@opengeni/core 3.0.1 → 3.1.2

package/src/domain/scheduled-tasks.ts

@@ -1,25 +1,45 @@
 import {
+  getSessionTurnClaudeProviderAccountAuthoritySnapshot,
+  getScheduledTaskClaudeProviderAccountAuthoritySnapshot,
+} from "@opengeni/db";
+import {
+  SCHEDULED_SLACK_BOT_POSTING_TOOLS,
   scheduledTaskKnowledgeSource,
   requireScheduledTaskKnowledgeSource,
+  scheduledOccurrencePayloadUtf8Bytes,
+  mergeResourceRefs,
+  SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,
+  SCHEDULED_TASK_OCCURRENCE_PAYLOAD_INGRESS_HEADROOM_BYTES,
 } from "@opengeni/contracts";
 import {
   allowedFirstPartyMcpToolsForSession,
+  resolveSessionFirstPartyMcpTools,
   resolveFirstPartyMcpToolPolicy,
+  type FirstPartyMcpToolPolicySettings,
   type Settings,
 } from "@opengeni/config";
+import { WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 } from "@opengeni/contracts";
+import type { VaultPolicy } from "@opengeni/contracts";
+import {
+  ATLASSIAN_NATIVE_RETIRED_MESSAGE,
+  isRetiredNativeAtlassianSource,
+  isRetiredNativeAtlassianTask,
+} from "@opengeni/contracts/atlassian-native-retirement";
 import type {
   AccessGrant,
-  McpPersonalConnectionDelegation,
   KnowledgeSourceSyncAction,
+  McpConnectionAccountSelection,
   Permission,
   ScheduledTask,
   ScheduledTaskAgentConfig,
   Session,
+  ToolRef,
   SessionAuthorizationPort,
   SessionAuthorizationSurface,
   CreateScheduledTaskRequest as CreateScheduledTaskPayload,
   UpdateScheduledTaskRequest as UpdateScheduledTaskPayload,
   XaiProviderAccountAuthoritySnapshotV1,
+  ClaudeProviderAccountAuthoritySnapshotV1,
 } from "@opengeni/contracts";
 import {
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
@@ -29,9 +49,11 @@ import {
   SessionAgentAccess,
   SessionScopeSubjectId,
   SessionMemoryScope,
+  readTurnExecutionPolicyV1,
 } from "@opengeni/contracts";
 import {
   createScheduledTask,
+  scheduledTaskMutationOwnerMatches,
   getAgentLearningSettings,
   saveAgentLearningSettings,
   type KnowledgeContext,
@@ -45,33 +67,49 @@ import {
   getRig,
   getScheduledTask,
   getScheduledTaskIncludingDeletedForUpdate,
-  getScheduledTaskPersonalConnectionDelegations,
   getScheduledTaskXaiProviderAccountAuthoritySnapshot,
   getSandbox,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
   getSession,
+  getSessionTurnForAttempt,
   getSessionAuthorityProjection,
+  getWorkspaceDefaultRigId,
   withSessionRlsActorContext,
   nestedPostgresSqlState,
   requireWorkspace,
   scopedKnowledgeScopeKey,
   updateScheduledTask,
+  ScheduledTaskHeadChangedError,
   withWorkspaceSubjectRls,
-  resolveXaiProviderAccountAuthoritySnapshotForAcceptance,
   type Database,
   type ScheduledTaskCreatorPolicy,
+  type SessionCommandActor,
   type TemporalScheduleCleanupClaim,
   type UpdateScheduledTaskInput,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
+import { GOOGLE_DRIVE_PUBLICATION_SERVER_ID } from "@opengeni/contracts/google-drive";
+import { PERSONAL_GITHUB_CONNECTION_SURFACE_ID } from "@opengeni/contracts/personal-github";
+import {
+  currentSiteSessionOrigin,
+  SITE_ORIGIN_METADATA_KEY,
+  siteOriginsMatch,
+  siteSessionOriginFromMetadata,
+  withSiteOriginMetadata,
+} from "../site-session-origin";
+import { assertNotSiteClampedAgent } from "../site-agent-clamp";
+import { personalGitHubRepositoryResources } from "./resources";
 import { knowledgeContextForAccess } from "./knowledge";
 import { fileOwnerContextForAccess, fileOwnerContextForAgent } from "./file-owner";
 import { isDeepStrictEqual } from "node:util";
-import { hasPermission, requirePermission, type AccessGrantAuthorization } from "../access";
 import {
-  prepareHostMcpTaskAdmission,
-  prepareInheritedHostMcpTaskAdmission,
-} from "./host-mcp-task-admission";
+  hasPermission,
+  requireExplicitPermissionDelegation,
+  isDeveloperSetupAuthorization,
+  isDeveloperSetupGrant,
+  requirePermission,
+  type AccessGrantAuthorization,
+} from "../access";
 import {
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
@@ -79,32 +117,46 @@ import {
 } from "../session-authorization";
 import type { SessionWorkflowClient } from "../dependencies";
 import type { ObjectStorageDependency } from "../dependencies";
+import {
+  resolveScheduledTaskVisibility,
+  scheduledTaskViewerForGrant,
+} from "./scheduled-task-audience";
 import { lockActiveCustomModelForAdmission, workspaceCustomModelReference } from "../model-catalog";
 import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
+import {
+  resolveSessionToolPolicy,
+  workspaceSessionToolPolicyDefaultServerIds,
+} from "./session-tool-policy";
 import { prepareExternalLinkTaskAdmission } from "../application/external-link-work-admission";
-import { validateVariableSetAttachment } from "./environments";
+import { variableSetsRemovedError } from "./encryption-key";
 import {
-  freezePersonalConnectionDelegations,
+  freezeConnectionAccounts,
   personalConnectionDelegationSourceForGrant,
 } from "./personal-connection-delegations";
 import {
   assertWorkspaceModelPolicyAllows,
   canonicalConfiguredModel,
   creationInitiatorForGrant,
+  modelUnavailableHttpException,
+  settingsWithSessionMcpServerMetadata,
 } from "./sessions";
 import {
   hasReservedOpenGeniSlackBotSessionMetadata,
-  scheduledSlackBotConnectionId,
   validateOpenGeniSlackBotConnectionSelection,
+  validateScheduledTaskSlackChannel,
+  type ScheduledTaskSlackChannelVerifier,
 } from "./slack-bot";
 import {
   normalizeResources,
-  personalGitHubRepositoryResources,
   validateFileResources,
   validateGitHubRepositorySelection,
   validateToolRefs,
-  withWorkspaceDefaultMcpTools,
+  scheduledTaskRunTools,
 } from "./resources";
+import {
+  recordScheduledTaskAccountChoiceChanges,
+  scheduledTaskAccountChoiceChanges,
+} from "./scheduled-task-account-audit";
 
 /**
  * Whether a raw scheduled-task payload explicitly set agentConfig.tools.
@@ -114,6 +166,14 @@ import {
  * (enabled capability MCP servers)", an explicit list (even empty) is taken
  * verbatim.
  */
+
+/** Vault IDs are compared as lowercase text in SQL. */
+function scheduledVaultPolicy(policy: VaultPolicy): VaultPolicy {
+  return policy.mode === "all"
+    ? { mode: "all" }
+    : { mode: "selected", vaultIds: [...new Set(policy.vaultIds.map((id) => id.toLowerCase()))] };
+}
+
 export function scheduledTaskToolsProvided(rawPayload: unknown): boolean {
   if (!rawPayload || typeof rawPayload !== "object") {
     return false;
@@ -126,11 +186,31 @@ export function scheduledTaskToolsProvided(rawPayload: unknown): boolean {
   );
 }
 
+/**
+ * Only the message survives. The destination chat owns execution: its
+ * connectors, and the owner's current accounts resolved at each run. An
+ * existing-chat schedule never saves account choices of its own.
+ */
+function scheduledSessionMessageConfig(config: ScheduledTaskAgentConfig): ScheduledTaskAgentConfig {
+  return {
+    prompt: config.prompt,
+    resources: config.resources,
+    tools: [],
+    metadata: config.metadata,
+    ...(config.approvalTimeoutSeconds !== undefined
+      ? { approvalTimeoutSeconds: config.approvalTimeoutSeconds }
+      : {}),
+  };
+}
+
 function workspaceCustomModelCommitGuard(input: {
   settings: Settings;
   accountId: string;
   workspaceId: string;
   modelId: string;
+  claudeAuthoritySnapshot?: ClaudeProviderAccountAuthoritySnapshotV1;
+  /** The task an update re-admits (Claude's core route reads its accepted authority). */
+  scheduledTaskId?: string;
 }): ((tx: Database) => Promise<void>) | undefined {
   const reference = workspaceCustomModelReference(input.settings, input.modelId);
   if (!reference) return undefined;
@@ -139,35 +219,142 @@ function workspaceCustomModelCommitGuard(input: {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       reference,
+      claudeAuthority: input.claudeAuthoritySnapshot
+        ? {
+            authoritySnapshot: input.claudeAuthoritySnapshot,
+            ...(input.scheduledTaskId ? { scheduledTaskId: input.scheduledTaskId } : {}),
+          }
+        : null,
     });
     if (!active) {
-      throw new HTTPException(422, {
-        message: `model is not available: ${input.modelId}`,
-      });
+      throw modelUnavailableHttpException(input.modelId);
     }
   };
 }
 
+/** Resolve the target's current tool policy before choosing its owner's accounts. */
+export async function scheduledConnectionTools(
+  db: Database,
+  workspaceId: string,
+  settings: Settings,
+  target: Session | null,
+  taskTools: ToolRef[],
+  subjectId?: string,
+): Promise<ToolRef[]> {
+  if (!target) return [...taskTools, { kind: "mcp", id: "opengeni" }];
+  return resolveSessionToolPolicy({
+    toolPolicy: target.toolPolicy,
+    sessionTools: target.tools,
+    availableMcpServerIds: [
+      "opengeni",
+      ...settings.mcpServers.map(({ id }) => id),
+      ...target.mcpServers.map(({ id }) => id),
+    ],
+    defaultMcpServerIds: await workspaceSessionToolPolicyDefaultServerIds(
+      db,
+      workspaceId,
+      settings,
+      subjectId,
+    ),
+  }).toolRefs;
+}
+
 export function scheduledConnectionSurfaceEligibility(
   settings: Settings,
-  target: Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null,
+  target:
+    | (Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> &
+        Partial<Pick<Session, "toolPolicy" | "agent">>)
+    | null,
+  workspaceSettings: unknown = {},
 ): { googleDrivePublicationEnabled: boolean; atlassianEnabled: boolean } {
-  const tools = target?.firstPartyMcpTools ?? resolveFirstPartyMcpToolPolicy(settings).default;
-  const permissions = target?.firstPartyMcpPermissions?.length
-    ? target.firstPartyMcpPermissions
-    : DEFAULT_FIRST_PARTY_MCP_PERMISSIONS;
+  const tools = target?.toolPolicy
+    ? resolveSessionFirstPartyMcpTools(
+        settings,
+        { ...target, toolPolicy: target.toolPolicy },
+        workspaceSettings,
+      )
+    : allowedFirstPartyMcpToolsForSession(settings, target?.firstPartyMcpTools);
+  const permissions = target?.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS;
   return {
     googleDrivePublicationEnabled:
       tools.includes("editable_artifact_export") &&
       tools.includes("editable_artifact_export_status") &&
       permissions.includes("artifacts:read") &&
       permissions.includes("artifacts:publish"),
-    atlassianEnabled:
-      tools.some((tool) => tool.startsWith("atlassian_")) &&
-      permissions.includes("connections:read"),
+    atlassianEnabled: false,
   };
 }
 
+/**
+ * An organization/workspace API key or the deployment's configured key is a
+ * machine principal. It is never a person, so it can never be a schedule's
+ * execution owner (a human revision authorizer): its schedules are ownerless
+ * and run under service authority, exactly like a delegated service's.
+ */
+function isScheduledTaskMachinePrincipal(grant: AccessGrant): boolean {
+  return grant.principalKind === "api_key" || grant.principalKind === "configured_key";
+}
+
+/**
+ * Only a person pins connector accounts: an authenticated human acting
+ * directly, through the schedule editor or their own API call. Agents, API
+ * keys, services and delegated bearers never pin; schedules they save follow
+ * the owner's current accounts at each run.
+ */
+function requireScheduledTaskPinAuthor(grant: AccessGrant): void {
+  if (
+    isScheduledTaskMachinePrincipal(grant) ||
+    personalConnectionDelegationSourceForGrant(grant).kind !== "subject"
+  ) {
+    throw new HTTPException(403, {
+      message:
+        "Only a person can pin connector accounts on a schedule. Schedules saved by agents, API keys or services use the owner's current accounts.",
+    });
+  }
+}
+
+/** Stable, duplicate-free pin order so equal choices store identically. */
+function normalizedScheduledTaskPins(
+  pins: readonly McpConnectionAccountSelection[],
+): McpConnectionAccountSelection[] {
+  const unique = new Map(
+    pins.map((pin) => [`${pin.serverId}\u0000${pin.connectionId}`, pin] as const),
+  );
+  return [...unique.entries()]
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([, pin]) => ({ serverId: pin.serverId, connectionId: pin.connectionId }));
+}
+
+/** Store pins and the do-not-run switch only when they say something. */
+function withScheduledTaskPins(
+  config: ScheduledTaskAgentConfig,
+  pins: readonly McpConnectionAccountSelection[] | undefined,
+  required: boolean,
+): ScheduledTaskAgentConfig {
+  const {
+    pinnedAccounts: _pinnedAccounts,
+    pinnedAccountsRequired: _pinnedAccountsRequired,
+    ...rest
+  } = config;
+  const normalized = normalizedScheduledTaskPins(pins ?? []);
+  return normalized.length > 0
+    ? { ...rest, pinnedAccounts: normalized, ...(required ? { pinnedAccountsRequired: true } : {}) }
+    : rest;
+}
+
+/** Service attribution cannot become a personal schedule execution owner. */
+function scheduledTaskInitiatorForGrant(grant: AccessGrant) {
+  const creator = creationInitiatorForGrant(grant);
+  if (
+    creator.initiator?.kind === "subject" &&
+    (personalConnectionDelegationSourceForGrant(grant).kind === "none" ||
+      isScheduledTaskMachinePrincipal(grant))
+  ) {
+    return { ...creator, initiator: { ...creator.initiator, kind: "service" as const } };
+  }
+  return creator;
+}
+
 export async function createValidatedScheduledTask(input: {
   settings: Settings;
   db: Database;
@@ -179,12 +366,43 @@ export async function createValidatedScheduledTask(input: {
   // scheduledTaskToolsProvided). Absent tools get the workspace's enabled
   // capability MCP servers, mirroring session creation.
   toolsProvided?: boolean;
-  // Set for pack-installation-inherited attachments that were already
-  // authorized with variable-sets:use when the pack was enabled.
-  variableSetPreauthorized?: boolean;
   sessionAuthorization?: SessionAuthorizationPort | null | undefined;
   authorizationSurface?: SessionAuthorizationSurface | undefined;
+  /** Proves the bot may post in a newly chosen task Slack channel. */
+  verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
 }): Promise<ScheduledTask> {
+  // An agent started from a Site page acts with the page's reach: no schedules.
+  await assertNotSiteClampedAgent(input.db, input.grant, "schedules");
+  // Variable Sets were replaced by vaults (RM-1).
+  if (input.payload.variableSetId) throw variableSetsRemovedError("variableSetId");
+  if (input.payload.runMode === "existing_session") {
+    const target = await validateScheduledTaskTarget({
+      ...input,
+      targetSessionId: input.payload.targetSessionId,
+      runMode: "existing_session",
+      variableSetId: input.payload.variableSetId,
+      rigId: input.payload.rigId,
+      agentConfig: input.payload.agentConfig,
+    });
+    if (input.payload.agentConfig.knowledgeSource)
+      throw new HTTPException(422, {
+        message: "Source ingestion requires a separate scheduled agent",
+      });
+    if (input.payload.rigId && input.payload.rigId !== target?.rigId)
+      throw new HTTPException(422, {
+        message:
+          "Existing-chat schedules use the chat's environment. Change the chat's attachments separately.",
+      });
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        agentConfig: scheduledSessionMessageConfig(input.payload.agentConfig),
+        variableSetId: null,
+        rigId: null,
+      },
+    };
+  }
   const learning = "agentLearning" in input.payload ? input.payload.agentLearning : undefined;
   const learningContext =
     learning && input.authorization
@@ -201,13 +419,8 @@ export async function createValidatedScheduledTask(input: {
   }
   if (learningContext?.actor.kind === "human" && learning)
     learningContext.actor.settingsScopes = [learning.scope];
-  // API parsing fills this default, but pack installers and older internal
-  // callers can still invoke the shared validator with the pre-action shape.
+  // Internal callers can omit the action; agent turns are the default.
   const action = input.payload.action ?? ({ kind: "agent_turn" } as const);
-  const hostSelections =
-    "selectedHostMcpDelegations" in input.payload
-      ? input.payload.selectedHostMcpDelegations
-      : undefined;
   const knowledgeAction = input.payload.agentConfig.knowledgeSource ?? null;
   if (knowledgeAction) {
     await validateKnowledgeSourceSyncAction({
@@ -216,10 +429,45 @@ export async function createValidatedScheduledTask(input: {
       action: knowledgeAction,
     });
   }
-  const agentConfig: ScheduledTaskAgentConfig = await validateScheduledTaskAgentConfig({
+  const validatedAgentConfig: ScheduledTaskAgentConfig = await validateScheduledTaskAgentConfig({
     ...input,
     workspaceId: input.grant.workspaceId,
   });
+  // A schedule created from a Site page records which Site. Each run's
+  // session copies this metadata, so runs record it too and act with the
+  // page's reach (the Site agent clamp). Callers never supply it themselves.
+  const agentConfig: ScheduledTaskAgentConfig = {
+    ...validatedAgentConfig,
+    metadata: withSiteOriginMetadata(
+      validatedAgentConfig.metadata ?? {},
+      currentSiteSessionOrigin(),
+    ),
+  };
+  // Connector accounts are never saved from what the schedule would resolve
+  // now. Only accounts a person explicitly pins are stored, and only on a
+  // schedule that starts its own session; everything else follows the owner's
+  // current accounts at each run.
+  const requestedPins =
+    "pinnedAccounts" in input.payload ? input.payload.pinnedAccounts : undefined;
+  const requestedPinsRequired =
+    "pinnedAccountsRequired" in input.payload && input.payload.pinnedAccountsRequired === true;
+  if ((requestedPins?.length ?? 0) > 0 || requestedPinsRequired) {
+    if (input.payload.runMode === "existing_session" || knowledgeAction)
+      throw new HTTPException(422, {
+        message:
+          "Pin connector accounts only on a schedule that starts its own session. An existing-chat schedule uses that chat's connectors with the owner's current accounts.",
+      });
+    requireScheduledTaskPinAuthor(input.grant);
+  }
+  await validateScheduledTaskSlackChannel({
+    grant: input.grant,
+    authorization: input.authorization,
+    previous: null,
+    next: agentConfig,
+    runMode: input.payload.runMode,
+    reusableSessionCanPost: null,
+    verifySlackChannel: input.verifySlackChannel,
+  });
   if (knowledgeAction && input.payload.overlapPolicy === "allow_concurrent")
     throw new HTTPException(422, { message: "Source tasks require skip or buffer_one overlap" });
   const id = crypto.randomUUID();
@@ -233,6 +481,7 @@ export async function createValidatedScheduledTask(input: {
     runMode: input.payload.runMode,
     variableSetId: input.payload.variableSetId,
     rigId: input.payload.rigId,
+    // An omitted Sandbox Environment adopts the target session's own one below.
     agentConfig,
   });
   if (
@@ -263,17 +512,12 @@ export async function createValidatedScheduledTask(input: {
       grant: input.grant,
       runMode: input.payload.runMode,
       agentConfig,
+      audience:
+        "visibility" in input.payload && input.payload.visibility === "private"
+          ? "user_private"
+          : "workspace_shared",
     });
   }
-  if (input.payload.variableSetId) {
-    await validateVariableSetAttachment(
-      { settings: input.settings, db: input.db },
-      input.grant,
-      input.grant.workspaceId,
-      input.payload.variableSetId,
-      { preauthorized: input.variableSetPreauthorized ?? false },
-    );
-  }
   // The rig is stored on the task and resolved to its ACTIVE version per fire
   // (at dispatch), so validate only that the id names a rig in the workspace —
   // NOT that it has an active version now (that is a fire-time concern). RLS
@@ -289,6 +533,17 @@ export async function createValidatedScheduledTask(input: {
       input.payload.rigId,
     );
   }
+  const rigId = knowledgeAction
+    ? (input.payload.rigId ?? null)
+    : await resolveScheduledTaskCreateRigId({
+        settings: input.settings,
+        db: input.db,
+        grant: input.grant,
+        requestedRigId: input.payload.rigId,
+        runMode: input.payload.runMode,
+        target,
+        agentConfig,
+      });
   const runtimeSettings = knowledgeAction
     ? null
     : await settingsWithEnabledCapabilityMcpServers(
@@ -297,33 +552,63 @@ export async function createValidatedScheduledTask(input: {
         input.settings,
         { subjectId: input.grant.subjectId },
       );
-  const personalConnectionDelegations =
-    knowledgeAction || !runtimeSettings
-      ? []
-      : await freezePersonalConnectionDelegations({
-          db: input.db,
-          workspaceId: input.grant.workspaceId,
-          settings: runtimeSettings,
-          tools: [...agentConfig.tools, { kind: "mcp", id: "opengeni" }],
-          resources: agentConfig.resources,
-          source: personalConnectionDelegationSourceForGrant(input.grant),
-          authoritySelections: input.payload.connectionAuthorities,
-          rejectUnselectedActivatedConnections: true,
-          ...scheduledConnectionSurfaceEligibility(runtimeSettings, target),
-        });
-  const creationInitiator = creationInitiatorForGrant(input.grant);
+  // Existing-session runs use the target's persisted MCP configuration, with
+  // session definitions taking precedence over deployment servers of the same
+  // ID. Metadata selects the destination; captured grants still supply authority.
+  const effectiveRuntimeSettings =
+    runtimeSettings && target
+      ? settingsWithSessionMcpServerMetadata(runtimeSettings, target.mcpServers)
+      : runtimeSettings;
+  // Prove the creator may use the schedule's connectors and repositories, and
+  // that every pinned account resolves for the owner. Nothing it resolves is
+  // saved: each run resolves the owner's current accounts again, and a
+  // schedule that follows the workspace defaults resolves them again too.
+  if (!knowledgeAction && effectiveRuntimeSettings) {
+    const creationWorkspaceSettings = (await requireWorkspace(input.db, input.grant.workspaceId))
+      .settings;
+    await freezeConnectionAccounts({
+      db: input.db,
+      accountId: input.grant.accountId,
+      workspaceId: input.grant.workspaceId,
+      settings: effectiveRuntimeSettings,
+      tools: await scheduledConnectionTools(
+        input.db,
+        input.grant.workspaceId,
+        effectiveRuntimeSettings,
+        target,
+        scheduledTaskRunTools({
+          agentConfig,
+          settings: input.settings,
+          runtimeSettings: effectiveRuntimeSettings,
+          workspaceDefaults: resolveWorkspaceSessionToolDefaults(creationWorkspaceSettings),
+        }),
+        input.grant.subjectId,
+      ),
+      resources: mergeResourceRefs(target?.resources ?? [], agentConfig.resources),
+      source: personalConnectionDelegationSourceForGrant(input.grant),
+      authoritySelections: requestedPins ?? [],
+      ...scheduledConnectionSurfaceEligibility(
+        effectiveRuntimeSettings,
+        target,
+        creationWorkspaceSettings,
+      ),
+    });
+  }
+  const storedAgentConfig = knowledgeAction
+    ? agentConfig
+    : withScheduledTaskPins(agentConfig, requestedPins, requestedPinsRequired);
+  const creationInitiator = scheduledTaskInitiatorForGrant(input.grant);
   const captureLinkAuthority = prepareExternalLinkTaskAdmission(
     input.authorization,
     creationInitiator.actor,
   );
-  const creatorPolicy = creationInitiator.actor
-    ? await frozenScheduledTaskCreatorPolicy({
-        db: input.db,
-        settings: input.settings,
-        grant: input.grant,
-        sessionId: creationInitiator.actor.sessionId,
-      })
-    : null;
+  const creatorPolicy = await frozenScheduledTaskCreatorPolicy({
+    db: input.db,
+    settings: input.settings,
+    grant: input.grant,
+    authorization: input.authorization,
+    actor: creationInitiator.actor ?? null,
+  });
   const xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1 =
     creationInitiator.actor
       ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(
@@ -332,10 +617,19 @@ export async function createValidatedScheduledTask(input: {
           creationInitiator.actor.sessionId,
           creationInitiator.actor.turnId,
         )
-      : await resolveXaiProviderAccountAuthoritySnapshotForAcceptance(input.db, {
-          workspaceId: input.grant.workspaceId,
-          subjectId: input.grant.subjectId,
-        });
+      : // SuperGrok's v1 value is never computed from live state after its
+        // cutover: new work writes the column default (design 5.3, "v1
+        // columns after a provider's cutover").
+        WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1;
+  const claudeProviderAccountAuthoritySnapshot: ClaudeProviderAccountAuthoritySnapshotV1 =
+    creationInitiator.actor
+      ? await getSessionTurnClaudeProviderAccountAuthoritySnapshot(
+          input.db,
+          input.grant.workspaceId,
+          creationInitiator.actor.sessionId,
+          creationInitiator.actor.turnId,
+        )
+      : { version: 1 as const, scope: "workspace" as const };
   const beforeCreateCommit =
     input.payload.runMode !== "existing_session"
       ? workspaceCustomModelCommitGuard({
@@ -343,8 +637,28 @@ export async function createValidatedScheduledTask(input: {
           accountId: input.grant.accountId,
           workspaceId: input.grant.workspaceId,
           modelId: agentConfig.model ?? input.settings.openaiModel,
+          claudeAuthoritySnapshot: claudeProviderAccountAuthoritySnapshot,
         })
       : undefined;
+  const visibility = await resolveScheduledTaskVisibility({
+    db: input.db,
+    settings: input.settings,
+    grant: input.grant,
+    requested: "visibility" in input.payload ? input.payload.visibility : undefined,
+    current: null,
+    targetSessionId: target?.id ?? null,
+    personalKnowledge: agentConfig.knowledgeSource?.destination.kind === "personal",
+    ownerSubjectId:
+      action.kind === "agent_turn"
+        ? (await scheduledTaskViewerForGrant(input.db, input.grant, input.settings)).subjectId
+        : null,
+  });
+  await requirePersonalMachineAudience({
+    db: input.db,
+    grant: input.grant,
+    agentConfig,
+    audience: visibility,
+  });
   return await withScheduledTaskAuthorityWriteErrors(() =>
     input.db.transaction(async (transaction) => {
       const task = await createScheduledTask(transaction, {
@@ -353,44 +667,36 @@ export async function createValidatedScheduledTask(input: {
         workspaceId: input.grant.workspaceId,
         name: trimmedScheduledTaskName(input.payload.name),
         status: input.payload.status,
+        visibility,
         schedule: input.payload.schedule,
         temporalScheduleId: scheduledTaskTemporalScheduleId(id),
         runMode: input.payload.runMode,
         overlapPolicy: input.payload.overlapPolicy,
         action,
-        agentConfig,
+        agentConfig: storedAgentConfig,
         ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),
         ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),
         createdByActor: creationInitiator.actor ?? null,
         ...(captureLinkAuthority ? { captureLinkAuthority } : {}),
-        personalConnectionDelegations,
         xaiProviderAccountAuthoritySnapshot,
+        claudeProviderAccountAuthoritySnapshot,
         creatorPolicy,
         targetSessionId: target?.id ?? null,
         variableSetId: input.payload.variableSetId ?? null,
-        rigId: input.payload.rigId ?? null,
+        ...("vaultPolicy" in input.payload && input.payload.vaultPolicy
+          ? { vaultPolicy: scheduledVaultPolicy(input.payload.vaultPolicy) }
+          : {}),
+        rigId,
         metadata: input.payload.metadata,
-        ...(hostSelections?.length && runtimeSettings
-          ? {
-              captureHostAuthority: prepareHostMcpTaskAdmission({
-                settings: runtimeSettings,
-                tools: target?.tools ?? agentConfig.tools,
-                grant: input.grant,
-                ...(input.authorization ? { authorization: input.authorization } : {}),
-                selections: hostSelections,
-              }),
-            }
-          : hostSelections === undefined && creationInitiator.actor && runtimeSettings
-            ? {
-                captureHostAuthority: prepareInheritedHostMcpTaskAdmission(
-                  runtimeSettings,
-                  target?.tools ?? agentConfig.tools,
-                  creationInitiator.actor,
-                ),
-              }
-            : {}),
         ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
       });
+      await recordScheduledTaskAccountChoiceChanges(transaction, {
+        grant: input.grant,
+        taskId: task.id,
+        operation: "create",
+        before: null,
+        after: task.agentConfig,
+      });
       if (learning && learningContext)
         await saveAgentLearningSettings(transaction, learningContext, {
           scope: learning.scope,
@@ -405,7 +711,8 @@ export async function createValidatedScheduledTask(input: {
 }
 
 /**
- * Freeze the creating session's boundary onto an agent-created task so the
+ * Freeze authenticated credential restrictions for every creation lane, and
+ * the creating session's boundary onto an agent-created task so the
  * sessions generated for it inherit exactly what the creator could see and
  * do, never the deployment default. Tools are the session's effective
  * model-visible selection under the deployment ceiling; permissions are the
@@ -415,25 +722,86 @@ export async function createValidatedScheduledTask(input: {
  * projection when it exposes those facts; each absent fact is stored as null
  * so a generated session keeps its own default for that key.
  */
-async function frozenScheduledTaskCreatorPolicy(input: {
+export async function frozenScheduledTaskCreatorPolicy(input: {
   db: Database;
   settings: Settings;
   grant: AccessGrant;
-  sessionId: string;
-}): Promise<ScheduledTaskCreatorPolicy> {
-  const session = await getSession(input.db, input.grant.workspaceId, input.sessionId);
+  authorization?: AccessGrantAuthorization | undefined;
+  actor: Extract<SessionCommandActor, { type: "agent_attempt" }> | null;
+}): Promise<ScheduledTaskCreatorPolicy | null> {
+  let restricted =
+    (input.authorization?.grant === input.grant &&
+      isDeveloperSetupAuthorization(input.authorization)) ||
+    isDeveloperSetupGrant(input.grant);
+  if (!input.actor) {
+    if (input.grant.permissionMode === "explicit") {
+      const permissions = DEFAULT_FIRST_PARTY_MCP_PERMISSIONS.filter((permission) =>
+        hasPermission(input.grant.permissions, permission, "explicit"),
+      );
+      if (permissions.length === 0) {
+        throw new HTTPException(403, {
+          message:
+            "the organization key holds no first-party MCP permission it could delegate to scheduled runs",
+        });
+      }
+      return {
+        firstPartyMcpTools: null,
+        firstPartyMcpPermissions: permissions,
+        sessionPolicy: null,
+        ...(restricted ? { credentialRestriction: "developer_setup" as const } : {}),
+      };
+    }
+    // A restriction is not an agent tool/permission selection. Keep the exact
+    // first-party and session defaults of ordinary API/service/asUser tasks.
+    return restricted
+      ? {
+          firstPartyMcpTools: null,
+          firstPartyMcpPermissions: null,
+          sessionPolicy: null,
+          credentialRestriction: "developer_setup",
+        }
+      : null;
+  }
+  const session = await getSession(input.db, input.grant.workspaceId, input.actor.sessionId);
   if (!session) {
     throw new HTTPException(403, {
       message: "the calling agent session is not available in this workspace",
     });
   }
-  const firstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
+  const turn = await getSessionTurnForAttempt(
+    input.db,
+    input.grant.workspaceId,
+    input.actor.sessionId,
+    input.actor.attemptId,
+  );
+  if (!turn || turn.id !== input.actor.turnId) {
+    throw new HTTPException(403, { message: "the calling agent attempt is not available" });
+  }
+  // These are server-frozen policies, not task/agentConfig metadata. The DB
+  // insert also verifies this exact actor under its ownership locks.
+  const turnPolicy = readTurnExecutionPolicyV1(turn.metadata);
+  const sessionPolicy = readTurnExecutionPolicyV1(session.metadata);
+  restricted ||= Boolean(
+    (turnPolicy.kind === "valid" &&
+      turnPolicy.policy.credentialRestriction === "developer_setup") ||
+    (sessionPolicy.kind === "valid" &&
+      sessionPolicy.policy.credentialRestriction === "developer_setup"),
+  );
+  const currentSelection = resolveSessionFirstPartyMcpTools(
     input.settings,
-    session.firstPartyMcpTools,
+    session,
+    (await requireWorkspace(input.db, input.grant.workspaceId)).settings,
   );
+  const signedSelection = input.grant.metadata?.["firstPartyMcpTools"];
+  const firstPartyMcpTools = Array.isArray(signedSelection)
+    ? currentSelection.filter((name) => signedSelection.includes(name))
+    : currentSelection;
   const firstPartyMcpPermissions = (
     session.firstPartyMcpPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS]
-  ).filter((permission) => hasPermission(input.grant.permissions, permission));
+  ).filter((permission) =>
+    hasPermission(input.grant.permissions, permission, input.grant.permissionMode),
+  );
+  requireExplicitPermissionDelegation(input.grant, firstPartyMcpPermissions);
   if (firstPartyMcpPermissions.length === 0) {
     throw new HTTPException(403, {
       message:
@@ -449,6 +817,7 @@ async function frozenScheduledTaskCreatorPolicy(input: {
   return {
     firstPartyMcpTools,
     firstPartyMcpPermissions,
+    ...(restricted ? { credentialRestriction: "developer_setup" as const } : {}),
     sessionPolicy: {
       agentAccess: agentAccess.success ? agentAccess.data : null,
       scopeSubjectId: scopeSubjectId.success ? scopeSubjectId.data : null,
@@ -487,6 +856,10 @@ export async function withScheduledTaskAuthorityWriteErrors<T>(run: () => Promis
   try {
     return await run();
   } catch (error) {
+    if (error instanceof ScheduledTaskHeadChangedError)
+      throw new HTTPException(409, {
+        message: "Scheduled task changed. Reload it before saving.",
+      });
     if (nestedPostgresSqlState(error) === "40001")
       throw new HTTPException(409, {
         message: "Scheduled task learning settings changed. Reload the task before saving.",
@@ -506,7 +879,7 @@ export async function withScheduledTaskAuthorityWriteErrors<T>(run: () => Promis
 /** API/MCP-facing update that maps authority-write denials to 409. */
 export async function updateScheduledTaskForApi(
   db: Database,
-  workspaceId: string,
+  grant: AccessGrant,
   taskId: string,
   update: UpdateScheduledTaskInput,
   learning?: {
@@ -515,6 +888,15 @@ export async function updateScheduledTaskForApi(
     restoreState: ScheduledTaskRestoreState;
   },
 ): Promise<ScheduledTask> {
+  const workspaceId = grant.workspaceId;
+  const beforeUpdateCommit = update.beforeUpdateCommit;
+  update = {
+    ...update,
+    beforeUpdateCommit: async (tx) => {
+      await assertScheduledTaskMutationOwner(tx, grant, taskId);
+      await beforeUpdateCommit?.(tx);
+    },
+  };
   if (learning) {
     const context = await knowledgeContextForAccess(
       { db },
@@ -581,6 +963,116 @@ export async function updateScheduledTaskForApi(
   );
 }
 
+export async function assertScheduledTaskMutationOwner(
+  db: Database,
+  grant: AccessGrant,
+  taskId: string,
+): Promise<void> {
+  await assertNotSiteClampedAgent(db, grant, "schedules");
+  await assertSiteMayReachScheduledTask(db, grant, taskId);
+  const writer = scheduledTaskInitiatorForGrant(grant);
+  const matches = await scheduledTaskMutationOwnerMatches(db, {
+    workspaceId: grant.workspaceId,
+    taskId,
+    ...(writer.initiator ? { createdBy: writer.initiator } : {}),
+    ...(writer.context ? { createdByContext: writer.context } : {}),
+    createdByActor: writer.actor ?? null,
+  });
+  if (!matches)
+    throw new HTTPException(403, {
+      message: "Only the schedule owner can change or run it. Copy it to create your own schedule.",
+    });
+}
+
+/**
+ * A request from a Site page (a tool the page called) may change or run only
+ * a schedule that same Site created. Refused as a missing schedule.
+ */
+async function assertSiteMayReachScheduledTask(
+  db: Database,
+  grant: AccessGrant,
+  taskId: string,
+): Promise<void> {
+  const origin = currentSiteSessionOrigin();
+  if (!origin) return;
+  const task = await getScheduledTask(db, grant.workspaceId, taskId);
+  if (!siteOriginsMatch(origin, siteSessionOriginFromMetadata(task?.agentConfig.metadata)))
+    throw new HTTPException(404, { message: "scheduled task not found" });
+}
+
+/**
+ * An admin's pause of a schedule they do not own. Pausing is reversible and
+ * changes nothing else; only the owner can change, run or resume it again.
+ */
+export async function pauseScheduledTaskAsAdmin(
+  db: Database,
+  workspaceId: string,
+  taskId: string,
+): Promise<ScheduledTask> {
+  return await withScheduledTaskAuthorityWriteErrors(() =>
+    updateScheduledTask(db, workspaceId, taskId, { status: "paused" }),
+  );
+}
+
+export const SCHEDULED_TASK_PAUSED_TRIGGER_MESSAGE =
+  "This schedule is paused, so it cannot run now. Resume it first, then trigger it.";
+
+export async function triggerScheduledTaskForGrant(
+  db: Database,
+  grant: AccessGrant,
+  workflowClient: SessionWorkflowClient,
+  input: Parameters<SessionWorkflowClient["triggerScheduledTask"]>[0],
+): Promise<void> {
+  await db.transaction(async (tx) => {
+    await assertScheduledTaskMutationOwner(tx, grant, input.task.id);
+    if (isRetiredNativeAtlassianTask(input.task))
+      throw new HTTPException(410, { message: ATLASSIAN_NATIVE_RETIRED_MESSAGE });
+    // The worker never runs a paused schedule. Refuse here so the caller is
+    // told, instead of accepting a trigger that would silently do nothing.
+    if (input.task.status === "paused")
+      throw new HTTPException(409, { message: SCHEDULED_TASK_PAUSED_TRIGGER_MESSAGE });
+    const actor = creationInitiatorForGrant(grant).actor ?? null;
+    const restriction = await scheduledTaskCredentialRestrictionForGrant(tx, grant, actor);
+    // A caller cannot supply or clear the trusted ceiling. Ownerless and
+    // same-human schedules can be triggered by a different credential than
+    // their creator; restrict that accepted run, not the durable task.
+    const { credentialRestriction: _untrustedRestriction, ...trigger } = input;
+    await workflowClient.triggerScheduledTask({
+      ...trigger,
+      ...(restriction ? { credentialRestriction: restriction } : {}),
+    });
+  });
+}
+
+async function scheduledTaskCredentialRestrictionForGrant(
+  db: Database,
+  grant: AccessGrant,
+  actor: Extract<SessionCommandActor, { type: "agent_attempt" }> | null,
+): Promise<"developer_setup" | undefined> {
+  if (isDeveloperSetupGrant(grant)) return "developer_setup";
+  if (!actor) return undefined;
+  const session = await getSession(db, grant.workspaceId, actor.sessionId);
+  const turn = await getSessionTurnForAttempt(
+    db,
+    grant.workspaceId,
+    actor.sessionId,
+    actor.attemptId,
+  );
+  if (!session || !turn || turn.id !== actor.turnId) {
+    throw new HTTPException(403, { message: "the calling agent attempt is not available" });
+  }
+  const policies = [
+    readTurnExecutionPolicyV1(turn.metadata),
+    readTurnExecutionPolicyV1(session.metadata),
+  ];
+  return policies.some(
+    (policy) =>
+      policy.kind === "valid" && policy.policy.credentialRestriction === "developer_setup",
+  )
+    ? "developer_setup"
+    : undefined;
+}
+
 export async function validateScheduledTaskTarget(input: {
   db: Database;
   sessionAuthorization?: SessionAuthorizationPort | null | undefined;
@@ -592,6 +1084,8 @@ export async function validateScheduledTaskTarget(input: {
   rigId: string | null | undefined;
   agentConfig: ScheduledTaskAgentConfig;
   missingTargetStatus?: 404 | 422;
+  /** Leaving a cancelled chat still requires control, but not revivability. */
+  departingTarget?: boolean;
 }): Promise<Session | null> {
   if (input.runMode !== "existing_session") {
     if (input.targetSessionId) {
@@ -643,54 +1137,58 @@ export async function validateScheduledTaskTarget(input: {
   if (!session || session.accountId !== input.grant.accountId) {
     throw new HTTPException(404, { message: "target session not found" });
   }
-  if (
-    input.agentConfig.bundledSkillIds !== undefined &&
-    !isDeepStrictEqual(input.agentConfig.bundledSkillIds, session.bundledSkillIds)
-  ) {
-    throw new HTTPException(422, {
-      message: "An existing-session schedule cannot change that session's bundled Skill selection",
-    });
-  }
-  if (session.status === "cancelled") {
+  if (session.status === "cancelled" && !input.departingTarget) {
     throw new HTTPException(409, {
       message: "target session is cancelled; choose a revivable session",
     });
   }
-  if ((session.variableSetId ?? null) !== (input.variableSetId ?? null)) {
-    throw new HTTPException(422, {
-      message: "target session variableSet attachment does not match the scheduled task",
-    });
-  }
-  if ((session.rigId ?? null) !== (input.rigId ?? null)) {
-    throw new HTTPException(422, {
-      message: "target session rig does not match the scheduled task",
-    });
-  }
-  if (
-    input.agentConfig.sandboxBackend !== undefined &&
-    input.agentConfig.sandboxBackend !== session.sandboxBackend
-  ) {
-    throw new HTTPException(422, {
-      message: "target session sandbox backend does not match the scheduled task",
-    });
-  }
-  if (
-    scheduledSlackBotConnectionId(session.metadata) !==
-    (input.agentConfig.slackBotConnectionId ?? null)
-  ) {
-    throw new HTTPException(422, {
-      message: "target session OpenGeni Slack bot binding does not match the scheduled task",
-    });
-  }
+  // The target owns execution settings. Admission freezes and revalidates its
+  // current policy under the scheduled owner; duplicated task fields confer no access.
   return session;
 }
 
+export const PERSONAL_MACHINE_SCHEDULE_AUDIENCE_MESSAGE =
+  "Your personal machine can only run schedules that only you can see. Set Who can see it to Only me, or pick a shared machine.";
+
+/**
+ * A schedule's audience is resolved after its machine is validated, and can be
+ * changed without touching the machine. Re-check the pairing on the final
+ * audience so a personal machine never ends up on a schedule others can see.
+ */
+async function requirePersonalMachineAudience(input: {
+  db: Database;
+  grant: AccessGrant;
+  agentConfig: ScheduledTaskAgentConfig;
+  audience: "user_private" | "workspace_shared";
+}): Promise<void> {
+  const target = input.agentConfig.machineTarget;
+  if (!target || input.audience === "user_private") return;
+  const sandbox = await getSandbox(
+    input.db,
+    {
+      accountId: input.grant.accountId,
+      workspaceId: input.grant.workspaceId,
+      subjectId: input.grant.subjectId,
+    },
+    target.targetSandboxId,
+  );
+  if (sandbox?.scope === "user") {
+    throw new HTTPException(422, { message: PERSONAL_MACHINE_SCHEDULE_AUDIENCE_MESSAGE });
+  }
+}
+
 export async function validateScheduledTaskMachineTarget(input: {
   settings: Settings;
   db: Database;
   grant: AccessGrant;
   runMode: ScheduledTask["runMode"];
   agentConfig: ScheduledTaskAgentConfig;
+  /**
+   * Who can see the schedule. A personal machine runs only an Only me schedule
+   * of its owner; the owner check is the scoped lookup itself, which returns a
+   * personal machine to nobody else.
+   */
+  audience: "user_private" | "workspace_shared";
   requireOnline?: boolean;
 }): Promise<{
   sandboxId: string;
@@ -731,11 +1229,8 @@ export async function validateScheduledTaskMachineTarget(input: {
       message: "the selected Connected Machine is unavailable",
     });
   }
-  if (sandbox.scope === "user") {
-    throw new HTTPException(422, {
-      message:
-        "personal Connected Machines cannot run unattended schedules; select a workspace or organization machine",
-    });
+  if (sandbox.scope === "user" && input.audience !== "user_private") {
+    throw new HTTPException(422, { message: PERSONAL_MACHINE_SCHEDULE_AUDIENCE_MESSAGE });
   }
   const enrollment = input.requireOnline
     ? await getLiveEnrollmentConnection(input.db, access, sandbox.enrollmentId)
@@ -786,7 +1281,7 @@ export function scheduledTaskAuthorityUpdateForGrant(
   | "authorityUpdatedByContext"
   | "authorityUpdatedByActor"
 > {
-  const writer = creationInitiatorForGrant(grant);
+  const writer = scheduledTaskInitiatorForGrant(grant);
   return {
     refreshPersonalResourceAuthority: true,
     ...(writer.initiator ? { authorityUpdatedBy: writer.initiator } : {}),
@@ -795,20 +1290,131 @@ export function scheduledTaskAuthorityUpdateForGrant(
   };
 }
 
+/**
+ * The Sandbox Environment a new task stores. An explicit id or null is the
+ * caller's choice. An omitted value is resolved once, here, and frozen on the
+ * task, the way session create resolves an omitted rigId:
+ * - an existing-session task keeps its target session's own environment;
+ * - a Connected Machine task stores none: environment setup and Variable Set
+ *   injection never reach a machine, so a binding would only add a fire-time
+ *   failure mode;
+ * - otherwise the workspace default, when the creator can see it and it has an
+ *   active version. A stale default degrades to none, like session create.
+ * The default's own Variable Sets must be attachable by the creator, exactly
+ * as session create requires, so a workspace default never gives a task
+ * secrets its creator could not attach. Later changes to the workspace default
+ * do not move an existing task.
+ */
+async function resolveScheduledTaskCreateRigId(input: {
+  settings: Settings;
+  db: Database;
+  grant: AccessGrant;
+  requestedRigId: string | null | undefined;
+  runMode: ScheduledTask["runMode"];
+  target: Session | null;
+  agentConfig: ScheduledTaskAgentConfig;
+}): Promise<string | null> {
+  if (input.requestedRigId !== undefined) return input.requestedRigId;
+  if (input.runMode === "existing_session") return input.target?.rigId ?? null;
+  if (input.agentConfig.machineTarget) return null;
+  const defaultRigId = await getWorkspaceDefaultRigId(input.db, input.grant.workspaceId);
+  if (!defaultRigId) return null;
+  const rig = await getRig(
+    input.db,
+    {
+      accountId: input.grant.accountId,
+      workspaceId: input.grant.workspaceId,
+      subjectId: input.grant.subjectId,
+    },
+    defaultRigId,
+  );
+  if (!rig?.activeVersion) return null;
+  return rig.id;
+}
+
+type ScheduledTaskRig = NonNullable<Awaited<ReturnType<typeof getRig>>>;
+
 // Validate a scheduled task's rig reference: it must name a rig in the
 // workspace. A missing/cross-workspace id is a 422 (RLS-invisible == missing).
 async function requireScheduledTaskRig(
   db: Database,
   access: { accountId: string; workspaceId: string; subjectId: string },
   rigId: string,
-): Promise<void> {
+): Promise<ScheduledTaskRig> {
   const rig = await getRig(db, access, rigId);
   if (!rig) {
     throw new HTTPException(422, { message: `unknown rigId: ${rigId}` });
   }
+  return rig;
+}
+
+/**
+ * The validated update for a schedule edit, including its audience: a schedule
+ * that ends up posting into an Only me chat is Only me, and only its owner can
+ * change who sees it (the update itself is owner-only).
+ */
+export async function validatedScheduledTaskUpdate(
+  input: Parameters<typeof validatedScheduledTaskUpdateWithoutAudience>[0],
+): Promise<UpdateScheduledTaskInput> {
+  const update = await validatedScheduledTaskUpdateWithoutAudience(input);
+  const runMode = update.runMode ?? input.existing.runMode;
+  const targetSessionId =
+    runMode === "existing_session"
+      ? (update.targetSessionId ?? input.existing.targetSessionId)
+      : runMode === "reusable_session" && input.existing.runMode === "reusable_session"
+        ? input.existing.reusableSessionId
+        : null;
+  const agentConfig = update.agentConfig ?? input.existing.agentConfig;
+  const visibility = await resolveScheduledTaskVisibility({
+    db: input.db,
+    settings: input.settings,
+    grant: input.grant,
+    requested: input.payload.visibility,
+    current: input.existing,
+    targetSessionId,
+    personalKnowledge: agentConfig.knowledgeSource?.destination.kind === "personal",
+    ownerSubjectId: input.existing.ownerSubjectId,
+  });
+  await requirePersonalMachineAudience({
+    db: input.db,
+    grant: input.grant,
+    agentConfig,
+    audience: visibility,
+  });
+  const current = input.existing.visibility === "private" ? "user_private" : "workspace_shared";
+  const audited = withScheduledTaskAccountChoiceAudit(input.grant, input.existing, update);
+  return visibility === current ? audited : { ...audited, visibility };
+}
+
+/**
+ * Record the edit's account and connector choice changes in the transaction
+ * that commits it. Every update writer (form, API, agent tool, access
+ * refresh) commits through the validated update.
+ */
+function withScheduledTaskAccountChoiceAudit(
+  grant: AccessGrant,
+  existing: ScheduledTask,
+  update: UpdateScheduledTaskInput,
+): UpdateScheduledTaskInput {
+  const next = update.agentConfig;
+  if (!next || !scheduledTaskAccountChoiceChanges(existing.agentConfig, next)) return update;
+  const prior = update.beforeUpdateCommit;
+  return {
+    ...update,
+    beforeUpdateCommit: async (tx) => {
+      await prior?.(tx);
+      await recordScheduledTaskAccountChoiceChanges(tx, {
+        grant,
+        taskId: existing.id,
+        operation: "update",
+        before: existing.agentConfig,
+        after: next,
+      });
+    },
+  };
 }
 
-export async function validatedScheduledTaskUpdate(input: {
+async function validatedScheduledTaskUpdateWithoutAudience(input: {
   settings: Settings;
   db: Database;
   objectStorage: ObjectStorageDependency;
@@ -820,7 +1426,124 @@ export async function validatedScheduledTaskUpdate(input: {
   toolsProvided?: boolean;
   sessionAuthorization?: SessionAuthorizationPort | null | undefined;
   authorizationSurface?: SessionAuthorizationSurface | undefined;
+  /** Proves the bot may post in a newly chosen task Slack channel. */
+  verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
 }): Promise<UpdateScheduledTaskInput> {
+  const requestedPrompt =
+    input.payload.prompt ??
+    input.payload.agentConfigPatch?.prompt ??
+    input.payload.agentConfig?.prompt;
+  if (requestedPrompt !== undefined && !requestedPrompt.trim())
+    throw new HTTPException(422, { message: "scheduled task prompt is required" });
+  const retainedPrompt =
+    input.payload.agentConfig === undefined
+      ? (requestedPrompt ?? input.existing.agentConfig.prompt)
+      : undefined;
+  if (
+    input.payload.expectedExecutionDigest !== undefined &&
+    input.payload.expectedExecutionDigest !== input.existing.executionDigest
+  )
+    throw new HTTPException(409, {
+      message: "Scheduled task changed. Reload it before saving.",
+    });
+  if (input.payload.prompt !== undefined)
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        agentConfigPatch: {
+          ...input.payload.agentConfigPatch,
+          prompt: input.payload.prompt,
+        },
+      },
+    };
+  if (input.payload.targetSessionId && input.payload.runMode === undefined)
+    input = {
+      ...input,
+      payload: { ...input.payload, runMode: "existing_session" },
+    };
+  const requestedMode = input.payload.runMode ?? input.existing.runMode;
+  if (requestedMode === "existing_session") {
+    const config = input.payload.agentConfig ?? input.existing.agentConfig;
+    if (config.knowledgeSource)
+      throw new HTTPException(422, {
+        message: "Source ingestion requires a separate scheduled agent",
+      });
+    const target = await validateScheduledTaskTarget({
+      ...input,
+      runMode: "existing_session",
+      targetSessionId: input.payload.targetSessionId ?? input.existing.targetSessionId,
+      variableSetId: null,
+      rigId: null,
+      agentConfig: scheduledSessionMessageConfig(config),
+    });
+    if (input.payload.rigId && input.payload.rigId !== target?.rigId)
+      throw new HTTPException(422, {
+        message:
+          "Existing-chat schedules use the chat's environment. Change the chat's attachments separately.",
+      });
+    const retargeting =
+      input.existing.runMode !== "existing_session" ||
+      target?.id !== input.existing.targetSessionId;
+    const previousTargetSessionId =
+      input.existing.runMode === "existing_session"
+        ? input.existing.targetSessionId
+        : input.existing.runMode === "reusable_session"
+          ? input.existing.reusableSessionId
+          : null;
+    const previousTarget =
+      retargeting && previousTargetSessionId
+        ? await validateScheduledTaskTarget({
+            ...input,
+            runMode: "existing_session",
+            targetSessionId: previousTargetSessionId,
+            departingTarget: true,
+            variableSetId: null,
+            rigId: null,
+            agentConfig: scheduledSessionMessageConfig(input.existing.agentConfig),
+          })
+        : null;
+    // Variable Sets were replaced by vaults; only an environment change needs review.
+    const removedVariableSetIds: string[] = [];
+    const previousRigId = previousTarget ? previousTarget.rigId : input.existing.rigId;
+    const changedRig = retargeting && previousRigId && previousRigId !== target?.rigId;
+    if ((removedVariableSetIds.length || changedRig) && !input.payload.adoptSessionSettings) {
+      const detail = {
+        code: "scheduled_target_access_change",
+        targetSessionId: target!.id,
+        removedVariableSetIds,
+        removedVariableSetCount: removedVariableSetIds.length,
+        removedRigId: changedRig ? previousRigId : null,
+        resolution:
+          "Review the destination's access, then retry with adoptSessionSettings=true and the reviewed expectedExecutionDigest to use that chat's attachments.",
+      };
+      throw new HTTPException(409, {
+        message:
+          "The destination chat has different attachments. Review the access change before moving this schedule.",
+        cause: detail,
+      });
+    }
+    // Server-side normalization preserves exact message fields and authority choices;
+    // callers never reconstruct an incomplete get projection to remove old settings.
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        ...(retargeting
+          ? {
+              agentConfig: scheduledSessionMessageConfig({
+                ...config,
+                ...input.payload.agentConfigPatch,
+                prompt: input.payload.agentConfigPatch?.prompt ?? config.prompt,
+              }),
+              agentConfigPatch: undefined,
+              variableSetId: null,
+              rigId: null,
+            }
+          : {}),
+      },
+    };
+  }
   if (input.payload.agentLearning) {
     const context = input.authorization
       ? await knowledgeContextForAccess(
@@ -834,8 +1557,15 @@ export async function validatedScheduledTaskUpdate(input: {
         message: "Only an authenticated person can configure Agent learning",
       });
   }
-  const update: UpdateScheduledTaskInput = {};
+  const update: UpdateScheduledTaskInput = {
+    expectedExecutionDigest: input.existing.executionDigest,
+  };
   const requestedKnowledgeSource = input.payload.agentConfig?.knowledgeSource ?? null;
+  if (
+    isRetiredNativeAtlassianTask(input.existing) &&
+    (input.payload.status === "active" || requestedKnowledgeSource)
+  )
+    throw new HTTPException(410, { message: ATLASSIAN_NATIVE_RETIRED_MESSAGE });
   const existingKnowledgeSource = scheduledTaskKnowledgeSource(input.existing);
   // Editing an ordinary source task's prompt/settings must not orphan its
   // connector binding. Deleting the task is the explicit source-disable path.
@@ -885,22 +1615,17 @@ export async function validatedScheduledTaskUpdate(input: {
     });
   const existingTarget = input.existing.targetSessionId;
   const nextRunMode = input.payload.runMode ?? input.existing.runMode;
+  const materializedReusable =
+    input.existing.runMode === "reusable_session" &&
+    nextRunMode === "reusable_session" &&
+    input.existing.reusableSessionId !== null;
+  let reusableTarget: Session | null = null;
   const nextTargetSessionId =
     input.payload.targetSessionId !== undefined
       ? input.payload.targetSessionId
       : nextRunMode === "existing_session"
         ? existingTarget
         : null;
-  if (
-    input.existing.runMode === "reusable_session" &&
-    input.existing.reusableSessionId &&
-    nextRunMode === "existing_session"
-  ) {
-    throw new HTTPException(409, {
-      message:
-        "cannot target an existing session after this task created its reusable session; create a new task",
-    });
-  }
   if (input.payload.name !== undefined) {
     update.name = trimmedScheduledTaskName(input.payload.name);
   }
@@ -920,41 +1645,14 @@ export async function validatedScheduledTaskUpdate(input: {
   if (input.payload.metadata !== undefined) {
     update.metadata = input.payload.metadata;
   }
-  if (input.payload.variableSetId !== undefined) {
-    const nextVariableSetId = input.payload.variableSetId;
-    if (
-      (input.existing.variableSetId ?? null) !== (nextVariableSetId ?? null) &&
-      input.existing.runMode === "reusable_session" &&
-      input.existing.reusableSessionId
-    ) {
-      throw new HTTPException(409, {
-        message:
-          "cannot change variableSet of a task with a live reusable session; recreate the task",
-      });
-    }
-    if (nextVariableSetId === null) {
-      if (input.existing.variableSetId !== null) {
-        // Detaching is also an attachment change: it strips the secrets a
-        // task's instructions were designed around.
-        requirePermission(input.grant, "variable-sets:attach");
-      }
-      update.variableSetId = null;
-    } else {
-      await validateVariableSetAttachment(
-        { settings: input.settings, db: input.db },
-        input.grant,
-        input.existing.workspaceId,
-        nextVariableSetId,
-      );
-      update.variableSetId = nextVariableSetId;
-    }
+  if (input.payload.vaultPolicy !== undefined) {
+    update.vaultPolicy = scheduledVaultPolicy(input.payload.vaultPolicy);
   }
+  if (input.payload.variableSetId) throw variableSetsRemovedError("variableSetId");
+  // Clearing a legacy selection stays allowed.
+  if (input.payload.variableSetId === null) update.variableSetId = null;
   if (input.payload.rigId !== undefined) {
-    if (
-      input.existing.runMode === "reusable_session" &&
-      input.existing.reusableSessionId !== null &&
-      input.payload.rigId !== input.existing.rigId
-    ) {
+    if (materializedReusable && input.payload.rigId !== input.existing.rigId) {
       throw new HTTPException(409, {
         message: "A reusable-session task cannot change rigId after materialization; recreate it",
       });
@@ -972,17 +1670,44 @@ export async function validatedScheduledTaskUpdate(input: {
     }
     update.rigId = input.payload.rigId;
   }
-  if (input.payload.agentConfig !== undefined) {
-    // Editing the instructions of a task that injects workspace secrets is
-    // equivalent to attaching those secrets to new instructions, so it
-    // requires variable-sets:use even though plain task edits do not.
-    const willHaveVariableSet =
-      input.payload.variableSetId !== undefined
-        ? input.payload.variableSetId !== null
-        : Boolean(input.existing.variableSetId);
-    if (willHaveVariableSet) {
-      requirePermission(input.grant, "variable-sets:use");
+  if (input.payload.agentConfig !== undefined || input.payload.agentConfigPatch !== undefined) {
+    // A materialized reusable chat must still exist to take new instructions.
+    if (materializedReusable) {
+      reusableTarget = await getSession(
+        input.db,
+        input.existing.workspaceId,
+        input.existing.reusableSessionId!,
+      );
+      if (!reusableTarget || reusableTarget.accountId !== input.existing.accountId)
+        throw new HTTPException(409, { message: "Scheduled task chat is unavailable" });
+    }
+  }
+  if (input.payload.agentConfigPatch) {
+    const patch = input.payload.agentConfigPatch;
+    const model =
+      patch.model === undefined ? undefined : canonicalConfiguredModel(input.settings, patch.model);
+    if (model !== undefined && model !== null) {
+      await assertWorkspaceModelPolicyAllows(
+        input.db,
+        input.settings,
+        input.existing.workspaceId,
+        model,
+      );
     }
+    // Validate only the newly supplied model settings, not a reconstructed
+    // bounded input. Legacy stored text, resources and selections stay exact.
+    update.agentConfig = {
+      ...input.existing.agentConfig,
+      ...(patch.prompt !== undefined ? { prompt: patch.prompt } : {}),
+      ...(model !== undefined && model !== null ? { model } : {}),
+      ...(patch.reasoningEffort !== undefined ? { reasoningEffort: patch.reasoningEffort } : {}),
+    };
+    // Validation performs asynchronous authority checks before persistence.
+    // Reuse the locked-row CAS so that merging this snapshot cannot erase a
+    // concurrent config edit. The caller receives 409, never an automatic retry.
+    update.expectedExecutionDigest = input.existing.executionDigest;
+  }
+  if (input.payload.agentConfig !== undefined) {
     const nextAgentConfig = await validateScheduledTaskAgentConfig({
       settings: input.settings,
       db: input.db,
@@ -999,21 +1724,105 @@ export async function validatedScheduledTaskUpdate(input: {
             : input.existing.reusableSessionId,
       },
       ...(input.toolsProvided !== undefined ? { toolsProvided: input.toolsProvided } : {}),
+      ...(materializedReusable ? { retainedCreationConfig: input.existing.agentConfig } : {}),
+      ...(input.existing.agentConfig.toolPolicy
+        ? { existingToolPolicy: input.existing.agentConfig.toolPolicy }
+        : {}),
     });
     if (
-      input.existing.reusableSessionId &&
-      input.existing.runMode === "reusable_session" &&
+      materializedReusable &&
       (input.existing.agentConfig.slackBotConnectionId ?? null) !==
         (nextAgentConfig.slackBotConnectionId ?? null)
     ) {
       throw new HTTPException(409, {
         message:
-          "cannot change the OpenGeni Slack bot connection of a task with a live reusable session; recreate the task",
+          "cannot change the Opengeni Slack bot connection of a task with a live reusable session; recreate the task",
       });
     }
+    // Update text is exact, even when a full form submission reuses the saved
+    // prompt while changing another setting. Creation keeps its trim convention.
+    nextAgentConfig.prompt = retainedPrompt ?? input.payload.agentConfig.prompt;
+    if (retainedPrompt !== undefined) {
+      nextAgentConfig.resources = input.existing.agentConfig.resources;
+    }
+    // The Site a schedule was created from stays recorded; an update never
+    // sets, changes or clears it.
+    const recordedOrigin = input.existing.agentConfig.metadata?.[SITE_ORIGIN_METADATA_KEY];
+    nextAgentConfig.metadata = {
+      ...withSiteOriginMetadata(nextAgentConfig.metadata ?? {}, null),
+      ...(recordedOrigin !== undefined ? { [SITE_ORIGIN_METADATA_KEY]: recordedOrigin } : {}),
+    };
     update.agentConfig = nextAgentConfig;
   }
-  const nextAgentConfig = update.agentConfig ?? input.existing.agentConfig;
+  // Pins are the only saved account choice, a person's explicit one, and only
+  // a schedule that starts its own session has them. A full config replacement
+  // keeps them unless the request changes them; moving into an existing chat
+  // drops them, because that chat's connectors and the owner's current
+  // accounts apply.
+  const pinsProvided =
+    input.payload.pinnedAccounts !== undefined ||
+    input.payload.pinnedAccountsRequired !== undefined;
+  if (pinsProvided) {
+    if (
+      nextRunMode === "existing_session" &&
+      ((input.payload.pinnedAccounts?.length ?? 0) > 0 ||
+        input.payload.pinnedAccountsRequired === true)
+    )
+      throw new HTTPException(422, {
+        message:
+          "Pin connector accounts only on a schedule that starts its own session. An existing-chat schedule uses that chat's connectors with the owner's current accounts.",
+      });
+    requireScheduledTaskPinAuthor(input.grant);
+  }
+  if (update.agentConfig || pinsProvided || nextRunMode === "existing_session") {
+    const base = update.agentConfig ?? input.existing.agentConfig;
+    const pins =
+      nextRunMode === "existing_session"
+        ? []
+        : (input.payload.pinnedAccounts ?? input.existing.agentConfig.pinnedAccounts ?? []);
+    const required =
+      input.payload.pinnedAccountsRequired ??
+      input.existing.agentConfig.pinnedAccountsRequired === true;
+    const next = withScheduledTaskPins(base, pins, required);
+    if (update.agentConfig || !isDeepStrictEqual(next, input.existing.agentConfig))
+      update.agentConfig = next;
+  }
+  const nextAgentConfig = {
+    ...(update.agentConfig ?? input.existing.agentConfig),
+  };
+  // Retargeting rewrites a narrow patch into a full config above. Check the
+  // exact final message after restoring retained fields, regardless of path.
+  // An unedited legacy prompt remains movable even when above today's limit.
+  if (
+    requestedPrompt !== undefined &&
+    scheduledOccurrencePayloadUtf8Bytes(nextAgentConfig) >
+      SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES -
+        SCHEDULED_TASK_OCCURRENCE_PAYLOAD_INGRESS_HEADROOM_BYTES
+  )
+    throw new HTTPException(422, {
+      message: "Updated scheduled message and attachments exceed the supported occurrence payload",
+    });
+  await validateScheduledTaskSlackChannel({
+    grant: input.grant,
+    authorization: input.authorization,
+    previous: input.existing.agentConfig,
+    next: nextAgentConfig,
+    runMode: nextRunMode,
+    reusableSessionCanPost:
+      input.existing.runMode === "reusable_session" && input.existing.reusableSessionId !== null
+        ? async () => {
+            const chat = await getSession(
+              input.db,
+              input.existing.workspaceId,
+              input.existing.reusableSessionId!,
+            );
+            return SCHEDULED_SLACK_BOT_POSTING_TOOLS.every(
+              (tool) => chat?.firstPartyMcpTools?.includes(tool) === true,
+            );
+          }
+        : null,
+    verifySlackChannel: input.verifySlackChannel,
+  });
   const authorityTargetChanged =
     nextRunMode !== input.existing.runMode ||
     nextTargetSessionId !== input.existing.targetSessionId ||
@@ -1022,8 +1831,7 @@ export async function validatedScheduledTaskUpdate(input: {
     (input.payload.rigId !== undefined && input.payload.rigId !== input.existing.rigId);
   const materialExecutionChange =
     authorityTargetChanged ||
-    input.payload.selectedHostMcpDelegations !== undefined ||
-    input.payload.connectionAuthorities !== undefined ||
+    pinsProvided ||
     !isDeepStrictEqual(nextAgentConfig, input.existing.agentConfig) ||
     (input.payload.action !== undefined &&
       !isDeepStrictEqual(input.payload.action, input.existing.action)) ||
@@ -1034,15 +1842,31 @@ export async function validatedScheduledTaskUpdate(input: {
     (input.payload.metadata !== undefined &&
       !isDeepStrictEqual(input.payload.metadata, input.existing.metadata)) ||
     (input.existing.status === "paused" && input.payload.status === "active");
-  if (materialExecutionChange && nextRunMode !== "existing_session") {
+  if (
+    materialExecutionChange &&
+    nextRunMode !== "existing_session" &&
+    (!materializedReusable || nextAgentConfig.model !== input.existing.agentConfig.model)
+  ) {
     const beforeUpdateCommit = workspaceCustomModelCommitGuard({
       settings: input.settings,
       accountId: input.existing.accountId,
       workspaceId: input.existing.workspaceId,
       modelId: nextAgentConfig.model ?? input.settings.openaiModel,
+      claudeAuthoritySnapshot: await getScheduledTaskClaudeProviderAccountAuthoritySnapshot(
+        input.db,
+        input.existing.workspaceId,
+        input.existing.id,
+      ),
+      scheduledTaskId: input.existing.id,
     });
     if (beforeUpdateCommit) update.beforeUpdateCommit = beforeUpdateCommit;
   }
+  // A task accepted with a user-scoped SuperGrok v1 snapshot keeps its
+  // causal human: the scheduled dispatch and the deployed admission fence
+  // (`admit_scheduled_agent_run_execution`) still take the run's causal
+  // subject from that stored snapshot, so a material edit by anyone else
+  // would leave every later occurrence refused. Reading the stored value is
+  // not deriving it from live state; it retires with that fence.
   const existingXaiAuthority = await getScheduledTaskXaiProviderAccountAuthoritySnapshot(
     input.db,
     input.existing.workspaceId,
@@ -1058,67 +1882,16 @@ export async function validatedScheduledTaskUpdate(input: {
       message: "changing a user-scoped xAI scheduled task requires the same causal human",
     });
   }
-  const existingDelegations = await getScheduledTaskPersonalConnectionDelegations(
-    input.db,
-    input.existing.workspaceId,
-    input.existing.id,
-  );
-  if (input.payload.connectionAuthorities === undefined) {
-    if (
-      materialExecutionChange &&
-      existingDelegations.some((delegation) => delegation.connectionType === "github_personal")
-    ) {
-      throw new HTTPException(409, {
-        message:
-          "material changes to a personal GitHub-authorized task require explicit connectionAuthorities",
-      });
-    }
-    if (
-      existingDelegations.length > 0 &&
-      !isDeepStrictEqual(nextAgentConfig.tools, input.existing.agentConfig.tools)
-    ) {
-      throw new HTTPException(409, {
-        message:
-          "changing tools on a connection-authorized task requires explicit connectionAuthorities",
-      });
-    }
-    if (existingDelegations.length > 0) {
-      if (
-        materialExecutionChange &&
-        existingDelegations.some(
-          (delegation) => delegation.ownerSubjectId !== input.grant.subjectId,
-        )
-      ) {
-        throw new HTTPException(409, {
-          message:
-            "preserving connection authority requires the same causal human; provide a new explicit selection",
-        });
-      }
-      if (authorityTargetChanged) {
-        update.cloneConnectionAuthorityFromRevision = input.existing.authorityRevision;
-      } else {
-        update.clonePersonalResourceAuthorityFromRevision = input.existing.authorityRevision;
-      }
-    }
-  } else if (input.payload.connectionAuthorities.length === 0) {
-    if (personalGitHubRepositoryResources(nextAgentConfig.resources).length > 0) {
-      throw new HTTPException(409, {
-        message:
-          "personal GitHub repository resources cannot be retained without connectionAuthorities",
-      });
-    }
-    update.personalConnectionDelegations = [];
-  } else {
+  if (materialExecutionChange) {
+    await assertScheduledTaskMutationOwner(input.db, input.grant, input.existing.id);
+    const ownerSubjectId = input.existing.ownerSubjectId;
     const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
       input.db,
-      // Same object as the subject just below, and as the freeze call further
-      // down: the task was loaded with `getScheduledTask(db, grant.workspaceId,
-      // ...)`, so this is `input.existing.workspaceId`, sourced consistently.
       input.grant.workspaceId,
       input.settings,
-      { subjectId: input.grant.subjectId },
+      ownerSubjectId ? { subjectId: ownerSubjectId } : {},
     );
-    const nextTarget = await validateScheduledTaskTarget({
+    let nextTarget = await validateScheduledTaskTarget({
       db: input.db,
       sessionAuthorization: input.sessionAuthorization,
       authorizationSurface: input.authorizationSurface,
@@ -1132,26 +1905,120 @@ export async function validatedScheduledTaskUpdate(input: {
       rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,
       agentConfig: nextAgentConfig,
     });
-    update.personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    if (materializedReusable) {
+      nextTarget =
+        reusableTarget ??
+        (await getSession(input.db, input.existing.workspaceId, input.existing.reusableSessionId!));
+      if (!nextTarget || nextTarget.accountId !== input.existing.accountId)
+        throw new HTTPException(409, { message: "Scheduled task chat is unavailable" });
+    }
+    const updateWorkspaceDefaults = resolveWorkspaceSessionToolDefaults(
+      (await requireWorkspace(input.db, input.grant.workspaceId)).settings,
+    );
+    // Pins are judged against what a run gets: its own tools plus the
+    // workspace defaults it follows.
+    const runToolsFor = (config: ScheduledTaskAgentConfig) =>
+      scheduledTaskRunTools({
+        agentConfig: config,
+        settings: input.settings,
+        runtimeSettings,
+        workspaceDefaults: updateWorkspaceDefaults,
+      });
+    const nextRunTools = runToolsFor(nextAgentConfig);
+    const priorRunTools = runToolsFor(input.existing.agentConfig);
+    const nextConnectionTools = await scheduledConnectionTools(
+      input.db,
+      input.grant.workspaceId,
+      runtimeSettings,
+      nextTarget,
+      nextRunTools,
+      ownerSubjectId ?? undefined,
+    );
+    const priorTargetSessionId =
+      input.existing.runMode === "existing_session"
+        ? input.existing.targetSessionId
+        : input.existing.runMode === "reusable_session"
+          ? input.existing.reusableSessionId
+          : null;
+    const priorTarget = priorTargetSessionId
+      ? priorTargetSessionId === nextTarget?.id
+        ? nextTarget
+        : await getSession(input.db, input.existing.workspaceId, priorTargetSessionId)
+      : null;
+    const priorConnectionResources = mergeResourceRefs(
+      priorTarget?.resources ?? [],
+      input.existing.agentConfig.resources,
+    );
+    const nextConnectionResources = mergeResourceRefs(
+      nextTarget?.resources ?? [],
+      nextAgentConfig.resources,
+    );
+    const priorConnectionTools = await scheduledConnectionTools(
+      input.db,
+      input.grant.workspaceId,
+      runtimeSettings,
+      priorTarget,
+      priorRunTools,
+      ownerSubjectId ?? undefined,
+    );
+    const priorAccountSurfaceIds = new Set(
+      [...priorRunTools, ...(priorTarget?.tools ?? []), ...priorConnectionTools]
+        .filter((tool) => tool.kind === "mcp")
+        .map((tool) => tool.id),
+    );
+    if (personalGitHubRepositoryResources(priorConnectionResources).length)
+      priorAccountSurfaceIds.add(PERSONAL_GITHUB_CONNECTION_SURFACE_ID);
+    // Compared like for like with the prior surfaces: a connector the task or
+    // its chat still names keeps its pin even while the chat has it turned
+    // off, so only an edit that removes the connector removes the pin.
+    const nextAccountSurfaceIds = new Set(
+      [...nextRunTools, ...(nextTarget?.tools ?? []), ...nextConnectionTools]
+        .filter((tool) => tool.kind === "mcp")
+        .map((tool) => tool.id),
+    );
+    const nextSurfaceEligibility = scheduledConnectionSurfaceEligibility(
+      runtimeSettings,
+      nextTarget,
+      (await requireWorkspace(input.db, input.grant.workspaceId)).settings,
+    );
+    if (nextSurfaceEligibility.googleDrivePublicationEnabled)
+      nextAccountSurfaceIds.add(GOOGLE_DRIVE_PUBLICATION_SERVER_ID);
+    if (personalGitHubRepositoryResources(nextConnectionResources).length)
+      nextAccountSurfaceIds.add(PERSONAL_GITHUB_CONNECTION_SURFACE_ID);
+    // Removing a connector or repository also removes its pin. Pins the
+    // request supplies are validated strictly; retained pins are kept even
+    // when their account is gone, so an edit never fails on a stale pin (the
+    // run goes without that connector and the owner is told).
+    const keptPins = (nextAgentConfig.pinnedAccounts ?? []).filter(
+      (pin) =>
+        input.payload.pinnedAccounts !== undefined ||
+        nextAccountSurfaceIds.has(pin.serverId) ||
+        !priorAccountSurfaceIds.has(pin.serverId),
+    );
+    await freezeConnectionAccounts({
       db: input.db,
-      // Both halves of the authority question come from ONE object. The task was
-      // loaded with `getScheduledTask(db, grant.workspaceId, ...)`, so this is
-      // the same workspace as `input.existing.workspaceId`; taking it from the
-      // grant means the workspace can never drift from the `accountId` that
-      // `personalConnectionDelegationSourceForGrant` reads off the same grant.
+      accountId: input.grant.accountId,
       workspaceId: input.grant.workspaceId,
-      settings: runtimeSettings,
-      tools: [...nextAgentConfig.tools, { kind: "mcp", id: "opengeni" }],
-      resources: nextAgentConfig.resources,
-      source: personalConnectionDelegationSourceForGrant(input.grant),
-      authoritySelections: input.payload.connectionAuthorities,
-      rejectUnselectedActivatedConnections: true,
-      ...scheduledConnectionSurfaceEligibility(runtimeSettings, nextTarget),
+      settings: nextTarget
+        ? settingsWithSessionMcpServerMetadata(runtimeSettings, nextTarget.mcpServers)
+        : runtimeSettings,
+      tools: nextConnectionTools,
+      resources: nextConnectionResources,
+      source: ownerSubjectId
+        ? { kind: "subject", subjectId: ownerSubjectId, accountId: input.existing.accountId }
+        : { kind: "none" },
+      authoritySelections: input.payload.pinnedAccounts ?? [],
+      ...nextSurfaceEligibility,
     });
+    update.agentConfig = withScheduledTaskPins(
+      nextAgentConfig,
+      keptPins,
+      nextAgentConfig.pinnedAccountsRequired === true,
+    );
   }
   if (
     !materialExecutionChange &&
-    input.payload.connectionAuthorities === undefined &&
+    !pinsProvided &&
     update.clonePersonalResourceAuthorityFromRevision === undefined
   ) {
     // Administrative lifecycle/name edits preserve the exact revision-bound
@@ -1169,6 +2036,7 @@ export async function validatedScheduledTaskUpdate(input: {
       authorizationSurface: input.authorizationSurface,
       grant: input.grant,
       targetSessionId: existingTarget,
+      departingTarget: true,
       runMode: "existing_session",
       variableSetId: input.existing.variableSetId,
       rigId: input.existing.rigId,
@@ -1189,13 +2057,24 @@ export async function validatedScheduledTaskUpdate(input: {
     rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,
     agentConfig: update.agentConfig ?? input.existing.agentConfig,
   });
-  if (!knowledgeSource) {
+  if (
+    !knowledgeSource &&
+    !(
+      materializedReusable &&
+      isDeepStrictEqual(nextAgentConfig.machineTarget, input.existing.agentConfig.machineTarget) &&
+      nextAgentConfig.sandboxBackend === input.existing.agentConfig.sandboxBackend
+    )
+  ) {
     await validateScheduledTaskMachineTarget({
       settings: input.settings,
       db: input.db,
       grant: input.grant,
       runMode: nextRunMode,
       agentConfig: update.agentConfig ?? input.existing.agentConfig,
+      audience:
+        (input.payload.visibility ?? input.existing.visibility) === "private"
+          ? "user_private"
+          : "workspace_shared",
     });
   }
   if (
@@ -1209,28 +2088,9 @@ export async function validatedScheduledTaskUpdate(input: {
   Object.assign(update, scheduledTaskAuthorityUpdateForGrant(input.grant));
   const linkCapture = prepareExternalLinkTaskAdmission(
     input.authorization,
-    creationInitiatorForGrant(input.grant).actor,
+    scheduledTaskInitiatorForGrant(input.grant).actor,
   );
   if (linkCapture) update.captureLinkAuthority = linkCapture;
-  if (input.payload.selectedHostMcpDelegations !== undefined) {
-    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
-      input.db,
-      input.grant.workspaceId,
-      input.settings,
-      { subjectId: input.grant.subjectId },
-    );
-    const target =
-      nextRunMode === "existing_session" && nextTargetSessionId
-        ? await getSession(input.db, input.grant.workspaceId, nextTargetSessionId)
-        : null;
-    update.captureHostAuthority = prepareHostMcpTaskAdmission({
-      settings: runtimeSettings,
-      tools: target?.tools ?? nextAgentConfig.tools,
-      grant: input.grant,
-      ...(input.authorization ? { authorization: input.authorization } : {}),
-      selections: input.payload.selectedHostMcpDelegations,
-    });
-  }
   if (update.clonePersonalResourceAuthorityFromRevision !== undefined) {
     update.refreshPersonalResourceAuthority = false;
   }
@@ -1251,7 +2111,6 @@ export async function requireScheduledTaskForApi(
 
 export type ScheduledTaskRestoreState = {
   task: ScheduledTask;
-  personalConnectionDelegations: McpPersonalConnectionDelegation[];
   learning?: {
     context: KnowledgeContext;
     scope: "workspace" | "personal";
@@ -1261,17 +2120,10 @@ export type ScheduledTaskRestoreState = {
 };
 
 export async function captureScheduledTaskRestoreState(
-  db: Database,
+  _db: Database,
   task: ScheduledTask,
 ): Promise<ScheduledTaskRestoreState> {
-  return {
-    task,
-    personalConnectionDelegations: await getScheduledTaskPersonalConnectionDelegations(
-      db,
-      task.workspaceId,
-      task.id,
-    ),
-  };
+  return { task };
 }
 
 export async function restoreScheduledTask(
@@ -1287,7 +2139,6 @@ export async function restoreScheduledTask(
     overlapPolicy: task.overlapPolicy,
     action: task.action,
     agentConfig: task.agentConfig,
-    personalConnectionDelegations: previous.personalConnectionDelegations,
     ...(task.runMode === "existing_session"
       ? { targetSessionId: task.targetSessionId }
       : { reusableSessionId: task.reusableSessionId }),
@@ -1303,6 +2154,8 @@ async function validateKnowledgeSourceSyncAction(input: {
   grant: AccessGrant;
   action: KnowledgeSourceSyncAction;
 }): Promise<void> {
+  if (isRetiredNativeAtlassianSource(input.action))
+    throw new HTTPException(410, { message: ATLASSIAN_NATIVE_RETIRED_MESSAGE });
   if (input.action.initiatingSubjectId !== input.grant.subjectId) {
     throw new HTTPException(403, {
       message: "knowledge source sync must preserve the exact initiating subject",
@@ -1377,6 +2230,7 @@ export async function deleteScheduledTaskLifecycle(input: {
   workspaceId: string;
   taskId: string;
   subjectId: string;
+  beforeDeleteCommit?: (tx: Database) => Promise<void>;
   preflightConnectorAuthorization: (task: ScheduledTask) => Promise<void>;
   cleanupConnectorAuthorization: (db: Database, task: ScheduledTask) => Promise<void>;
   processCleanupClaims?: (claims: readonly TemporalScheduleCleanupClaim[]) => Promise<void>;
@@ -1396,6 +2250,7 @@ export async function deleteScheduledTaskLifecycle(input: {
         input.taskId,
       );
       if (!task) throw new HTTPException(404, { message: "Scheduled task not found" });
+      await input.beforeDeleteCommit?.(tx);
       const wasLive = task.deletedAt === null;
       if (
         scheduledTaskKnowledgeSource(task) &&
@@ -1437,21 +2292,49 @@ export async function syncCreatedScheduledTask(input: {
   task: ScheduledTask;
 }): Promise<void> {
   try {
-    await input.workflowClient.syncScheduledTask({ task: input.task });
+    await input.workflowClient.syncScheduledTask({
+      task: input.task,
+      onFailure: async (db, error) => {
+        let persistenceRestored = true;
+        try {
+          // The synchronizer keeps its lock through compensation and commit.
+          // A savepoint also rolls back a failed compensation independently.
+          await db.transaction(async (tx) => {
+            await requireUnchangedScheduledTaskForCompensation(tx, input.task);
+            await deleteScheduledTask(tx, input.task.workspaceId, input.task.id);
+          });
+        } catch {
+          persistenceRestored = false;
+        }
+        return new ScheduledTaskSyncError(error, persistenceRestored);
+      },
+    });
   } catch (error) {
-    let persistenceRestored = true;
-    try {
-      // Creation rollback removes only the failed schedule. Connector desired
-      // state remains authoritative so a later connector save can rematerialize
-      // it; this is intentionally not the user-requested deletion lifecycle.
-      await deleteScheduledTask(input.db, input.task.workspaceId, input.task.id);
-    } catch {
-      persistenceRestored = false;
-    }
-    throw new ScheduledTaskSyncError(error, persistenceRestored);
+    if (error instanceof ScheduledTaskSyncError) throw error;
+    // Lock admission or transaction commit failed. No committed restoration
+    // was acknowledged; never compensate outside the synchronizer's lock.
+    throw new ScheduledTaskSyncError(error, false);
   }
 }
 
+async function requireUnchangedScheduledTaskForCompensation(
+  db: Database,
+  expected: ScheduledTask,
+): Promise<void> {
+  const current = await getScheduledTaskIncludingDeletedForUpdate(
+    db,
+    expected.workspaceId,
+    expected.id,
+  );
+  if (!current) throw new ScheduledTaskHeadChangedError();
+  const { deletedAt, ...task } = current;
+  // The execution digest excludes names and lifecycle state. Compare the full
+  // saved row under its write lock so a late sync failure cannot undo a newer
+  // edit, pause, materialization or authority revision.
+  if (deletedAt !== null || !isDeepStrictEqual(task, expected))
+    throw new ScheduledTaskHeadChangedError();
+}
+
 export async function syncUpdatedScheduledTask(input: {
   db: Database;
   workflowClient: SessionWorkflowClient;
@@ -1459,33 +2342,42 @@ export async function syncUpdatedScheduledTask(input: {
   task: ScheduledTask;
 }): Promise<void> {
   try {
-    await input.workflowClient.syncScheduledTask({ task: input.task });
-  } catch (error) {
-    let persistenceRestored = true;
-    try {
-      await input.db.transaction(async (tx) => {
-        const learning = input.previous.learning;
-        // Compensate only our exact settings version, while the updated task
-        // still names that owner scope. A concurrent edit is never overwritten.
-        if (learning)
-          await saveAgentLearningSettings(tx, learning.context, {
-            scope: learning.scope,
-            source: { kind: "scheduled_task", id: input.task.id },
-            operationId: crypto.randomUUID(),
-            expectedVersion: learning.expectedVersion,
-            settings: {
-              knowledge: "inherit",
-              instructions: "inherit",
-              skills: "inherit",
-              ...learning.settings,
-            },
+    await input.workflowClient.syncScheduledTask({
+      task: input.task,
+      onFailure: async (db, error) => {
+        let persistenceRestored = true;
+        try {
+          await db.transaction(async (tx) => {
+            const learning = input.previous.learning;
+            // Compensate only our exact settings version, while the updated task
+            // still names that owner scope. A concurrent edit is never overwritten.
+            if (learning)
+              await saveAgentLearningSettings(tx, learning.context, {
+                scope: learning.scope,
+                source: { kind: "scheduled_task", id: input.task.id },
+                operationId: crypto.randomUUID(),
+                expectedVersion: learning.expectedVersion,
+                settings: {
+                  knowledge: "inherit",
+                  instructions: "inherit",
+                  skills: "inherit",
+                  ...learning.settings,
+                },
+              });
+            // Keep the learning-owner → task lock order used by ordinary edits.
+            // Any learning compensation above rolls back with a stale task head.
+            await requireUnchangedScheduledTaskForCompensation(tx, input.task);
+            await restoreScheduledTask(tx, input.previous);
           });
-        await restoreScheduledTask(tx, input.previous);
-      });
-    } catch {
-      persistenceRestored = false;
-    }
-    throw new ScheduledTaskSyncError(error, persistenceRestored);
+        } catch {
+          persistenceRestored = false;
+        }
+        return new ScheduledTaskSyncError(error, persistenceRestored);
+      },
+    });
+  } catch (error) {
+    if (error instanceof ScheduledTaskSyncError) throw error;
+    throw new ScheduledTaskSyncError(error, false);
   }
 }
 
@@ -1551,20 +2443,46 @@ async function validateScheduledTaskAgentConfig(input: {
   };
   workspaceId: string;
   toolsProvided?: boolean;
+  /** Only an already materialized reusable chat may retain unused creation defaults. */
+  retainedCreationConfig?: ScheduledTaskAgentConfig;
+  /**
+   * The connector policy the schedule already follows. An edit that does not
+   * name a policy keeps it, so replacing the configuration (for example with
+   * the tools a read returned) never turns the defaults into a fixed list.
+   */
+  existingToolPolicy?: ScheduledTaskAgentConfig["toolPolicy"];
 }): Promise<ScheduledTaskAgentConfig> {
-  const actor = creationInitiatorForGrant(input.grant).actor;
-  const parent = actor ? await getSession(input.db, input.workspaceId, actor.sessionId) : null;
-  if (actor && (!parent || parent.accountId !== input.grant.accountId)) {
+  const existingChat = input.payload.runMode === "existing_session";
+  if (existingChat)
+    input = {
+      ...input,
+      payload: {
+        ...input.payload,
+        agentConfig: scheduledSessionMessageConfig(input.payload.agentConfig),
+      },
+      toolsProvided: true,
+    };
+  const unchangedCreationField = (key: keyof ScheduledTaskAgentConfig) =>
+    input.retainedCreationConfig !== undefined &&
+    isDeepStrictEqual(input.payload.agentConfig[key], input.retainedCreationConfig[key]);
+  const actor = scheduledTaskInitiatorForGrant(input.grant).actor;
+  const parent =
+    actor && !existingChat ? await getSession(input.db, input.workspaceId, actor.sessionId) : null;
+  if (!existingChat && actor && (!parent || parent.accountId !== input.grant.accountId)) {
     throw new HTTPException(403, {
       message: "Scheduled Skill selection requires the creating agent's session",
     });
   }
   let bundledSkillIds: ScheduledTaskAgentConfig["bundledSkillIds"];
   try {
-    bundledSkillIds = resolveBundledSkillSelection(
-      input.payload.agentConfig.bundledSkillIds,
-      parent?.bundledSkillIds,
-    );
+    bundledSkillIds = existingChat
+      ? undefined
+      : unchangedCreationField("bundledSkillIds")
+        ? input.payload.agentConfig.bundledSkillIds
+        : resolveBundledSkillSelection(
+            input.payload.agentConfig.bundledSkillIds,
+            parent?.bundledSkillIds,
+          );
   } catch (error) {
     throw new HTTPException(422, {
       message: error instanceof Error ? error.message : "Invalid bundled Skill selection",
@@ -1575,10 +2493,13 @@ async function validateScheduledTaskAgentConfig(input: {
   // session choke points (a `scheduled_tasks:manage` holder could otherwise set
   // a model the host does not expose). An omitted model inherits the host
   // default downstream, which is always configured.
-  const model = canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);
+  const model = unchangedCreationField("model")
+    ? input.payload.agentConfig.model
+    : canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);
   // Same policy vetting as the session choke points; an omitted model flows
   // through session creation later, where the effective default is vetted.
-  await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);
+  if (!unchangedCreationField("model"))
+    await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);
   const resources = normalizeResources(input.payload.agentConfig.resources ?? []);
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     input.db,
@@ -1586,7 +2507,10 @@ async function validateScheduledTaskAgentConfig(input: {
     input.settings,
     { subjectId: input.grant.subjectId },
   );
-  const requestedTools = validateToolRefs(input.payload.agentConfig.tools ?? [], runtimeSettings);
+  const retainTools = unchangedCreationField("tools");
+  const requestedTools = retainTools
+    ? input.payload.agentConfig.tools
+    : validateToolRefs(input.payload.agentConfig.tools ?? [], runtimeSettings);
   const workspace = await requireWorkspace(input.db, input.workspaceId);
   if (
     parent?.tenancy?.visibility === "private" &&
@@ -1600,21 +2524,24 @@ async function validateScheduledTaskAgentConfig(input: {
     });
   }
   const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
-  // A task whose creator did not choose tools gets the workspace's exact
-  // session defaults (or the deployment compatibility default), exactly like
-  // a session created without a tools key. Scheduled runs are sessions too;
-  // "no MCP servers at all" was a trap every pack/template instantiation path
-  // kept falling into (a maintenance task that cannot reach its workspace's
-  // notebook MCP cannot do its job).
-  const tools =
-    (input.toolsProvided ?? true)
-      ? requestedTools
-      : withWorkspaceDefaultMcpTools(
-          requestedTools,
-          input.settings,
-          runtimeSettings,
-          workspaceSessionToolDefaults,
-        );
+  // A schedule that starts its own session and whose creator did not choose
+  // tools follows the workspace's default connectors at each run, exactly
+  // like a new chat: nothing about the defaults is copied into the schedule,
+  // so a connector the workspace adds later reaches its next run. A request
+  // may also say so explicitly (`toolPolicy`), with the defaults a person
+  // turned off; its `tools` are then added on top. An edit keeps the policy
+  // the schedule already follows. Only a new schedule created with a list of
+  // tools and no policy gets exactly that list.
+  // A knowledge sync reads one source and never follows the defaults.
+  const toolPolicy =
+    existingChat || input.payload.agentConfig.knowledgeSource
+      ? undefined
+      : (input.payload.agentConfig.toolPolicy ??
+        input.existingToolPolicy ??
+        (retainTools || (input.toolsProvided ?? true)
+          ? undefined
+          : { mode: "workspace_default" as const, excludedMcpServerIds: [] }));
+  const tools = requestedTools;
   const prompt = input.payload.agentConfig.prompt.trim();
   if (!prompt) {
     throw new HTTPException(422, { message: "scheduled task prompt is required" });
@@ -1675,7 +2602,7 @@ async function validateScheduledTaskAgentConfig(input: {
     );
   }
   const requestedMaxDepth = input.payload.agentConfig.maxNestedAgentDepth;
-  if (requestedMaxDepth !== undefined) {
+  if (requestedMaxDepth !== undefined && !unchangedCreationField("maxNestedAgentDepth")) {
     const workspaceMaxDepth = workspace.settings.maxNestedAgentDepth;
     const deploymentPolicy = await getNestedAgentDepthDeploymentPolicy(input.db);
     const inheritedMaxDepth =
@@ -1691,16 +2618,28 @@ async function validateScheduledTaskAgentConfig(input: {
       });
     }
   }
+  const { toolPolicy: _requestedToolPolicy, ...requestedConfig } = input.payload.agentConfig;
   const validated = {
-    ...input.payload.agentConfig,
+    ...requestedConfig,
     ...(bundledSkillIds !== undefined ? { bundledSkillIds } : {}),
     ...(model === undefined || model === null ? {} : { model }),
     prompt,
     resources,
     tools,
+    ...(toolPolicy ? { toolPolicy } : {}),
   };
-  validateIncidentTelemetryPreflightSelection(input.settings, validated);
-  return validated;
+  // Incident preflight names the connectors it needs; judge it on what a run
+  // would get now, including the defaults the schedule follows.
+  validateIncidentTelemetryPreflightSelection(input.settings, {
+    ...validated,
+    tools: scheduledTaskRunTools({
+      agentConfig: validated,
+      settings: input.settings,
+      runtimeSettings,
+      workspaceDefaults: workspaceSessionToolDefaults,
+    }),
+  });
+  return existingChat ? scheduledSessionMessageConfig(validated) : validated;
 }
 
 /**
@@ -1710,7 +2649,7 @@ async function validateScheduledTaskAgentConfig(input: {
  * Mutable rig/variable-set metadata is revalidated again at dispatch.
  */
 export function validateIncidentTelemetryPreflightSelection(
-  settings: Pick<Settings, "allowedFirstPartyMcpTools" | "defaultFirstPartyMcpTools">,
+  settings: FirstPartyMcpToolPolicySettings,
   agentConfig: ScheduledTaskAgentConfig,
 ): void {
   const executionClass = agentConfig.executionClass;
@@ -1732,7 +2671,7 @@ export function validateIncidentTelemetryPreflightSelection(
   }
 
   const selectedMcpServerIds = new Set(agentConfig.tools.map((tool) => tool.id));
-  // Scheduled dispatch always attaches the first-party OpenGeni MCP server.
+  // Scheduled dispatch always attaches the first-party Opengeni MCP server.
   selectedMcpServerIds.add("opengeni");
   if (preflight.requiredMcpServerIds.some((id) => !selectedMcpServerIds.has(id))) {
     throw new HTTPException(422, {