@opengeni/core 0.28.1 → 1.0.0

package/src/domain/scheduled-tasks.ts

@@ -1,38 +1,105 @@
-import type { Settings } from "@opengeni/config";
+import {
+  getSessionTurnClaudeProviderAccountAuthoritySnapshot,
+  getScheduledTaskClaudeProviderAccountAuthoritySnapshot,
+  resolveClaudeProviderAccountAuthoritySnapshotForAcceptance,
+} from "@opengeni/db";
+import {
+  SCHEDULED_SLACK_BOT_POSTING_TOOLS,
+  scheduledTaskKnowledgeSource,
+  requireScheduledTaskKnowledgeSource,
+  scheduledOccurrencePayloadUtf8Bytes,
+  mergeResourceRefs,
+  SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,
+  SCHEDULED_TASK_OCCURRENCE_PAYLOAD_INGRESS_HEADROOM_BYTES,
+} from "@opengeni/contracts";
+import {
+  allowedFirstPartyMcpToolsForSession,
+  resolveFirstPartyMcpToolPolicy,
+  type Settings,
+} from "@opengeni/config";
+import {
+  ATLASSIAN_NATIVE_RETIRED_MESSAGE,
+  isRetiredNativeAtlassianSource,
+  isRetiredNativeAtlassianTask,
+} from "@opengeni/contracts/atlassian-native-retirement";
 import type {
   AccessGrant,
-  McpPersonalConnectionDelegation,
   KnowledgeSourceSyncAction,
+  Permission,
   ScheduledTask,
   ScheduledTaskAgentConfig,
   Session,
+  ToolRef,
   SessionAuthorizationPort,
   SessionAuthorizationSurface,
   CreateScheduledTaskRequest as CreateScheduledTaskPayload,
   UpdateScheduledTaskRequest as UpdateScheduledTaskPayload,
   XaiProviderAccountAuthoritySnapshotV1,
+  ClaudeProviderAccountAuthoritySnapshotV1,
+} from "@opengeni/contracts";
+import {
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
+  resolveWorkspaceSessionToolDefaults,
+  resolveBundledSkillSelection,
+  SessionAgentAccess,
+  SessionScopeSubjectId,
+  SessionMemoryScope,
+  readTurnExecutionPolicyV1,
 } from "@opengeni/contracts";
-import { OPENGENI_SLACK_BOT_SESSION_METADATA_KEY } from "@opengeni/contracts";
 import {
   createScheduledTask,
+  scheduledTaskMutationOwnerMatches,
+  getAgentLearningSettings,
+  saveAgentLearningSettings,
+  type KnowledgeContext,
+  dbSql,
   deleteScheduledTask,
   getConnectionMetadata,
+  getEnrollment,
+  getLiveEnrollmentConnection,
   getKnowledgeSourceForSyncAuthority,
   getNestedAgentDepthDeploymentPolicy,
   getRig,
+  getScheduledScopedRigVersionMetadata,
   getScheduledTask,
-  getScheduledTaskPersonalConnectionDelegations,
+  getScheduledTaskIncludingDeletedForUpdate,
+  getScheduledTaskXaiProviderAccountAuthoritySnapshot,
+  getSandbox,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
   getSession,
+  getSessionTurnForAttempt,
+  getSessionAuthorityProjection,
+  getWorkspaceDefaultRigId,
+  withSessionRlsActorContext,
+  nestedPostgresSqlState,
   requireWorkspace,
   scopedKnowledgeScopeKey,
   updateScheduledTask,
+  ScheduledTaskHeadChangedError,
+  withWorkspaceSubjectRls,
   resolveXaiProviderAccountAuthoritySnapshotForAcceptance,
   type Database,
+  type ScheduledTaskCreatorPolicy,
+  type SessionCommandActor,
+  type TemporalScheduleCleanupClaim,
   type UpdateScheduledTaskInput,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
-import { hasPermission, requirePermission } from "../access";
+import { GOOGLE_DRIVE_PUBLICATION_SERVER_ID } from "@opengeni/contracts/google-drive";
+import { PERSONAL_GITHUB_CONNECTION_SURFACE_ID } from "@opengeni/contracts/personal-github";
+import { personalGitHubRepositoryResources } from "./resources";
+import { knowledgeContextForAccess } from "./knowledge";
+import { fileOwnerContextForAccess, fileOwnerContextForAgent } from "./file-owner";
+import { isDeepStrictEqual } from "node:util";
+import {
+  hasPermission,
+  requireExplicitPermissionDelegation,
+  isDeveloperSetupAuthorization,
+  isDeveloperSetupGrant,
+  requirePermission,
+  type AccessGrantAuthorization,
+} from "../access";
 import {
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
@@ -40,29 +107,37 @@ import {
 } from "../session-authorization";
 import type { SessionWorkflowClient } from "../dependencies";
 import type { ObjectStorageDependency } from "../dependencies";
+import { lockActiveCustomModelForAdmission, workspaceCustomModelReference } from "../model-catalog";
 import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
+import {
+  resolveSessionToolPolicy,
+  workspaceSessionToolPolicyDefaultServerIds,
+} from "./session-tool-policy";
+import { prepareExternalLinkTaskAdmission } from "../application/external-link-work-admission";
 import { validateVariableSetAttachment } from "./environments";
 import {
-  freezePersonalConnectionDelegations,
+  freezeConnectionAccounts,
   personalConnectionDelegationSourceForGrant,
-  personalConnectionDelegationsEqual,
 } from "./personal-connection-delegations";
 import {
   assertWorkspaceModelPolicyAllows,
   canonicalConfiguredModel,
   creationInitiatorForGrant,
+  modelUnavailableHttpException,
+  settingsWithSessionMcpServerMetadata,
 } from "./sessions";
 import {
   hasReservedOpenGeniSlackBotSessionMetadata,
-  scheduledSlackBotConnectionId,
   validateOpenGeniSlackBotConnectionSelection,
+  validateScheduledTaskSlackChannel,
+  type ScheduledTaskSlackChannelVerifier,
 } from "./slack-bot";
 import {
   normalizeResources,
   validateFileResources,
   validateGitHubRepositorySelection,
   validateToolRefs,
-  withDefaultEnabledCapabilityMcpTools,
+  withWorkspaceDefaultMcpTools,
 } from "./resources";
 
 /**
@@ -85,26 +160,186 @@ export function scheduledTaskToolsProvided(rawPayload: unknown): boolean {
   );
 }
 
+/** Message data and captured account choices survive; the destination owns execution. */
+function scheduledSessionMessageConfig(config: ScheduledTaskAgentConfig): ScheduledTaskAgentConfig {
+  return {
+    prompt: config.prompt,
+    resources: config.resources,
+    tools: [],
+    metadata: config.metadata,
+    ...(config.approvalTimeoutSeconds !== undefined
+      ? { approvalTimeoutSeconds: config.approvalTimeoutSeconds }
+      : {}),
+    ...(config.connectionAccounts !== undefined
+      ? { connectionAccounts: config.connectionAccounts }
+      : {}),
+    ...(config.connectionAccountsFrozen ? { connectionAccountsFrozen: true } : {}),
+  };
+}
+
+function workspaceCustomModelCommitGuard(input: {
+  settings: Settings;
+  accountId: string;
+  workspaceId: string;
+  modelId: string;
+  claudeAuthoritySnapshot?: ClaudeProviderAccountAuthoritySnapshotV1;
+}): ((tx: Database) => Promise<void>) | undefined {
+  const reference = workspaceCustomModelReference(input.settings, input.modelId);
+  if (!reference) return undefined;
+  return async (tx: Database): Promise<void> => {
+    const active = await lockActiveCustomModelForAdmission(tx, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      reference,
+      ...(input.claudeAuthoritySnapshot
+        ? { claudeAuthority: { authoritySnapshot: input.claudeAuthoritySnapshot } }
+        : {}),
+    });
+    if (!active) {
+      throw modelUnavailableHttpException(input.modelId);
+    }
+  };
+}
+
+/** Resolve the target's current tool policy before choosing its owner's accounts. */
+export async function scheduledConnectionTools(
+  db: Database,
+  workspaceId: string,
+  settings: Settings,
+  target: Session | null,
+  taskTools: ToolRef[],
+  subjectId?: string,
+): Promise<ToolRef[]> {
+  if (!target) return [...taskTools, { kind: "mcp", id: "opengeni" }];
+  return resolveSessionToolPolicy({
+    toolPolicy: target.toolPolicy,
+    sessionTools: target.tools,
+    availableMcpServerIds: [
+      "opengeni",
+      ...settings.mcpServers.map(({ id }) => id),
+      ...target.mcpServers.map(({ id }) => id),
+    ],
+    defaultMcpServerIds: await workspaceSessionToolPolicyDefaultServerIds(
+      db,
+      workspaceId,
+      settings,
+      subjectId,
+    ),
+  }).toolRefs;
+}
+
+export function scheduledConnectionSurfaceEligibility(
+  settings: Settings,
+  target: Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null,
+): { googleDrivePublicationEnabled: boolean; atlassianEnabled: boolean } {
+  const tools = target?.firstPartyMcpTools ?? resolveFirstPartyMcpToolPolicy(settings).default;
+  const permissions = target?.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS;
+  return {
+    googleDrivePublicationEnabled:
+      tools.includes("editable_artifact_export") &&
+      tools.includes("editable_artifact_export_status") &&
+      permissions.includes("artifacts:read") &&
+      permissions.includes("artifacts:publish"),
+    atlassianEnabled: false,
+  };
+}
+
+/**
+ * An organization/workspace API key or the deployment's configured key is a
+ * machine principal. It is never a person, so it can never be a schedule's
+ * execution owner (a human revision authorizer): its schedules are ownerless
+ * and run under service authority, exactly like a delegated service's.
+ */
+function isScheduledTaskMachinePrincipal(grant: AccessGrant): boolean {
+  return grant.principalKind === "api_key" || grant.principalKind === "configured_key";
+}
+
+/** Service attribution cannot become a personal schedule execution owner. */
+function scheduledTaskInitiatorForGrant(grant: AccessGrant) {
+  const creator = creationInitiatorForGrant(grant);
+  if (
+    creator.initiator?.kind === "subject" &&
+    (personalConnectionDelegationSourceForGrant(grant).kind === "none" ||
+      isScheduledTaskMachinePrincipal(grant))
+  ) {
+    return { ...creator, initiator: { ...creator.initiator, kind: "service" as const } };
+  }
+  return creator;
+}
+
 export async function createValidatedScheduledTask(input: {
   settings: Settings;
   db: Database;
   objectStorage: ObjectStorageDependency;
   grant: AccessGrant;
+  authorization?: AccessGrantAuthorization;
   payload: CreateScheduledTaskPayload;
   // Whether the caller explicitly set agentConfig.tools (see
   // scheduledTaskToolsProvided). Absent tools get the workspace's enabled
   // capability MCP servers, mirroring session creation.
   toolsProvided?: boolean;
-  // Set for pack-installation-inherited attachments that were already
-  // authorized with variable-sets:use when the pack was enabled.
-  variableSetPreauthorized?: boolean;
   sessionAuthorization?: SessionAuthorizationPort | null | undefined;
   authorizationSurface?: SessionAuthorizationSurface | undefined;
+  /** Proves the bot may post in a newly chosen task Slack channel. */
+  verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
 }): Promise<ScheduledTask> {
-  // API parsing fills this default, but pack installers and older internal
-  // callers can still invoke the shared validator with the pre-action shape.
+  if (input.payload.runMode === "existing_session") {
+    const target = await validateScheduledTaskTarget({
+      ...input,
+      targetSessionId: input.payload.targetSessionId,
+      runMode: "existing_session",
+      variableSetId: input.payload.variableSetId,
+      rigId: input.payload.rigId,
+      agentConfig: input.payload.agentConfig,
+    });
+    if (input.payload.agentConfig.knowledgeSource)
+      throw new HTTPException(422, {
+        message: "Source ingestion requires a separate scheduled agent",
+      });
+    if (input.payload.variableSetId && input.payload.variableSetId !== target?.variableSetId)
+      throw new HTTPException(422, {
+        message:
+          "Existing-chat schedules use the chat's Variable Sets. Change the chat's attachments separately.",
+      });
+    if (input.payload.rigId && input.payload.rigId !== target?.rigId)
+      throw new HTTPException(422, {
+        message:
+          "Existing-chat schedules use the chat's environment. Change the chat's attachments separately.",
+      });
+    await requireScheduledMessageVariableSetUse({
+      db: input.db,
+      grant: input.grant,
+      target,
+    });
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        agentConfig: scheduledSessionMessageConfig(input.payload.agentConfig),
+        variableSetId: null,
+        rigId: null,
+      },
+    };
+  }
+  const learning = "agentLearning" in input.payload ? input.payload.agentLearning : undefined;
+  const learningContext =
+    learning && input.authorization
+      ? await knowledgeContextForAccess(
+          { db: input.db },
+          input.authorization,
+          "scheduled_tasks:manage",
+        )
+      : null;
+  if (learning && learningContext?.actor.kind !== "human") {
+    throw new HTTPException(403, {
+      message: "Only an authenticated person can configure Agent learning",
+    });
+  }
+  if (learningContext?.actor.kind === "human" && learning)
+    learningContext.actor.settingsScopes = [learning.scope];
+  // Internal callers can omit the action; agent turns are the default.
   const action = input.payload.action ?? ({ kind: "agent_turn" } as const);
-  const knowledgeAction = action.kind === "knowledge_source_sync" ? action : null;
+  const knowledgeAction = input.payload.agentConfig.knowledgeSource ?? null;
   if (knowledgeAction) {
     await validateKnowledgeSourceSyncAction({
       db: input.db,
@@ -112,58 +347,180 @@ export async function createValidatedScheduledTask(input: {
       action: knowledgeAction,
     });
   }
-  const agentConfig = knowledgeAction
-    ? input.payload.agentConfig
-    : await validateScheduledTaskAgentConfig({
-        ...input,
-        workspaceId: input.grant.workspaceId,
-      });
+  const agentConfig: ScheduledTaskAgentConfig = await validateScheduledTaskAgentConfig({
+    ...input,
+    workspaceId: input.grant.workspaceId,
+  });
+  agentConfig.connectionAccounts = input.payload.connectionAccounts ?? [];
+  await validateScheduledTaskSlackChannel({
+    grant: input.grant,
+    authorization: input.authorization,
+    previous: null,
+    next: agentConfig,
+    runMode: input.payload.runMode,
+    reusableSessionCanPost: null,
+    verifySlackChannel: input.verifySlackChannel,
+  });
+  if (knowledgeAction && input.payload.overlapPolicy === "allow_concurrent")
+    throw new HTTPException(422, { message: "Source tasks require skip or buffer_one overlap" });
   const id = crypto.randomUUID();
   validateScheduledTaskSchedule(input.payload.schedule);
-  const target = knowledgeAction
-    ? null
-    : await validateScheduledTaskTarget({
-        db: input.db,
-        sessionAuthorization: input.sessionAuthorization,
-        authorizationSurface: input.authorizationSurface,
-        grant: input.grant,
-        targetSessionId: input.payload.targetSessionId,
-        runMode: input.payload.runMode,
-        variableSetId: input.payload.variableSetId,
-        rigId: input.payload.rigId,
-        agentConfig,
+  const target = await validateScheduledTaskTarget({
+    db: input.db,
+    sessionAuthorization: input.sessionAuthorization,
+    authorizationSurface: input.authorizationSurface,
+    grant: input.grant,
+    targetSessionId: input.payload.targetSessionId,
+    runMode: input.payload.runMode,
+    variableSetId: input.payload.variableSetId,
+    rigId: input.payload.rigId,
+    // An omitted Sandbox Environment adopts the target session's own one below.
+    agentConfig,
+  });
+  if (
+    knowledgeAction?.destination.kind === "personal" &&
+    input.payload.runMode !== "new_session_per_run"
+  )
+    throw new HTTPException(422, {
+      message: "Personal source tasks create a private session for each run",
+    });
+  if (learning) {
+    const workspace = await requireWorkspace(input.db, input.grant.workspaceId);
+    const destination =
+      knowledgeAction?.destination.kind === "personal" ||
+      workspace.kind === "personal" ||
+      target?.tenancy?.visibility === "private" ||
+      target?.memoryScope === "user"
+        ? "personal"
+        : "workspace";
+    if (learning.scope !== destination)
+      throw new HTTPException(422, {
+        message: `This task saves Knowledge in the ${destination} scope. Set its Agent learning override for that scope.`,
       });
-  if (!knowledgeAction && input.payload.variableSetId) {
+  }
+  if (!knowledgeAction) {
+    agentConfig.connectionAccountsFrozen = true;
+    await validateScheduledTaskMachineTarget({
+      settings: input.settings,
+      db: input.db,
+      grant: input.grant,
+      runMode: input.payload.runMode,
+      agentConfig,
+    });
+  }
+  if (input.payload.variableSetId) {
     await validateVariableSetAttachment(
       { settings: input.settings, db: input.db },
       input.grant,
       input.grant.workspaceId,
       input.payload.variableSetId,
-      { preauthorized: input.variableSetPreauthorized ?? false },
     );
   }
   // The rig is stored on the task and resolved to its ACTIVE version per fire
   // (at dispatch), so validate only that the id names a rig in the workspace —
   // NOT that it has an active version now (that is a fire-time concern). RLS
   // makes a cross-workspace id indistinguishable from missing → both 422.
+  // A generated session binds the environment and its default Variable Sets,
+  // so an explicit choice needs the same attachment authority as session
+  // create; an existing-session task only matches its target's environment.
   if (!knowledgeAction && input.payload.rigId) {
-    await requireScheduledTaskRig(input.db, input.grant.workspaceId, input.payload.rigId);
-  }
-  const personalConnectionDelegations = knowledgeAction
-    ? []
-    : await freezePersonalConnectionDelegations({
+    const rig = await requireScheduledTaskRig(
+      input.db,
+      {
+        accountId: input.grant.accountId,
+        workspaceId: input.grant.workspaceId,
+        subjectId: input.grant.subjectId,
+      },
+      input.payload.rigId,
+    );
+    if (input.payload.runMode !== "existing_session") {
+      await requireScheduledTaskRigVariableSetAttachments({
+        settings: input.settings,
         db: input.db,
+        grant: input.grant,
         workspaceId: input.grant.workspaceId,
-        settings: await settingsWithEnabledCapabilityMcpServers(
-          input.db,
-          input.grant.workspaceId,
-          input.settings,
-          { subjectId: input.grant.subjectId },
-        ),
-        tools: [...agentConfig.tools, { kind: "mcp", id: "opengeni" }],
-        source: personalConnectionDelegationSourceForGrant(input.grant),
+        rig,
+      });
+    }
+  }
+  const rigId = knowledgeAction
+    ? (input.payload.rigId ?? null)
+    : await resolveScheduledTaskCreateRigId({
+        settings: input.settings,
+        db: input.db,
+        grant: input.grant,
+        requestedRigId: input.payload.rigId,
+        runMode: input.payload.runMode,
+        target,
+        agentConfig,
       });
-  const creationInitiator = creationInitiatorForGrant(input.grant);
+  const runtimeSettings = knowledgeAction
+    ? null
+    : await settingsWithEnabledCapabilityMcpServers(
+        input.db,
+        input.grant.workspaceId,
+        input.settings,
+        { subjectId: input.grant.subjectId },
+      );
+  // Existing-session runs use the target's persisted MCP configuration, with
+  // session definitions taking precedence over deployment servers of the same
+  // ID. Metadata selects the destination; captured grants still supply authority.
+  const effectiveRuntimeSettings =
+    runtimeSettings && target
+      ? settingsWithSessionMcpServerMetadata(runtimeSettings, target.mcpServers)
+      : runtimeSettings;
+  const acceptedConnections =
+    knowledgeAction || !effectiveRuntimeSettings
+      ? { personalConnectionDelegations: [], mcpAccountBindings: [] }
+      : await freezeConnectionAccounts({
+          db: input.db,
+          accountId: input.grant.accountId,
+          workspaceId: input.grant.workspaceId,
+          settings: effectiveRuntimeSettings,
+          tools: await scheduledConnectionTools(
+            input.db,
+            input.grant.workspaceId,
+            effectiveRuntimeSettings,
+            target,
+            agentConfig.tools,
+            input.grant.subjectId,
+          ),
+          resources: mergeResourceRefs(target?.resources ?? [], agentConfig.resources),
+          source: personalConnectionDelegationSourceForGrant(input.grant),
+          authoritySelections: input.payload.connectionAccounts,
+          ...scheduledConnectionSurfaceEligibility(effectiveRuntimeSettings, target),
+        });
+  const { personalConnectionDelegations, mcpAccountBindings } = acceptedConnections;
+  if (!knowledgeAction) {
+    const boundRoutes = new Set((mcpAccountBindings ?? []).map((binding) => binding.serverId));
+    agentConfig.connectionAccounts = [
+      ...(mcpAccountBindings ?? []).map(({ canonicalServerId, connectionId }) => ({
+        serverId: canonicalServerId,
+        connectionId,
+      })),
+      ...personalConnectionDelegations
+        .filter(
+          (item) =>
+            !boundRoutes.has(item.serverId) &&
+            (!item.connectionType ||
+              item.connectionType === "mcp" ||
+              item.connectionType === "github_personal"),
+        )
+        .map(({ serverId, connectionId }) => ({ serverId, connectionId })),
+    ];
+  }
+  const creationInitiator = scheduledTaskInitiatorForGrant(input.grant);
+  const captureLinkAuthority = prepareExternalLinkTaskAdmission(
+    input.authorization,
+    creationInitiator.actor,
+  );
+  const creatorPolicy = await frozenScheduledTaskCreatorPolicy({
+    db: input.db,
+    settings: input.settings,
+    grant: input.grant,
+    authorization: input.authorization,
+    actor: creationInitiator.actor ?? null,
+  });
   const xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1 =
     creationInitiator.actor
       ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(
@@ -176,28 +533,385 @@ export async function createValidatedScheduledTask(input: {
           workspaceId: input.grant.workspaceId,
           subjectId: input.grant.subjectId,
         });
-  return await createScheduledTask(input.db, {
-    id,
-    accountId: input.grant.accountId,
-    workspaceId: input.grant.workspaceId,
-    name: trimmedScheduledTaskName(input.payload.name),
-    status: input.payload.status,
-    schedule: input.payload.schedule,
-    temporalScheduleId: scheduledTaskTemporalScheduleId(id),
-    runMode: input.payload.runMode,
-    overlapPolicy: input.payload.overlapPolicy,
-    action,
-    agentConfig,
-    ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),
-    ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),
-    createdByActor: creationInitiator.actor ?? null,
-    personalConnectionDelegations,
-    xaiProviderAccountAuthoritySnapshot,
-    targetSessionId: target?.id ?? null,
-    variableSetId: input.payload.variableSetId ?? null,
-    rigId: input.payload.rigId ?? null,
-    metadata: input.payload.metadata,
+  const claudeProviderAccountAuthoritySnapshot: ClaudeProviderAccountAuthoritySnapshotV1 =
+    creationInitiator.actor
+      ? await getSessionTurnClaudeProviderAccountAuthoritySnapshot(
+          input.db,
+          input.grant.workspaceId,
+          creationInitiator.actor.sessionId,
+          creationInitiator.actor.turnId,
+        )
+      : await resolveClaudeProviderAccountAuthoritySnapshotForAcceptance(input.db, {
+          workspaceId: input.grant.workspaceId,
+          subjectId: input.grant.subjectId,
+        });
+  const beforeCreateCommit =
+    input.payload.runMode !== "existing_session"
+      ? workspaceCustomModelCommitGuard({
+          settings: input.settings,
+          accountId: input.grant.accountId,
+          workspaceId: input.grant.workspaceId,
+          modelId: agentConfig.model ?? input.settings.openaiModel,
+          claudeAuthoritySnapshot: claudeProviderAccountAuthoritySnapshot,
+        })
+      : undefined;
+  return await withScheduledTaskAuthorityWriteErrors(() =>
+    input.db.transaction(async (transaction) => {
+      const task = await createScheduledTask(transaction, {
+        id,
+        accountId: input.grant.accountId,
+        workspaceId: input.grant.workspaceId,
+        name: trimmedScheduledTaskName(input.payload.name),
+        status: input.payload.status,
+        schedule: input.payload.schedule,
+        temporalScheduleId: scheduledTaskTemporalScheduleId(id),
+        runMode: input.payload.runMode,
+        overlapPolicy: input.payload.overlapPolicy,
+        action,
+        agentConfig,
+        ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),
+        ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),
+        createdByActor: creationInitiator.actor ?? null,
+        ...(captureLinkAuthority ? { captureLinkAuthority } : {}),
+        xaiProviderAccountAuthoritySnapshot,
+        claudeProviderAccountAuthoritySnapshot,
+        creatorPolicy,
+        targetSessionId: target?.id ?? null,
+        variableSetId: input.payload.variableSetId ?? null,
+        rigId,
+        metadata: input.payload.metadata,
+        ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
+      });
+      if (learning && learningContext)
+        await saveAgentLearningSettings(transaction, learningContext, {
+          scope: learning.scope,
+          source: { kind: "scheduled_task", id: task.id },
+          operationId: crypto.randomUUID(),
+          expectedVersion: 0,
+          settings: learning.settings,
+        });
+      return task;
+    }),
+  );
+}
+
+/**
+ * Freeze authenticated credential restrictions for every creation lane, and
+ * the creating session's boundary onto an agent-created task so the
+ * sessions generated for it inherit exactly what the creator could see and
+ * do, never the deployment default. Tools are the session's effective
+ * model-visible selection under the deployment ceiling; permissions are the
+ * session's effective first-party set intersected with what the calling
+ * grant actually holds (a narrowly delegated spawn token cannot hand a
+ * schedule more than itself). The session access policy is copied from the
+ * projection when it exposes those facts; each absent fact is stored as null
+ * so a generated session keeps its own default for that key.
+ */
+export async function frozenScheduledTaskCreatorPolicy(input: {
+  db: Database;
+  settings: Settings;
+  grant: AccessGrant;
+  authorization?: AccessGrantAuthorization | undefined;
+  actor: Extract<SessionCommandActor, { type: "agent_attempt" }> | null;
+}): Promise<ScheduledTaskCreatorPolicy | null> {
+  let restricted =
+    (input.authorization?.grant === input.grant &&
+      isDeveloperSetupAuthorization(input.authorization)) ||
+    isDeveloperSetupGrant(input.grant);
+  if (!input.actor) {
+    if (input.grant.permissionMode === "explicit") {
+      const permissions = DEFAULT_FIRST_PARTY_MCP_PERMISSIONS.filter((permission) =>
+        hasPermission(input.grant.permissions, permission, "explicit"),
+      );
+      if (permissions.length === 0) {
+        throw new HTTPException(403, {
+          message:
+            "the organization key holds no first-party MCP permission it could delegate to scheduled runs",
+        });
+      }
+      return {
+        firstPartyMcpTools: null,
+        firstPartyMcpPermissions: permissions,
+        sessionPolicy: null,
+        ...(restricted ? { credentialRestriction: "developer_setup" as const } : {}),
+      };
+    }
+    // A restriction is not an agent tool/permission selection. Keep the exact
+    // first-party and session defaults of ordinary API/service/asUser tasks.
+    return restricted
+      ? {
+          firstPartyMcpTools: null,
+          firstPartyMcpPermissions: null,
+          sessionPolicy: null,
+          credentialRestriction: "developer_setup",
+        }
+      : null;
+  }
+  const session = await getSession(input.db, input.grant.workspaceId, input.actor.sessionId);
+  if (!session) {
+    throw new HTTPException(403, {
+      message: "the calling agent session is not available in this workspace",
+    });
+  }
+  const turn = await getSessionTurnForAttempt(
+    input.db,
+    input.grant.workspaceId,
+    input.actor.sessionId,
+    input.actor.attemptId,
+  );
+  if (!turn || turn.id !== input.actor.turnId) {
+    throw new HTTPException(403, { message: "the calling agent attempt is not available" });
+  }
+  // These are server-frozen policies, not task/agentConfig metadata. The DB
+  // insert also verifies this exact actor under its ownership locks.
+  const turnPolicy = readTurnExecutionPolicyV1(turn.metadata);
+  const sessionPolicy = readTurnExecutionPolicyV1(session.metadata);
+  restricted ||= Boolean(
+    (turnPolicy.kind === "valid" &&
+      turnPolicy.policy.credentialRestriction === "developer_setup") ||
+    (sessionPolicy.kind === "valid" &&
+      sessionPolicy.policy.credentialRestriction === "developer_setup"),
+  );
+  const firstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
+    input.settings,
+    session.firstPartyMcpTools,
+  );
+  const firstPartyMcpPermissions = (
+    session.firstPartyMcpPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS]
+  ).filter((permission) =>
+    hasPermission(input.grant.permissions, permission, input.grant.permissionMode),
+  );
+  requireExplicitPermissionDelegation(input.grant, firstPartyMcpPermissions);
+  if (firstPartyMcpPermissions.length === 0) {
+    throw new HTTPException(403, {
+      message:
+        "the calling agent session holds no first-party MCP permission it could delegate to scheduled runs",
+    });
+  }
+  // The projection facts are validated through the access-scope contract so
+  // only a well-formed value is frozen; anything else stores null for that key.
+  const projection = session as unknown as Record<string, unknown>;
+  const agentAccess = SessionAgentAccess.safeParse(projection["agentAccess"]);
+  const scopeSubjectId = SessionScopeSubjectId.safeParse(projection["scopeSubjectId"]);
+  const memoryScope = SessionMemoryScope.safeParse(projection["memoryScope"]);
+  return {
+    firstPartyMcpTools,
+    firstPartyMcpPermissions,
+    ...(restricted ? { credentialRestriction: "developer_setup" as const } : {}),
+    sessionPolicy: {
+      agentAccess: agentAccess.success ? agentAccess.data : null,
+      scopeSubjectId: scopeSubjectId.success ? scopeSubjectId.data : null,
+      memoryScope: memoryScope.success ? memoryScope.data : null,
+    },
+  };
+}
+
+function nestedPostgresMessage(error: unknown): string | null {
+  const queue: unknown[] = [error];
+  const seen = new Set<unknown>();
+  while (queue.length > 0 && seen.size < 64) {
+    const current = queue.shift();
+    if (!current || typeof current !== "object" || seen.has(current)) continue;
+    seen.add(current);
+    const record = current as Record<string, unknown>;
+    if (typeof record.code === "string" && typeof record.message === "string") {
+      return record.message;
+    }
+    for (const key of ["cause", "errors", "error", "originalError"]) {
+      const nested = record[key];
+      if (Array.isArray(nested)) queue.push(...nested);
+      else if (nested !== undefined) queue.push(nested);
+    }
+  }
+  return null;
+}
+
+/**
+ * Scheduled-task authority writes fail closed inside SECURITY DEFINER seams
+ * (42501): a non-human writer delegating resources, an authorizer without
+ * active workspace membership, or a foreign human retaining another subject's
+ * grants. Those are caller-resolvable conflicts, not server faults.
+ */
+export async function withScheduledTaskAuthorityWriteErrors<T>(run: () => Promise<T>): Promise<T> {
+  try {
+    return await run();
+  } catch (error) {
+    if (error instanceof ScheduledTaskHeadChangedError)
+      throw new HTTPException(409, {
+        message: "Scheduled task changed. Reload it before saving.",
+      });
+    if (nestedPostgresSqlState(error) === "40001")
+      throw new HTTPException(409, {
+        message: "Scheduled task learning settings changed. Reload the task before saving.",
+      });
+    if (nestedPostgresSqlState(error) === "42501") {
+      const detail = nestedPostgresMessage(error);
+      throw new HTTPException(409, {
+        message: detail
+          ? `scheduled task authority denied: ${detail}`
+          : "scheduled task authority denied",
+      });
+    }
+    throw error;
+  }
+}
+
+/** API/MCP-facing update that maps authority-write denials to 409. */
+export async function updateScheduledTaskForApi(
+  db: Database,
+  grant: AccessGrant,
+  taskId: string,
+  update: UpdateScheduledTaskInput,
+  learning?: {
+    authorization: AccessGrantAuthorization;
+    request: NonNullable<UpdateScheduledTaskPayload["agentLearning"]>;
+    restoreState: ScheduledTaskRestoreState;
+  },
+): Promise<ScheduledTask> {
+  const workspaceId = grant.workspaceId;
+  const beforeUpdateCommit = update.beforeUpdateCommit;
+  update = {
+    ...update,
+    beforeUpdateCommit: async (tx) => {
+      await assertScheduledTaskMutationOwner(tx, grant, taskId);
+      await beforeUpdateCommit?.(tx);
+    },
+  };
+  if (learning) {
+    const context = await knowledgeContextForAccess(
+      { db },
+      learning.authorization,
+      "scheduled_tasks:manage",
+    );
+    if (context.actor.kind !== "human")
+      throw new HTTPException(403, {
+        message: "Only an authenticated person can configure Agent learning",
+      });
+    context.actor.settingsScopes = [learning.request.scope];
+    return withScheduledTaskAuthorityWriteErrors(() =>
+      db.transaction(async (tx) => {
+        const source = { kind: "scheduled_task" as const, id: taskId };
+        const baselineScope = learning.request.baselineScope ?? learning.request.scope;
+        // Lock policy owners in one order before comparing the draft baseline.
+        // A destination change must not race an edit in its previous owner layer.
+        const subjectId = context.actor.kind === "human" ? context.actor.subjectId : "";
+        const owners = [
+          ...new Set(
+            [baselineScope, learning.request.scope].map((scope) =>
+              scope === "personal" ? `personal:${subjectId}` : `workspace:${workspaceId}`,
+            ),
+          ),
+        ].sort();
+        for (const owner of owners)
+          await tx.execute(
+            dbSql`SELECT pg_advisory_xact_lock(hashtextextended(${`agent-learning:${context.accountId}:${owner}`},0))`,
+          );
+        const baseline = await getAgentLearningSettings(tx, context, baselineScope, source);
+        if (baseline.version !== learning.request.expectedVersion)
+          throw new HTTPException(409, {
+            message: "Scheduled task learning settings changed. Reload the task before saving.",
+          });
+        const task = await updateScheduledTask(tx, workspaceId, taskId, update);
+        const prior = await getAgentLearningSettings(tx, context, learning.request.scope, source);
+        const saved = await saveAgentLearningSettings(tx, context, {
+          scope: learning.request.scope,
+          operationId: learning.request.operationId,
+          expectedVersion:
+            baselineScope === learning.request.scope
+              ? learning.request.expectedVersion
+              : prior.version,
+          source,
+          settings: {
+            knowledge: "inherit",
+            instructions: "inherit",
+            skills: "inherit",
+            ...learning.request.settings,
+          },
+        });
+        learning.restoreState.learning = {
+          context,
+          scope: learning.request.scope,
+          settings: prior.settings,
+          expectedVersion: saved.version,
+        };
+        return task;
+      }),
+    );
+  }
+  return await withScheduledTaskAuthorityWriteErrors(() =>
+    updateScheduledTask(db, workspaceId, taskId, update),
+  );
+}
+
+export async function assertScheduledTaskMutationOwner(
+  db: Database,
+  grant: AccessGrant,
+  taskId: string,
+): Promise<void> {
+  const writer = scheduledTaskInitiatorForGrant(grant);
+  const matches = await scheduledTaskMutationOwnerMatches(db, {
+    workspaceId: grant.workspaceId,
+    taskId,
+    ...(writer.initiator ? { createdBy: writer.initiator } : {}),
+    ...(writer.context ? { createdByContext: writer.context } : {}),
+    createdByActor: writer.actor ?? null,
   });
+  if (!matches)
+    throw new HTTPException(403, {
+      message: "Only the schedule owner can change or run it. Copy it to create your own schedule.",
+    });
+}
+
+export async function triggerScheduledTaskForGrant(
+  db: Database,
+  grant: AccessGrant,
+  workflowClient: SessionWorkflowClient,
+  input: Parameters<SessionWorkflowClient["triggerScheduledTask"]>[0],
+): Promise<void> {
+  await db.transaction(async (tx) => {
+    await assertScheduledTaskMutationOwner(tx, grant, input.task.id);
+    if (isRetiredNativeAtlassianTask(input.task))
+      throw new HTTPException(410, { message: ATLASSIAN_NATIVE_RETIRED_MESSAGE });
+    const actor = creationInitiatorForGrant(grant).actor ?? null;
+    const restriction = await scheduledTaskCredentialRestrictionForGrant(tx, grant, actor);
+    // A caller cannot supply or clear the trusted ceiling. Ownerless and
+    // same-human schedules can be triggered by a different credential than
+    // their creator; restrict that accepted run, not the durable task.
+    const { credentialRestriction: _untrustedRestriction, ...trigger } = input;
+    await workflowClient.triggerScheduledTask({
+      ...trigger,
+      ...(restriction ? { credentialRestriction: restriction } : {}),
+    });
+  });
+}
+
+async function scheduledTaskCredentialRestrictionForGrant(
+  db: Database,
+  grant: AccessGrant,
+  actor: Extract<SessionCommandActor, { type: "agent_attempt" }> | null,
+): Promise<"developer_setup" | undefined> {
+  if (isDeveloperSetupGrant(grant)) return "developer_setup";
+  if (!actor) return undefined;
+  const session = await getSession(db, grant.workspaceId, actor.sessionId);
+  const turn = await getSessionTurnForAttempt(
+    db,
+    grant.workspaceId,
+    actor.sessionId,
+    actor.attemptId,
+  );
+  if (!session || !turn || turn.id !== actor.turnId) {
+    throw new HTTPException(403, { message: "the calling agent attempt is not available" });
+  }
+  const policies = [
+    readTurnExecutionPolicyV1(turn.metadata),
+    readTurnExecutionPolicyV1(session.metadata),
+  ];
+  return policies.some(
+    (policy) =>
+      policy.kind === "valid" && policy.policy.credentialRestriction === "developer_setup",
+  )
+    ? "developer_setup"
+    : undefined;
 }
 
 export async function validateScheduledTaskTarget(input: {
@@ -211,6 +925,8 @@ export async function validateScheduledTaskTarget(input: {
   rigId: string | null | undefined;
   agentConfig: ScheduledTaskAgentConfig;
   missingTargetStatus?: 404 | 422;
+  /** Leaving a cancelled chat still requires control, but not revivability. */
+  departingTarget?: boolean;
 }): Promise<Session | null> {
   if (input.runMode !== "existing_session") {
     if (input.targetSessionId) {
@@ -262,38 +978,89 @@ export async function validateScheduledTaskTarget(input: {
   if (!session || session.accountId !== input.grant.accountId) {
     throw new HTTPException(404, { message: "target session not found" });
   }
-  if (session.status === "cancelled") {
+  if (session.status === "cancelled" && !input.departingTarget) {
     throw new HTTPException(409, {
       message: "target session is cancelled; choose a revivable session",
     });
   }
-  if ((session.variableSetId ?? null) !== (input.variableSetId ?? null)) {
+  // The target owns execution settings. Admission freezes and revalidates its
+  // current policy under the scheduled owner; duplicated task fields confer no access.
+  return session;
+}
+
+export async function validateScheduledTaskMachineTarget(input: {
+  settings: Settings;
+  db: Database;
+  grant: AccessGrant;
+  runMode: ScheduledTask["runMode"];
+  agentConfig: ScheduledTaskAgentConfig;
+  requireOnline?: boolean;
+}): Promise<{
+  sandboxId: string;
+  enrollmentId: string;
+  sandboxOs: Session["sandboxOs"];
+} | null> {
+  const machineTarget = input.agentConfig.machineTarget;
+  if (!machineTarget) {
+    if (
+      input.runMode !== "existing_session" &&
+      (input.agentConfig.sandboxBackend ?? input.settings.sandboxBackend) === "selfhosted"
+    ) {
+      throw new HTTPException(422, {
+        message:
+          "self-hosted scheduled tasks require a Connected Machine; select a machine before saving",
+      });
+    }
+    return null;
+  }
+  if (input.runMode === "existing_session") {
     throw new HTTPException(422, {
-      message: "target session variableSet attachment does not match the scheduled task",
+      message: "machineTarget cannot be used with an existing-session target",
     });
   }
-  if (input.rigId && input.rigId !== session.rigId) {
+  if (!input.settings.sandboxOwnershipEnabled || !input.settings.sandboxSelfhostedEnabled) {
     throw new HTTPException(422, {
-      message: "target session rig does not match the scheduled task",
+      message: "Connected Machines are not enabled for scheduled tasks in this deployment",
     });
   }
-  if (
-    input.agentConfig.sandboxBackend !== undefined &&
-    input.agentConfig.sandboxBackend !== session.sandboxBackend
-  ) {
+  const access = {
+    accountId: input.grant.accountId,
+    workspaceId: input.grant.workspaceId,
+    subjectId: input.grant.subjectId,
+  };
+  const sandbox = await getSandbox(input.db, access, machineTarget.targetSandboxId);
+  if (!sandbox || sandbox.kind !== "selfhosted" || !sandbox.enrollmentId) {
     throw new HTTPException(422, {
-      message: "target session sandbox backend does not match the scheduled task",
+      message: "the selected Connected Machine is unavailable",
     });
   }
-  if (
-    scheduledSlackBotConnectionId(session.metadata) !==
-    (input.agentConfig.slackBotConnectionId ?? null)
-  ) {
+  if (sandbox.scope === "user") {
     throw new HTTPException(422, {
-      message: "target session OpenGeni Slack bot binding does not match the scheduled task",
+      message:
+        "personal Connected Machines cannot run unattended schedules; select a workspace or organization machine",
     });
   }
-  return session;
+  const enrollment = input.requireOnline
+    ? await getLiveEnrollmentConnection(input.db, access, sandbox.enrollmentId)
+    : await getEnrollment(input.db, access, sandbox.enrollmentId);
+  if (!enrollment || enrollment.status !== "active") {
+    throw new HTTPException(422, {
+      message: input.requireOnline
+        ? "the selected Connected Machine is offline"
+        : "the selected Connected Machine is unavailable",
+    });
+  }
+  if (input.requireOnline && !enrollment.workspaceRoot) {
+    throw new HTTPException(422, {
+      message:
+        "the selected Connected Machine has not reported a workspace root; reconnect it with a current agent",
+    });
+  }
+  return {
+    sandboxId: sandbox.id,
+    enrollmentId: sandbox.enrollmentId,
+    sandboxOs: enrollment.os,
+  };
 }
 
 export function scheduledTaskForGrant(task: ScheduledTask, grant: AccessGrant): ScheduledTask {
@@ -313,17 +1080,152 @@ export function scheduledTaskRunForGrant<T extends { sessionId: string | null }>
   return { ...run, sessionId: null };
 }
 
+export function scheduledTaskAuthorityUpdateForGrant(
+  grant: AccessGrant,
+): Pick<
+  UpdateScheduledTaskInput,
+  | "refreshPersonalResourceAuthority"
+  | "authorityUpdatedBy"
+  | "authorityUpdatedByContext"
+  | "authorityUpdatedByActor"
+> {
+  const writer = scheduledTaskInitiatorForGrant(grant);
+  return {
+    refreshPersonalResourceAuthority: true,
+    ...(writer.initiator ? { authorityUpdatedBy: writer.initiator } : {}),
+    ...(writer.context ? { authorityUpdatedByContext: writer.context } : {}),
+    authorityUpdatedByActor: writer.actor ?? null,
+  };
+}
+
+/**
+ * The Sandbox Environment a new task stores. An explicit id or null is the
+ * caller's choice. An omitted value is resolved once, here, and frozen on the
+ * task, the way session create resolves an omitted rigId:
+ * - an existing-session task keeps its target session's own environment;
+ * - a Connected Machine task stores none: environment setup and Variable Set
+ *   injection never reach a machine, so a binding would only add a fire-time
+ *   failure mode;
+ * - otherwise the workspace default, when the creator can see it and it has an
+ *   active version. A stale default degrades to none, like session create.
+ * The default's own Variable Sets must be attachable by the creator, exactly
+ * as session create requires, so a workspace default never gives a task
+ * secrets its creator could not attach. Later changes to the workspace default
+ * do not move an existing task.
+ */
+async function resolveScheduledTaskCreateRigId(input: {
+  settings: Settings;
+  db: Database;
+  grant: AccessGrant;
+  requestedRigId: string | null | undefined;
+  runMode: ScheduledTask["runMode"];
+  target: Session | null;
+  agentConfig: ScheduledTaskAgentConfig;
+}): Promise<string | null> {
+  if (input.requestedRigId !== undefined) return input.requestedRigId;
+  if (input.runMode === "existing_session") return input.target?.rigId ?? null;
+  if (input.agentConfig.machineTarget) return null;
+  const defaultRigId = await getWorkspaceDefaultRigId(input.db, input.grant.workspaceId);
+  if (!defaultRigId) return null;
+  const rig = await getRig(
+    input.db,
+    {
+      accountId: input.grant.accountId,
+      workspaceId: input.grant.workspaceId,
+      subjectId: input.grant.subjectId,
+    },
+    defaultRigId,
+  );
+  if (!rig?.activeVersion) return null;
+  await requireScheduledTaskRigVariableSetAttachments({
+    settings: input.settings,
+    db: input.db,
+    grant: input.grant,
+    workspaceId: input.grant.workspaceId,
+    rig,
+  });
+  return rig.id;
+}
+
+type ScheduledTaskRig = NonNullable<Awaited<ReturnType<typeof getRig>>>;
+
+/**
+ * Binding a Sandbox Environment to generated sessions layers its active
+ * version's default Variable Sets into every turn, so the task writer must be
+ * allowed to attach each of them, exactly as session create requires. An
+ * environment without an active version has nothing to check yet.
+ */
+async function requireScheduledTaskRigVariableSetAttachments(input: {
+  settings: Settings;
+  db: Database;
+  grant: AccessGrant;
+  workspaceId: string;
+  rig: ScheduledTaskRig;
+}): Promise<void> {
+  for (const variableSetId of new Set(input.rig.activeVersion?.defaultVariableSetIds ?? [])) {
+    await validateVariableSetAttachment(
+      { settings: input.settings, db: input.db },
+      input.grant,
+      input.workspaceId,
+      variableSetId,
+    );
+  }
+}
+
+/** Message authority covers both direct sets and the environment's defaults. */
+async function requireScheduledMessageVariableSetUse(input: {
+  db: Database;
+  grant: AccessGrant;
+  target?: Session | null;
+  variableSetId?: string | null;
+  rigId?: string | null;
+}): Promise<void> {
+  if (hasPermission(input.grant.permissions, "variable-sets:use", input.grant.permissionMode))
+    return;
+  const directSets = input.target
+    ? Boolean(input.target.variableSetId || input.target.variableSetIds?.length)
+    : Boolean(input.variableSetId);
+  if (directSets) requirePermission(input.grant, "variable-sets:use");
+  const rigId = input.target ? input.target.rigId : input.rigId;
+  if (!rigId) return;
+  const access = {
+    accountId: input.grant.accountId,
+    workspaceId: input.grant.workspaceId,
+    subjectId: input.grant.subjectId,
+  };
+  let defaultVariableSetIds: string[];
+  if (input.target) {
+    // A chat rides its exact retained version. The rig's active version only
+    // determines defaults for newly generated chats.
+    if (!input.target.rigVersionId) return;
+    const pinned = await getScheduledScopedRigVersionMetadata(
+      input.db,
+      access,
+      rigId,
+      input.target.rigVersionId,
+    );
+    if (!pinned)
+      throw new HTTPException(409, { message: "Scheduled task chat environment is unavailable" });
+    defaultVariableSetIds = pinned.version.defaultVariableSetIds;
+  } else {
+    const rig = await requireScheduledTaskRig(input.db, access, rigId);
+    defaultVariableSetIds = rig.activeVersion?.defaultVariableSetIds ?? [];
+  }
+  if (defaultVariableSetIds.length) requirePermission(input.grant, "variable-sets:use");
+}
+
 // Validate a scheduled task's rig reference: it must name a rig in the
 // workspace. A missing/cross-workspace id is a 422 (RLS-invisible == missing).
 async function requireScheduledTaskRig(
   db: Database,
-  workspaceId: string,
+  access: { accountId: string; workspaceId: string; subjectId: string },
   rigId: string,
-): Promise<void> {
-  const rig = await getRig(db, workspaceId, rigId);
+): Promise<ScheduledTaskRig> {
+  const rig = await getRig(db, access, rigId);
   if (!rig) {
     throw new HTTPException(422, { message: `unknown rigId: ${rigId}` });
   }
+  return rig;
 }
 
 export async function validatedScheduledTaskUpdate(input: {
@@ -331,76 +1233,238 @@ export async function validatedScheduledTaskUpdate(input: {
   db: Database;
   objectStorage: ObjectStorageDependency;
   grant: AccessGrant;
+  authorization?: AccessGrantAuthorization;
   existing: ScheduledTask;
   payload: UpdateScheduledTaskPayload;
   /** See createValidatedScheduledTask; only consulted when agentConfig is updated. */
   toolsProvided?: boolean;
   sessionAuthorization?: SessionAuthorizationPort | null | undefined;
   authorizationSurface?: SessionAuthorizationSurface | undefined;
+  /** Proves the bot may post in a newly chosen task Slack channel. */
+  verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
 }): Promise<UpdateScheduledTaskInput> {
-  const update: UpdateScheduledTaskInput = {};
-  const existingKnowledge = input.existing.action.kind === "knowledge_source_sync";
-  if (input.payload.action && input.payload.action.kind !== input.existing.action.kind) {
+  const requestedPrompt =
+    input.payload.prompt ??
+    input.payload.agentConfigPatch?.prompt ??
+    input.payload.agentConfig?.prompt;
+  if (requestedPrompt !== undefined && !requestedPrompt.trim())
+    throw new HTTPException(422, { message: "scheduled task prompt is required" });
+  const retainedPrompt =
+    input.payload.agentConfig === undefined
+      ? (requestedPrompt ?? input.existing.agentConfig.prompt)
+      : undefined;
+  if (
+    input.payload.expectedExecutionDigest !== undefined &&
+    input.payload.expectedExecutionDigest !== input.existing.executionDigest
+  )
     throw new HTTPException(409, {
-      message: "scheduled task action kind is immutable; create a new schedule",
+      message: "Scheduled task changed. Reload it before saving.",
+    });
+  if (input.payload.prompt !== undefined)
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        agentConfigPatch: {
+          ...input.payload.agentConfigPatch,
+          prompt: input.payload.prompt,
+        },
+      },
+    };
+  if (input.payload.targetSessionId && input.payload.runMode === undefined)
+    input = {
+      ...input,
+      payload: { ...input.payload, runMode: "existing_session" },
+    };
+  const requestedMode = input.payload.runMode ?? input.existing.runMode;
+  if (requestedMode === "existing_session") {
+    const config = input.payload.agentConfig ?? input.existing.agentConfig;
+    if (config.knowledgeSource)
+      throw new HTTPException(422, {
+        message: "Source ingestion requires a separate scheduled agent",
+      });
+    const target = await validateScheduledTaskTarget({
+      ...input,
+      runMode: "existing_session",
+      targetSessionId: input.payload.targetSessionId ?? input.existing.targetSessionId,
+      variableSetId: null,
+      rigId: null,
+      agentConfig: scheduledSessionMessageConfig(config),
     });
-  }
-  if (existingKnowledge) {
     if (
-      input.payload.agentConfig !== undefined ||
-      input.payload.runMode !== undefined ||
-      input.payload.targetSessionId !== undefined ||
-      input.payload.variableSetId !== undefined ||
-      input.payload.rigId !== undefined
-    ) {
+      input.payload.variableSetId &&
+      ![target?.variableSetId, ...(target?.variableSetIds ?? [])].includes(
+        input.payload.variableSetId,
+      )
+    )
       throw new HTTPException(422, {
-        message: "knowledge source schedules do not accept agent/session configuration",
+        message:
+          "Existing-chat schedules use the chat's Variable Sets. Change the chat's attachments separately.",
       });
-    }
-    if (input.payload.overlapPolicy === "allow_concurrent") {
+    if (input.payload.rigId && input.payload.rigId !== target?.rigId)
       throw new HTTPException(422, {
-        message: "knowledge source schedules require skip or buffer_one overlap",
+        message:
+          "Existing-chat schedules use the chat's environment. Change the chat's attachments separately.",
       });
-    }
-    if (input.payload.action?.kind === "knowledge_source_sync") {
-      await validateKnowledgeSourceSyncAction({
-        db: input.db,
-        grant: input.grant,
-        action: input.payload.action,
+    const retargeting =
+      input.existing.runMode !== "existing_session" ||
+      target?.id !== input.existing.targetSessionId;
+    const previousTargetSessionId =
+      input.existing.runMode === "existing_session"
+        ? input.existing.targetSessionId
+        : input.existing.runMode === "reusable_session"
+          ? input.existing.reusableSessionId
+          : null;
+    const previousTarget =
+      retargeting && previousTargetSessionId
+        ? await validateScheduledTaskTarget({
+            ...input,
+            runMode: "existing_session",
+            targetSessionId: previousTargetSessionId,
+            departingTarget: true,
+            variableSetId: null,
+            rigId: null,
+            agentConfig: scheduledSessionMessageConfig(input.existing.agentConfig),
+          })
+        : null;
+    const previousVariableSets = previousTarget
+      ? [
+          ...new Set(
+            [previousTarget.variableSetId, ...(previousTarget.variableSetIds ?? [])].filter(
+              (id): id is string => Boolean(id),
+            ),
+          ),
+        ]
+      : input.existing.variableSetId
+        ? [input.existing.variableSetId]
+        : [];
+    const targetVariableSets = new Set([target?.variableSetId, ...(target?.variableSetIds ?? [])]);
+    const removedVariableSetIds = retargeting
+      ? previousVariableSets.filter((id) => !targetVariableSets.has(id))
+      : [];
+    const previousRigId = previousTarget ? previousTarget.rigId : input.existing.rigId;
+    const changedRig = retargeting && previousRigId && previousRigId !== target?.rigId;
+    if ((removedVariableSetIds.length || changedRig) && !input.payload.adoptSessionSettings) {
+      const detail = {
+        code: "scheduled_target_access_change",
+        targetSessionId: target!.id,
+        removedVariableSetIds,
+        removedVariableSetCount: removedVariableSetIds.length,
+        removedRigId: changedRig ? previousRigId : null,
+        resolution:
+          "Review the destination's access, then retry with adoptSessionSettings=true and the reviewed expectedExecutionDigest to use that chat's attachments.",
+      };
+      throw new HTTPException(409, {
+        message:
+          "The destination chat has different attachments. Review the access change before moving this schedule.",
+        cause: detail,
       });
-      update.action = input.payload.action;
-    }
-    if (input.payload.name !== undefined)
-      update.name = trimmedScheduledTaskName(input.payload.name);
-    if (input.payload.status !== undefined) update.status = input.payload.status;
-    if (input.payload.schedule !== undefined) {
-      validateScheduledTaskSchedule(input.payload.schedule);
-      update.schedule = input.payload.schedule;
-    }
-    if (input.payload.overlapPolicy !== undefined) {
-      update.overlapPolicy = input.payload.overlapPolicy;
     }
-    if (input.payload.metadata !== undefined) update.metadata = input.payload.metadata;
-    return update;
+    if (input.payload.agentConfig || input.payload.agentConfigPatch || retargeting)
+      await requireScheduledMessageVariableSetUse({ db: input.db, grant: input.grant, target });
+    // Server-side normalization preserves exact message fields and authority choices;
+    // callers never reconstruct an incomplete get projection to remove old settings.
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        ...(retargeting
+          ? {
+              agentConfig: scheduledSessionMessageConfig({
+                ...config,
+                ...input.payload.agentConfigPatch,
+                prompt: input.payload.agentConfigPatch?.prompt ?? config.prompt,
+              }),
+              agentConfigPatch: undefined,
+              variableSetId: null,
+              rigId: null,
+            }
+          : {}),
+      },
+    };
+  }
+  if (input.payload.agentLearning) {
+    const context = input.authorization
+      ? await knowledgeContextForAccess(
+          { db: input.db },
+          input.authorization,
+          "scheduled_tasks:manage",
+        )
+      : null;
+    if (context?.actor.kind !== "human")
+      throw new HTTPException(403, {
+        message: "Only an authenticated person can configure Agent learning",
+      });
+  }
+  const update: UpdateScheduledTaskInput = {
+    expectedExecutionDigest: input.existing.executionDigest,
+  };
+  const requestedKnowledgeSource = input.payload.agentConfig?.knowledgeSource ?? null;
+  if (
+    isRetiredNativeAtlassianTask(input.existing) &&
+    (input.payload.status === "active" || requestedKnowledgeSource)
+  )
+    throw new HTTPException(410, { message: ATLASSIAN_NATIVE_RETIRED_MESSAGE });
+  const existingKnowledgeSource = scheduledTaskKnowledgeSource(input.existing);
+  // Editing an ordinary source task's prompt/settings must not orphan its
+  // connector binding. Deleting the task is the explicit source-disable path.
+  if (
+    input.payload.agentConfig &&
+    input.existing.agentConfig.knowledgeSource &&
+    !input.payload.agentConfig.knowledgeSource
+  ) {
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        agentConfig: {
+          ...input.payload.agentConfig,
+          knowledgeSource: input.existing.agentConfig.knowledgeSource,
+        },
+      },
+    };
+  }
+  if (input.payload.action && input.payload.action.kind !== "agent_turn") {
+    throw new HTTPException(422, { message: "Source ingestion uses an ordinary agent task" });
+  }
+  const knowledgeSource =
+    input.payload.agentConfig?.knowledgeSource ?? scheduledTaskKnowledgeSource(input.existing);
+  if (
+    knowledgeSource &&
+    requestedKnowledgeSource &&
+    !isDeepStrictEqual(requestedKnowledgeSource, existingKnowledgeSource)
+  ) {
+    await validateKnowledgeSourceSyncAction({
+      db: input.db,
+      grant: input.grant,
+      action: knowledgeSource,
+    });
   }
+  if (
+    knowledgeSource &&
+    (input.payload.overlapPolicy ?? input.existing.overlapPolicy) === "allow_concurrent"
+  )
+    throw new HTTPException(422, { message: "Source tasks require skip or buffer_one overlap" });
+  if (
+    knowledgeSource?.destination.kind === "personal" &&
+    (input.payload.runMode ?? input.existing.runMode) !== "new_session_per_run"
+  )
+    throw new HTTPException(422, {
+      message: "Personal source tasks create a private session for each run",
+    });
   const existingTarget = input.existing.targetSessionId;
   const nextRunMode = input.payload.runMode ?? input.existing.runMode;
+  const materializedReusable =
+    input.existing.runMode === "reusable_session" &&
+    nextRunMode === "reusable_session" &&
+    input.existing.reusableSessionId !== null;
+  let reusableTarget: Session | null = null;
   const nextTargetSessionId =
     input.payload.targetSessionId !== undefined
       ? input.payload.targetSessionId
       : nextRunMode === "existing_session"
         ? existingTarget
         : null;
-  if (
-    input.existing.runMode === "reusable_session" &&
-    input.existing.reusableSessionId &&
-    nextRunMode === "existing_session"
-  ) {
-    throw new HTTPException(409, {
-      message:
-        "cannot target an existing session after this task created its reusable session; create a new task",
-    });
-  }
   if (input.payload.name !== undefined) {
     update.name = trimmedScheduledTaskName(input.payload.name);
   }
@@ -424,8 +1488,7 @@ export async function validatedScheduledTaskUpdate(input: {
     const nextVariableSetId = input.payload.variableSetId;
     if (
       (input.existing.variableSetId ?? null) !== (nextVariableSetId ?? null) &&
-      input.existing.runMode === "reusable_session" &&
-      input.existing.reusableSessionId
+      materializedReusable
     ) {
       throw new HTTPException(409, {
         message:
@@ -433,10 +1496,10 @@ export async function validatedScheduledTaskUpdate(input: {
       });
     }
     if (nextVariableSetId === null) {
-      if (input.existing.variableSetId !== null) {
+      if (input.existing.variableSetId !== null && nextRunMode !== "existing_session") {
         // Detaching is also an attachment change: it strips the secrets a
         // task's instructions were designed around.
-        requirePermission(input.grant, "variable-sets:use");
+        requirePermission(input.grant, "variable-sets:attach");
       }
       update.variableSetId = null;
     } else {
@@ -450,73 +1513,396 @@ export async function validatedScheduledTaskUpdate(input: {
     }
   }
   if (input.payload.rigId !== undefined) {
-    // The rig binds fresh per fire, so changing it on a reusable-session task is
-    // harmless for the LIVE session (which keeps its own frozen version) and
-    // only affects subsequent new-session fires — no live-session guard needed.
+    if (materializedReusable && input.payload.rigId !== input.existing.rigId) {
+      throw new HTTPException(409, {
+        message: "A reusable-session task cannot change rigId after materialization; recreate it",
+      });
+    }
     if (input.payload.rigId !== null) {
-      await requireScheduledTaskRig(input.db, input.existing.workspaceId, input.payload.rigId);
+      await requireScheduledTaskRig(
+        input.db,
+        {
+          accountId: input.existing.accountId,
+          workspaceId: input.existing.workspaceId,
+          subjectId: input.grant.subjectId,
+        },
+        input.payload.rigId,
+      );
     }
     update.rigId = input.payload.rigId;
   }
-  if (input.payload.agentConfig !== undefined) {
+  // An edit that newly binds an environment to generated sessions needs the
+  // same Variable Set attachment authority as create: a changed rigId, or a
+  // switch away from an existing-session target that keeps the environment
+  // the task adopted from that session.
+  const nextRigId = input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId;
+  if (
+    nextRigId !== null &&
+    !knowledgeSource &&
+    nextRunMode !== "existing_session" &&
+    (nextRigId !== input.existing.rigId || input.existing.runMode === "existing_session")
+  ) {
+    await requireScheduledTaskRigVariableSetAttachments({
+      settings: input.settings,
+      db: input.db,
+      grant: input.grant,
+      workspaceId: input.existing.workspaceId,
+      rig: await requireScheduledTaskRig(
+        input.db,
+        {
+          accountId: input.existing.accountId,
+          workspaceId: input.existing.workspaceId,
+          subjectId: input.grant.subjectId,
+        },
+        nextRigId,
+      ),
+    });
+  }
+  if (input.payload.agentConfig !== undefined || input.payload.agentConfigPatch !== undefined) {
     // Editing the instructions of a task that injects workspace secrets is
     // equivalent to attaching those secrets to new instructions, so it
     // requires variable-sets:use even though plain task edits do not.
-    const willHaveVariableSet =
-      input.payload.variableSetId !== undefined
-        ? input.payload.variableSetId !== null
-        : Boolean(input.existing.variableSetId);
-    if (willHaveVariableSet) {
-      requirePermission(input.grant, "variable-sets:use");
+    if (materializedReusable) {
+      reusableTarget = await getSession(
+        input.db,
+        input.existing.workspaceId,
+        input.existing.reusableSessionId!,
+      );
+      if (!reusableTarget || reusableTarget.accountId !== input.existing.accountId)
+        throw new HTTPException(409, { message: "Scheduled task chat is unavailable" });
+    }
+    // Existing-chat targets were checked above. A materialized reusable chat
+    // likewise owns its live attachments; obsolete creation defaults do not
+    // determine whether editing its scheduled message needs secret-use access.
+    if (nextRunMode !== "existing_session")
+      await requireScheduledMessageVariableSetUse({
+        db: input.db,
+        grant: input.grant,
+        target: reusableTarget,
+        variableSetId:
+          input.payload.variableSetId !== undefined
+            ? input.payload.variableSetId
+            : input.existing.variableSetId,
+        rigId: nextRigId,
+      });
+  }
+  if (input.payload.agentConfigPatch) {
+    const patch = input.payload.agentConfigPatch;
+    const model =
+      patch.model === undefined ? undefined : canonicalConfiguredModel(input.settings, patch.model);
+    if (model !== undefined && model !== null) {
+      await assertWorkspaceModelPolicyAllows(
+        input.db,
+        input.settings,
+        input.existing.workspaceId,
+        model,
+      );
     }
+    // Validate only the newly supplied model settings, not a reconstructed
+    // bounded input. Legacy stored text, resources and selections stay exact.
+    update.agentConfig = {
+      ...input.existing.agentConfig,
+      ...(patch.prompt !== undefined ? { prompt: patch.prompt } : {}),
+      ...(model !== undefined && model !== null ? { model } : {}),
+      ...(patch.reasoningEffort !== undefined ? { reasoningEffort: patch.reasoningEffort } : {}),
+    };
+    // Validation performs asynchronous authority checks before persistence.
+    // Reuse the locked-row CAS so that merging this snapshot cannot erase a
+    // concurrent config edit. The caller receives 409, never an automatic retry.
+    update.expectedExecutionDigest = input.existing.executionDigest;
+  }
+  if (input.payload.agentConfig !== undefined) {
     const nextAgentConfig = await validateScheduledTaskAgentConfig({
       settings: input.settings,
       db: input.db,
       objectStorage: input.objectStorage,
       grant: input.grant,
       workspaceId: input.existing.workspaceId,
-      payload: { agentConfig: input.payload.agentConfig },
+      ...(input.authorization ? { authorization: input.authorization } : {}),
+      payload: {
+        agentConfig: input.payload.agentConfig,
+        runMode: nextRunMode,
+        targetSessionId:
+          nextRunMode === "existing_session"
+            ? nextTargetSessionId
+            : input.existing.reusableSessionId,
+      },
       ...(input.toolsProvided !== undefined ? { toolsProvided: input.toolsProvided } : {}),
+      ...(materializedReusable ? { retainedCreationConfig: input.existing.agentConfig } : {}),
     });
     if (
-      input.existing.reusableSessionId &&
-      input.existing.runMode === "reusable_session" &&
+      materializedReusable &&
       (input.existing.agentConfig.slackBotConnectionId ?? null) !==
         (nextAgentConfig.slackBotConnectionId ?? null)
     ) {
       throw new HTTPException(409, {
         message:
-          "cannot change the OpenGeni Slack bot connection of a task with a live reusable session; recreate the task",
+          "cannot change the Opengeni Slack bot connection of a task with a live reusable session; recreate the task",
       });
     }
+    // Update text is exact, even when a full form submission reuses the saved
+    // prompt while changing another setting. Creation keeps its trim convention.
+    nextAgentConfig.prompt = retainedPrompt ?? input.payload.agentConfig.prompt;
+    if (retainedPrompt !== undefined) {
+      nextAgentConfig.resources = input.existing.agentConfig.resources;
+    }
     update.agentConfig = nextAgentConfig;
+  }
+  if (
+    (update.agentConfig && !input.payload.agentConfigPatch) ||
+    input.payload.connectionAccounts !== undefined
+  ) {
+    update.agentConfig = {
+      ...(update.agentConfig ?? input.existing.agentConfig),
+      connectionAccounts:
+        input.payload.connectionAccounts ?? input.existing.agentConfig.connectionAccounts ?? [],
+    };
+  }
+  const nextAgentConfig = {
+    ...(update.agentConfig ?? input.existing.agentConfig),
+  };
+  // Retargeting rewrites a narrow patch into a full config above. Check the
+  // exact final message after restoring retained fields, regardless of path.
+  // An unedited legacy prompt remains movable even when above today's limit.
+  if (
+    requestedPrompt !== undefined &&
+    scheduledOccurrencePayloadUtf8Bytes(nextAgentConfig) >
+      SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES -
+        SCHEDULED_TASK_OCCURRENCE_PAYLOAD_INGRESS_HEADROOM_BYTES
+  )
+    throw new HTTPException(422, {
+      message: "Updated scheduled message and attachments exceed the supported occurrence payload",
+    });
+  await validateScheduledTaskSlackChannel({
+    grant: input.grant,
+    authorization: input.authorization,
+    previous: input.existing.agentConfig,
+    next: nextAgentConfig,
+    runMode: nextRunMode,
+    reusableSessionCanPost:
+      input.existing.runMode === "reusable_session" && input.existing.reusableSessionId !== null
+        ? async () => {
+            const chat = await getSession(
+              input.db,
+              input.existing.workspaceId,
+              input.existing.reusableSessionId!,
+            );
+            return SCHEDULED_SLACK_BOT_POSTING_TOOLS.every(
+              (tool) => chat?.firstPartyMcpTools?.includes(tool) === true,
+            );
+          }
+        : null,
+    verifySlackChannel: input.verifySlackChannel,
+  });
+  const authorityTargetChanged =
+    nextRunMode !== input.existing.runMode ||
+    nextTargetSessionId !== input.existing.targetSessionId ||
+    (input.payload.variableSetId !== undefined &&
+      input.payload.variableSetId !== input.existing.variableSetId) ||
+    (input.payload.rigId !== undefined && input.payload.rigId !== input.existing.rigId);
+  const materialExecutionChange =
+    authorityTargetChanged ||
+    input.payload.connectionAccounts !== undefined ||
+    !isDeepStrictEqual(nextAgentConfig, input.existing.agentConfig) ||
+    (input.payload.action !== undefined &&
+      !isDeepStrictEqual(input.payload.action, input.existing.action)) ||
+    (input.payload.schedule !== undefined &&
+      !isDeepStrictEqual(input.payload.schedule, input.existing.schedule)) ||
+    (input.payload.overlapPolicy !== undefined &&
+      input.payload.overlapPolicy !== input.existing.overlapPolicy) ||
+    (input.payload.metadata !== undefined &&
+      !isDeepStrictEqual(input.payload.metadata, input.existing.metadata)) ||
+    (input.existing.status === "paused" && input.payload.status === "active");
+  if (
+    materialExecutionChange &&
+    nextRunMode !== "existing_session" &&
+    (!materializedReusable || nextAgentConfig.model !== input.existing.agentConfig.model)
+  ) {
+    const beforeUpdateCommit = workspaceCustomModelCommitGuard({
+      settings: input.settings,
+      accountId: input.existing.accountId,
+      workspaceId: input.existing.workspaceId,
+      modelId: nextAgentConfig.model ?? input.settings.openaiModel,
+      claudeAuthoritySnapshot: await getScheduledTaskClaudeProviderAccountAuthoritySnapshot(
+        input.db,
+        input.existing.workspaceId,
+        input.existing.id,
+      ),
+    });
+    if (beforeUpdateCommit) update.beforeUpdateCommit = beforeUpdateCommit;
+  }
+  const existingXaiAuthority = await getScheduledTaskXaiProviderAccountAuthoritySnapshot(
+    input.db,
+    input.existing.workspaceId,
+    input.existing.id,
+  );
+  if (
+    existingXaiAuthority.scope === "user" &&
+    materialExecutionChange &&
+    (input.existing.createdBy.kind !== "subject" ||
+      input.existing.createdBy.subjectId !== input.grant.subjectId)
+  ) {
+    throw new HTTPException(409, {
+      message: "changing a user-scoped xAI scheduled task requires the same causal human",
+    });
+  }
+  if (materialExecutionChange) {
+    await assertScheduledTaskMutationOwner(input.db, input.grant, input.existing.id);
+    const ownerSubjectId = input.existing.ownerSubjectId;
     const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
       input.db,
-      input.existing.workspaceId,
+      input.grant.workspaceId,
       input.settings,
-      { subjectId: input.grant.subjectId },
+      ownerSubjectId ? { subjectId: ownerSubjectId } : {},
     );
-    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    let nextTarget = await validateScheduledTaskTarget({
       db: input.db,
-      workspaceId: input.existing.workspaceId,
-      settings: runtimeSettings,
-      tools: [...nextAgentConfig.tools, { kind: "mcp", id: "opengeni" }],
-      source: personalConnectionDelegationSourceForGrant(input.grant),
+      sessionAuthorization: input.sessionAuthorization,
+      authorizationSurface: input.authorizationSurface,
+      grant: input.grant,
+      targetSessionId: nextTargetSessionId,
+      runMode: nextRunMode,
+      variableSetId:
+        input.payload.variableSetId !== undefined
+          ? input.payload.variableSetId
+          : input.existing.variableSetId,
+      rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,
+      agentConfig: nextAgentConfig,
     });
-    if (input.existing.reusableSessionId && input.existing.runMode === "reusable_session") {
-      const existingDelegations = await getScheduledTaskPersonalConnectionDelegations(
-        input.db,
-        input.existing.workspaceId,
-        input.existing.id,
+    if (materializedReusable) {
+      nextTarget =
+        reusableTarget ??
+        (await getSession(input.db, input.existing.workspaceId, input.existing.reusableSessionId!));
+      if (!nextTarget || nextTarget.accountId !== input.existing.accountId)
+        throw new HTTPException(409, { message: "Scheduled task chat is unavailable" });
+    }
+    const nextConnectionTools = await scheduledConnectionTools(
+      input.db,
+      input.grant.workspaceId,
+      runtimeSettings,
+      nextTarget,
+      nextAgentConfig.tools,
+      ownerSubjectId ?? undefined,
+    );
+    const priorTargetSessionId =
+      input.existing.runMode === "existing_session"
+        ? input.existing.targetSessionId
+        : input.existing.runMode === "reusable_session"
+          ? input.existing.reusableSessionId
+          : null;
+    const priorTarget = priorTargetSessionId
+      ? priorTargetSessionId === nextTarget?.id
+        ? nextTarget
+        : await getSession(input.db, input.existing.workspaceId, priorTargetSessionId)
+      : null;
+    const priorConnectionResources = mergeResourceRefs(
+      priorTarget?.resources ?? [],
+      input.existing.agentConfig.resources,
+    );
+    const nextConnectionResources = mergeResourceRefs(
+      nextTarget?.resources ?? [],
+      nextAgentConfig.resources,
+    );
+    const priorConnectionTools = await scheduledConnectionTools(
+      input.db,
+      input.grant.workspaceId,
+      runtimeSettings,
+      priorTarget,
+      input.existing.agentConfig.tools,
+      ownerSubjectId ?? undefined,
+    );
+    const priorAccountSurfaceIds = new Set(
+      [...input.existing.agentConfig.tools, ...(priorTarget?.tools ?? []), ...priorConnectionTools]
+        .filter((tool) => tool.kind === "mcp")
+        .map((tool) => tool.id),
+    );
+    if (personalGitHubRepositoryResources(priorConnectionResources).length)
+      priorAccountSurfaceIds.add(PERSONAL_GITHUB_CONNECTION_SURFACE_ID);
+    const nextMcpIds = new Set(
+      nextConnectionTools.filter((tool) => tool.kind === "mcp").map((tool) => tool.id),
+    );
+    const nextAccountSurfaceIds = new Set(nextMcpIds);
+    const nextSurfaceEligibility = scheduledConnectionSurfaceEligibility(
+      runtimeSettings,
+      nextTarget,
+    );
+    if (nextSurfaceEligibility.googleDrivePublicationEnabled)
+      nextAccountSurfaceIds.add(GOOGLE_DRIVE_PUBLICATION_SERVER_ID);
+    if (personalGitHubRepositoryResources(nextConnectionResources).length)
+      nextAccountSurfaceIds.add(PERSONAL_GITHUB_CONNECTION_SURFACE_ID);
+    const movingChat =
+      nextRunMode !== input.existing.runMode ||
+      nextTargetSessionId !== input.existing.targetSessionId;
+    // Removing a selected tool or repository also removes its inherited account choice.
+    // Keep explicit caller selections subject to normal validation, and retain
+    // account choices for unchanged tools and repository selections.
+    const authoritySelections = (nextAgentConfig.connectionAccounts ?? []).filter(
+      (selection) =>
+        input.payload.connectionAccounts !== undefined ||
+        (movingChat
+          ? nextAccountSurfaceIds.has(selection.serverId)
+          : !priorAccountSurfaceIds.has(selection.serverId) ||
+            nextAccountSurfaceIds.has(selection.serverId)),
+    );
+    const acceptedConnections = await freezeConnectionAccounts({
+      db: input.db,
+      accountId: input.grant.accountId,
+      workspaceId: input.grant.workspaceId,
+      settings: nextTarget
+        ? settingsWithSessionMcpServerMetadata(runtimeSettings, nextTarget.mcpServers)
+        : runtimeSettings,
+      tools: nextConnectionTools,
+      resources: nextConnectionResources,
+      source: ownerSubjectId
+        ? { kind: "subject", subjectId: ownerSubjectId, accountId: input.existing.accountId }
+        : { kind: "none" },
+      authoritySelections,
+      // An edit replaces an accepted account set exactly. Omitting a connector
+      // from that set must not attach newly available accounts implicitly.
+      authoritySelectionsFrozen: input.existing.agentConfig.connectionAccountsFrozen === true,
+      ...nextSurfaceEligibility,
+    });
+    // A model-only patch still revalidates authority above, but is not an
+    // access refresh. Preserve exact existing selections, including legacy
+    // absent fields, unless the caller also changed accounts or the target.
+    if (
+      !input.payload.agentConfigPatch ||
+      input.payload.connectionAccounts !== undefined ||
+      authorityTargetChanged
+    ) {
+      const routeIds = new Set(
+        (acceptedConnections.mcpAccountBindings ?? []).map((binding) => binding.serverId),
       );
-      if (!personalConnectionDelegationsEqual(existingDelegations, personalConnectionDelegations)) {
-        throw new HTTPException(409, {
-          message:
-            "cannot change personal MCP connections of a task with a live reusable session; recreate the task",
-        });
-      }
+      nextAgentConfig.connectionAccounts = [
+        ...(acceptedConnections.mcpAccountBindings ?? []).map(
+          ({ canonicalServerId, connectionId }) => ({
+            serverId: canonicalServerId,
+            connectionId,
+          }),
+        ),
+        ...acceptedConnections.personalConnectionDelegations
+          .filter(
+            (item) =>
+              !routeIds.has(item.serverId) &&
+              (!item.connectionType ||
+                item.connectionType === "mcp" ||
+                item.connectionType === "github_personal"),
+          )
+          .map(({ serverId, connectionId }) => ({ serverId, connectionId })),
+      ];
+      nextAgentConfig.connectionAccountsFrozen = true;
     }
-    update.personalConnectionDelegations = personalConnectionDelegations;
+    update.agentConfig = nextAgentConfig;
+  }
+  if (
+    !materialExecutionChange &&
+    input.payload.connectionAccounts === undefined &&
+    update.clonePersonalResourceAuthorityFromRevision === undefined
+  ) {
+    // Administrative lifecycle/name edits preserve the exact revision-bound
+    // causal human. They must not silently re-authorize retained Variable Set,
+    // Rig, Connection, or xAI authority under the manager performing the edit.
+    update.clonePersonalResourceAuthorityFromRevision = input.existing.authorityRevision;
   }
   if (
     existingTarget &&
@@ -528,6 +1914,7 @@ export async function validatedScheduledTaskUpdate(input: {
       authorizationSurface: input.authorizationSurface,
       grant: input.grant,
       targetSessionId: existingTarget,
+      departingTarget: true,
       runMode: "existing_session",
       variableSetId: input.existing.variableSetId,
       rigId: input.existing.rigId,
@@ -548,13 +1935,39 @@ export async function validatedScheduledTaskUpdate(input: {
     rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,
     agentConfig: update.agentConfig ?? input.existing.agentConfig,
   });
+  if (
+    !knowledgeSource &&
+    !(
+      materializedReusable &&
+      isDeepStrictEqual(nextAgentConfig.machineTarget, input.existing.agentConfig.machineTarget) &&
+      nextAgentConfig.sandboxBackend === input.existing.agentConfig.sandboxBackend
+    )
+  ) {
+    await validateScheduledTaskMachineTarget({
+      settings: input.settings,
+      db: input.db,
+      grant: input.grant,
+      runMode: nextRunMode,
+      agentConfig: update.agentConfig ?? input.existing.agentConfig,
+    });
+  }
   if (
     input.payload.targetSessionId !== undefined ||
     input.existing.runMode === "existing_session" ||
-    nextRunMode === "existing_session"
+    nextRunMode === "existing_session" ||
+    (input.existing.runMode === "reusable_session" && nextRunMode !== "reusable_session")
   ) {
     update.targetSessionId = nextTargetSessionId;
   }
+  Object.assign(update, scheduledTaskAuthorityUpdateForGrant(input.grant));
+  const linkCapture = prepareExternalLinkTaskAdmission(
+    input.authorization,
+    scheduledTaskInitiatorForGrant(input.grant).actor,
+  );
+  if (linkCapture) update.captureLinkAuthority = linkCapture;
+  if (update.clonePersonalResourceAuthorityFromRevision !== undefined) {
+    update.refreshPersonalResourceAuthority = false;
+  }
   return update;
 }
 
@@ -572,21 +1985,19 @@ export async function requireScheduledTaskForApi(
 
 export type ScheduledTaskRestoreState = {
   task: ScheduledTask;
-  personalConnectionDelegations: McpPersonalConnectionDelegation[];
+  learning?: {
+    context: KnowledgeContext;
+    scope: "workspace" | "personal";
+    settings: import("@opengeni/contracts").AgentLearningOverridePatch;
+    expectedVersion: number;
+  };
 };
 
 export async function captureScheduledTaskRestoreState(
-  db: Database,
+  _db: Database,
   task: ScheduledTask,
 ): Promise<ScheduledTaskRestoreState> {
-  return {
-    task,
-    personalConnectionDelegations: await getScheduledTaskPersonalConnectionDelegations(
-      db,
-      task.workspaceId,
-      task.id,
-    ),
-  };
+  return { task };
 }
 
 export async function restoreScheduledTask(
@@ -602,13 +2013,13 @@ export async function restoreScheduledTask(
     overlapPolicy: task.overlapPolicy,
     action: task.action,
     agentConfig: task.agentConfig,
-    personalConnectionDelegations: previous.personalConnectionDelegations,
     ...(task.runMode === "existing_session"
       ? { targetSessionId: task.targetSessionId }
       : { reusableSessionId: task.reusableSessionId }),
     variableSetId: task.variableSetId,
     rigId: task.rigId,
     metadata: task.metadata,
+    clonePersonalResourceAuthorityFromRevision: task.authorityRevision,
   });
 }
 
@@ -617,6 +2028,8 @@ async function validateKnowledgeSourceSyncAction(input: {
   grant: AccessGrant;
   action: KnowledgeSourceSyncAction;
 }): Promise<void> {
+  if (isRetiredNativeAtlassianSource(input.action))
+    throw new HTTPException(410, { message: ATLASSIAN_NATIVE_RETIRED_MESSAGE });
   if (input.action.initiatingSubjectId !== input.grant.subjectId) {
     throw new HTTPException(403, {
       message: "knowledge source sync must preserve the exact initiating subject",
@@ -679,24 +2092,123 @@ export class ScheduledTaskSyncError extends Error {
   }
 }
 
+/**
+ * One deletion lifecycle shared by HTTP and first-party MCP adapters.
+ * Connector authorization is proven before the one-way tombstone. The same
+ * transaction detaches reclaimable task resources and persists both external
+ * cleanup obligations; best-effort processing is only an acceleration of that
+ * durable receipt.
+ */
+export async function deleteScheduledTaskLifecycle(input: {
+  db: Database;
+  workspaceId: string;
+  taskId: string;
+  subjectId: string;
+  beforeDeleteCommit?: (tx: Database) => Promise<void>;
+  preflightConnectorAuthorization: (task: ScheduledTask) => Promise<void>;
+  cleanupConnectorAuthorization: (db: Database, task: ScheduledTask) => Promise<void>;
+  processCleanupClaims?: (claims: readonly TemporalScheduleCleanupClaim[]) => Promise<void>;
+}): Promise<{
+  task: ScheduledTask;
+  changed: boolean;
+  cleanup: TemporalScheduleCleanupClaim | null;
+}> {
+  const result = await withWorkspaceSubjectRls(
+    input.db,
+    input.workspaceId,
+    input.subjectId,
+    async (tx) => {
+      const task = await getScheduledTaskIncludingDeletedForUpdate(
+        tx,
+        input.workspaceId,
+        input.taskId,
+      );
+      if (!task) throw new HTTPException(404, { message: "Scheduled task not found" });
+      await input.beforeDeleteCommit?.(tx);
+      const wasLive = task.deletedAt === null;
+      if (
+        scheduledTaskKnowledgeSource(task) &&
+        (requireScheduledTaskKnowledgeSource(task).initiatingSubjectId !== input.subjectId ||
+          requireScheduledTaskKnowledgeSource(task).connection.ownerSubjectId !== input.subjectId)
+      ) {
+        throw new HTTPException(403, {
+          message: "knowledge source schedule requires the exact initiating subject",
+        });
+      }
+      if (wasLive && scheduledTaskKnowledgeSource(task)) {
+        await input.preflightConnectorAuthorization(task);
+      }
+      const deletion = scheduledTaskKnowledgeSource(task)
+        ? await (async () => {
+            await input.cleanupConnectorAuthorization(tx, task);
+            return await deleteScheduledTask(tx, input.workspaceId, task.id, {
+              connectorCleanupSubjectId: input.subjectId,
+              connectorCleanupCompleted: true,
+              expectedAuthorityRevision: task.authorityRevision,
+              expectedExecutionDigest: task.executionDigest,
+            });
+          })()
+        : await deleteScheduledTask(tx, input.workspaceId, task.id);
+      return { task, deletion };
+    },
+  );
+  const { task, deletion } = result;
+  const { cleanup, changed } = deletion;
+  if (cleanup && input.processCleanupClaims) {
+    await input.processCleanupClaims([cleanup]);
+  }
+  return { task, changed, cleanup };
+}
+
 export async function syncCreatedScheduledTask(input: {
   db: Database;
   workflowClient: SessionWorkflowClient;
   task: ScheduledTask;
 }): Promise<void> {
   try {
-    await input.workflowClient.syncScheduledTask({ task: input.task });
+    await input.workflowClient.syncScheduledTask({
+      task: input.task,
+      onFailure: async (db, error) => {
+        let persistenceRestored = true;
+        try {
+          // The synchronizer keeps its lock through compensation and commit.
+          // A savepoint also rolls back a failed compensation independently.
+          await db.transaction(async (tx) => {
+            await requireUnchangedScheduledTaskForCompensation(tx, input.task);
+            await deleteScheduledTask(tx, input.task.workspaceId, input.task.id);
+          });
+        } catch {
+          persistenceRestored = false;
+        }
+        return new ScheduledTaskSyncError(error, persistenceRestored);
+      },
+    });
   } catch (error) {
-    let persistenceRestored = true;
-    try {
-      await deleteScheduledTask(input.db, input.task.workspaceId, input.task.id);
-    } catch {
-      persistenceRestored = false;
-    }
-    throw new ScheduledTaskSyncError(error, persistenceRestored);
+    if (error instanceof ScheduledTaskSyncError) throw error;
+    // Lock admission or transaction commit failed. No committed restoration
+    // was acknowledged; never compensate outside the synchronizer's lock.
+    throw new ScheduledTaskSyncError(error, false);
   }
 }
 
+async function requireUnchangedScheduledTaskForCompensation(
+  db: Database,
+  expected: ScheduledTask,
+): Promise<void> {
+  const current = await getScheduledTaskIncludingDeletedForUpdate(
+    db,
+    expected.workspaceId,
+    expected.id,
+  );
+  if (!current) throw new ScheduledTaskHeadChangedError();
+  const { deletedAt, ...task } = current;
+  // The execution digest excludes names and lifecycle state. Compare the full
+  // saved row under its write lock so a late sync failure cannot undo a newer
+  // edit, pause, materialization or authority revision.
+  if (deletedAt !== null || !isDeepStrictEqual(task, expected))
+    throw new ScheduledTaskHeadChangedError();
+}
+
 export async function syncUpdatedScheduledTask(input: {
   db: Database;
   workflowClient: SessionWorkflowClient;
@@ -704,15 +2216,42 @@ export async function syncUpdatedScheduledTask(input: {
   task: ScheduledTask;
 }): Promise<void> {
   try {
-    await input.workflowClient.syncScheduledTask({ task: input.task });
+    await input.workflowClient.syncScheduledTask({
+      task: input.task,
+      onFailure: async (db, error) => {
+        let persistenceRestored = true;
+        try {
+          await db.transaction(async (tx) => {
+            const learning = input.previous.learning;
+            // Compensate only our exact settings version, while the updated task
+            // still names that owner scope. A concurrent edit is never overwritten.
+            if (learning)
+              await saveAgentLearningSettings(tx, learning.context, {
+                scope: learning.scope,
+                source: { kind: "scheduled_task", id: input.task.id },
+                operationId: crypto.randomUUID(),
+                expectedVersion: learning.expectedVersion,
+                settings: {
+                  knowledge: "inherit",
+                  instructions: "inherit",
+                  skills: "inherit",
+                  ...learning.settings,
+                },
+              });
+            // Keep the learning-owner → task lock order used by ordinary edits.
+            // Any learning compensation above rolls back with a stale task head.
+            await requireUnchangedScheduledTaskForCompensation(tx, input.task);
+            await restoreScheduledTask(tx, input.previous);
+          });
+        } catch {
+          persistenceRestored = false;
+        }
+        return new ScheduledTaskSyncError(error, persistenceRestored);
+      },
+    });
   } catch (error) {
-    let persistenceRestored = true;
-    try {
-      await restoreScheduledTask(input.db, input.previous);
-    } catch {
-      persistenceRestored = false;
-    }
-    throw new ScheduledTaskSyncError(error, persistenceRestored);
+    if (error instanceof ScheduledTaskSyncError) throw error;
+    throw new ScheduledTaskSyncError(error, false);
   }
 }
 
@@ -770,19 +2309,65 @@ async function validateScheduledTaskAgentConfig(input: {
   db: Database;
   objectStorage: ObjectStorageDependency;
   grant: AccessGrant;
-  payload: { agentConfig: ScheduledTaskAgentConfig };
+  authorization?: AccessGrantAuthorization;
+  payload: {
+    agentConfig: ScheduledTaskAgentConfig;
+    runMode?: string;
+    targetSessionId?: string | null | undefined;
+  };
   workspaceId: string;
   toolsProvided?: boolean;
+  /** Only an already materialized reusable chat may retain unused creation defaults. */
+  retainedCreationConfig?: ScheduledTaskAgentConfig;
 }): Promise<ScheduledTaskAgentConfig> {
+  const existingChat = input.payload.runMode === "existing_session";
+  if (existingChat)
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        agentConfig: scheduledSessionMessageConfig(input.payload.agentConfig),
+      },
+      toolsProvided: true,
+    };
+  const unchangedCreationField = (key: keyof ScheduledTaskAgentConfig) =>
+    input.retainedCreationConfig !== undefined &&
+    isDeepStrictEqual(input.payload.agentConfig[key], input.retainedCreationConfig[key]);
+  const actor = scheduledTaskInitiatorForGrant(input.grant).actor;
+  const parent =
+    actor && !existingChat ? await getSession(input.db, input.workspaceId, actor.sessionId) : null;
+  if (!existingChat && actor && (!parent || parent.accountId !== input.grant.accountId)) {
+    throw new HTTPException(403, {
+      message: "Scheduled Skill selection requires the creating agent's session",
+    });
+  }
+  let bundledSkillIds: ScheduledTaskAgentConfig["bundledSkillIds"];
+  try {
+    bundledSkillIds = existingChat
+      ? undefined
+      : unchangedCreationField("bundledSkillIds")
+        ? input.payload.agentConfig.bundledSkillIds
+        : resolveBundledSkillSelection(
+            input.payload.agentConfig.bundledSkillIds,
+            parent?.bundledSkillIds,
+          );
+  } catch (error) {
+    throw new HTTPException(422, {
+      message: error instanceof Error ? error.message : "Invalid bundled Skill selection",
+    });
+  }
   // Reject a curated-out model before touching the DB: a scheduled task is a
   // session the worker runs later, so it must pass the same allow-list as the
   // session choke points (a `scheduled_tasks:manage` holder could otherwise set
   // a model the host does not expose). An omitted model inherits the host
   // default downstream, which is always configured.
-  const model = canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);
+  const model = unchangedCreationField("model")
+    ? input.payload.agentConfig.model
+    : canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);
   // Same policy vetting as the session choke points; an omitted model flows
   // through session creation later, where the effective default is vetted.
-  await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);
+  if (!unchangedCreationField("model"))
+    await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);
   const resources = normalizeResources(input.payload.agentConfig.resources ?? []);
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     input.db,
@@ -790,16 +2375,38 @@ async function validateScheduledTaskAgentConfig(input: {
     input.settings,
     { subjectId: input.grant.subjectId },
   );
-  const requestedTools = validateToolRefs(input.payload.agentConfig.tools ?? [], runtimeSettings);
-  // A task whose creator did not choose tools gets the workspace's enabled
-  // capability MCP servers, exactly like a session created without a tools
-  // key. Scheduled runs are sessions too; "no MCP servers at all" was a trap
-  // every pack/template instantiation path kept falling into (a maintenance
-  // task that cannot reach its workspace's notebook MCP cannot do its job).
+  const retainTools = unchangedCreationField("tools");
+  const requestedTools = retainTools
+    ? input.payload.agentConfig.tools
+    : validateToolRefs(input.payload.agentConfig.tools ?? [], runtimeSettings);
+  const workspace = await requireWorkspace(input.db, input.workspaceId);
+  if (
+    parent?.tenancy?.visibility === "private" &&
+    workspace.kind !== "personal" &&
+    input.payload.runMode !== "existing_session" &&
+    !input.payload.targetSessionId
+  ) {
+    throw new HTTPException(422, {
+      message:
+        "Schedule this private chat as the existing-session target, or create the task in your Personal workspace.",
+    });
+  }
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
+  // A task whose creator did not choose tools gets the workspace's exact
+  // session defaults (or the deployment compatibility default), exactly like
+  // a session created without a tools key. Scheduled runs are sessions too;
+
+  // kept falling into (a maintenance task that cannot reach its workspace's
+  // notebook MCP cannot do its job).
   const tools =
-    (input.toolsProvided ?? true)
+    retainTools || (input.toolsProvided ?? true)
       ? requestedTools
-      : withDefaultEnabledCapabilityMcpTools(requestedTools, input.settings, runtimeSettings);
+      : withWorkspaceDefaultMcpTools(
+          requestedTools,
+          input.settings,
+          runtimeSettings,
+          workspaceSessionToolDefaults,
+        );
   const prompt = input.payload.agentConfig.prompt.trim();
   if (!prompt) {
     throw new HTTPException(422, { message: "scheduled task prompt is required" });
@@ -813,7 +2420,44 @@ async function validateScheduledTaskAgentConfig(input: {
   if (resources.some((resource) => resource.kind === "file") && !input.objectStorage) {
     throw new HTTPException(503, { message: "object storage is not configured" });
   }
-  await validateFileResources(input.db, input.workspaceId, resources);
+  const fileActor =
+    resources.some((resource) => resource.kind === "file") &&
+    hasPermission(input.grant.permissions, "files:read")
+      ? input.authorization
+        ? await fileOwnerContextForAccess({ db: input.db }, input.authorization, "files:read")
+        : input.grant.principalKind === "agent_attempt"
+          ? await fileOwnerContextForAgent({ db: input.db }, input.grant, "files:read")
+          : { subjectId: input.grant.subjectId, privateFileOwnerSubjectId: null }
+      : { subjectId: input.grant.subjectId, privateFileOwnerSubjectId: null };
+  await withSessionRlsActorContext(fileActor, async () => {
+    const target =
+      input.payload.targetSessionId && input.payload.runMode !== "new_session_per_run"
+        ? await getSessionAuthorityProjection(
+            input.db,
+            input.workspaceId,
+            input.payload.targetSessionId,
+          )
+        : null;
+    const privateDestination =
+      workspace.kind === "personal" ||
+      (target?.visibility === "user_private" &&
+        target.ownerSubjectId === fileActor.privateFileOwnerSubjectId) ||
+      (target?.memoryScope === "user" &&
+        target.scopeSubjectId === fileActor.privateFileOwnerSubjectId);
+    await validateFileResources(
+      input.db,
+      input.grant.accountId,
+      input.workspaceId,
+      input.grant.subjectId,
+      resources,
+      {
+        ...fileActor,
+        privateFileOwnerSubjectId: privateDestination
+          ? (fileActor.privateFileOwnerSubjectId ?? null)
+          : null,
+      },
+    );
+  });
   if (input.payload.agentConfig.slackBotConnectionId) {
     await validateOpenGeniSlackBotConnectionSelection(
       input.db,
@@ -823,8 +2467,7 @@ async function validateScheduledTaskAgentConfig(input: {
     );
   }
   const requestedMaxDepth = input.payload.agentConfig.maxNestedAgentDepth;
-  if (requestedMaxDepth !== undefined) {
-    const workspace = await requireWorkspace(input.db, input.workspaceId);
+  if (requestedMaxDepth !== undefined && !unchangedCreationField("maxNestedAgentDepth")) {
     const workspaceMaxDepth = workspace.settings.maxNestedAgentDepth;
     const deploymentPolicy = await getNestedAgentDepthDeploymentPolicy(input.db);
     const inheritedMaxDepth =
@@ -840,13 +2483,107 @@ async function validateScheduledTaskAgentConfig(input: {
       });
     }
   }
-  return {
+  const validated = {
     ...input.payload.agentConfig,
+    ...(bundledSkillIds !== undefined ? { bundledSkillIds } : {}),
     ...(model === undefined || model === null ? {} : { model }),
     prompt,
     resources,
     tools,
   };
+  validateIncidentTelemetryPreflightSelection(input.settings, validated);
+  return existingChat ? scheduledSessionMessageConfig(validated) : validated;
+}
+
+/**
+ * Static incident-telemetry admission validates only already-selected task
+ * authority. It never discovers a resource, reads a variable value, probes a
+ * provider, or treats ambient worker credentials as responder capability.
+ * Mutable rig/variable-set metadata is revalidated again at dispatch.
+ */
+export function validateIncidentTelemetryPreflightSelection(
+  settings: Pick<Settings, "allowedFirstPartyMcpTools" | "defaultFirstPartyMcpTools">,
+  agentConfig: ScheduledTaskAgentConfig,
+): void {
+  const executionClass = agentConfig.executionClass;
+  const preflight = agentConfig.incidentTelemetryPreflight;
+  if (executionClass === undefined && preflight === undefined) return;
+  if (executionClass !== "incident_telemetry" || !preflight) {
+    throw new HTTPException(422, {
+      message:
+        "executionClass=incident_telemetry and incidentTelemetryPreflight must be configured together",
+    });
+  }
+
+  for (const required of preflight.requiredResources) {
+    if (!agentConfig.resources.some((selected) => isDeepStrictEqual(selected, required))) {
+      throw new HTTPException(422, {
+        message: "incidentTelemetryPreflight.requiredResources must be exact selected resources",
+      });
+    }
+  }
+
+  const selectedMcpServerIds = new Set(agentConfig.tools.map((tool) => tool.id));
+  // Scheduled dispatch always attaches the first-party OpenGeni MCP server.
+  selectedMcpServerIds.add("opengeni");
+  if (preflight.requiredMcpServerIds.some((id) => !selectedMcpServerIds.has(id))) {
+    throw new HTTPException(422, {
+      message: "incidentTelemetryPreflight.requiredMcpServerIds must be exact selected MCP servers",
+    });
+  }
+
+  const selectedFirstPartyTools = new Set(resolveFirstPartyMcpToolPolicy(settings).default);
+  if (preflight.requiredFirstPartyMcpTools.some((tool) => !selectedFirstPartyTools.has(tool))) {
+    throw new HTTPException(422, {
+      message:
+        "incidentTelemetryPreflight.requiredFirstPartyMcpTools must be present in the selected first-party tool policy",
+    });
+  }
+
+  const selectedFirstPartyPermissions = new Set<Permission>(DEFAULT_FIRST_PARTY_MCP_PERMISSIONS);
+  if (
+    (preflight.requiredFirstPartyMcpPermissions ?? []).some(
+      (permission) => !selectedFirstPartyPermissions.has(permission),
+    )
+  ) {
+    throw new HTTPException(422, {
+      message:
+        "incidentTelemetryPreflight.requiredFirstPartyMcpPermissions must be present in the scheduled responder permission policy",
+    });
+  }
+
+  const route = preflight.dataSource.route;
+  if (route.kind === "mcp" && !selectedMcpServerIds.has(route.serverId)) {
+    throw new HTTPException(422, {
+      message: "incidentTelemetryPreflight.dataSource.route must use a selected MCP server",
+    });
+  }
+  if (route.kind === "first_party" && !selectedFirstPartyTools.has(route.tool)) {
+    throw new HTTPException(422, {
+      message: "incidentTelemetryPreflight.dataSource.route must use a selected first-party tool",
+    });
+  }
+  if (route.kind === "variable_set") {
+    const declaredSets = new Set(preflight.requiredVariableSetNames);
+    const declaredVariables = new Set(preflight.requiredVariableNames);
+    if (
+      !declaredSets.has(route.variableSetName) ||
+      route.variableNames.some((name) => !declaredVariables.has(name))
+    ) {
+      throw new HTTPException(422, {
+        message:
+          "incidentTelemetryPreflight.dataSource.route variable metadata must be declared as required",
+      });
+    }
+  }
+  if (route.kind === "rig_credential_hook") {
+    if (!preflight.requiredRig?.credentialHookIds.includes(route.credentialHookId)) {
+      throw new HTTPException(422, {
+        message:
+          "incidentTelemetryPreflight.dataSource.route rig hook must be declared as required",
+      });
+    }
+  }
 }
 
 function validateScheduledTaskSchedule(schedule: ScheduledTask["schedule"]): void {