@linxin666/dsh-client-ui-task-board 0.4.4 → 0.4.6

package/src/core/extension.ts

@@ -0,0 +1,376 @@
+/**
+ * The task board's external provider extension contract.
+ *
+ * This module is the single source of truth for how another plugin adds a
+ * provider surface to the task board: the cordis service name both halves
+ * publish, the API version they negotiate, the child seats a provider renders
+ * into, the host capability face a provider implements against, and the client
+ * capability face the board's browser half provides. It is framework-free and
+ * shared by the host and browser programs; the only imported SDK type is
+ * type-only, so the browser bundle never pulls a value out of an SDK package.
+ *
+ * @module dsh-task-board/core/extension
+ */
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
+import type { ExecutionOutcome, TaskRecord, TaskStatus } from './tasks.ts'
+
+/** Cordis service name the host and browser halves each publish. */
+export const TASK_BOARD_SERVICE_NAME = 'taskBoard'
+
+/**
+ * Contract version of {@link TASK_BOARD_SERVICE_NAME}. A provider declares the
+ * version it was built against; the board refuses (visibly) any other version
+ * instead of guessing at a stale shape.
+ */
+export const TASK_BOARD_API_VERSION = 1
+
+/** Child seat a provider registers its task-detail section into. */
+export const TASK_BOARD_DETAIL_SECTION = 'task-board.detail.section'
+/** Child seat a provider registers its settings section into. */
+export const TASK_BOARD_SETTINGS_SECTION = 'task-board.settings.section'
+/** Child seat a provider registers its card decoration into. */
+export const TASK_BOARD_CARD_DECORATION = 'task-board.card.decoration'
+
+/** Every child seat the board declares for extensions, in render order. */
+export const TASK_BOARD_EXTENSION_SEATS: readonly string[] = [
+  TASK_BOARD_DETAIL_SECTION,
+  TASK_BOARD_SETTINGS_SECTION,
+  TASK_BOARD_CARD_DECORATION,
+]
+
+/**
+ * Largest accepted extension payload, in bytes of its JSON serialization. One
+ * integration entry — and one action payload — may carry schema the board does
+ * not interpret, but never enough of it to bloat the ledger or the action
+ * channel.
+ */
+export const TASK_BOARD_PAYLOAD_LIMIT_BYTES = 64 * 1024
+
+/** Depth beyond which a payload is refused instead of walked. */
+const PAYLOAD_DEPTH_LIMIT = 64
+
+/** One opaque provider payload the board stores and forwards without interpreting. */
+export type TaskBoardExtensionPayload = Record<string, unknown>
+
+/** Whether a value is a plain JSON value (no undefined, function, symbol, bigint or cycle). */
+function isJsonValue(value: unknown, depth: number): boolean {
+  if (depth > PAYLOAD_DEPTH_LIMIT) return false
+  if (value === null) return true
+  switch (typeof value) {
+    case 'string':
+    case 'boolean':
+      return true
+    case 'number':
+      return Number.isFinite(value)
+    // A provider's in-memory metadata legitimately clears a field by setting it
+    // to undefined; JSON serialization drops such a key, so the persisted
+    // payload is still pure JSON.
+    case 'undefined':
+      return true
+    case 'object':
+      break
+    default:
+      return false
+  }
+  if (Array.isArray(value)) return value.every(item => isJsonValue(item, depth + 1))
+  const prototype = Object.getPrototypeOf(value)
+  if (prototype !== Object.prototype && prototype !== null) return false
+  return Object.values(value as Record<string, unknown>).every(item => isJsonValue(item, depth + 1))
+}
+
+/**
+ * Validate one extension payload: a pure JSON object whose serialization fits
+ * {@link TASK_BOARD_PAYLOAD_LIMIT_BYTES}. Arrays, primitives and non-plain
+ * objects are refused; the board never interprets the keys.
+ * @param value - candidate payload.
+ * @returns whether the value is an acceptable opaque payload.
+ */
+export function isTaskBoardExtensionPayload(value: unknown): value is TaskBoardExtensionPayload {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false
+  if (!isJsonValue(value, 0)) return false
+  try {
+    return new TextEncoder().encode(JSON.stringify(value)).length <= TASK_BOARD_PAYLOAD_LIMIT_BYTES
+  } catch {
+    return false
+  }
+}
+
+/** Byte length of a value's JSON serialization, or undefined when it does not serialize. */
+export function taskBoardPayloadBytes(value: unknown): number | undefined {
+  try {
+    return new TextEncoder().encode(JSON.stringify(value)).length
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Normalize a task's whole integrations container: a plain JSON object whose
+ * values are each an opaque provider payload within the size limit. A malformed
+ * container normalizes to undefined (the field is dropped), and one malformed
+ * entry is dropped alone so a single bad provider can never take a card — or
+ * another provider's data — with it.
+ * @param value - candidate container from the wire, the ledger, or a create input.
+ * @returns the cleaned container, or undefined when nothing usable remains.
+ */
+export function normalizeTaskIntegrations(value: unknown): Record<string, TaskBoardExtensionPayload> | undefined {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined
+  const prototype = Object.getPrototypeOf(value)
+  if (prototype !== Object.prototype && prototype !== null) return undefined
+  const result: Record<string, TaskBoardExtensionPayload> = {}
+  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {
+    if (key === '') continue
+    if (!isTaskBoardExtensionPayload(entry)) continue
+    result[key] = entry
+  }
+  return Object.keys(result).length === 0 ? undefined : result
+}
+
+/** One action a provider dispatches over the board's same-origin channel. */
+export interface TaskBoardExtensionActionRequest {
+  /** Id of the extension the action belongs to. */
+  extensionId: string
+  /** Provider-owned action name, routed back to that extension's handleAction. */
+  action: string
+  /** Task the action targets, when it targets one. */
+  taskId?: string
+  /** Opaque provider payload, bounded like every other extension payload. */
+  payload?: TaskBoardExtensionPayload
+}
+
+/**
+ * Deliver one extension action through the board's same-origin action channel.
+ * The extension never opens an HTTP surface of its own.
+ */
+export type TaskBoardExtensionDispatch = (request: TaskBoardExtensionActionRequest) => Promise<boolean>
+
+/** Draft one provider creates a task from. */
+export interface TaskBoardTaskDraft {
+  title: string
+  description: string
+  prompt: string
+  /** Column the created card opens in; absent means the board default (todo). */
+  status?: TaskStatus
+  /** Parent card id, when the provider materializes a subtask. */
+  parentId?: string
+  /**
+   * Workspace the execution must run in. Absent leaves the board's own
+   * inheritance rules in charge (the creating session's workspace for a root
+   * card, else the recent workspace at execution time), so a provider that has
+   * no reason to know better pins nothing.
+   */
+  workspaceId?: string
+}
+
+/** Options of {@link TaskBoardTasksFace.create}. */
+export interface TaskBoardCreateOptions {
+  /** Opaque payload stored under the creating extension's id. */
+  payload?: TaskBoardExtensionPayload
+  /** Create the card off-board: it exists in the ledger but is never shown on the board. */
+  hidden?: boolean
+}
+
+/** One task linked to an extension, with that extension's own payload. */
+export interface TaskBoardLinkedTask {
+  task: TaskRecord
+  payload: TaskBoardExtensionPayload
+}
+
+/** Task reads and writes the board grants an extension. */
+export interface TaskBoardTasksFace {
+  /** Every task in the ledger, most recent mutation last. */
+  list(): readonly TaskRecord[]
+  /** One task by id, or undefined. */
+  get(taskId: string): TaskRecord | undefined
+  /**
+   * Create a task through the board's own creation gate; the payload lands
+   * under the creating extension's id. Throws on a refused draft.
+   */
+  create(draft: TaskBoardTaskDraft, options?: TaskBoardCreateOptions): TaskRecord
+  /**
+   * Patch a task's content. Reuses the board's own content gate: a task that
+   * has started executing keeps its recorded title/description/prompt.
+   * Throws when the card is frozen.
+   */
+  patchContent(taskId: string, patch: { title?: string; description?: string; prompt?: string }): void
+  /**
+   * Move a task through the board's existing status gates (running lock,
+   * permission confirmation gate). Throws on refusal.
+   */
+  setStatus(taskId: string, status: TaskStatus, initiator?: string): void
+  /** Every task carrying this extension's payload. */
+  linked(): readonly TaskBoardLinkedTask[]
+}
+
+/** Storage face for one extension's own payload on a task. */
+export interface TaskBoardIntegrationFace {
+  /** Read this extension's payload, or undefined when the task carries none. */
+  read(taskId: string): TaskBoardExtensionPayload | undefined
+  /**
+   * Shallow-merge this extension's payload into the task: the given keys
+   * replace the stored ones, and a key explicitly set to undefined clears it.
+   * The board stores the result opaquely; a non-JSON or oversized payload is
+   * refused.
+   */
+  write(taskId: string, payload: TaskBoardExtensionPayload): void
+}
+
+/** Status-change notification. */
+export interface TaskBoardStatusChangedEvent {
+  taskId: string
+  status: TaskStatus
+  previous: TaskStatus
+  initiator?: string
+}
+
+/** Execution-settlement notification. */
+export interface TaskBoardExecutionSettledEvent {
+  taskId: string
+  executionId: string
+  outcome: ExecutionOutcome
+  error?: string
+}
+
+/** Task-deletion notification. */
+export interface TaskBoardTaskDeletedEvent {
+  taskId: string
+}
+
+/**
+ * Event subscriptions an extension registers for. Every callback runs isolated:
+ * a throw is logged and never interrupts the board's own execution path.
+ */
+export interface TaskBoardEventFace {
+  onStatusChanged(callback: (event: TaskBoardStatusChangedEvent) => void): () => void
+  onExecutionSettled(callback: (event: TaskBoardExecutionSettledEvent) => void): () => void
+  onTaskDeleted(callback: (event: TaskBoardTaskDeletedEvent) => void): () => void
+}
+
+/**
+ * Host capability face handed to one extension while it is started. The face
+ * lives for the extension's enabled lifetime; the board revokes it by calling
+ * the extension's stop().
+ */
+export interface TaskBoardExtensionHost {
+  tasks: TaskBoardTasksFace
+  integration: TaskBoardIntegrationFace
+  events: TaskBoardEventFace
+  /**
+   * Publish this extension's read-only summary; it lands in the snapshot's
+   * extensions[id] for the extension's browser half to render.
+   */
+  publish(summary: TaskBoardExtensionPayload): void
+  /** Register one model-visible tool; the returned disposer unregisters it. */
+  registerTool(definition: ToolDefinition): () => void
+}
+
+/** One external provider contributed to the task board. */
+export interface TaskBoardExtension {
+  /** Stable extension id; also the key of this extension's integration payload. */
+  readonly id: string
+  /** Contract version this extension was built against. */
+  readonly apiVersion: number
+  /** Volatile per-extension switch; absent means enabled. Read at use time. */
+  enabled?(): boolean
+  /** Acquire the capability face and start any provider-side work. */
+  start?(host: TaskBoardExtensionHost): void
+  /** Release provider-side work. Never clears stored data. */
+  stop?(): void
+  /** Route one dispatched action; the returned value goes back to the dispatcher. */
+  handleAction?(request: TaskBoardExtensionActionRequest): unknown | Promise<unknown>
+}
+
+/** Board mirror an extension's browser half observes. */
+export interface TaskBoardClientMirror {
+  /** Whether the board's master switch currently runs the extension faces. */
+  enabled: boolean
+  /** Tasks the board currently holds. */
+  tasks: readonly TaskRecord[]
+  /** Published extension summaries, keyed by extension id (opaque to the board). */
+  extensions: Readonly<Record<string, unknown>>
+}
+
+/** Whether a task should be shown on the board; false hides it. */
+export type TaskBoardVisibilityPredicate = (task: TaskRecord) => boolean
+
+/**
+ * Client capability face the board's browser half provides. A provider's
+ * browser half resolves it from the shared cordis service name; it never
+ * value-imports the board package.
+ */
+export interface TaskBoardClientFace {
+  /** Deliver one action through the board's same-origin action channel. */
+  dispatch(request: TaskBoardExtensionActionRequest): Promise<boolean>
+  /** Register one card visibility predicate; the returned disposer removes it. */
+  registerVisibility(predicate: TaskBoardVisibilityPredicate): () => void
+  /** Subscribe to the board mirror. */
+  subscribe(callback: (mirror: TaskBoardClientMirror) => void): () => void
+  /** Read the current board mirror. */
+  snapshot(): TaskBoardClientMirror
+}
+
+/** Owner props of the task-detail seat. */
+export interface TaskBoardDetailSectionProps {
+  task: TaskRecord
+  dispatch: TaskBoardExtensionDispatch
+}
+
+/** Owner props of the settings seat. */
+export interface TaskBoardSettingsSectionProps {
+  dispatch: TaskBoardExtensionDispatch
+}
+
+/** Owner props of the card-decoration seat. */
+export interface TaskBoardCardDecorationProps {
+  task: TaskRecord
+}
+
+/**
+ * Host-half service face published under {@link TASK_BOARD_SERVICE_NAME}. A
+ * provider package's host half resolves this from the shared cordis service
+ * and registers its extension; the board's ledger never crosses this boundary.
+ */
+export interface TaskBoardHostFace {
+  /**
+   * Admit one provider extension. Idempotent by extension id; the returned
+   * disposer releases it without clearing stored data.
+   */
+  registerExtension(extension: TaskBoardExtension): () => void
+  /** Whether the board currently runs a given extension (board x extension). */
+  isExtensionEnabled(extensionId: string): boolean
+}
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    /**
+     * The board's extension service. The host half publishes
+     * {@link TaskBoardHostFace}; the browser half publishes
+     * {@link TaskBoardClientFace} under the same name. The two halves never run
+     * in one process, so the browser half resolves its face through
+     * {@link resolveTaskBoardClientFace} and this shared declaration names the
+     * host face that registration-side consumers type against.
+     */
+    taskBoard: TaskBoardHostFace
+  }
+}
+
+/** The narrow context seat {@link resolveTaskBoardClientFace} needs. */
+export interface TaskBoardClientContextSeat {
+  get(name: string): unknown
+}
+
+/**
+ * Resolve the browser half's client capability face by service name. Returns
+ * undefined when the board is not loaded or the service is not served, so a
+ * provider's browser half can degrade instead of throwing.
+ * @param ctx - client context.
+ * @returns the client face, or undefined.
+ */
+export function resolveTaskBoardClientFace(ctx: TaskBoardClientContextSeat): TaskBoardClientFace | undefined {
+  try {
+    const face = ctx.get(TASK_BOARD_SERVICE_NAME) as TaskBoardClientFace | undefined
+    return face !== undefined && typeof (face as { dispatch?: unknown }).dispatch === 'function' ? face : undefined
+  } catch {
+    return undefined
+  }
+}

package/src/core/freeze-snapshot.ts

@@ -48,8 +48,8 @@ const SECTION_NAMES: Record<SectionKey, string> = {
 /**
  * Sensitive patterns, each matched globally over every field body:
  * PEM private key blocks (whole block collapses to one marker), Bearer
- * credentials, OpenAI sk-, GitHub ghp_, GitLab glpat-, Slack xox* tokens,
- * and AWS access key ids.
+ * credentials, OpenAI sk-, `ghp_`-shaped provider tokens, GitLab glpat-,
+ * Slack xox* tokens, and AWS access key ids.
  */
 const SENSITIVE_PATTERNS: RegExp[] = [
   /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,

package/src/core/handover.ts

@@ -40,7 +40,11 @@ export const HANDOVER_MAX_TOTAL_BYTES = 8 * 1024
 /** Per target-id (workspace/preset) byte cap. */
 export const HANDOVER_MAX_TARGET_BYTES = 256
 
-/** The board's notion of the deployment session-default permission (fail-safe default). */
+/**
+ * Fail-safe baseline for the confirmation gate: what it falls back to when the
+ * deployment pins no baseline of its own and the Host's default permission
+ * preset cannot be read. Every elevation above it stays gated.
+ */
 export const DEFAULT_SESSION_PERMISSION: TaskPermission = 'read-only'
 
 /** Permission elevation rank (higher = more authority). */
@@ -105,6 +109,17 @@ export function exceedsSessionDefault(permission: TaskPermission | undefined, se
   return (PERMISSION_RANK.get(permission) ?? -1) > (PERMISSION_RANK.get(sessionDefault) ?? -1)
 }
 
+/**
+ * Whether a session running at `holder` already carries `permission`: the
+ * permission is absent, or its rank does not exceed the holder's. A teammate
+ * inherits the Lead session's permission and cannot be narrowed below it, so a
+ * subtask's own pin is carried by a team run exactly when this holds, and a pin
+ * it does not carry would be silently dropped instead.
+ */
+export function permissionCarriedBy(holder: TaskPermission, permission: TaskPermission | undefined): boolean {
+  return !exceedsSessionDefault(permission, holder)
+}
+
 /**
  * The confirmation-gate predicate: an elevated permission without a human
  * confirmation stamp. Manual run/rerun and cron must refuse such a card.

package/src/core/issue-form.ts

@@ -0,0 +1,19 @@
+/**
+ * Issue-form vocabulary the card excerpt recognizes.
+ *
+ * Issue forms from an issue tracker (and the zh templates this family's repositories use)
+ * write the same section headings and empty-field placeholders on every issue.
+ * The patterns are data about those forms, not UI copy, so they live in the
+ * shared core rather than in a locale dictionary; the browser half imports them.
+ *
+ * @module @linxin666/dsh-client-ui-task-board/core/issue-form
+ */
+
+/** Section headings whose body is the issue's own summary (zh and en forms). */
+export const SUMMARY_HEADING = /^(?:摘要|概要|概述|简介|描述|问题描述|问题|现象|summary|description|overview|problem|what happened)$/i
+
+/** Values an issue form writes for an empty field. */
+export const EMPTY_FIELD = /^(?:_?no response_?|n\/a|none|无|暂无)$/i
+
+/** A trailing colon (ASCII or full-width) after a heading. */
+export const HEADING_COLON = /[:\uFF1A]\s*$/

package/src/core/poll-cadence.ts

@@ -0,0 +1,41 @@
+/**
+ * Roster-poll cadence: the one recurring Host timer the board holds.
+ *
+ * The cadence is a user setting (seconds), so the bounds and the seconds to
+ * milliseconds conversion live here rather than in either half: the settings
+ * card validates a draft against the same range the Host clamps a hand-edited
+ * configuration to, and a programmatic mount that passes no cadence gets the
+ * default.
+ *
+ * @module dsh-task-board/core/poll-cadence
+ */
+
+/** Cadence used when neither the settings document nor the mount names one. */
+export const DEFAULT_SESSION_POLL_SECONDS = 5
+
+/** Shortest accepted cadence: a faster poll only burns CPU on the Host. */
+export const SESSION_POLL_MIN_SECONDS = 1
+
+/** Longest accepted cadence, five minutes. */
+export const SESSION_POLL_MAX_SECONDS = 300
+
+/**
+ * Clamp a configured cadence into the supported range. A value the schema
+ * would refuse (non-finite, below the floor, above the ceiling) still leaves
+ * the board polling: an out-of-range setting never disables the timer.
+ * @param seconds - configured cadence in seconds, or undefined for the default.
+ * @returns the effective cadence in seconds.
+ */
+export function normalizeSessionPollSeconds(seconds: number | undefined): number {
+  if (seconds === undefined || !Number.isFinite(seconds)) return DEFAULT_SESSION_POLL_SECONDS
+  return Math.min(Math.max(Math.trunc(seconds), SESSION_POLL_MIN_SECONDS), SESSION_POLL_MAX_SECONDS)
+}
+
+/**
+ * The cadence in the milliseconds the Host timer face takes.
+ * @param seconds - configured cadence in seconds, or undefined for the default.
+ * @returns the effective cadence in milliseconds.
+ */
+export function sessionPollMs(seconds: number | undefined): number {
+  return normalizeSessionPollSeconds(seconds) * 1_000
+}

package/src/core/store.ts

@@ -10,11 +10,13 @@
  * localStorage backend.
  */
 import { isValidCron, isValidTimeZone } from './schedule.ts'
-import { isTaskPermission, isTaskStatus, normalizeTags, normalizeTargetId, type ScheduleRule, type TaskFreeze, type TaskRecord, type TaskPermission, type TaskStatus } from './tasks.ts'
+import { SCHEDULE_STOP_REASONS, isTaskPermission, isTaskStatus, normalizeTags, normalizeTargetId, type ScheduleRule, type ScheduleStopReason, type TaskFreeze, type TaskRecord, type TaskPermission, type TaskStatus } from './tasks.ts'
 import { isExecutionOutcome } from './subtask.ts'
 import type { TaskHandover } from './handover.ts'
 import { sanitizeFreezeSnapshot } from './freeze-snapshot.ts'
 import { sanitizeHandover } from './handover.ts'
+import { normalizeTaskIntegrations } from './extension.ts'
+import { normalizeVerification } from './verification.ts'
 
 /** Persistence seam for the task ledger. */
 export interface TaskStore {
@@ -67,8 +69,11 @@ function isTaskRecordShape(value: unknown): value is Omit<TaskRecord, 'status'>
   if (record.workspaceId !== undefined && typeof record.workspaceId !== 'string') return false
   if (record.mode !== undefined && typeof record.mode !== 'string') return false
   if (record.permission !== undefined && typeof record.permission !== 'string') return false
+  if (record.integrations !== undefined && (typeof record.integrations !== 'object' || record.integrations === null || Array.isArray(record.integrations))) return false
+  if (record.hidden !== undefined && typeof record.hidden !== 'boolean') return false
   if (record.reuseSession !== undefined && typeof record.reuseSession !== 'boolean') return false
   if (record.goalRun !== undefined && typeof record.goalRun !== 'boolean') return false
+  if (record.skipVerification !== undefined && typeof record.skipVerification !== 'boolean') return false
   if (!Array.isArray(record.executions)) return false
   for (const execution of record.executions) {
     if (typeof execution !== 'object' || execution === null) return false
@@ -82,6 +87,13 @@ function isTaskRecordShape(value: unknown): value is Omit<TaskRecord, 'status'>
     if (entry.initiatedBy !== undefined && typeof entry.initiatedBy !== 'string') return false
     if (entry.frozenBy !== undefined && typeof entry.frozenBy !== 'string') return false
     if (entry.frozenAt !== undefined && typeof entry.frozenAt !== 'number') return false
+    // An external-outcome marker is optional in BOTH directions: a ledger
+    // written before the field existed carries none, and a non-boolean value
+    // is dropped by the repair below rather than trusted as provenance.
+    if (entry.external !== undefined && typeof entry.external !== 'boolean') return false
+    // The acceptance block is repaired like every other optional field: an
+    // unusable one is dropped, which can only make the board MORE strict.
+    if (entry.verification !== undefined && normalizeVerification(entry.verification) === undefined) return false
   }
   return true
 }
@@ -96,29 +108,73 @@ function normalizeStatus(status: unknown): TaskStatus {
   return isTaskStatus(status) ? status : 'todo'
 }
 
+/** A persisted ms timestamp, kept only when it is a usable finite number. */
+function optionalInstant(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined
+}
+
+/** A persisted positive-integer run cap, or undefined for unlimited/repair. */
+function optionalRunCap(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isInteger(value) && value >= 1 ? value : undefined
+}
+
+/** A persisted stop reason, kept only when it names a reason this build knows. */
+function optionalStopReason(value: unknown): ScheduleStopReason | undefined {
+  return typeof value === 'string' && SCHEDULE_STOP_REASONS.includes(value as ScheduleStopReason)
+    ? value as ScheduleStopReason
+    : undefined
+}
+
 /**
- * Repair a persisted schedule rule: drop rules without a usable cron string,
- * coerce booleans/numbers, and leave `nextRunAt`/`lastTriggeredAt` undefined
- * when missing (a fresh recompute or the next tick fixes them).
+ * Repair a persisted schedule rule. Both modes are repaired field by field and
+ * a rule that carries no usable plan is dropped (the task row survives):
+ * a recurring rule without a well-formed 5-field cron, or a one-shot without a
+ * finite planned instant. A rule written before `mode` existed is a cron rule.
  */
 function normalizeSchedule(schedule: unknown): ScheduleRule | undefined {
   if (typeof schedule !== 'object' || schedule === null) return undefined
   const rule = schedule as Record<string, unknown>
+  // A stored zone survives only when this runtime can resolve it; an unusable
+  // name is dropped (the rule then follows the Host zone) instead of being
+  // kept to fail every later resolve.
+  const timeZone = typeof rule.timeZone === 'string' && isValidTimeZone(rule.timeZone) ? rule.timeZone : undefined
+  const runCountValue = rule.runCount
+  const runCount = typeof runCountValue === 'number' && Number.isInteger(runCountValue) && runCountValue >= 0
+    ? runCountValue
+    : 0
+  const endedAt = optionalInstant(rule.endedAt)
+  const endedReason = optionalStopReason(rule.endedReason)
+  const skippedAt = optionalInstant(rule.skippedAt)
+  const skippedReason = optionalStopReason(rule.skippedReason)
+  const common = {
+    enabled: rule.enabled === true,
+    ...(timeZone === undefined ? {} : { timeZone }),
+    nextRunAt: optionalInstant(rule.nextRunAt),
+    lastTriggeredAt: optionalInstant(rule.lastTriggeredAt),
+    runCount,
+    ...(endedAt === undefined ? {} : { endedAt }),
+    ...(endedReason === undefined ? {} : { endedReason }),
+    ...(skippedAt === undefined ? {} : { skippedAt }),
+    ...(skippedReason === undefined ? {} : { skippedReason }),
+  }
+  if (rule.mode === 'once') {
+    const at = optionalInstant(rule.at)
+    // A one-shot with no instant can never fire; drop it rather than keep a
+    // rule the scheduler would have to interpret.
+    if (at === undefined) return undefined
+    return { ...common, mode: 'once', at }
+  }
   // Reject (drop) a schedule whose cron is not a well-formed 5-field
   // expression: a malformed rule would otherwise linger as a never-firing
   // schedule instead of being dropped for later repair.
   if (typeof rule.cron !== 'string') return undefined
   if (rule.cron.trim() === '' || !isValidCron(rule.cron)) return undefined
-  // A stored zone survives only when this runtime can resolve it; an unusable
-  // name is dropped (the rule then follows the Host zone) instead of being
-  // kept to fail every later resolve.
-  const timeZone = typeof rule.timeZone === 'string' && isValidTimeZone(rule.timeZone) ? rule.timeZone : undefined
+  const maxRuns = optionalRunCap(rule.maxRuns)
   return {
-    enabled: rule.enabled === true,
+    ...common,
+    mode: 'cron',
     cron: rule.cron,
-    ...(timeZone === undefined ? {} : { timeZone }),
-    nextRunAt: typeof rule.nextRunAt === 'number' ? rule.nextRunAt : undefined,
-    lastTriggeredAt: typeof rule.lastTriggeredAt === 'number' ? rule.lastTriggeredAt : undefined,
+    ...(maxRuns === undefined ? {} : { maxRuns }),
   }
 }
 
@@ -199,6 +255,10 @@ export function parseLedger(raw: string | null): TaskRecord[] {
       runGroupId: normalizeTargetId(execution.runGroupId),
       ownResult: isExecutionOutcome(execution.ownResult) ? execution.ownResult : undefined,
       ownError: typeof execution.ownError === 'string' ? execution.ownError : undefined,
+      // A malformed acceptance block is dropped rather than dropping the
+      // execution record: the board then treats that run as unverified.
+      verification: normalizeVerification(execution.verification),
+      external: execution.external === true ? true : undefined,
     }))
     // Execution targets are normalized like the schedule: blank strings
     // clear the pin and unknown permission strings from a future version
@@ -208,9 +268,12 @@ export function parseLedger(raw: string | null): TaskRecord[] {
     task.archivedAt = typeof row.archivedAt === 'number' && Number.isFinite(row.archivedAt) ? row.archivedAt : undefined
     task.permission = isTaskPermission(row.permission) ? row.permission as TaskPermission : undefined
     task.reuseSession = row.reuseSession === true ? true : undefined
-    // The goal opt-in is stored only when it is OFF: absent means the default
-    // (start each run with /goal), so a hand-edited true normalizes back to it.
-    task.goalRun = row.goalRun === false ? false : undefined
+    // The goal opt-in is stored only when it is ON: absent means the default
+    // (one plain turn per run), so a hand-edited false normalizes back to it.
+    task.goalRun = row.goalRun === true ? true : undefined
+    // The acceptance opt-out is stored only when it is ON: absent inherits the
+    // board-wide switch, so a hand-edited false normalizes back to inherit.
+    task.skipVerification = row.skipVerification === true ? true : undefined
     task.freeze = normalizeFreeze(row.freeze)
     task.handover = normalizeHandover(row.handover)
     // Tags are repaired field by field like the schedule: a malformed entry is
@@ -218,6 +281,8 @@ export function parseLedger(raw: string | null): TaskRecord[] {
     // dropping the task row.
     task.tags = normalizeTags(row.tags)
     task.permissionConfirmedAt = typeof row.permissionConfirmedAt === 'number' && Number.isFinite(row.permissionConfirmedAt) ? row.permissionConfirmedAt : undefined
+    task.integrations = normalizeTaskIntegrations(row.integrations)
+    task.hidden = row.hidden === true ? true : undefined
     tasks.push(task)
   }
   return tasks