@opengeni/core 2.5.3 → 2.6.4-canary.0

package/src/dependencies.ts

@@ -19,6 +19,7 @@ import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets";
 import type { ApiSandboxClient, ResumeBoxByIdInput, ResumedSandboxSession } from "./sandbox-types";
 import type { TranscriptionSegmenter, TranscriptionService } from "./transcription";
 import type { EditableArtifactApplicationPort } from "./editable-artifact-live";
+import type { ResolvedCatalogSettings } from "./model-catalog";
 import type {
   EditableArtifactAgentApplication,
   EditableArtifactDurableExportService,
@@ -129,6 +130,13 @@ export type ManagedEmailTransport = {
 
 export type AppDependencies = {
   settings: Settings;
+  /**
+   * Original deployment settings when `settings` is already overlaid with a
+   * deployment/workspace catalog snapshot. Model-bearing request adapters set
+   * this marker so core admission never feeds a synthetic reviewed provider
+   * back through deployment validation.
+   */
+  catalogSourceSettings?: Settings;
   db: Database;
   /**
    * Host-composed editable artifact engine. Standalone startup binds the same
@@ -225,6 +233,7 @@ export type AppDependencies = {
 export type ObjectStorageDependency = ReturnType<typeof createObjectStorage>;
 
 export type ApiRouteDeps = AppDependencies & {
+  resolveCatalogSettings: () => Promise<ResolvedCatalogSettings>;
   managedEmailTransport: ManagedEmailTransport;
   objectStorage: ObjectStorageDependency;
   githubStateSecret: string;
@@ -244,7 +253,12 @@ export type ApiRouteDeps = AppDependencies & {
  */
 export type AcceptSessionUserMessageDependencies = Pick<
   AppDependencies,
-  "settings" | "db" | "bus" | "sessionAuthorization" | "schedulePromptPostCommit"
+  | "settings"
+  | "catalogSourceSettings"
+  | "db"
+  | "bus"
+  | "sessionAuthorization"
+  | "schedulePromptPostCommit"
 > & {
   workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
   objectStorage: ObjectStorageDependency;

package/src/domain/company-brain-governed-writes.ts

@@ -45,9 +45,8 @@ export type CompanyBrainGovernedWriteRouterOptions = {
   activate?: typeof activateGovernedLearningDecision;
   /**
    * Destinations the router may activate automatically from a final eligible
-   * decision. Defaults to preferences only: mandatory instruction policy keeps
-   * requiring human-authoritative activation even under `automatic`, so its
-   * decision receipt is recorded but the inactive draft stays for review.
+   * decision. Defaults to Skills and instruction policy. Both still pass
+   * through the evaluator and destination-owned activation lifecycle.
    */
   automaticDestinations?: ReadonlyArray<GovernedLearningActivationDestination>;
   /**
@@ -64,7 +63,27 @@ export type CompanyBrainGovernedWriteRouterOptions = {
 };
 
 export const DEFAULT_AUTOMATIC_LEARNING_DESTINATIONS: ReadonlyArray<GovernedLearningActivationDestination> =
-  ["preference"];
+  ["preference", "instruction_policy"];
+
+/**
+ * Start a non-authoritative post-activation notification without making the
+ * durable activation receipt wait for its settlement. The callback is invoked
+ * synchronously so immediate enqueue work begins before the router returns;
+ * both synchronous throws and later promise rejections are contained.
+ *
+ * Exact retries intentionally dispatch again: the publication sink owns an
+ * activation-receipt idempotency key, while the activation receipt remains the
+ * caller-facing source of truth even if notification delivery stalls forever.
+ */
+export function dispatchBestEffortGovernedLearningNotification(
+  notify: () => Promise<unknown>,
+): void {
+  try {
+    void notify().catch(() => undefined);
+  } catch {
+    // Notification is best-effort; the durable activation receipt already exists.
+  }
+}
 
 /**
  * Transport-neutral facade for explicit governed Company Brain proposals.
@@ -143,9 +162,8 @@ function classifyLearningFailure(
  * snapshot. `suggest` records the content-free decision receipt only. Under
  * `automatic`, a final `automaticEligible` receipt is handed to the activation
  * controller, which revalidates current authority and applies the change only
- * through the destination-owned lifecycle. By default only preferences may
- * activate automatically; mandatory instruction policy always keeps a human
- * activation boundary. Evaluation or activation failure
+ * through the destination-owned lifecycle. Eligible Skills and instruction
+ * policies may activate automatically. Evaluation or activation failure
  * never rolls back the durable proposal; it is reported as a bounded
  * `learningFailure` and the proposal remains for human review.
  */
@@ -297,16 +315,14 @@ export function createCompanyBrainLearningPolicyRouter(
           learningFailure: classifyLearningFailure("activation", error),
         });
       }
-      try {
-        await notifyActivation({
+      dispatchBestEffortGovernedLearningNotification(() =>
+        notifyActivation({
           db: options.db,
           receipt: activation,
           sessionId: attempt.sessionId,
           attemptId: attempt.attemptId,
-        });
-      } catch {
-        // Notification is best-effort; the durable receipts already exist.
-      }
+        }),
+      );
       return CompanyBrainLearningPolicyRouteReceipt.parse({
         operationId: request.operationId,
         workspaceId: attempt.workspaceId,

package/src/domain/company-profile-agent-admin.ts

@@ -21,8 +21,9 @@ export type CompanyProfileAgentAdminRouterOptions = {
 /**
  * Explicit organization administration is intentionally separate from derived
  * workspace learning. The database capabilities own exact-attempt admission,
- * current organization-owner authority, canonical human confirmation,
- * tenant isolation, CAS, and immutable receipts.
+ * current organization-owner authority, the separate organization policy,
+ * canonical review when required, tenant isolation, CAS, and immutable
+ * receipts.
  */
 export function createCompanyProfileAgentAdminRouter(
   options: CompanyProfileAgentAdminRouterOptions,

package/src/domain/environments.ts

@@ -1,5 +1,9 @@
 import { environmentsEncryptionKeyBytes, type Settings } from "@opengeni/config";
-import type { AccessGrant, VariableSet } from "@opengeni/contracts";
+import {
+  variableSetVariableNameReservation,
+  type AccessGrant,
+  type VariableSet,
+} from "@opengeni/contracts";
 import { getVariableSet, recordAuditEvent, type Database } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 import { requirePermission } from "../access";
@@ -11,40 +15,8 @@ export const MAX_VARIABLES_PER_ENVIRONMENT = 100;
 // collectGitIdentityEnvironment) plus loader/startup-injection vectors. These
 // can never be set as variable set variables, so the run-scoped
 // git auth block and git identity always win without silent collisions.
-const reservedExactNames = new Set([
-  "HOME",
-  "PATH",
-  "SHELL",
-  "USER",
-  "LOGNAME",
-  "TMPDIR",
-  "IFS",
-  "ENV",
-  "BASH_ENV",
-  "NODE_OPTIONS",
-  "PYTHONPATH",
-  "PYTHONSTARTUP",
-  "PERL5OPT",
-  "PERL5LIB",
-  "GH_TOKEN",
-  "GITHUB_TOKEN",
-  "GITLAB_TOKEN",
-  "AZURE_DEVOPS_EXT_PAT",
-  "GIT_ASKPASS",
-  "GIT_TERMINAL_PROMPT",
-]);
-
-const reservedPrefixes = [
-  "OPENGENI_",
-  "GIT_CONFIG_",
-  "GIT_AUTHOR_",
-  "GIT_COMMITTER_",
-  "LD_",
-  "DYLD_",
-];
-
 export function assertAllowedVariableSetVariableName(name: string): void {
-  if (reservedExactNames.has(name) || reservedPrefixes.some((prefix) => name.startsWith(prefix))) {
+  if (variableSetVariableNameReservation(name)) {
     throw new HTTPException(422, {
       message: `reserved variable set variable name / reserved environment variable name: ${name}`,
     });

package/src/domain/memory-slack-delivery.ts

@@ -1,10 +1,13 @@
 import type { MemorySlackPublicationDistribution } from "@opengeni/contracts";
 import {
+  correctWorkspaceMemory,
   enqueueMemorySlackPublication,
   getCurrentMemorySlackPublicationConfiguration,
   getWorkspaceMemorySlackPublicationSnapshot,
   saveWorkspaceMemory,
   withWorkspaceRls,
+  type CorrectWorkspaceMemoryInput,
+  type CorrectWorkspaceMemoryResult,
   type Database,
   type EnqueueMemorySlackPublicationResult,
   type MemoryEmbedder,
@@ -46,6 +49,33 @@ export async function saveWorkspaceMemoryWithSlackPublication(
   });
 }
 
+export async function correctWorkspaceMemoryWithSlackPublication(
+  db: Database,
+  input: CorrectWorkspaceMemoryInput,
+  publication: MemorySlackPublicationCommitRequest | null,
+  embedder?: MemoryEmbedder,
+): Promise<
+  CorrectWorkspaceMemoryResult & { slackPublication: MemorySlackPublicationCommitResult }
+> {
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const result = await correctWorkspaceMemory(scopedDb, input, embedder);
+    if (!publication || result.action !== "superseded" || !result.replacement) {
+      return { ...result, slackPublication: { decision: null, enqueue: null } };
+    }
+    const replacement = await requiredSnapshot(scopedDb, input.workspaceId, result.replacement.id);
+    const slackPublication = await evaluateAndEnqueue(scopedDb, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      snapshot: replacement,
+      changeKind: "corrected",
+      relatedMemoryId: result.memory.id,
+      occurredAt: result.replacement.updatedAt,
+      publication,
+    });
+    return { ...result, slackPublication };
+  });
+}
+
 async function publishSavedMemoryMutation(
   db: Database,
   input: SaveWorkspaceMemoryInput,

package/src/domain/personal-connection-delegations.ts

@@ -384,6 +384,7 @@ export function personalConnectionDelegationsFromVisibleConnections(input: {
 export function personalConnectionDelegationsFromParent(input: {
   servers: McpServerConfig[];
   parentDelegations: McpPersonalConnectionDelegation[];
+  personalGitHubResources?: ResourceRef[];
   targetSessionId?: string;
   rejectActivatedConnections?: boolean;
 }): McpPersonalConnectionDelegation[] {
@@ -416,19 +417,55 @@ export function personalConnectionDelegationsFromParent(input: {
           childEligible(item) &&
           (item.connectionType === "social" ||
             item.connectionType === "atlassian" ||
+            item.connectionType === "github_personal" ||
             item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID),
       )
       .map((item) => ({ ...item })),
   ];
+  const requestedGitHub = personalGitHubRepositoryResources(input.personalGitHubResources ?? []);
+  const inherited = projected.flatMap((delegation) => {
+    if (delegation.connectionType !== "github_personal") return [delegation];
+    if (requestedGitHub.length === 0) return [];
+    const snapshot = delegation.personalGitHubRepositorySelection;
+    if (!snapshot) return [];
+    const repositories = requestedGitHub.map((resource) => {
+      const parent = snapshot.repositories.find(
+        (candidate) =>
+          candidate.repositoryId === resource.repositoryId &&
+          candidate.canonicalUrl === resource.uri &&
+          candidate.ref === resource.ref,
+      );
+      if (
+        !parent ||
+        resource.credentialBindingId !== snapshot.credentialBindingId ||
+        (resource.access === "write" && parent.access !== "write")
+      ) {
+        throw new Error("agent-created personal GitHub repository exceeds parent authority");
+      }
+      return { ...parent, access: resource.access };
+    });
+    return [
+      {
+        ...delegation,
+        personalGitHubRepositorySelection: { ...snapshot, repositories },
+      },
+    ];
+  });
+  if (
+    requestedGitHub.length > 0 &&
+    !inherited.some((delegation) => delegation.connectionType === "github_personal")
+  ) {
+    throw new Error("agent-created personal GitHub repository authority is unavailable");
+  }
   if (
     input.rejectActivatedConnections &&
-    projected.some((delegation) => delegation.userDelegation)
+    inherited.some((delegation) => delegation.userDelegation)
   ) {
     throw new Error(
       "scheduled connection authority is not available until task occurrence authority is activated",
     );
   }
-  return projected;
+  return inherited;
 }
 
 /**
@@ -798,11 +835,6 @@ export async function freezePersonalConnectionDelegations(input: {
         "agent-created work inherits connection authority from its exact parent turn",
       );
     }
-    if (personalGitHubResources.length > 0) {
-      throw new Error(
-        "agent-created personal GitHub repository authority is not activated in this delivery phase",
-      );
-    }
     const inherited = personalConnectionDelegationsFromParent({
       servers,
       parentDelegations: await getSessionTurnPersonalConnectionDelegations(
@@ -811,6 +843,7 @@ export async function freezePersonalConnectionDelegations(input: {
         input.source.sessionId,
         input.source.turnId,
       ),
+      personalGitHubResources,
       ...(input.targetSessionId ? { targetSessionId: input.targetSessionId } : {}),
       ...(input.rejectUnselectedActivatedConnections !== undefined
         ? { rejectActivatedConnections: input.rejectUnselectedActivatedConnections }

package/src/domain/remember.ts

@@ -35,6 +35,7 @@ import { createHash } from "node:crypto";
 import {
   createCompanyBrainLearningPolicyRouter,
   derivedGovernedLearningOperationId,
+  dispatchBestEffortGovernedLearningNotification,
 } from "./company-brain-governed-writes";
 import { publishGovernedLearningEventToSlack } from "./governed-learning-slack-publication";
 
@@ -548,16 +549,14 @@ export function createRememberRouter(options: RememberRouterOptions): {
         }
       }
       if (!activation) throw asRememberFailure(lastFailure);
-      try {
-        await notifyActivation({
+      dispatchBestEffortGovernedLearningNotification(() =>
+        notifyActivation({
           db: options.db,
           receipt: activation,
           sessionId: attempt.sessionId,
           attemptId: attempt.attemptId,
-        });
-      } catch {
-        // Notification is best-effort; the durable receipts already exist.
-      }
+        }),
+      );
       return RememberConfirmReceipt.parse({
         status: "activated",
         operationId: request.operationId,

package/src/domain/scheduled-tasks.ts

@@ -22,6 +22,8 @@ import {
   createScheduledTask,
   deleteScheduledTask,
   getConnectionMetadata,
+  getEnrollment,
+  getLiveEnrollmentConnection,
   getKnowledgeSourceForSyncAuthority,
   getNestedAgentDepthDeploymentPolicy,
   getRig,
@@ -29,8 +31,11 @@ import {
   getScheduledTaskIncludingDeletedForUpdate,
   getScheduledTaskPersonalConnectionDelegations,
   getScheduledTaskXaiProviderAccountAuthoritySnapshot,
+  getSandbox,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
   getSession,
+  lockActiveWorkspaceGatewayCustomModelForAdmission,
+  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   nestedPostgresSqlState,
   requireWorkspace,
   scopedKnowledgeScopeKey,
@@ -51,6 +56,7 @@ import {
 } from "../session-authorization";
 import type { SessionWorkflowClient } from "../dependencies";
 import type { ObjectStorageDependency } from "../dependencies";
+import { workspaceCustomModelReference } from "../model-catalog";
 import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
 import { validateVariableSetAttachment } from "./environments";
 import {
@@ -96,6 +102,35 @@ export function scheduledTaskToolsProvided(rawPayload: unknown): boolean {
   );
 }
 
+function workspaceCustomModelCommitGuard(input: {
+  settings: Settings;
+  accountId: string;
+  workspaceId: string;
+  modelId: string;
+}): ((tx: Database) => Promise<void>) | undefined {
+  const reference = workspaceCustomModelReference(input.settings, input.modelId);
+  if (!reference) return undefined;
+  return async (tx: Database): Promise<void> => {
+    const active =
+      reference.providerKind === "openrouter"
+        ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            upstreamModelId: reference.upstreamModelId,
+          })
+        : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            upstreamModelId: reference.upstreamModelId,
+          });
+    if (!active) {
+      throw new HTTPException(422, {
+        message: `model is not available: ${input.modelId}`,
+      });
+    }
+  };
+}
+
 export function scheduledConnectionSurfaceEligibility(
   settings: Settings,
   target: Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null,
@@ -143,7 +178,7 @@ export async function createValidatedScheduledTask(input: {
       action: knowledgeAction,
     });
   }
-  const agentConfig = knowledgeAction
+  const agentConfig: ScheduledTaskAgentConfig = knowledgeAction
     ? input.payload.agentConfig
     : await validateScheduledTaskAgentConfig({
         ...input,
@@ -164,6 +199,15 @@ export async function createValidatedScheduledTask(input: {
         rigId: input.payload.rigId,
         agentConfig,
       });
+  if (!knowledgeAction) {
+    await validateScheduledTaskMachineTarget({
+      settings: input.settings,
+      db: input.db,
+      grant: input.grant,
+      runMode: input.payload.runMode,
+      agentConfig,
+    });
+  }
   if (!knowledgeAction && input.payload.variableSetId) {
     await validateVariableSetAttachment(
       { settings: input.settings, db: input.db },
@@ -223,6 +267,15 @@ export async function createValidatedScheduledTask(input: {
           workspaceId: input.grant.workspaceId,
           subjectId: input.grant.subjectId,
         });
+  const beforeCreateCommit =
+    !knowledgeAction && input.payload.runMode !== "existing_session"
+      ? workspaceCustomModelCommitGuard({
+          settings: input.settings,
+          accountId: input.grant.accountId,
+          workspaceId: input.grant.workspaceId,
+          modelId: agentConfig.model ?? input.settings.openaiModel,
+        })
+      : undefined;
   return await withScheduledTaskAuthorityWriteErrors(() =>
     createScheduledTask(input.db, {
       id,
@@ -245,6 +298,7 @@ export async function createValidatedScheduledTask(input: {
       variableSetId: input.payload.variableSetId ?? null,
       rigId: input.payload.rigId ?? null,
       metadata: input.payload.metadata,
+      ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
     }),
   );
 }
@@ -399,6 +453,81 @@ export async function validateScheduledTaskTarget(input: {
   return session;
 }
 
+export async function validateScheduledTaskMachineTarget(input: {
+  settings: Settings;
+  db: Database;
+  grant: AccessGrant;
+  runMode: ScheduledTask["runMode"];
+  agentConfig: ScheduledTaskAgentConfig;
+  requireOnline?: boolean;
+}): Promise<{
+  sandboxId: string;
+  enrollmentId: string;
+  sandboxOs: Session["sandboxOs"];
+} | null> {
+  const machineTarget = input.agentConfig.machineTarget;
+  if (!machineTarget) {
+    if (
+      input.runMode !== "existing_session" &&
+      (input.agentConfig.sandboxBackend ?? input.settings.sandboxBackend) === "selfhosted"
+    ) {
+      throw new HTTPException(422, {
+        message:
+          "self-hosted scheduled tasks require a Connected Machine; select a machine before saving",
+      });
+    }
+    return null;
+  }
+  if (input.runMode === "existing_session") {
+    throw new HTTPException(422, {
+      message: "machineTarget cannot be used with an existing-session target",
+    });
+  }
+  if (!input.settings.sandboxOwnershipEnabled || !input.settings.sandboxSelfhostedEnabled) {
+    throw new HTTPException(422, {
+      message: "Connected Machines are not enabled for scheduled tasks in this deployment",
+    });
+  }
+  const access = {
+    accountId: input.grant.accountId,
+    workspaceId: input.grant.workspaceId,
+    subjectId: input.grant.subjectId,
+  };
+  const sandbox = await getSandbox(input.db, access, machineTarget.targetSandboxId);
+  if (!sandbox || sandbox.kind !== "selfhosted" || !sandbox.enrollmentId) {
+    throw new HTTPException(422, {
+      message: "the selected Connected Machine is unavailable",
+    });
+  }
+  if (sandbox.scope === "user") {
+    throw new HTTPException(422, {
+      message:
+        "personal Connected Machines cannot run unattended schedules; select a workspace or organization machine",
+    });
+  }
+  const enrollment = input.requireOnline
+    ? await getLiveEnrollmentConnection(input.db, access, sandbox.enrollmentId)
+    : await getEnrollment(input.db, access, sandbox.enrollmentId);
+  if (!enrollment || enrollment.status !== "active") {
+    throw new HTTPException(422, {
+      message: input.requireOnline
+        ? "the selected Connected Machine is offline"
+        : "the selected Connected Machine is unavailable",
+    });
+  }
+  if (input.requireOnline && !enrollment.workspaceRoot) {
+    throw new HTTPException(422, {
+      message:
+        "the selected Connected Machine has not reported a workspace root; reconnect it with a current agent",
+    });
+  }
+  return {
+    sandboxId: sandbox.id,
+    enrollmentId: sandbox.enrollmentId,
+    sandboxOs: enrollment.os,
+  };
+}
+
 export function scheduledTaskForGrant(task: ScheduledTask, grant: AccessGrant): ScheduledTask {
   if (hasPermission(grant.permissions, "sessions:control") || task.targetSessionId === null) {
     return task;
@@ -647,6 +776,15 @@ export async function validatedScheduledTaskUpdate(input: {
     (input.payload.metadata !== undefined &&
       !isDeepStrictEqual(input.payload.metadata, input.existing.metadata)) ||
     (input.existing.status === "paused" && input.payload.status === "active");
+  if (materialExecutionChange && nextRunMode !== "existing_session") {
+    const beforeUpdateCommit = workspaceCustomModelCommitGuard({
+      settings: input.settings,
+      accountId: input.existing.accountId,
+      workspaceId: input.existing.workspaceId,
+      modelId: nextAgentConfig.model ?? input.settings.openaiModel,
+    });
+    if (beforeUpdateCommit) update.beforeUpdateCommit = beforeUpdateCommit;
+  }
   const existingXaiAuthority = await getScheduledTaskXaiProviderAccountAuthoritySnapshot(
     input.db,
     input.existing.workspaceId,
@@ -793,6 +931,13 @@ export async function validatedScheduledTaskUpdate(input: {
     rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,
     agentConfig: update.agentConfig ?? input.existing.agentConfig,
   });
+  await validateScheduledTaskMachineTarget({
+    settings: input.settings,
+    db: input.db,
+    grant: input.grant,
+    runMode: nextRunMode,
+    agentConfig: update.agentConfig ?? input.existing.agentConfig,
+  });
   if (
     input.payload.targetSessionId !== undefined ||
     input.existing.runMode === "existing_session" ||