@opengeni/core 0.28.1 → 2.1.0-canary.0

package/src/domain/scheduled-tasks.ts

@@ -1,8 +1,9 @@
-import type { Settings } from "@opengeni/config";
+import { resolveFirstPartyMcpToolPolicy, type Settings } from "@opengeni/config";
 import type {
   AccessGrant,
   McpPersonalConnectionDelegation,
   KnowledgeSourceSyncAction,
+  Permission,
   ScheduledTask,
   ScheduledTaskAgentConfig,
   Session,
@@ -12,7 +13,11 @@ import type {
   UpdateScheduledTaskRequest as UpdateScheduledTaskPayload,
   XaiProviderAccountAuthoritySnapshotV1,
 } from "@opengeni/contracts";
-import { OPENGENI_SLACK_BOT_SESSION_METADATA_KEY } from "@opengeni/contracts";
+import {
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
+  resolveWorkspaceSessionToolDefaults,
+} from "@opengeni/contracts";
 import {
   createScheduledTask,
   deleteScheduledTask,
@@ -21,17 +26,23 @@ import {
   getNestedAgentDepthDeploymentPolicy,
   getRig,
   getScheduledTask,
+  getScheduledTaskIncludingDeletedForUpdate,
   getScheduledTaskPersonalConnectionDelegations,
+  getScheduledTaskXaiProviderAccountAuthoritySnapshot,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
   getSession,
+  nestedPostgresSqlState,
   requireWorkspace,
   scopedKnowledgeScopeKey,
   updateScheduledTask,
+  withWorkspaceSubjectRls,
   resolveXaiProviderAccountAuthoritySnapshotForAcceptance,
   type Database,
+  type TemporalScheduleCleanupClaim,
   type UpdateScheduledTaskInput,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
+import { isDeepStrictEqual } from "node:util";
 import { hasPermission, requirePermission } from "../access";
 import {
   requireSessionAuthorization,
@@ -45,7 +56,6 @@ import { validateVariableSetAttachment } from "./environments";
 import {
   freezePersonalConnectionDelegations,
   personalConnectionDelegationSourceForGrant,
-  personalConnectionDelegationsEqual,
 } from "./personal-connection-delegations";
 import {
   assertWorkspaceModelPolicyAllows,
@@ -59,10 +69,11 @@ import {
 } from "./slack-bot";
 import {
   normalizeResources,
+  personalGitHubRepositoryResources,
   validateFileResources,
   validateGitHubRepositorySelection,
   validateToolRefs,
-  withDefaultEnabledCapabilityMcpTools,
+  withWorkspaceDefaultMcpTools,
 } from "./resources";
 
 /**
@@ -85,6 +96,26 @@ export function scheduledTaskToolsProvided(rawPayload: unknown): boolean {
   );
 }
 
+export function scheduledConnectionSurfaceEligibility(
+  settings: Settings,
+  target: Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null,
+): { googleDrivePublicationEnabled: boolean; atlassianEnabled: boolean } {
+  const tools = target?.firstPartyMcpTools ?? resolveFirstPartyMcpToolPolicy(settings).default;
+  const permissions = target?.firstPartyMcpPermissions?.length
+    ? target.firstPartyMcpPermissions
+    : DEFAULT_FIRST_PARTY_MCP_PERMISSIONS;
+  return {
+    googleDrivePublicationEnabled:
+      tools.includes("editable_artifact_export") &&
+      tools.includes("editable_artifact_export_status") &&
+      permissions.includes("artifacts:read") &&
+      permissions.includes("artifacts:publish"),
+    atlassianEnabled:
+      tools.some((tool) => tool.startsWith("atlassian_")) &&
+      permissions.includes("connections:read"),
+  };
+}
+
 export async function createValidatedScheduledTask(input: {
   settings: Settings;
   db: Database;
@@ -147,22 +178,38 @@ export async function createValidatedScheduledTask(input: {
   // NOT that it has an active version now (that is a fire-time concern). RLS
   // makes a cross-workspace id indistinguishable from missing → both 422.
   if (!knowledgeAction && input.payload.rigId) {
-    await requireScheduledTaskRig(input.db, input.grant.workspaceId, input.payload.rigId);
-  }
-  const personalConnectionDelegations = knowledgeAction
-    ? []
-    : await freezePersonalConnectionDelegations({
-        db: input.db,
+    await requireScheduledTaskRig(
+      input.db,
+      {
+        accountId: input.grant.accountId,
         workspaceId: input.grant.workspaceId,
-        settings: await settingsWithEnabledCapabilityMcpServers(
-          input.db,
-          input.grant.workspaceId,
-          input.settings,
-          { subjectId: input.grant.subjectId },
-        ),
-        tools: [...agentConfig.tools, { kind: "mcp", id: "opengeni" }],
-        source: personalConnectionDelegationSourceForGrant(input.grant),
-      });
+        subjectId: input.grant.subjectId,
+      },
+      input.payload.rigId,
+    );
+  }
+  const runtimeSettings = knowledgeAction
+    ? null
+    : await settingsWithEnabledCapabilityMcpServers(
+        input.db,
+        input.grant.workspaceId,
+        input.settings,
+        { subjectId: input.grant.subjectId },
+      );
+  const personalConnectionDelegations =
+    knowledgeAction || !runtimeSettings
+      ? []
+      : await freezePersonalConnectionDelegations({
+          db: input.db,
+          workspaceId: input.grant.workspaceId,
+          settings: runtimeSettings,
+          tools: [...agentConfig.tools, { kind: "mcp", id: "opengeni" }],
+          resources: agentConfig.resources,
+          source: personalConnectionDelegationSourceForGrant(input.grant),
+          authoritySelections: input.payload.connectionAuthorities,
+          rejectUnselectedActivatedConnections: true,
+          ...scheduledConnectionSurfaceEligibility(runtimeSettings, target),
+        });
   const creationInitiator = creationInitiatorForGrant(input.grant);
   const xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1 =
     creationInitiator.actor
@@ -176,28 +223,84 @@ export async function createValidatedScheduledTask(input: {
           workspaceId: input.grant.workspaceId,
           subjectId: input.grant.subjectId,
         });
-  return await createScheduledTask(input.db, {
-    id,
-    accountId: input.grant.accountId,
-    workspaceId: input.grant.workspaceId,
-    name: trimmedScheduledTaskName(input.payload.name),
-    status: input.payload.status,
-    schedule: input.payload.schedule,
-    temporalScheduleId: scheduledTaskTemporalScheduleId(id),
-    runMode: input.payload.runMode,
-    overlapPolicy: input.payload.overlapPolicy,
-    action,
-    agentConfig,
-    ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),
-    ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),
-    createdByActor: creationInitiator.actor ?? null,
-    personalConnectionDelegations,
-    xaiProviderAccountAuthoritySnapshot,
-    targetSessionId: target?.id ?? null,
-    variableSetId: input.payload.variableSetId ?? null,
-    rigId: input.payload.rigId ?? null,
-    metadata: input.payload.metadata,
-  });
+  return await withScheduledTaskAuthorityWriteErrors(() =>
+    createScheduledTask(input.db, {
+      id,
+      accountId: input.grant.accountId,
+      workspaceId: input.grant.workspaceId,
+      name: trimmedScheduledTaskName(input.payload.name),
+      status: input.payload.status,
+      schedule: input.payload.schedule,
+      temporalScheduleId: scheduledTaskTemporalScheduleId(id),
+      runMode: input.payload.runMode,
+      overlapPolicy: input.payload.overlapPolicy,
+      action,
+      agentConfig,
+      ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),
+      ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),
+      createdByActor: creationInitiator.actor ?? null,
+      personalConnectionDelegations,
+      xaiProviderAccountAuthoritySnapshot,
+      targetSessionId: target?.id ?? null,
+      variableSetId: input.payload.variableSetId ?? null,
+      rigId: input.payload.rigId ?? null,
+      metadata: input.payload.metadata,
+    }),
+  );
+}
+
+function nestedPostgresMessage(error: unknown): string | null {
+  const queue: unknown[] = [error];
+  const seen = new Set<unknown>();
+  while (queue.length > 0 && seen.size < 64) {
+    const current = queue.shift();
+    if (!current || typeof current !== "object" || seen.has(current)) continue;
+    seen.add(current);
+    const record = current as Record<string, unknown>;
+    if (typeof record.code === "string" && typeof record.message === "string") {
+      return record.message;
+    }
+    for (const key of ["cause", "errors", "error", "originalError"]) {
+      const nested = record[key];
+      if (Array.isArray(nested)) queue.push(...nested);
+      else if (nested !== undefined) queue.push(nested);
+    }
+  }
+  return null;
+}
+
+/**
+ * Scheduled-task authority writes fail closed inside SECURITY DEFINER seams
+ * (42501): a non-human writer delegating resources, an authorizer without
+ * active workspace membership, or a foreign human retaining another subject's
+ * grants. Those are caller-resolvable conflicts, not server faults.
+ */
+export async function withScheduledTaskAuthorityWriteErrors<T>(run: () => Promise<T>): Promise<T> {
+  try {
+    return await run();
+  } catch (error) {
+    if (nestedPostgresSqlState(error) === "42501") {
+      const detail = nestedPostgresMessage(error);
+      throw new HTTPException(409, {
+        message: detail
+          ? `scheduled task authority denied: ${detail}`
+          : "scheduled task authority denied",
+      });
+    }
+    throw error;
+  }
+}
+
+/** API/MCP-facing update that maps authority-write denials to 409. */
+export async function updateScheduledTaskForApi(
+  db: Database,
+  workspaceId: string,
+  taskId: string,
+  update: UpdateScheduledTaskInput,
+): Promise<ScheduledTask> {
+  return await withScheduledTaskAuthorityWriteErrors(() =>
+    updateScheduledTask(db, workspaceId, taskId, update),
+  );
 }
 
 export async function validateScheduledTaskTarget(input: {
@@ -272,7 +375,7 @@ export async function validateScheduledTaskTarget(input: {
       message: "target session variableSet attachment does not match the scheduled task",
     });
   }
-  if (input.rigId && input.rigId !== session.rigId) {
+  if ((session.rigId ?? null) !== (input.rigId ?? null)) {
     throw new HTTPException(422, {
       message: "target session rig does not match the scheduled task",
     });
@@ -313,14 +416,32 @@ export function scheduledTaskRunForGrant<T extends { sessionId: string | null }>
   return { ...run, sessionId: null };
 }
 
+export function scheduledTaskAuthorityUpdateForGrant(
+  grant: AccessGrant,
+): Pick<
+  UpdateScheduledTaskInput,
+  | "refreshPersonalResourceAuthority"
+  | "authorityUpdatedBy"
+  | "authorityUpdatedByContext"
+  | "authorityUpdatedByActor"
+> {
+  const writer = creationInitiatorForGrant(grant);
+  return {
+    refreshPersonalResourceAuthority: true,
+    ...(writer.initiator ? { authorityUpdatedBy: writer.initiator } : {}),
+    ...(writer.context ? { authorityUpdatedByContext: writer.context } : {}),
+    authorityUpdatedByActor: writer.actor ?? null,
+  };
+}
+
 // Validate a scheduled task's rig reference: it must name a rig in the
 // workspace. A missing/cross-workspace id is a 422 (RLS-invisible == missing).
 async function requireScheduledTaskRig(
   db: Database,
-  workspaceId: string,
+  access: { accountId: string; workspaceId: string; subjectId: string },
   rigId: string,
 ): Promise<void> {
-  const rig = await getRig(db, workspaceId, rigId);
+  const rig = await getRig(db, access, rigId);
   if (!rig) {
     throw new HTTPException(422, { message: `unknown rigId: ${rigId}` });
   }
@@ -351,7 +472,8 @@ export async function validatedScheduledTaskUpdate(input: {
       input.payload.runMode !== undefined ||
       input.payload.targetSessionId !== undefined ||
       input.payload.variableSetId !== undefined ||
-      input.payload.rigId !== undefined
+      input.payload.rigId !== undefined ||
+      input.payload.connectionAuthorities !== undefined
     ) {
       throw new HTTPException(422, {
         message: "knowledge source schedules do not accept agent/session configuration",
@@ -436,7 +558,7 @@ export async function validatedScheduledTaskUpdate(input: {
       if (input.existing.variableSetId !== null) {
         // Detaching is also an attachment change: it strips the secrets a
         // task's instructions were designed around.
-        requirePermission(input.grant, "variable-sets:use");
+        requirePermission(input.grant, "variable-sets:attach");
       }
       update.variableSetId = null;
     } else {
@@ -450,11 +572,25 @@ export async function validatedScheduledTaskUpdate(input: {
     }
   }
   if (input.payload.rigId !== undefined) {
-    // The rig binds fresh per fire, so changing it on a reusable-session task is
-    // harmless for the LIVE session (which keeps its own frozen version) and
-    // only affects subsequent new-session fires — no live-session guard needed.
+    if (
+      input.existing.runMode === "reusable_session" &&
+      input.existing.reusableSessionId !== null &&
+      input.payload.rigId !== input.existing.rigId
+    ) {
+      throw new HTTPException(409, {
+        message: "A reusable-session task cannot change rigId after materialization; recreate it",
+      });
+    }
     if (input.payload.rigId !== null) {
-      await requireScheduledTaskRig(input.db, input.existing.workspaceId, input.payload.rigId);
+      await requireScheduledTaskRig(
+        input.db,
+        {
+          accountId: input.existing.accountId,
+          workspaceId: input.existing.workspaceId,
+          subjectId: input.grant.subjectId,
+        },
+        input.payload.rigId,
+      );
     }
     update.rigId = input.payload.rigId;
   }
@@ -490,33 +626,142 @@ export async function validatedScheduledTaskUpdate(input: {
       });
     }
     update.agentConfig = nextAgentConfig;
+  }
+  const nextAgentConfig = update.agentConfig ?? input.existing.agentConfig;
+  const authorityTargetChanged =
+    nextRunMode !== input.existing.runMode ||
+    nextTargetSessionId !== input.existing.targetSessionId ||
+    (input.payload.variableSetId !== undefined &&
+      input.payload.variableSetId !== input.existing.variableSetId) ||
+    (input.payload.rigId !== undefined && input.payload.rigId !== input.existing.rigId);
+  const materialExecutionChange =
+    authorityTargetChanged ||
+    input.payload.connectionAuthorities !== undefined ||
+    !isDeepStrictEqual(nextAgentConfig, input.existing.agentConfig) ||
+    (input.payload.action !== undefined &&
+      !isDeepStrictEqual(input.payload.action, input.existing.action)) ||
+    (input.payload.schedule !== undefined &&
+      !isDeepStrictEqual(input.payload.schedule, input.existing.schedule)) ||
+    (input.payload.overlapPolicy !== undefined &&
+      input.payload.overlapPolicy !== input.existing.overlapPolicy) ||
+    (input.payload.metadata !== undefined &&
+      !isDeepStrictEqual(input.payload.metadata, input.existing.metadata)) ||
+    (input.existing.status === "paused" && input.payload.status === "active");
+  const existingXaiAuthority = await getScheduledTaskXaiProviderAccountAuthoritySnapshot(
+    input.db,
+    input.existing.workspaceId,
+    input.existing.id,
+  );
+  if (
+    existingXaiAuthority.scope === "user" &&
+    materialExecutionChange &&
+    (input.existing.createdBy.kind !== "subject" ||
+      input.existing.createdBy.subjectId !== input.grant.subjectId)
+  ) {
+    throw new HTTPException(409, {
+      message: "changing a user-scoped xAI scheduled task requires the same causal human",
+    });
+  }
+  const existingDelegations = await getScheduledTaskPersonalConnectionDelegations(
+    input.db,
+    input.existing.workspaceId,
+    input.existing.id,
+  );
+  if (input.payload.connectionAuthorities === undefined) {
+    if (
+      materialExecutionChange &&
+      existingDelegations.some((delegation) => delegation.connectionType === "github_personal")
+    ) {
+      throw new HTTPException(409, {
+        message:
+          "material changes to a personal GitHub-authorized task require explicit connectionAuthorities",
+      });
+    }
+    if (
+      existingDelegations.length > 0 &&
+      !isDeepStrictEqual(nextAgentConfig.tools, input.existing.agentConfig.tools)
+    ) {
+      throw new HTTPException(409, {
+        message:
+          "changing tools on a connection-authorized task requires explicit connectionAuthorities",
+      });
+    }
+    if (existingDelegations.length > 0) {
+      if (
+        materialExecutionChange &&
+        existingDelegations.some(
+          (delegation) => delegation.ownerSubjectId !== input.grant.subjectId,
+        )
+      ) {
+        throw new HTTPException(409, {
+          message:
+            "preserving connection authority requires the same causal human; provide a new explicit selection",
+        });
+      }
+      if (authorityTargetChanged) {
+        update.cloneConnectionAuthorityFromRevision = input.existing.authorityRevision;
+      } else {
+        update.clonePersonalResourceAuthorityFromRevision = input.existing.authorityRevision;
+      }
+    }
+  } else if (input.payload.connectionAuthorities.length === 0) {
+    if (personalGitHubRepositoryResources(nextAgentConfig.resources).length > 0) {
+      throw new HTTPException(409, {
+        message:
+          "personal GitHub repository resources cannot be retained without connectionAuthorities",
+      });
+    }
+    update.personalConnectionDelegations = [];
+  } else {
     const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
       input.db,
-      input.existing.workspaceId,
+      // Same object as the subject just below, and as the freeze call further
+      // down: the task was loaded with `getScheduledTask(db, grant.workspaceId,
+      // ...)`, so this is `input.existing.workspaceId`, sourced consistently.
+      input.grant.workspaceId,
       input.settings,
       { subjectId: input.grant.subjectId },
     );
-    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    const nextTarget = await validateScheduledTaskTarget({
       db: input.db,
-      workspaceId: input.existing.workspaceId,
+      sessionAuthorization: input.sessionAuthorization,
+      authorizationSurface: input.authorizationSurface,
+      grant: input.grant,
+      targetSessionId: nextTargetSessionId,
+      runMode: nextRunMode,
+      variableSetId:
+        input.payload.variableSetId !== undefined
+          ? input.payload.variableSetId
+          : input.existing.variableSetId,
+      rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,
+      agentConfig: nextAgentConfig,
+    });
+    update.personalConnectionDelegations = await freezePersonalConnectionDelegations({
+      db: input.db,
+      // Both halves of the authority question come from ONE object. The task was
+      // loaded with `getScheduledTask(db, grant.workspaceId, ...)`, so this is
+      // the same workspace as `input.existing.workspaceId`; taking it from the
+      // grant means the workspace can never drift from the `accountId` that
+      // `personalConnectionDelegationSourceForGrant` reads off the same grant.
+      workspaceId: input.grant.workspaceId,
       settings: runtimeSettings,
       tools: [...nextAgentConfig.tools, { kind: "mcp", id: "opengeni" }],
+      resources: nextAgentConfig.resources,
       source: personalConnectionDelegationSourceForGrant(input.grant),
+      authoritySelections: input.payload.connectionAuthorities,
+      rejectUnselectedActivatedConnections: true,
+      ...scheduledConnectionSurfaceEligibility(runtimeSettings, nextTarget),
     });
-    if (input.existing.reusableSessionId && input.existing.runMode === "reusable_session") {
-      const existingDelegations = await getScheduledTaskPersonalConnectionDelegations(
-        input.db,
-        input.existing.workspaceId,
-        input.existing.id,
-      );
-      if (!personalConnectionDelegationsEqual(existingDelegations, personalConnectionDelegations)) {
-        throw new HTTPException(409, {
-          message:
-            "cannot change personal MCP connections of a task with a live reusable session; recreate the task",
-        });
-      }
-    }
-    update.personalConnectionDelegations = personalConnectionDelegations;
+  }
+  if (
+    !materialExecutionChange &&
+    input.payload.connectionAuthorities === undefined &&
+    update.clonePersonalResourceAuthorityFromRevision === undefined
+  ) {
+    // Administrative lifecycle/name edits preserve the exact revision-bound
+    // causal human. They must not silently re-authorize retained Variable Set,
+    // Rig, Connection, or xAI authority under the manager performing the edit.
+    update.clonePersonalResourceAuthorityFromRevision = input.existing.authorityRevision;
   }
   if (
     existingTarget &&
@@ -551,10 +796,15 @@ export async function validatedScheduledTaskUpdate(input: {
   if (
     input.payload.targetSessionId !== undefined ||
     input.existing.runMode === "existing_session" ||
-    nextRunMode === "existing_session"
+    nextRunMode === "existing_session" ||
+    (input.existing.runMode === "reusable_session" && nextRunMode !== "reusable_session")
   ) {
     update.targetSessionId = nextTargetSessionId;
   }
+  Object.assign(update, scheduledTaskAuthorityUpdateForGrant(input.grant));
+  if (update.clonePersonalResourceAuthorityFromRevision !== undefined) {
+    update.refreshPersonalResourceAuthority = false;
+  }
   return update;
 }
 
@@ -609,6 +859,7 @@ export async function restoreScheduledTask(
     variableSetId: task.variableSetId,
     rigId: task.rigId,
     metadata: task.metadata,
+    clonePersonalResourceAuthorityFromRevision: task.authorityRevision,
   });
 }
 
@@ -679,6 +930,73 @@ export class ScheduledTaskSyncError extends Error {
   }
 }
 
+/**
+ * One deletion lifecycle shared by HTTP and first-party MCP adapters.
+ * Connector authorization is proven before the one-way tombstone. The same
+ * transaction detaches reclaimable task resources and persists both external
+ * cleanup obligations; best-effort processing is only an acceleration of that
+ * durable receipt.
+ */
+export async function deleteScheduledTaskLifecycle(input: {
+  db: Database;
+  workspaceId: string;
+  taskId: string;
+  subjectId: string;
+  preflightConnectorAuthorization: (task: ScheduledTask) => Promise<void>;
+  cleanupConnectorAuthorization: (db: Database, task: ScheduledTask) => Promise<void>;
+  processCleanupClaims?: (claims: readonly TemporalScheduleCleanupClaim[]) => Promise<void>;
+}): Promise<{
+  task: ScheduledTask;
+  changed: boolean;
+  cleanup: TemporalScheduleCleanupClaim | null;
+}> {
+  const result = await withWorkspaceSubjectRls(
+    input.db,
+    input.workspaceId,
+    input.subjectId,
+    async (tx) => {
+      const task = await getScheduledTaskIncludingDeletedForUpdate(
+        tx,
+        input.workspaceId,
+        input.taskId,
+      );
+      if (!task) throw new HTTPException(404, { message: "Scheduled task not found" });
+      const wasLive = task.deletedAt === null;
+      if (
+        task.action.kind === "knowledge_source_sync" &&
+        (task.action.initiatingSubjectId !== input.subjectId ||
+          task.action.connection.ownerSubjectId !== input.subjectId)
+      ) {
+        throw new HTTPException(403, {
+          message: "knowledge source schedule requires the exact initiating subject",
+        });
+      }
+      if (wasLive && task.action.kind === "knowledge_source_sync") {
+        await input.preflightConnectorAuthorization(task);
+      }
+      const deletion =
+        task.action.kind === "knowledge_source_sync"
+          ? await (async () => {
+              await input.cleanupConnectorAuthorization(tx, task);
+              return await deleteScheduledTask(tx, input.workspaceId, task.id, {
+                connectorCleanupSubjectId: input.subjectId,
+                connectorCleanupCompleted: true,
+                expectedAuthorityRevision: task.authorityRevision,
+                expectedExecutionDigest: task.executionDigest,
+              });
+            })()
+          : await deleteScheduledTask(tx, input.workspaceId, task.id);
+      return { task, deletion };
+    },
+  );
+  const { task, deletion } = result;
+  const { cleanup, changed } = deletion;
+  if (cleanup && input.processCleanupClaims) {
+    await input.processCleanupClaims([cleanup]);
+  }
+  return { task, changed, cleanup };
+}
+
 export async function syncCreatedScheduledTask(input: {
   db: Database;
   workflowClient: SessionWorkflowClient;
@@ -689,6 +1007,9 @@ export async function syncCreatedScheduledTask(input: {
   } catch (error) {
     let persistenceRestored = true;
     try {
+      // Creation rollback removes only the failed schedule. Connector desired
+      // state remains authoritative so a later connector save can rematerialize
+      // it; this is intentionally not the user-requested deletion lifecycle.
       await deleteScheduledTask(input.db, input.task.workspaceId, input.task.id);
     } catch {
       persistenceRestored = false;
@@ -791,15 +1112,23 @@ async function validateScheduledTaskAgentConfig(input: {
     { subjectId: input.grant.subjectId },
   );
   const requestedTools = validateToolRefs(input.payload.agentConfig.tools ?? [], runtimeSettings);
-  // A task whose creator did not choose tools gets the workspace's enabled
-  // capability MCP servers, exactly like a session created without a tools
-  // key. Scheduled runs are sessions too; "no MCP servers at all" was a trap
-  // every pack/template instantiation path kept falling into (a maintenance
-  // task that cannot reach its workspace's notebook MCP cannot do its job).
+  const workspace = await requireWorkspace(input.db, input.workspaceId);
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
+  // A task whose creator did not choose tools gets the workspace's exact
+  // session defaults (or the deployment compatibility default), exactly like
+  // a session created without a tools key. Scheduled runs are sessions too;
+  // "no MCP servers at all" was a trap every pack/template instantiation path
+  // kept falling into (a maintenance task that cannot reach its workspace's
+  // notebook MCP cannot do its job).
   const tools =
     (input.toolsProvided ?? true)
       ? requestedTools
-      : withDefaultEnabledCapabilityMcpTools(requestedTools, input.settings, runtimeSettings);
+      : withWorkspaceDefaultMcpTools(
+          requestedTools,
+          input.settings,
+          runtimeSettings,
+          workspaceSessionToolDefaults,
+        );
   const prompt = input.payload.agentConfig.prompt.trim();
   if (!prompt) {
     throw new HTTPException(422, { message: "scheduled task prompt is required" });
@@ -813,7 +1142,13 @@ async function validateScheduledTaskAgentConfig(input: {
   if (resources.some((resource) => resource.kind === "file") && !input.objectStorage) {
     throw new HTTPException(503, { message: "object storage is not configured" });
   }
-  await validateFileResources(input.db, input.workspaceId, resources);
+  await validateFileResources(
+    input.db,
+    input.grant.accountId,
+    input.workspaceId,
+    input.grant.subjectId,
+    resources,
+  );
   if (input.payload.agentConfig.slackBotConnectionId) {
     await validateOpenGeniSlackBotConnectionSelection(
       input.db,
@@ -824,7 +1159,6 @@ async function validateScheduledTaskAgentConfig(input: {
   }
   const requestedMaxDepth = input.payload.agentConfig.maxNestedAgentDepth;
   if (requestedMaxDepth !== undefined) {
-    const workspace = await requireWorkspace(input.db, input.workspaceId);
     const workspaceMaxDepth = workspace.settings.maxNestedAgentDepth;
     const deploymentPolicy = await getNestedAgentDepthDeploymentPolicy(input.db);
     const inheritedMaxDepth =
@@ -840,13 +1174,106 @@ async function validateScheduledTaskAgentConfig(input: {
       });
     }
   }
-  return {
+  const validated = {
     ...input.payload.agentConfig,
     ...(model === undefined || model === null ? {} : { model }),
     prompt,
     resources,
     tools,
   };
+  validateIncidentTelemetryPreflightSelection(input.settings, validated);
+  return validated;
+}
+
+/**
+ * Static incident-telemetry admission validates only already-selected task
+ * authority. It never discovers a resource, reads a variable value, probes a
+ * provider, or treats ambient worker credentials as responder capability.
+ * Mutable rig/variable-set metadata is revalidated again at dispatch.
+ */
+export function validateIncidentTelemetryPreflightSelection(
+  settings: Pick<Settings, "allowedFirstPartyMcpTools" | "defaultFirstPartyMcpTools">,
+  agentConfig: ScheduledTaskAgentConfig,
+): void {
+  const executionClass = agentConfig.executionClass;
+  const preflight = agentConfig.incidentTelemetryPreflight;
+  if (executionClass === undefined && preflight === undefined) return;
+  if (executionClass !== "incident_telemetry" || !preflight) {
+    throw new HTTPException(422, {
+      message:
+        "executionClass=incident_telemetry and incidentTelemetryPreflight must be configured together",
+    });
+  }
+
+  for (const required of preflight.requiredResources) {
+    if (!agentConfig.resources.some((selected) => isDeepStrictEqual(selected, required))) {
+      throw new HTTPException(422, {
+        message: "incidentTelemetryPreflight.requiredResources must be exact selected resources",
+      });
+    }
+  }
+
+  const selectedMcpServerIds = new Set(agentConfig.tools.map((tool) => tool.id));
+  // Scheduled dispatch always attaches the first-party OpenGeni MCP server.
+  selectedMcpServerIds.add("opengeni");
+  if (preflight.requiredMcpServerIds.some((id) => !selectedMcpServerIds.has(id))) {
+    throw new HTTPException(422, {
+      message: "incidentTelemetryPreflight.requiredMcpServerIds must be exact selected MCP servers",
+    });
+  }
+
+  const selectedFirstPartyTools = new Set(resolveFirstPartyMcpToolPolicy(settings).default);
+  if (preflight.requiredFirstPartyMcpTools.some((tool) => !selectedFirstPartyTools.has(tool))) {
+    throw new HTTPException(422, {
+      message:
+        "incidentTelemetryPreflight.requiredFirstPartyMcpTools must be present in the selected first-party tool policy",
+    });
+  }
+
+  const selectedFirstPartyPermissions = new Set<Permission>(DEFAULT_FIRST_PARTY_MCP_PERMISSIONS);
+  if (
+    (preflight.requiredFirstPartyMcpPermissions ?? []).some(
+      (permission) => !selectedFirstPartyPermissions.has(permission),
+    )
+  ) {
+    throw new HTTPException(422, {
+      message:
+        "incidentTelemetryPreflight.requiredFirstPartyMcpPermissions must be present in the scheduled responder permission policy",
+    });
+  }
+
+  const route = preflight.dataSource.route;
+  if (route.kind === "mcp" && !selectedMcpServerIds.has(route.serverId)) {
+    throw new HTTPException(422, {
+      message: "incidentTelemetryPreflight.dataSource.route must use a selected MCP server",
+    });
+  }
+  if (route.kind === "first_party" && !selectedFirstPartyTools.has(route.tool)) {
+    throw new HTTPException(422, {
+      message: "incidentTelemetryPreflight.dataSource.route must use a selected first-party tool",
+    });
+  }
+  if (route.kind === "variable_set") {
+    const declaredSets = new Set(preflight.requiredVariableSetNames);
+    const declaredVariables = new Set(preflight.requiredVariableNames);
+    if (
+      !declaredSets.has(route.variableSetName) ||
+      route.variableNames.some((name) => !declaredVariables.has(name))
+    ) {
+      throw new HTTPException(422, {
+        message:
+          "incidentTelemetryPreflight.dataSource.route variable metadata must be declared as required",
+      });
+    }
+  }
+  if (route.kind === "rig_credential_hook") {
+    if (!preflight.requiredRig?.credentialHookIds.includes(route.credentialHookId)) {
+      throw new HTTPException(422, {
+        message:
+          "incidentTelemetryPreflight.dataSource.route rig hook must be declared as required",
+      });
+    }
+  }
 }
 
 function validateScheduledTaskSchedule(schedule: ScheduledTask["schedule"]): void {