<string> {
+  const target = tasks.find(task => task.id === id)
+  const ids = new Set<string>([id])
+  for (const task of descendantTasks(tasks, id, normalizeSubtaskDepth(maxSubtaskDepth))) ids.add(task.id)
+  if (withAncestors && target !== undefined) {
+    for (const ancestor of ancestorChain(tasks, target)) ids.add(ancestor.id)
+  }
+  return ids
+}
+
 /**
- * Archive one task: only a `running` task stays on the board (its runner
- * still owns its lifecycle until the execution settles); every other status
- * can be archived. Archiving disarms a schedule; already-archived tasks are
- * a no-op.
+ * Archive one task and its subtasks: only a running member keeps the group on
+ * the board (its runner still owns its lifecycle until the execution settles);
+ * any other status can be archived. Archiving disarms schedules; an
+ * already-archived task is a no-op.
  */
 export function applyArchiveTask(
   tasks: readonly TaskRecord[],
   id: string,
   now: number,
+  maxSubtaskDepth: number = DEFAULT_SUBTASK_DEPTH,
 ): ArchiveTaskResult {
+  const target = tasks.find(task => task.id === id)
+  if (target === undefined || target.archivedAt !== undefined) return { tasks, archived: false }
+  const ids = groupIds(tasks, id, maxSubtaskDepth, false)
+  const declining = tasks.some(task => ids.has(task.id) && !(ARCHIVABLE_STATUSES as readonly string[]).includes(task.status))
+  if (declining) return { tasks, archived: false }
   let applied = false
   const next = tasks.map(task => {
-    if (task.id !== id || task.archivedAt !== undefined) return task
-    if (!(ARCHIVABLE_STATUSES as readonly string[]).includes(task.status)) return task
+    if (!ids.has(task.id) || task.archivedAt !== undefined) return task
     applied = true
     const schedule = task.schedule === undefined
       ? undefined
@@ -44,11 +67,22 @@ export function applyArchiveTask(
   return { tasks: next, archived: applied }
 }
 
-/** Restore one task back onto the main board (clears the archive marker). */
-export function applyRestoreTask(tasks: readonly TaskRecord[], id: string, now: number): ArchiveTaskResult {
+/**
+ * Restore one task back onto the main board, together with its ancestors (an
+ * on-board subtask must not point at an archived parent) and its subtasks.
+ */
+export function applyRestoreTask(
+  tasks: readonly TaskRecord[],
+  id: string,
+  now: number,
+  maxSubtaskDepth: number = DEFAULT_SUBTASK_DEPTH,
+): ArchiveTaskResult {
+  const target = tasks.find(task => task.id === id)
+  if (target === undefined || target.archivedAt === undefined) return { tasks, archived: false }
+  const ids = groupIds(tasks, id, maxSubtaskDepth, true)
   let applied = false
   const next = tasks.map(task => {
-    if (task.id !== id || task.archivedAt === undefined) return task
+    if (!ids.has(task.id) || task.archivedAt === undefined) return task
     applied = true
     const { archivedAt: _archived, ...rest } = task
     return { ...rest, updatedAt: now }

package/src/core/use-cases/task-create.ts

@@ -1,35 +1,70 @@
 /**
  * Create-task use case: mint a new task from user input, rejecting a blank
- * title. Pure ledger transition (no persistence or notify — the controller
- * orchestrates those), so it is unit-testable without any runtime face.
+ * title and any parent link the lineage gate refuses. Pure ledger transition
+ * (no persistence or notify - the controller orchestrates those), so it is
+ * unit-testable without any runtime face.
  */
 import { isValidCron, nextRunAtMs } from '../schedule.ts'
+import { DEFAULT_SUBTASK_DEPTH, normalizeSubtaskDepth, taskDepth } from '../subtask.ts'
 import { createTask, withSchedule, type NewTaskInput, type TaskRecord } from '../tasks.ts'
 
 /** Result of a create transition: the new task (when accepted) + the next ledger. */
 export interface CreateTaskResult {
-  /** The minted task, or undefined when the input was rejected (blank title). */
+  /** The minted task, or undefined when the input was rejected. */
   task: TaskRecord | undefined
   /** The next ledger; identical reference when rejected. */
   tasks: readonly TaskRecord[]
+  /** Why the input was rejected; absent when a task was minted. */
+  error?: string
 }
 
 /**
  * Apply a create against the current ledger. Returns the new task and the
- * appended ledger, or the unchanged ledger when the title is blank.
+ * appended ledger, or the unchanged ledger when the title is blank or the
+ * requested parent link is refused.
+ *
+ * A subtask inherits the execution targets its parent already pins (workspace,
+ * agent preset, permission, model) unless the form supplied its own; the
+ * parent human permission confirmation travels with an inherited permission,
+ * so a subtask of an already-confirmed elevated card is runnable at once.
  * @param tasks - current ledger.
- * @param input - raw user input (title/description/prompt + optional schedule).
+ * @param input - raw user input (title/description/prompt + optional schedule/parent).
  * @param now - clock instant (ms epoch).
  * @param id - minted task id.
+ * @param maxSubtaskDepth - deployment subtask depth limit.
  */
 export function applyCreateTask(
   tasks: readonly TaskRecord[],
   input: NewTaskInput,
   now: number,
   id: string,
+  maxSubtaskDepth: number = DEFAULT_SUBTASK_DEPTH,
 ): CreateTaskResult {
-  if (input.title.trim() === '') return { task: undefined, tasks }
-  let task = createTask(input, now, id)
+  if (input.title.trim() === '') return { task: undefined, tasks, error: 'title is required' }
+  const limit = normalizeSubtaskDepth(maxSubtaskDepth)
+  let parent: TaskRecord | undefined
+  if (input.parentId !== undefined) {
+    parent = tasks.find(task => task.id === input.parentId)
+    if (parent === undefined) return { task: undefined, tasks, error: 'parent task not found' }
+    if (parent.archivedAt !== undefined) return { task: undefined, tasks, error: 'parent task is archived' }
+    if (taskDepth(tasks, parent.id) + 1 > limit) {
+      return { task: undefined, tasks, error: `subtask depth limit (${limit}) exceeded` }
+    }
+  }
+  // A subtask copies the execution targets its parent pins so the card shows
+  // what it will run with — EXCEPT the permission. A copied permission would
+  // also have to copy the parent's human confirmation to stay runnable, and the
+  // child would keep both after being detached: one confirmed parent would mint
+  // unbounded confirmed elevated roots. The permission is resolved live from the
+  // attached ancestors at launch instead (see core/subtask.ts), so detaching
+  // removes the inheritance by construction.
+  const effective: NewTaskInput = parent === undefined ? input : {
+    ...input,
+    workspaceId: input.workspaceId ?? parent.workspaceId,
+    mode: input.mode ?? parent.mode,
+    model: input.model ?? parent.model,
+  }
+  let task = createTask(effective, now, id)
   // Arm the requested schedule (new-task dialog): only an enabled rule with
   // a valid cron is applied; blank, invalid, or disabled requests leave the
   // task unscheduled.

package/src/core/use-cases/task-delete.ts

@@ -1,7 +1,11 @@
 /**
  * Delete-task use case: drop a task from the ledger and clear the selection
  * when it pointed at the removed task. Pure ledger transition (no persistence
- * or notify — the controller orchestrates those).
+ * or notify - the controller orchestrates those).
+ *
+ * A task that still has subtasks is refused: deleting the parent would leave
+ * dangling child links, and silently detaching (or cascading) the children is
+ * a data-loss decision the user must make explicitly.
  */
 import type { TaskRecord } from '../tasks.ts'
 
@@ -11,6 +15,8 @@ export interface DeleteTaskResult {
   tasks: readonly TaskRecord[]
   /** Whether the previous selection referenced the removed task. */
   selectionCleared: boolean
+  /** True when the task still carries subtasks, so nothing was removed. */
+  blocked: boolean
 }
 
 /**
@@ -25,9 +31,13 @@ export function applyDeleteTask(
   selectedTaskId: string | undefined,
   id: string,
 ): DeleteTaskResult {
+  if (tasks.some(task => task.parentId === id)) {
+    return { tasks, selectionCleared: false, blocked: true }
+  }
   const next = tasks.filter(task => task.id !== id)
   return {
     tasks: next,
     selectionCleared: selectedTaskId === id,
+    blocked: false,
   }
 }