@opengeni/api-router 3.0.1 → 3.1.2

package/src/sandbox/viewer.ts

@@ -26,19 +26,18 @@ import {
   hasGitHubRepositorySelection,
   resolveStreamTokenSecret,
   sandboxLifecycleTransitionWaitMs,
+  sandboxWarmRateMicrosPerSecond,
   stableSandboxEnvironmentForRun,
 } from "@opengeni/config";
 import type { Settings } from "@opengeni/config";
 import { githubAppBotIdentity } from "@opengeni/github";
-import { type Session, type StreamUrlRotatedPayload } from "@opengeni/contracts";
+import { type AccessGrant, type Session, type StreamUrlRotatedPayload } from "@opengeni/contracts";
 import {
   acquireLease,
   getLiveEnrollmentConnection,
   getSandbox,
-  getScheduledScopedRigVersionMetadata,
   getSandboxSessionEnvelope,
-  heartbeatLeaseHolder,
-  loadWorkspaceEnvironmentForRun,
+  heartbeatLeaseHolderStatus,
   markSandboxProviderReady,
   markWarmLeaseInstanceLost,
   readLease,
@@ -47,6 +46,7 @@ import {
   releaseLeaseHolder,
   SandboxLeaseSupersededError,
   SandboxViewerAdmissionBlockedError,
+  SandboxPaidComputeAdmissionError,
   type Database,
   type LeaseSnapshot,
   type SandboxRecord,
@@ -154,51 +154,9 @@ export async function sessionAttachEnvironment(
    *  the materialization audit fact. Null records the legacy service sentinel. */
   attachSubjectId: string | null,
 ): Promise<Record<string, string>> {
-  const workspaceEnvironmentValues: Record<string, string> = {};
-  const rigVersion =
-    session.rigId && session.rigVersionId
-      ? await getScheduledScopedRigVersionMetadata(
-          services.db,
-          {
-            accountId: session.accountId,
-            workspaceId,
-            subjectId: attachSubjectId ?? "session-attach",
-          },
-          session.rigId,
-          session.rigVersionId,
-        )
-      : null;
-  for (const variableSetId of rigVersion?.version.defaultVariableSetIds ?? []) {
-    const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(
-      services.db,
-      services.settings,
-      {
-        accountId: session.accountId,
-        workspaceId,
-        variableSetId,
-        authority: { kind: "session_attach", sessionId: session.id, subjectId: attachSubjectId },
-      },
-    );
-    Object.assign(workspaceEnvironmentValues, workspaceEnvironment?.values ?? {});
-  }
-  // Older persisted/test projections can omit the plural field. Preserve the
-  // legacy final alias as the single explicit selection until every caller is
-  // guaranteed to have crossed the plural contract boundary.
-  const explicitVariableSetIds =
-    session.variableSetIds ?? (session.variableSetId ? [session.variableSetId] : []);
-  for (const variableSetId of explicitVariableSetIds) {
-    const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(
-      services.db,
-      services.settings,
-      {
-        accountId: session.accountId,
-        workspaceId,
-        variableSetId,
-        authority: { kind: "session_attach", sessionId: session.id, subjectId: attachSubjectId },
-      },
-    );
-    Object.assign(workspaceEnvironmentValues, workspaceEnvironment?.values ?? {});
-  }
+  // The manifest carries deployment constants only (W1): user secrets are
+  // resolved per command from `{{secret:…}}` references, never seeded here.
+  void attachSubjectId;
   // Build the env with the SESSION's backend, not the deployment default: the
   // stable base is backend-aware (HOME = the descriptor workspaceRoot, and the
   // git token-file/askpass pointers derive from HOME), the box is established
@@ -211,11 +169,7 @@ export async function sessionAttachEnvironment(
     session.sandboxBackend !== services.settings.sandboxBackend
       ? { ...services.settings, sandboxBackend: session.sandboxBackend }
       : services.settings;
-  const environment = stableSandboxEnvironmentForRun(
-    settingsForSession,
-    workspaceEnvironmentValues,
-    { workspaceId },
-  );
+  const environment = stableSandboxEnvironmentForRun(settingsForSession, { workspaceId });
   if (hasGitCredentialRepositorySelection(session.resources)) {
     applyGitAuthPointerEnvironment(
       environment,
@@ -245,6 +199,10 @@ export async function attachViewer(
     /** The authenticated subject attaching this viewer (0281): recorded on
      *  the holder row together with the live session authority epoch. */
     viewerSubjectId?: string;
+    /** The authenticated route grant, when one drives the attach. It resolves
+     *  the session's Sandbox Environment for an agent attempt as its
+     *  initiating human. */
+    grant?: AccessGrant;
     /** Cancel lifecycle waiting when the originating HTTP request disconnects. */
     waitSignal?: AbortSignal;
   },
@@ -275,7 +233,12 @@ export async function attachViewer(
     : null;
   const leaseTtlMs = settings.sandboxLeaseTtlMs;
   const sandboxGroupId = session.sandboxGroupId;
-  const sandboxRuntime = await resolveSessionSandboxRuntime(db, settings, session);
+  const sandboxRuntime = await resolveSessionSandboxRuntime(
+    db,
+    settings,
+    session,
+    input.grant ? { grant: input.grant } : { subjectId: attachSubjectId },
+  );
 
   const release = async (): Promise<void> => {
     await releaseLeaseHolder(db, {
@@ -300,8 +263,13 @@ export async function attachViewer(
       ...(attachSubjectId ? { viewerSubjectId: attachSubjectId } : {}),
       ...(attachAuthorityEpoch !== null ? { viewerAuthorityEpoch: attachAuthorityEpoch } : {}),
       backend: session.sandboxBackend,
+      warmBilling: {
+        mode: settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond(settings, session.sandboxBackend),
+      },
       os: session.sandboxOs,
       image: sandboxRuntime.image,
+      imagePolicy: "new_creates_only",
       rigVersionId: session.rigVersionId,
       leaseTtlMs,
       warmingLeaseTtlMs: settings.sandboxWarmingTimeoutMs,
@@ -309,11 +277,14 @@ export async function attachViewer(
       ...(input.waitSignal ? { waitSignal: input.waitSignal } : {}),
     });
   } catch (error) {
+    if (error instanceof SandboxPaidComputeAdmissionError) {
+      throw new HTTPException(402, { message: error.message, cause: error });
+    }
     if (error instanceof SandboxViewerAdmissionBlockedError) {
       throw new HTTPException(error.reason === "balance" ? 402 : 429, {
         message:
           error.reason === "balance"
-            ? "insufficient OpenGeni credits for an idle sandbox viewer"
+            ? "insufficient Opengeni credits for an idle sandbox viewer"
             : "workspace sandbox warm allowance exhausted",
         cause: error,
       });
@@ -592,7 +563,7 @@ export async function heartbeatViewer(
     expectedEpoch: number;
   },
 ): Promise<boolean> {
-  const alive = await heartbeatLeaseHolder(services.db, {
+  const status = await heartbeatLeaseHolderStatus(services.db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     sandboxGroupId: input.sandboxGroupId,
@@ -600,8 +571,12 @@ export async function heartbeatViewer(
     holderId: input.viewerId,
     leaseTtlMs: services.settings.sandboxLeaseTtlMs,
     expectedEpoch: input.expectedEpoch,
+    billingMode: services.settings.sandboxWarmBillingMode,
   });
-  if (!alive) return false;
+  // A funding fence stops renewing paid provider time, but the holder is
+  // deliberately kept alive while the viewer winds down or adds funds. Other
+  // fences (epoch/rotation/drain) still require the client to re-attach.
+  if (!status.leaseExtended) return status.holderAlive && status.fence === "funding";
   const lease = await readLease(services.db, input.workspaceId, input.sandboxGroupId);
   if (lease?.liveness === "warm" && lease.leaseEpoch === input.expectedEpoch && lease.instanceId) {
     await renewSandboxProviderExpiration({

package/src/sandbox-file-artifacts.ts

@@ -27,6 +27,12 @@ import {
 } from "@opengeni/db";
 import { retryWhileMissing, type ObjectHead, type ObjectStorage } from "@opengeni/storage";
 import { HTTPException } from "hono/http-exception";
+import {
+  isConnectedMachineAbsolutePath,
+  relativeConnectedMachinePath,
+  resolveConnectedMachinePath,
+  type SandboxChannelAService,
+} from "@opengeni/runtime/sandbox";
 
 import { withChannelARead } from "./sandbox/channel-a";
 import { sanitizeFilename } from "./routes/files";
@@ -98,13 +104,12 @@ async function publishSandboxFileArtifactInScope(
     });
   }
 
-  const path = sandboxArtifactRelativePath(input.path);
   const maxArtifactBytes = Math.min(SANDBOX_FILE_ARTIFACT_MAX_BYTES, storage.maxSinglePutSizeBytes);
   if (maxArtifactBytes < 1) {
     throw new HTTPException(503, { message: "object storage cannot accept artifact files" });
   }
   const readLimit = Math.min(25 * 1024 * 1024, maxArtifactBytes + FILE_READ_SENTINEL_BYTES);
-  const read = await withChannelARead(
+  const { path, sandboxPath, read } = await withChannelARead(
     {
       db: deps.db,
       settings: deps.settings,
@@ -116,10 +121,11 @@ async function publishSandboxFileArtifactInScope(
       workspaceId: input.grant.workspaceId,
       session: input.session,
       subjectId: input.grant.subjectId,
+      grant: input.grant,
       ...(input.signal ? { waitSignal: input.signal } : {}),
       operation: "artifact.publish",
     },
-    ({ service }) => service.fsRead({ path, encoding: "base64", maxBytes: readLimit }),
+    ({ service }) => readSandboxArtifactFile(service, input.path, readLimit),
   );
   if (read.truncated || read.sizeBytes > maxArtifactBytes) {
     throw new HTTPException(413, {
@@ -234,48 +240,54 @@ async function publishSandboxFileArtifactInScope(
   });
   return SandboxFileArtifactReceipt.parse({
     type: "sandbox_file",
-    sandboxPath: `/workspace/${path}`,
+    sandboxPath,
     filename,
     artifact,
   });
 }
 
-export function sandboxArtifactRelativePath(value: string): string {
+/** Use the root captured by the same fenced Channel-A service that reads bytes,
+ * not the session's placement-home label or a caller-supplied root. */
+export async function readSandboxArtifactFile(
+  service: Pick<SandboxChannelAService, "capabilities" | "fsRead">,
+  value: string,
+  maxBytes: number,
+) {
+  const root = service.capabilities().FileSystem.root;
+  const path = sandboxArtifactRelativePath(value, root);
+  const sandboxPath = resolveConnectedMachinePath(root, path);
+  const read = await service.fsRead({ path, encoding: "base64", maxBytes });
+  return { path, sandboxPath, read };
+}
+
+export function sandboxArtifactRelativePath(value: string, workspaceRoot = "/workspace"): string {
   let path = value.trim();
   if (path.startsWith("sandbox:")) {
     path = path.slice("sandbox:".length);
   }
-  if (path === "/workspace" || path === "/workspace/") {
+  if (!path || /[\\/]$/.test(path)) {
     throw new HTTPException(400, { message: "sandbox artifact path must name a file" });
   }
-  if (path.startsWith("/workspace/")) {
-    path = path.slice("/workspace/".length);
-  } else if (path.startsWith("/")) {
+  let absolute: string;
+  let relative: string | null;
+  try {
+    if (!isConnectedMachineAbsolutePath(workspaceRoot)) throw new Error("Missing workspace root");
+    absolute = resolveConnectedMachinePath(workspaceRoot, path);
+    relative = relativeConnectedMachinePath(workspaceRoot, absolute);
+  } catch {
     throw new HTTPException(400, {
-      message: "sandbox artifact path must be inside /workspace",
+      message: "sandbox artifact path is invalid for this workspace",
     });
   }
-  if (!path) {
-    throw new HTTPException(400, { message: "sandbox artifact path must name a file" });
-  }
-  if (path.includes("\0")) {
-    throw new HTTPException(400, { message: "sandbox artifact path is invalid" });
-  }
-  const normalized = posix.normalize(path);
-  if (
-    normalized === "." ||
-    normalized === ".." ||
-    normalized.startsWith("../") ||
-    normalized.endsWith("/")
-  ) {
+  if (!relative) {
     throw new HTTPException(400, {
-      message: "sandbox artifact path must canonically name a file inside /workspace",
+      message: "sandbox artifact path must name a file inside the active workspace root",
     });
   }
-  if (`/workspace/${normalized}`.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
+  if (absolute.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
     throw new HTTPException(400, { message: "sandbox artifact path is too long" });
   }
-  return normalized;
+  return relative;
 }
 
 export function sandboxArtifactSafeFilename(filename: string): string {
@@ -295,6 +307,14 @@ export function sandboxFileContentType(filename: string): string {
       ".jpg": "image/jpeg",
       ".json": "application/json",
       ".md": "text/markdown",
+      ".mp4": "video/mp4",
+      ".webm": "video/webm",
+      ".ogv": "video/ogg",
+      ".mp3": "audio/mpeg",
+      ".m4a": "audio/mp4",
+      ".ogg": "audio/ogg",
+      ".wav": "audio/wav",
+      ".flac": "audio/flac",
       ".pdf": "application/pdf",
       ".png": "image/png",
       ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
@@ -314,7 +334,13 @@ export function sandboxArtifactIdentity(input: {
   sha256: string;
 }): { fileId: string; uploadId: string } {
   const digest = createHash("sha256")
-    .update("opengeni-sandbox-file-artifact-v1\0")
+    // Newly classified media must not collide with old binary-typed publications.
+    // Preserve the v1 identity for every previously supported format.
+    .update(
+      /^(audio|video)\//.test(sandboxFileContentType(input.path))
+        ? "opengeni-sandbox-media-artifact-v1\0"
+        : "opengeni-sandbox-file-artifact-v1\0",
+    )
     .update(input.workspaceId)
     .update("\0")
     .update(input.sessionId)

package/src/scheduled-task-blockers.ts

@@ -0,0 +1,293 @@
+import {
+  NOTIFICATION_SUBTITLE_MAX_CHARS,
+  SessionNotificationPostedPayload,
+  SessionNotificationWithdrawnPayload,
+} from "@opengeni/contracts";
+import {
+  getPendingScheduledTaskBlockerNotice,
+  listScheduledTaskBlockerReviews,
+  reviewScheduledTaskBlockers,
+  settleScheduledTaskBlockerNotice,
+  type Database,
+  type ScheduledTaskBlockerDecision,
+  type ScheduledTaskBlockerFacts,
+  type ScheduledTaskBlockerRun,
+} from "@opengeni/db";
+import { appendAndPublishEvents, type EventBus } from "@opengeni/events";
+import type { Observability } from "@opengeni/observability";
+
+/**
+ * A schedule must never stay stuck without its owner knowing. After each
+ * settled scheduled run:
+ *
+ * - When the platform knows no later run can start until a person acts (its
+ *   chat is paused or gone, a pinned account or other resource it needs is
+ *   unavailable, or it was refused as non-retryable), the schedule pauses
+ *   itself with that reason and its owner is told once.
+ * - When runs keep failing or being skipped for a reason that may clear by
+ *   itself, the owner is told once, after {@link SCHEDULED_TASK_BLOCKER_STREAK}
+ *   in a row; the schedule keeps running. A single skip or failure is normal.
+ *
+ * The notice is withdrawn when a later run succeeds or a person resumes,
+ * pauses or deletes the schedule. Only scheduled (not manual) runs count, and
+ * only runs since the schedule was last edited or resumed.
+ */
+export const SCHEDULED_TASK_BLOCKER_STREAK = 3;
+
+const SETTLED = new Set(["succeeded", "failed", "skipped"]);
+
+type Blocker = { reason: string; text: string };
+
+const RESUME = "then resume the schedule.";
+
+const NON_RETRYABLE_REFUSAL_TEXT: Record<string, string> = {
+  scheduled_authority_unavailable: `The access it was set up with is no longer valid. Refresh the schedule's access, ${RESUME}`,
+  machine_target_unavailable: `The machine it runs on is no longer available. Choose another machine or reconnect this one, ${RESUME}`,
+  machine_enrollment_inactive: `The machine it runs on is disconnected from Opengeni. Reconnect the machine, ${RESUME}`,
+  variable_set_unavailable: `A variable set it uses no longer exists or can't be used. Edit the schedule, ${RESUME}`,
+  rig_version_unavailable: `Its rig has no usable version. Publish a rig version or edit the schedule, ${RESUME}`,
+  scheduled_model_unavailable: `Its model is no longer available. Edit the schedule to choose another model, ${RESUME}`,
+};
+
+const RETRYABLE_REFUSAL_TEXT: Record<string, string> = {
+  machine_enrollment_inactive: "the machine it runs on is disconnected",
+  insufficient_credits: "the workspace is out of credits",
+  allowance_exhausted: "the usage allowance is used up",
+  monthly_model_cost_limit: "the monthly model cost limit was reached",
+  monthly_agent_run_limit: "the monthly run limit was reached",
+  session_usage_limit: "the schedule reached its usage limit",
+};
+
+/** A blocker no later run can get past until a person acts, or null. */
+export function scheduledRunHardBlocker(
+  task: Pick<ScheduledTaskBlockerFacts["task"], "runMode">,
+  run: ScheduledTaskBlockerRun,
+): Blocker | null {
+  if (run.admissionDiagnostic) {
+    return {
+      reason: "connection_account_unavailable",
+      text: `A connected account it needs can no longer be used. Reconnect that account or refresh the schedule's access, ${RESUME}`,
+    };
+  }
+  if (run.admissionRefusal && !run.admissionRefusal.retryable) {
+    const reason = run.admissionRefusal.reason;
+    return {
+      reason,
+      text:
+        NON_RETRYABLE_REFUSAL_TEXT[reason] ??
+        `Every run is refused before it starts (${reason}). Fix that, ${RESUME}`,
+    };
+  }
+  switch (run.error) {
+    case "scheduled_session_paused":
+      return {
+        reason: run.error,
+        text: `Its chat is paused, so no run can start there. Resume the chat, ${RESUME}`,
+      };
+    case "session_cancelled":
+      // A run that starts a new chat each time is not blocked by one ended chat.
+      return task.runMode === "new_session_per_run"
+        ? null
+        : {
+            reason: run.error,
+            text: `The chat it runs in has ended, so no run can start there. Point the schedule at another chat or let it start a new chat each run, ${RESUME}`,
+          };
+    case "scheduled_target_session_unavailable":
+      return {
+        reason: run.error,
+        text: `The chat it runs in no longer exists. Point the schedule at another chat or let it start a new chat each run, ${RESUME}`,
+      };
+    case "scheduled_model_unavailable":
+      return { reason: run.error, text: NON_RETRYABLE_REFUSAL_TEXT.scheduled_model_unavailable! };
+    default:
+      return null;
+  }
+}
+
+function streakBlocker(streak: readonly ScheduledTaskBlockerRun[]): Blocker {
+  const count = streak.length;
+  if (streak.every((run) => run.error === "scheduled_session_not_idle")) {
+    return {
+      reason: "scheduled_session_not_idle",
+      text: `The last ${count} scheduled runs were skipped because its chat was still busy with earlier work. Check whether that chat is stuck. The schedule keeps trying.`,
+    };
+  }
+  const refusal = streak[0]?.admissionRefusal;
+  if (
+    refusal?.retryable &&
+    streak.every(
+      (run) => run.admissionRefusal?.retryable && run.admissionRefusal.reason === refusal.reason,
+    )
+  ) {
+    return {
+      reason: refusal.reason,
+      text: `The last ${count} scheduled runs were skipped because ${
+        RETRYABLE_REFUSAL_TEXT[refusal.reason] ?? `they were refused (${refusal.reason})`
+      }. Runs start again once that clears.`,
+    };
+  }
+  const latest = streak[0]!;
+  return {
+    reason: latest.error ?? latest.status,
+    text: `The last ${count} scheduled runs failed or were skipped. Open the latest run to see why. The schedule keeps trying.`,
+  };
+}
+
+export function scheduledTaskBlockerNoticeKey(taskId: string): string {
+  return `schedule-${taskId}`;
+}
+
+function clip(text: string, max: number): string {
+  return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;
+}
+
+function notice(
+  facts: ScheduledTaskBlockerFacts,
+  run: ScheduledTaskBlockerRun,
+  state: "notified" | "paused",
+  blocker: Blocker,
+): Extract<ScheduledTaskBlockerDecision, { kind: "block" }>["notice"] {
+  // The chat the owner opens from the notice: the blocked run's own, else the
+  // chat the schedule runs in, else the most recent run's.
+  const sessionId =
+    run.sessionId ??
+    facts.task.reusableSessionId ??
+    facts.runs.find((candidate) => candidate.sessionId !== null)?.sessionId ??
+    null;
+  if (!sessionId) return null;
+  const key = scheduledTaskBlockerNoticeKey(facts.task.id);
+  const payload = SessionNotificationPostedPayload.parse({
+    key,
+    title: state === "paused" ? "Schedule paused itself" : "Schedule needs attention",
+    subtitle: clip(facts.task.name.trim() || "Scheduled task", NOTIFICATION_SUBTITLE_MAX_CHARS),
+    body:
+      state === "paused"
+        ? `${blocker.text} It stays paused until someone resumes it.`
+        : blocker.text,
+    urgency: "normal",
+    replaced: false,
+  });
+  return { sessionId, key, payload };
+}
+
+/** The pure review of one schedule's newest settled scheduled run. */
+export function decideScheduledTaskBlocker(
+  facts: ScheduledTaskBlockerFacts,
+): ScheduledTaskBlockerDecision {
+  const { task, review, runs } = facts;
+  const blocked = review !== null && review.state !== "clear";
+  // A person acted: resumed a self-paused schedule, or paused or deleted one
+  // they were told about. Keep the reviewed run; a new one is reviewed next.
+  if (task.deleted) return blocked ? { kind: "clear", reviewedRunId: null } : none(null);
+  if (review?.state === "paused" && task.status === "active") {
+    return { kind: "clear", reviewedRunId: null };
+  }
+  if (review?.state === "notified" && task.status !== "active") {
+    return { kind: "clear", reviewedRunId: null };
+  }
+  if (task.status !== "active") return none(null);
+  const latest = runs[0];
+  if (!latest || !SETTLED.has(latest.status) || latest.id === review?.reviewedRunId) {
+    return none(null);
+  }
+  if (latest.status === "succeeded") {
+    return review?.state === "notified"
+      ? { kind: "clear", reviewedRunId: latest.id }
+      : none(latest.id);
+  }
+  // Runs before the last edit or resume say nothing about the schedule now.
+  const current = (run: ScheduledTaskBlockerRun) => run.createdAt >= task.updatedAt;
+  const hard = current(latest) ? scheduledRunHardBlocker(task, latest) : null;
+  if (hard) {
+    return {
+      kind: "block",
+      state: "paused",
+      reason: hard.reason,
+      message: hard.text,
+      blockedRunId: latest.id,
+      blockedSince: latest.createdAt,
+      reviewedRunId: latest.id,
+      notice: notice(facts, latest, "paused", hard),
+    };
+  }
+  if (review?.state === "notified") return none(latest.id);
+  const streak: ScheduledTaskBlockerRun[] = [];
+  for (const run of runs) {
+    if (!SETTLED.has(run.status) || run.status === "succeeded" || !current(run)) break;
+    streak.push(run);
+  }
+  if (streak.length < SCHEDULED_TASK_BLOCKER_STREAK) return none(latest.id);
+  const soft = streakBlocker(streak);
+  const first = streak.at(-1)!;
+  return {
+    kind: "block",
+    state: "notified",
+    reason: soft.reason,
+    message: soft.text,
+    blockedRunId: first.id,
+    blockedSince: first.createdAt,
+    reviewedRunId: latest.id,
+    notice: notice(facts, latest, "notified", soft),
+  };
+}
+
+function none(reviewedRunId: string | null): ScheduledTaskBlockerDecision {
+  return { kind: "none", reviewedRunId };
+}
+
+type Dependencies = {
+  db: Database;
+  bus: EventBus;
+  observability?: Pick<Observability, "error"> | undefined;
+};
+
+function sessionMissing(error: unknown): boolean {
+  return error instanceof Error && /^Session not found: /u.test(error.message);
+}
+
+/** Post or withdraw the owner notice a review left pending. */
+export async function deliverScheduledTaskBlockerNotice(
+  deps: Dependencies,
+  workspaceId: string,
+  taskId: string,
+): Promise<void> {
+  const pending = await getPendingScheduledTaskBlockerNotice(deps.db, workspaceId, taskId);
+  if (!pending) return;
+  try {
+    await appendAndPublishEvents(deps.db, deps.bus, workspaceId, pending.sessionId, [
+      pending.pending === "post"
+        ? {
+            type: "session.notification.posted",
+            payload: SessionNotificationPostedPayload.parse(pending.payload),
+          }
+        : {
+            type: "session.notification.withdrawn",
+            payload: SessionNotificationWithdrawnPayload.parse({ key: pending.key }),
+          },
+    ] as Parameters<typeof appendAndPublishEvents>[4]);
+  } catch (error) {
+    // A deleted chat cannot carry the notice; the schedule page still shows why.
+    if (!sessionMissing(error)) throw error;
+  }
+  await settleScheduledTaskBlockerNotice(deps.db, workspaceId, taskId, pending);
+}
+
+/** One bounded pass over schedules with a run to review or a notice to deliver. */
+export async function reviewScheduledTaskBlockerInventory(deps: Dependencies): Promise<void> {
+  for (const candidate of await listScheduledTaskBlockerReviews(deps.db)) {
+    try {
+      await reviewScheduledTaskBlockers(
+        deps.db,
+        candidate.workspace_id,
+        candidate.id,
+        decideScheduledTaskBlocker,
+      );
+      await deliverScheduledTaskBlockerNotice(deps, candidate.workspace_id, candidate.id);
+    } catch (error) {
+      deps.observability?.error("Scheduled task blocker review will retry", {
+        taskId: candidate.id,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+}

package/src/scheduled-task-deletion.ts

@@ -1,6 +1,10 @@
 import { scheduledTaskKnowledgeSource } from "@opengeni/contracts";
-import type { ScheduledTask as ScheduledTaskValue } from "@opengeni/contracts";
-import { deleteScheduledTaskLifecycle, type ApiRouteDeps } from "@opengeni/core";
+import type { AccessGrant, ScheduledTask as ScheduledTaskValue } from "@opengeni/contracts";
+import {
+  assertScheduledTaskMutationOwner,
+  deleteScheduledTaskLifecycle,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import type { TemporalScheduleCleanupClaim } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 import * as z4 from "zod/v4";
@@ -100,13 +104,19 @@ export async function cleanupScheduledTaskConnectorAuthorization(
 /** Shared HTTP/MCP domain operation: authorize, tombstone, persist, then accelerate cleanup. */
 export async function deleteScheduledTaskWithDurableCleanup(
   deps: ApiRouteDeps,
-  input: { workspaceId: string; taskId: string; subjectId: string },
+  request: { grant: AccessGrant; taskId: string },
 ): Promise<{ task: ScheduledTaskValue; changed: boolean }> {
+  const input = {
+    workspaceId: request.grant.workspaceId,
+    subjectId: request.grant.subjectId,
+    taskId: request.taskId,
+  };
   const result = await deleteScheduledTaskLifecycle({
     db: deps.db,
     workspaceId: input.workspaceId,
     taskId: input.taskId,
     subjectId: input.subjectId,
+    beforeDeleteCommit: (tx) => assertScheduledTaskMutationOwner(tx, request.grant, request.taskId),
     preflightConnectorAuthorization: async (task) =>
       await preflightConnectorAuthorization(deps, task, input.subjectId),
     cleanupConnectorAuthorization: async (db, task) =>