@opengeni/worker-bundle 2.2.1-canary.36927100590001 → 2.2.1

package/dist/workflows/scheduled-tasks.d.ts

@@ -1,5 +1,4 @@
 import type { TurnInitiator } from "@opengeni/contracts";
-import type { DispatchScheduledTaskRunInput } from "../activities/types.js";
 type ScheduledTaskFireWorkflowBase = {
     accountId: string;
     workspaceId: string;
@@ -9,13 +8,10 @@ export type ScheduledTaskFireWorkflowInput = ScheduledTaskFireWorkflowBase & ({
     triggerType: "scheduled";
     agentRunUsageIdempotencyKey?: never;
     initiator?: never;
-    credentialRestriction?: never;
 } | {
     triggerType: "manual" | "initial" | "provider_event" | "retry" | "repair";
     agentRunUsageIdempotencyKey: string;
     initiator: TurnInitiator;
-    credentialRestriction?: "developer_setup";
 });
-export declare function scheduledTaskDispatchInput(input: ScheduledTaskFireWorkflowInput, producerKey: string): DispatchScheduledTaskRunInput;
 export declare function scheduledTaskFireWorkflow(input: ScheduledTaskFireWorkflowInput): Promise<void>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "2.2.1-canary.36927100590001",
+  "version": "2.2.1",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,26 +54,26 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "^0.6.1-canary.36927100590001",
-    "@opengeni/capabilities": "^0.3.5-canary.36927100590001",
-    "@opengeni/codemode": "^0.6.6-canary.36927100590001",
-    "@opengeni/codex": "^0.2.30-canary.36927100590001",
-    "@opengeni/config": "^3.2.0-canary.36927100590001",
-    "@opengeni/contracts": "^5.5.0-canary.36927100590001",
-    "@opengeni/core": "^5.0.1-canary.36927100590001",
-    "@opengeni/db": "^6.3.0-canary.36927100590001",
-    "@opengeni/documents": "^0.8.38-canary.36927100590001",
-    "@opengeni/events": "^0.4.36-canary.36927100590001",
-    "@opengeni/github": "^0.8.1-canary.36927100590001",
-    "@opengeni/interaction": "^0.4.44-canary.36927100590001",
-    "@opengeni/jev": "^0.2.1-canary.36927100590001",
-    "@opengeni/network": "^0.3.1-canary.36927100590001",
-    "@opengeni/observability": "^0.8.36-canary.36927100590001",
-    "@opengeni/runtime": "^4.4.0-canary.36927100590001",
-    "@opengeni/sdk": "^7.5.0-canary.36927100590001",
-    "@opengeni/storage": "^0.2.137-canary.36927100590001",
-    "@opengeni/tool-gateway": "^0.1.17-canary.36927100590001",
-    "@opengeni/xai-subscription": "^0.1.5-canary.36927100590001",
+    "@opengeni/agent-proto": "^0.6.1",
+    "@opengeni/capabilities": "^0.3.5",
+    "@opengeni/codemode": "^0.6.6",
+    "@opengeni/codex": "^0.2.30",
+    "@opengeni/config": "^3.2.0",
+    "@opengeni/contracts": "^5.5.0",
+    "@opengeni/core": "^5.0.1",
+    "@opengeni/db": "^6.3.0",
+    "@opengeni/documents": "^0.8.38",
+    "@opengeni/events": "^0.4.36",
+    "@opengeni/github": "^0.8.1",
+    "@opengeni/interaction": "^0.4.44",
+    "@opengeni/jev": "^0.2.1",
+    "@opengeni/network": "^0.3.1",
+    "@opengeni/observability": "^0.8.36",
+    "@opengeni/runtime": "^4.4.0",
+    "@opengeni/sdk": "^7.5.0",
+    "@opengeni/storage": "^0.2.137",
+    "@opengeni/tool-gateway": "^0.1.17",
+    "@opengeni/xai-subscription": "^0.1.5",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/claim.ts

@@ -56,7 +56,6 @@ import {
 import { createTurnCredentialLeases } from "./credential-leases";
 import { createTurnMediaArtifacts } from "./media-artifacts";
 import { readTurnExecutionPolicyV1 } from "@opengeni/contracts";
-import { turnCredentialRestriction } from "./credential-restriction";
 
 import {
   credentialSubjectIdForTurnInitiator,
@@ -291,21 +290,10 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
   const codexAppsCredentialId = capabilitySettings.codexConnectedAppsEnabled
     ? await resolveCodexAppsCredentialIdForRun(db, input.workspaceId)
     : null;
-  const candidatePolicy =
+  const policyForAbsent =
     claimedPolicy.kind === "valid"
       ? claimedPolicy.policy
       : resolveTurnExecutionPolicyV1(capabilitySettings, legacyTurnExecutionPolicyInput(turn));
-  // This context is frozen by the accepted-turn writer from the exact source
-  // turn. Its reserved restriction field cannot come from public service JSON.
-  const credentialRestriction =
-    claimedPolicy.kind === "absent"
-      ? turn.initiatorContext?.credentialRestriction === "developer_setup"
-        ? "developer_setup"
-        : turnCredentialRestriction(candidatePolicy, session.metadata)
-      : undefined;
-  const policyForAbsent = credentialRestriction
-    ? { ...candidatePolicy, credentialRestriction }
-    : candidatePolicy;
   const installedPolicy = await installOrReadTurnExecutionPolicyForAttempt(db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,

package/src/activities/agent-turn/run-credentials.ts

@@ -65,7 +65,6 @@ import {
   sandboxSettingsForRoute,
 } from "./sandbox-route";
 import type { ClaimTurnOk } from "./claim";
-import { turnCredentialRestriction } from "./credential-restriction";
 import type { GovernanceModelOk } from "./governance-model";
 import type { SandboxTurnRuntime } from "./sandbox-runtime";
 import type {
@@ -92,7 +91,6 @@ export type PrepareRunCredentialsDeps = {
   sandboxRuntime: SandboxTurnRuntime;
   turn: ClaimTurnOk["turn"];
   session: ClaimTurnOk["session"];
-  turnExecutionPolicy: ClaimTurnOk["turnExecutionPolicy"];
   fileAuthoritySubjectId: ClaimTurnOk["fileAuthoritySubjectId"];
   runSettings: GovernanceModelOk["runSettings"];
   workspaceVariableSet: Awaited<ReturnType<typeof loadWorkspaceEnvironmentForRunWithCredentials>>;
@@ -131,7 +129,6 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     sandboxState,
     turn,
     session,
-    turnExecutionPolicy,
     fileAuthoritySubjectId,
     runSettings,
     workspaceVariableSet,
@@ -349,13 +346,11 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
           turn,
         })
       : undefined;
-  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const codemodeAuthority = {
     sessionId: input.sessionId,
     turnId: turn.id,
     attemptId: input.attemptId,
     executionGeneration: turn.executionGeneration,
-    ...(credentialRestriction ? { credentialRestriction } : {}),
   };
   const sandboxArtifactRuntime = sandboxArtifactRuntimeAdmission(
     settings,

package/src/activities/agent-turn/run.ts

@@ -1226,7 +1226,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             sandboxRuntime,
             turn,
             session,
-            turnExecutionPolicy,
             fileAuthoritySubjectId,
             runSettings,
             workspaceVariableSet,

package/src/activities/agent-turn/tool-environment.ts

@@ -127,7 +127,6 @@ import { codeSearchToolDefinitions, codeSearchWorkspaceFromChannel } from "./cod
 import { createWorkspaceSkillTools } from "./skill-tools";
 import { loadConfiguredBundledSkills } from "./skill-selection";
 import { guardSkillFilesystem } from "./skill-transfer";
-import { turnCredentialRestriction } from "./credential-restriction";
 
 export type PrepareTurnToolPolicyDeps = {
   input: RunAgentTurnInput;
@@ -423,7 +422,6 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   });
   const runSettings = accountRoutes.settings;
   const turnTools = accountRoutes.tools;
-  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const toolContextPreparationStartedAt = performance.now();
   throwIfWorkerShuttingDown();
   throwIfTurnCancelled();
@@ -1011,7 +1009,6 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       : []),
     ...createFirstPartyInteractionAttemptToolDefinitions({
       settings: runSettings,
-      ...(credentialRestriction ? { credentialRestriction } : {}),
       scope: {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -1107,7 +1104,6 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   try {
     eventing.preparedTools = await waitForTurnOperation(
       runtime.prepareTools(githubRestMcp.settings, githubRestMcp.tools, {
-        ...(credentialRestriction ? { credentialRestriction } : {}),
         mcpAccountLabels: accountRoutes.accountLabels,
         accountId: input.accountId,
         workspaceId: input.workspaceId,

package/src/activities/automations.ts

@@ -13,7 +13,6 @@ import {
   recordWorkspaceUsage,
   resolveCatalogSettings,
   resolveWorkspaceCatalogSettings,
-  isDeveloperSetupDelegatedPermissionAllowed,
 } from "@opengeni/core";
 import {
   AutomationAuthorityRevokedError,
@@ -108,20 +107,6 @@ export function createAutomationActivities(
         }
 
         const template = accepted.sessionTemplate;
-        if (
-          template.credentialRestriction === "developer_setup" &&
-          template.firstPartyMcpPermissions.some(
-            (permission) => !isDeveloperSetupDelegatedPermissionAllowed(permission),
-          )
-        ) {
-          await settle(service.db, {
-            workspaceId: input.workspaceId,
-            runId: run.id,
-            status: "failed",
-            errorCode: "credential_restriction_violation",
-          });
-          return { action: "failed", reason: "credential_restriction_violation" };
-        }
         const requestedModel = template.model ?? deploymentCatalogSettings.openaiModel;
         const catalogSettings =
           requestedModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||
@@ -224,7 +209,7 @@ export function createAutomationActivities(
           });
           return { action: "failed", reason: "dispatch_failed" };
         }
-        const resolvedTurnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {
+        const turnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {
           modelId: model,
           requestedModelId: template.model,
           modelSource: template.model ? "explicit" : "deployment",
@@ -233,12 +218,6 @@ export function createAutomationActivities(
           latencyMode: "standard",
           latencyModeSource: "deployment",
         });
-        const turnExecutionPolicy = template.credentialRestriction
-          ? {
-              ...resolvedTurnExecutionPolicy,
-              credentialRestriction: template.credentialRestriction,
-            }
-          : resolvedTurnExecutionPolicy;
         const created = await createSession({
           db: service.db,
           bus: service.bus,
@@ -262,7 +241,6 @@ export function createAutomationActivities(
           workspaceId: input.workspaceId,
           initialMessage: accepted.initialMessage,
           surface: "automation",
-          metrics: service.observability,
           resources: template.resources,
           skills: SessionSkills.parse(template.skills),
           bundledSkillIds: template.bundledSkillIds,

package/src/activities/goals.ts

@@ -14,7 +14,6 @@ import {
 import {
   evaluateWorkspaceModelPolicy,
   mergeToolRefs,
-  readTurnExecutionPolicyV1,
   type SessionGoal,
   type ToolRef,
 } from "@opengeni/contracts";
@@ -23,7 +22,6 @@ import {
   enqueueSessionWorkflowWakeIfRunnable,
   getWorkspaceModelPolicy,
   getSessionGoal,
-  getSessionTurn,
   materializeGoalContinuation,
   requireSession,
 } from "@opengeni/db";
@@ -38,7 +36,6 @@ import {
   resolveWorkspaceCatalogSettings,
 } from "@opengeni/core";
 import { agentRunAdmissionDenial } from "./agent-run-admission";
-import { turnCredentialRestriction } from "./agent-turn/credential-restriction";
 
 export function createGoalActivities(services: () => Promise<ControlActivityServices>) {
   async function enqueueGoalRetryWake(input: MaybeContinueGoalInput): Promise<void> {
@@ -127,16 +124,6 @@ export function createGoalActivities(services: () => Promise<ControlActivityServ
           latencyMode: continuationLatencyMode,
           latencyModeSource: "continuation",
         });
-    const continuationPolicy: NonNullable<
-      Parameters<typeof materializeGoalContinuation>[1]["policy"]
-    > = {
-      model: continuationModel,
-      reasoningEffort: continuationReasoningEffort,
-      latencyMode: continuationLatencyMode,
-      ...(turnExecutionPolicy ? { turnExecutionPolicy } : {}),
-      tools: withFirstPartyTools(settings, session.tools),
-      sandboxBackend: session.sandboxBackend,
-    };
     const decision = await materializeGoalContinuation(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
@@ -153,25 +140,6 @@ export function createGoalActivities(services: () => Promise<ControlActivityServ
       // pause can clear on its own; a policy pause needs a model/policy change)
       // and rides the same visible-pause channel.
       admission: async (tx, causalTurn) => {
-        // The materializer selects this exact causal row under its session/goal
-        // locks and freezes policy only after admission returns. Never infer
-        // credential authority from the generated continuation's payload.
-        const sourceTurn = causalTurn
-          ? await getSessionTurn(tx, input.workspaceId, causalTurn.id)
-          : null;
-        if (causalTurn && (!sourceTurn || sourceTurn.sessionId !== input.sessionId)) {
-          throw new Error("Goal continuation source turn is unavailable");
-        }
-        const sourcePolicy = readTurnExecutionPolicyV1(sourceTurn?.metadata);
-        if (turnExecutionPolicy) {
-          const credentialRestriction = turnCredentialRestriction(
-            sourcePolicy.kind === "valid" ? sourcePolicy.policy : turnExecutionPolicy,
-            session.metadata,
-          );
-          continuationPolicy.turnExecutionPolicy = credentialRestriction
-            ? { ...turnExecutionPolicy, credentialRestriction }
-            : turnExecutionPolicy;
-        }
         const budgetBlocked = modelPolicyBlocked
           ? null
           : await goalRunBudgetBlocked(
@@ -190,7 +158,14 @@ export function createGoalActivities(services: () => Promise<ControlActivityServ
             : (budgetBlocked?.pausedReason ?? "limits"),
         };
       },
-      policy: continuationPolicy,
+      policy: {
+        model: continuationModel,
+        reasoningEffort: continuationReasoningEffort,
+        latencyMode: continuationLatencyMode,
+        ...(turnExecutionPolicy ? { turnExecutionPolicy } : {}),
+        tools: withFirstPartyTools(settings, session.tools),
+        sandboxBackend: session.sandboxBackend,
+      },
       // Long-wait guidance is only given when `wait_for_input` is actually in this
       // session's effective first-party selection (the same source the worker
       // signs into the delegated token and the API uses to register tools), so

package/src/activities/sandbox-lease.ts

@@ -41,8 +41,6 @@ import {
   deferRetainedProcessReconciliation,
   forceDrainOverLimitViewerOnlyBoxes,
   listCreditBalancesByAccount,
-  countActiveUsers,
-  readCreditGrantTotals,
   readVerifiedSignupTrialSwitch,
   listLegacyModalCheckpointSlots,
   listLiveModalSandboxLeaseAttributions,
@@ -152,9 +150,7 @@ import { assertSandboxDrainInputTiming, sandboxDrainTiming } from "../sandbox-re
 import type { ControlActivityServices as ActivityServices } from "./types";
 import { reconcilePendingParentSystemUpdates } from "./parent-wake";
 import {
-  recordActiveUserGauges,
   recordCreditBalanceGauges,
-  recordCreditGrantGauges,
   recordCreditMicros,
   recordExpiredDrainingSandboxLeaseGauges,
   recordOpenSandboxKubernetesInventoryGauges,
@@ -2529,24 +2525,6 @@ async function refreshQueueLeaseAndCreditGauges(
         });
       }
     })(),
-    (async () => {
-      try {
-        recordActiveUserGauges(observability, await countActiveUsers(db));
-      } catch (error) {
-        observability.warn("sandbox reaper: active-user gauge refresh failed", {
-          error: error instanceof Error ? error.message : String(error),
-        });
-      }
-    })(),
-    (async () => {
-      try {
-        recordCreditGrantGauges(observability, await readCreditGrantTotals(db));
-      } catch (error) {
-        observability.warn("sandbox reaper: credit-grant gauge refresh failed", {
-          error: error instanceof Error ? error.message : String(error),
-        });
-      }
-    })(),
     (async () => {
       recordVerifiedSignupTrialDeploymentFlagGauge(
         observability,

package/src/activities/scheduled-tasks.ts

@@ -10,7 +10,6 @@ import {
   SessionAgentAccess,
   SessionMemoryScope,
   normalizeAutomaticSessionTitle,
-  metadataWithTurnExecutionPolicyV1,
   scheduledOccurrencePayloadUtf8Bytes,
   stableJson,
   TurnExecutionPolicyV1,
@@ -39,9 +38,6 @@ import {
   agentConfigMayResolve,
   applySessionAgentConfigWriteThrough,
   resolveSessionAgentConfigForCreate,
-  recordSessionCreated,
-  recordUserMessageAccepted,
-  type ProductUsageMetricsSink,
 } from "@opengeni/core";
 import {
   appendSessionEvents,
@@ -130,30 +126,6 @@ type ScheduledTemporalActivityIdentity = {
   activityId: string;
 };
 
-export function scheduledTaskRunExecutionPolicy(
-  policy: TurnExecutionPolicyV1,
-  input: DispatchScheduledTaskRunInput,
-  creatorRestriction?: "developer_setup",
-): TurnExecutionPolicyV1 {
-  return creatorRestriction === "developer_setup" ||
-    (input.triggerType !== "scheduled" && input.credentialRestriction === "developer_setup")
-    ? { ...policy, credentialRestriction: "developer_setup" }
-    : policy;
-}
-
-/** Only a creator ceiling is standing; a manual caller ceiling is per-run. */
-export function scheduledSessionExecutionPolicyMetadata(
-  policy: unknown,
-  creatorRestriction?: "developer_setup",
-): Record<string, unknown> {
-  if (policy === undefined || policy === null) return {};
-  const acceptedPolicy = TurnExecutionPolicyV1.parse(policy);
-  return creatorRestriction === "developer_setup" &&
-    acceptedPolicy.credentialRestriction === "developer_setup"
-    ? metadataWithTurnExecutionPolicyV1({}, acceptedPolicy)
-    : {};
-}
-
 export function scheduledTaskRunProducerKey(
   input: DispatchScheduledTaskRunInput,
   suppliedActivityIdentity?: ScheduledTemporalActivityIdentity,
@@ -223,15 +195,6 @@ export function scheduledTaskGeneratedSessionCreateIdempotencyKey(producerKey: s
  * alone, with no Intl call and so no host ICU or tzdata build to make the two
  * texts differ.
  */
-/** A scheduler-generated run session: a service-created root session. */
-function recordScheduledSessionCreated(observability: ProductUsageMetricsSink | undefined): void {
-  recordSessionCreated(observability, {
-    surface: "scheduled",
-    createdByKind: "service",
-    parentSessionId: null,
-  });
-}
-
 export function scheduledTaskSessionTitle(taskName: string): string {
   return normalizeAutomaticSessionTitle(taskName) ?? "Scheduled run";
 }
@@ -371,7 +334,6 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           try {
             return await recoverBoundScheduledTaskDispatch({
               db,
-              observability: baseService.observability,
               bus,
               settings,
               wakeSessionWorkflow,
@@ -1032,28 +994,23 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
             }
           }
         : undefined;
-      const turnExecutionPolicy = scheduledTaskRunExecutionPolicy(
-        resolveTurnExecutionPolicyV1(settings, {
-          modelId: acceptedModel,
-          requestedModelId:
-            generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,
-          modelSource: generatedTarget
-            ? task.agentConfig.model
-              ? "explicit"
-              : "deployment"
-            : "session",
-          reasoningEffort: acceptedReasoningEffort,
-          reasoningSource: generatedTarget
-            ? task.agentConfig.reasoningEffort
-              ? "explicit"
-              : "deployment"
-            : "session",
-          latencyMode: acceptedLatencyMode,
-          latencyModeSource: generatedTarget ? "deployment" : "session",
-        }),
-        input,
-        creatorPolicy?.credentialRestriction,
-      );
+      const turnExecutionPolicy: TurnExecutionPolicyV1 = resolveTurnExecutionPolicyV1(settings, {
+        modelId: acceptedModel,
+        requestedModelId: generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,
+        modelSource: generatedTarget
+          ? task.agentConfig.model
+            ? "explicit"
+            : "deployment"
+          : "session",
+        reasoningEffort: acceptedReasoningEffort,
+        reasoningSource: generatedTarget
+          ? task.agentConfig.reasoningEffort
+            ? "explicit"
+            : "deployment"
+          : "session",
+        latencyMode: acceptedLatencyMode,
+        latencyModeSource: generatedTarget ? "deployment" : "session",
+      });
       const deferredEvents: Array<{
         sessionId: string;
         events: Awaited<ReturnType<typeof appendSessionEvents>>;
@@ -1312,10 +1269,6 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                   : {}),
                 metadata: {
                   ...taskMetadata,
-                  ...scheduledSessionExecutionPolicyMetadata(
-                    turnExecutionPolicy,
-                    creatorPolicy?.credentialRestriction,
-                  ),
                   model,
                   reasoningEffort,
                   scheduledTaskId: task.id,
@@ -1411,7 +1364,6 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
               }
               session = created.session;
               sessionCreated = created.created;
-              if (sessionCreated) recordScheduledSessionCreated(baseService.observability);
               if (!sessionCreated) {
                 await bindScheduledTaskRunSessionInTransaction(dispatchDb, {
                   accountId: task.accountId,
@@ -1696,9 +1648,6 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 run: { ...run, status: "skipped" as const, error },
               };
             }
-            if (scheduledUpdate.added) {
-              recordUserMessageAccepted(baseService.observability, { surface: "scheduled" });
-            }
             if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {
               if (deferPublications) {
                 deferredEvents.push({
@@ -1842,9 +1791,6 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 run: { ...run, status: "skipped" as const, error },
               };
             }
-            if (bundled.added) {
-              recordUserMessageAccepted(baseService.observability, { surface: "scheduled" });
-            }
             if (bundled.added && bundled.events.length > 0) {
               if (deferPublications) {
                 deferredEvents.push({
@@ -2256,7 +2202,6 @@ async function seedScheduledGeneratedSessionRoute(input: {
 
 async function recoverBoundScheduledTaskDispatch(input: {
   db: Database;
-  observability?: ProductUsageMetricsSink | undefined;
   bus: ControlActivityServices["bus"];
   settings: ControlActivityServices["settings"];
   wakeSessionWorkflow: WakeSessionWorkflowSignal | null;
@@ -2271,11 +2216,6 @@ async function recoverBoundScheduledTaskDispatch(input: {
   const generatedSession =
     task.runMode === "new_session_per_run" ||
     (task.runMode === "reusable_session" && task.reusableSessionId === null);
-  // The immutable creator policy determines standing session authority, not
-  // a manual caller's per-run ceiling. Read it for creation and recovery checks.
-  const recoveredCreatorPolicy = generatedSession
-    ? await getScheduledTaskCreatorPolicy(input.db, task.workspaceId, task.id)
-    : null;
   const frozenSlack = input.acceptedExecution.resolvedSlackBotConnection;
   if (frozenSlack) {
     const currentSlack = await requireOpenGeniSlackBotConnection(
@@ -2344,6 +2284,14 @@ async function recoverBoundScheduledTaskDispatch(input: {
     }
     const taskMetadata = { ...task.agentConfig.metadata };
     delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
+    // Tools and permissions were frozen into the accepted execution. The
+    // creator session policy is immutable on the task row (a tombstoned task
+    // still answers), so re-reading it here is deterministic for the same run.
+    const recoveredCreatorPolicy = await getScheduledTaskCreatorPolicy(
+      input.db,
+      task.workspaceId,
+      task.id,
+    );
     const created = await createSessionWithIdempotencyKeyResult(input.db, {
       accountId: task.accountId,
       workspaceId: task.workspaceId,
@@ -2368,10 +2316,6 @@ async function recoverBoundScheduledTaskDispatch(input: {
         : {}),
       metadata: {
         ...taskMetadata,
-        ...scheduledSessionExecutionPolicyMetadata(
-          input.acceptedExecution.turnExecutionPolicy,
-          recoveredCreatorPolicy?.credentialRestriction,
-        ),
         model: input.acceptedExecution.resolvedModel,
         reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
         scheduledTaskId: task.id,
@@ -2430,7 +2374,6 @@ async function recoverBoundScheduledTaskDispatch(input: {
     });
     if (created.denied) throw new SessionSpawnDeniedDbError(created.denial);
     session = created.session;
-    if (created.created) recordScheduledSessionCreated(input.observability);
     if (!created.created) {
       await bindScheduledTaskRunSessionInTransaction(input.db, {
         accountId: task.accountId,
@@ -2504,10 +2447,6 @@ async function recoverBoundScheduledTaskDispatch(input: {
     const expectedMetadata = metadataWithAgentConfigCreateIdentity(
       {
         ...expectedTaskMetadata,
-        ...scheduledSessionExecutionPolicyMetadata(
-          input.acceptedExecution.turnExecutionPolicy,
-          recoveredCreatorPolicy?.credentialRestriction,
-        ),
         model: input.acceptedExecution.resolvedModel,
         reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
         scheduledTaskId: task.id,
@@ -2730,9 +2669,6 @@ async function recoverBoundScheduledTaskDispatch(input: {
   ) {
     return { action: "blocked", reason: "scheduled_run_terminal" };
   }
-  if (scheduledUpdate.added) {
-    recordUserMessageAccepted(input.observability, { surface: "scheduled" });
-  }
   if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {
     await publishDurableSessionEvents(
       input.bus,

package/src/activities/site-auth-maintenance.ts

@@ -176,7 +176,6 @@ async function dispatchMaintenanceSession(
     initialMessage: maintenancePrompt(maintenance),
     // OpenGeni's own periodic check: no human or product surface entered it.
     surface: "system",
-    metrics: service.observability,
     resources: [],
     tools: [{ kind: "mcp", id: "opengeni" }],
     toolPolicy: { mode: "explicit", inheritedFromSessionId: null },

package/src/activities/types.ts

@@ -436,7 +436,6 @@ export type DispatchScheduledTaskRunInput = {
       triggerType: Extract<ScheduledTaskTriggerType, "scheduled">;
       agentRunUsageIdempotencyKey?: never;
       initiator?: never;
-      credentialRestriction?: never;
     }
   | {
       triggerType: Extract<
@@ -446,8 +445,6 @@ export type DispatchScheduledTaskRunInput = {
       agentRunUsageIdempotencyKey: string;
       /** Exact identity used by the API-side charge for this same trigger. */
       initiator: TurnInitiator;
-      /** Trusted API-side caller ceiling for this occurrence, not the schedule. */
-      credentialRestriction?: "developer_setup";
     }
 );
 

package/src/activities/workspace-capture.ts

@@ -947,24 +947,13 @@ async function runCapture(
   }
 
   // ── 10. observe completion ────────────────────────────────────────────────
-  recordWorkspaceCaptureCompleted(observability, Date.now() - startedAt);
-}
-
-/** Count one committed logical capture and observe its end-to-end duration. */
-export function recordWorkspaceCaptureCompleted(
-  observability: Pick<Observability, "incrementCounter" | "observeHistogram">,
-  durationMs: number,
-): void {
+  const durationMs = Date.now() - startedAt;
   observability.incrementCounter({
     name: "opengeni_workspace_capture_total",
     labels: { result: "ok" },
   });
-  // Distinct from the physical `opengeni_workspace_capture_duration_seconds`
-  // {backend,outcome} histogram the runtime hook records in this same
-  // registry: one name cannot carry two label sets.
   observability.observeHistogram({
-    name: "opengeni_workspace_capture_revision_duration_seconds",
-    help: "Turn-end logical workspace revision capture duration for committed revisions.",
+    name: "opengeni_workspace_capture_duration_seconds",
     value: durationMs / 1000,
   });
 }