@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/shared/executorPhaseASchemas/preflight-report.schema.json

@@ -0,0 +1,216 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-preflight-report-v3.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "schema", "runId", "requestSha256", "collectedAt", "expiresAt", "status", "failures", "approvalContext",
+        "authorities", "target", "source", "baseAmi", "quotas", "budgets", "pricing", "immutableInputs",
+        "secretNameScan", "logicalEnvelopeSha256", "logicalEnvelope"
+    ],
+    "properties": {
+        "schema": { "const": "taskforce.executor-phase-a-preflight-report/v3" },
+        "runId": { "type": "string", "pattern": "^phase-a-[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$" },
+        "requestSha256": { "$ref": "#/$defs/sha256" },
+        "collectedAt": { "$ref": "#/$defs/timestamp" },
+        "expiresAt": { "$ref": "#/$defs/timestamp" },
+        "status": { "enum": ["pass", "fail"] },
+        "failures": {
+            "type": "array",
+            "uniqueItems": true,
+            "items": {
+                "type": "object", "additionalProperties": false, "required": ["code", "message"],
+                "properties": {
+                    "code": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{2,80}$" },
+                    "message": { "type": "string", "minLength": 1, "maxLength": 500 }
+                }
+            }
+        },
+        "approvalContext": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["environment", "workspaceId", "taskId", "taskReference"],
+            "properties": {
+                "environment": { "const": "performance" },
+                "workspaceId": { "const": "workspace-019c771a-b6d7-7bc8-b837-c1133f3ba7a2" },
+                "taskId": { "const": "task-62fecb296bbe07ca535b6e6630fc458f" },
+                "taskReference": { "const": "T-1653" }
+            }
+        },
+        "authorities": { "$ref": "#/$defs/authorities" },
+        "target": {
+            "type": "object", "additionalProperties": false,
+            "required": ["accountId", "readPrincipalArn", "mutationRoles", "oidcIssuer", "oidcAudience", "brokerPublicKeySpkiBase64", "brokerKeyFingerprint", "region", "availabilityZone", "availableZones", "instanceOfferingAvailable", "instanceType"],
+            "properties": {
+                "accountId": { "type": "string", "pattern": "^[0-9]{12}$" },
+                "readPrincipalArn": { "$ref": "#/$defs/principalArn" },
+                "mutationRoles": { "$ref": "#/$defs/roleMap" },
+                "oidcIssuer": { "$ref": "#/$defs/httpsIssuer" },
+                "oidcAudience": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,100}$" },
+                "brokerPublicKeySpkiBase64": { "type": "string", "pattern": "^MCowBQYDK2VwAyEA[A-Za-z0-9+/]{43}=$" },
+                "brokerKeyFingerprint": { "$ref": "#/$defs/sha256" },
+                "region": { "type": "string", "pattern": "^[a-z]{2}-[a-z]+-[0-9]$" },
+                "availabilityZone": { "type": "string", "pattern": "^[a-z]{2}-[a-z]+-[0-9][a-z]$" },
+                "availableZones": { "type": "array", "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z]{2}-[a-z]+-[0-9][a-z]$" } },
+                "instanceOfferingAvailable": { "type": "boolean" },
+                "instanceType": {
+                    "type": "object", "additionalProperties": false,
+                    "required": ["name", "supportedArchitectures", "currentGeneration", "burstable"],
+                    "properties": {
+                        "name": { "type": "string", "pattern": "^[a-z0-9]+[.][a-z0-9]+$" },
+                        "supportedArchitectures": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["x86_64", "arm64", "i386"] } },
+                        "currentGeneration": { "type": "boolean" },
+                        "burstable": { "type": "boolean" }
+                    }
+                }
+            }
+        },
+        "source": {
+            "type": "object", "additionalProperties": false,
+            "required": ["commit", "baselineCommit", "clean"],
+            "properties": {
+                "commit": { "$ref": "#/$defs/gitSha" },
+                "baselineCommit": { "$ref": "#/$defs/gitSha" },
+                "clean": { "type": "boolean" }
+            }
+        },
+        "baseAmi": {
+            "type": "object", "additionalProperties": false,
+            "required": ["id", "ownerId", "architecture", "rootDeviceName", "state"],
+            "properties": {
+                "id": { "type": "string", "pattern": "^ami-[a-f0-9]{8,17}$" },
+                "ownerId": { "type": "string", "pattern": "^[0-9]{12}$" },
+                "architecture": { "enum": ["x86_64", "arm64", "i386"] },
+                "rootDeviceName": { "type": "string", "minLength": 1, "maxLength": 64 },
+                "state": { "type": "string", "minLength": 1, "maxLength": 32 }
+            }
+        },
+        "quotas": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": {
+                "type": "object", "additionalProperties": false,
+                "required": ["serviceCode", "quotaCode", "required", "observed", "collectedAt"],
+                "properties": {
+                    "serviceCode": { "type": "string", "pattern": "^[a-z0-9-]{2,40}$" },
+                    "quotaCode": { "type": "string", "pattern": "^L-[A-Z0-9]{8,16}$" },
+                    "required": { "type": "integer", "minimum": 1 },
+                    "observed": { "type": "integer", "minimum": 0 },
+                    "collectedAt": { "$ref": "#/$defs/timestamp" }
+                }
+            }
+        },
+        "budgets": {
+            "type": "object", "additionalProperties": false,
+            "required": ["temporaryUsdMicros", "alarmUsdMicros", "foundationMonthlyCeilingUsdMicros"],
+            "properties": {
+                "temporaryUsdMicros": { "type": "integer", "minimum": 1 },
+                "alarmUsdMicros": { "type": "integer", "minimum": 1 },
+                "foundationMonthlyCeilingUsdMicros": { "type": "integer", "minimum": 1 }
+            }
+        },
+        "pricing": {
+            "type": "object", "additionalProperties": false,
+            "required": ["currency", "contingencyBasisPoints", "items", "foundationSubtotalUsdMicros", "foundationWithContingencyUsdMicros", "temporarySubtotalUsdMicros", "tenHostMonthlyInstanceUsdMicros"],
+            "properties": {
+                "currency": { "const": "USD" },
+                "contingencyBasisPoints": { "const": 1000 },
+                "items": {
+                    "type": "array", "minItems": 1, "uniqueItems": true,
+                    "items": {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["id", "unit", "unitPriceUsdMicros", "quantityMicros", "classification", "collectedAt", "source"],
+                        "properties": {
+                            "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,80}$" },
+                            "unit": { "type": "string", "minLength": 1, "maxLength": 40 },
+                            "unitPriceUsdMicros": { "type": "integer", "minimum": 0, "maximum": 1000000000000 },
+                            "quantityMicros": { "type": "integer", "minimum": 0, "maximum": 1000000000000000 },
+                            "classification": { "enum": ["foundation", "temporary"] },
+                            "collectedAt": { "$ref": "#/$defs/timestamp" },
+                            "source": { "const": "aws-price-list" }
+                        }
+                    }
+                },
+                "foundationSubtotalUsdMicros": { "type": "integer", "minimum": 0 },
+                "foundationWithContingencyUsdMicros": { "type": "integer", "minimum": 0 },
+                "temporarySubtotalUsdMicros": { "type": "integer", "minimum": 0 },
+                "tenHostMonthlyInstanceUsdMicros": { "type": "integer", "minimum": 0 }
+            }
+        },
+        "immutableInputs": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": {
+                "type": "object", "additionalProperties": false, "required": ["path", "expectedSha256", "observedSha256"],
+                "properties": {
+                    "path": { "type": "string", "minLength": 1, "maxLength": 240 },
+                    "expectedSha256": { "$ref": "#/$defs/sha256" },
+                    "observedSha256": { "$ref": "#/$defs/sha256" }
+                }
+            }
+        },
+        "secretNameScan": {
+            "type": "object", "additionalProperties": false, "required": ["scannedNameCount", "forbiddenNames"],
+            "properties": {
+                "scannedNameCount": { "type": "integer", "minimum": 0 },
+                "forbiddenNames": { "type": "array", "uniqueItems": true, "items": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,255}$" } }
+            }
+        },
+        "logicalEnvelopeSha256": { "$ref": "#/$defs/sha256" },
+        "logicalEnvelope": { "$ref": "https://taskforcehq.ai/schemas/executor-phase-a-logical-envelope-v1.json" }
+    },
+    "$defs": {
+        "timestamp": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{1,3})?Z$" },
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "gitSha": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+        "principalArn": { "type": "string", "pattern": "^arn:aws:iam::[0-9]{12}:(?:user|role)/[A-Za-z0-9+=,.@_/-]{1,512}$|^arn:aws:sts::[0-9]{12}:assumed-role/[A-Za-z0-9+=,.@_/-]{1,512}$" },
+        "roleArn": { "type": "string", "pattern": "^arn:aws:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$" },
+        "httpsIssuer": { "type": "string", "pattern": "^https://[A-Za-z0-9.-]+(?::[0-9]+)?(?:/[A-Za-z0-9._~!$&'()*+,;=:@%-]+)*$", "maxLength": 240 },
+        "roleMap": {
+            "type": "object", "additionalProperties": false,
+            "required": ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"],
+            "properties": {
+                "bootstrap": { "$ref": "#/$defs/roleArn" }, "ami-build": { "$ref": "#/$defs/roleArn" },
+                "provenance": { "$ref": "#/$defs/roleArn" }, "runtime": { "$ref": "#/$defs/roleArn" },
+                "cleanup": { "$ref": "#/$defs/roleArn" }
+            }
+        },
+        "authority": {
+            "type": "object", "additionalProperties": false, "required": ["document", "version", "sha256"],
+            "properties": {
+                "document": { "type": "string", "pattern": "^D-[1-9][0-9]*$" },
+                "version": { "type": "integer", "minimum": 1 },
+                "sha256": { "$ref": "#/$defs/sha256" }
+            }
+        },
+        "authorities": {
+            "type": "object", "additionalProperties": false, "required": ["architecture", "plan", "manifest"],
+            "properties": {
+                "architecture": {
+                    "allOf": [
+                        { "$ref": "#/$defs/authority" },
+                        { "type": "object", "properties": {
+                                "document": { "const": "D-691" }, "version": { "const": 8 },
+                                "sha256": { "const": "e04470a1762bb57495116c5d75528dcef0fc88f4a2202d7d669dd4d1642ff66d" }
+                            } }
+                    ]
+                },
+                "plan": {
+                    "allOf": [
+                        { "$ref": "#/$defs/authority" },
+                        { "type": "object", "properties": {
+                                "document": { "const": "D-706" }, "version": { "const": 9 },
+                                "sha256": { "const": "741adda34df66abfd8c3a7e4cd8eeff01e67dc79631acd747926fcbc338ff6d4" }
+                            } }
+                    ]
+                },
+                "manifest": {
+                    "type": "object", "additionalProperties": false, "required": ["assetId", "version", "sha256"],
+                    "properties": {
+                        "assetId": { "const": "asset-de22a50d6a612b0c9169616ce17c9cf9" },
+                        "version": { "const": 7 },
+                        "sha256": { "const": "1743a2cb183c8f0b2af480f6bba8a78b3bb71dd172653af6ed2870b5ba92d60b" }
+                    }
+                }
+            }
+        }
+    }
+}

package/dist/shared/executorPhaseASchemas/run-capability.schema.json

@@ -0,0 +1,111 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-run-capability-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["payload", "envelope"],
+    "properties": {
+        "payload": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "schema", "capabilityId", "capabilityKind", "originalCapabilityId", "residualInventorySha256",
+                "receiptId", "receiptSha256",
+                "workspaceId", "taskId", "actorUserId", "runId", "accountId", "region", "availabilityZone",
+                "sourceCommit", "preflightSha256", "logicalEnvelopeSha256", "budgetsSha256", "readPrincipalArn",
+                "mutationRoles", "roleMapSha256", "oidcIssuer", "oidcAudience", "brokerPublicKeySpkiBase64",
+                "brokerKeyFingerprint", "allowedPhases", "issuedAt", "expiresAt", "mutationDeadline", "cleanupDeadline"
+            ],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-run-capability-payload/v1" },
+                "capabilityId": { "$ref": "#/$defs/capabilityId" },
+                "capabilityKind": { "enum": ["main", "cleanup-only"] },
+                "originalCapabilityId": { "oneOf": [{ "$ref": "#/$defs/capabilityId" }, { "type": "null" }] },
+                "residualInventorySha256": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/sha256" }] },
+                "receiptId": { "$ref": "#/$defs/receiptId" },
+                "receiptSha256": { "$ref": "#/$defs/sha256" },
+                "workspaceId": { "type": "string", "pattern": "^workspace-[A-Za-z0-9_-]{8,128}$" },
+                "taskId": { "type": "string", "pattern": "^task-[A-Za-z0-9_-]{8,128}$" },
+                "actorUserId": { "type": "string", "pattern": "^user-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "runId": { "$ref": "#/$defs/runId" },
+                "accountId": { "type": "string", "pattern": "^[0-9]{12}$" },
+                "region": { "const": "us-west-2" },
+                "availabilityZone": { "type": "string", "pattern": "^us-west-2[a-z]$" },
+                "sourceCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+                "preflightSha256": { "$ref": "#/$defs/sha256" },
+                "logicalEnvelopeSha256": { "$ref": "#/$defs/sha256" },
+                "budgetsSha256": { "$ref": "#/$defs/sha256" },
+                "readPrincipalArn": { "$ref": "#/$defs/principalArn" },
+                "mutationRoles": { "$ref": "#/$defs/roleMap" },
+                "roleMapSha256": { "$ref": "#/$defs/sha256" },
+                "oidcIssuer": { "$ref": "#/$defs/httpsIssuer" },
+                "oidcAudience": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,100}$" },
+                "brokerPublicKeySpkiBase64": { "type": "string", "pattern": "^MCowBQYDK2VwAyEA[A-Za-z0-9+/]{43}=$" },
+                "brokerKeyFingerprint": { "$ref": "#/$defs/sha256" },
+                "allowedPhases": {
+                    "type": "array", "minItems": 1, "uniqueItems": true,
+                    "items": { "enum": ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"] }
+                },
+                "issuedAt": { "$ref": "#/$defs/timestamp" },
+                "expiresAt": { "$ref": "#/$defs/timestamp" },
+                "mutationDeadline": { "$ref": "#/$defs/timestamp" },
+                "cleanupDeadline": { "$ref": "#/$defs/timestamp" }
+            },
+            "allOf": [
+                {
+                    "if": { "properties": { "capabilityKind": { "const": "main" } } },
+                    "then": {
+                        "properties": {
+                            "originalCapabilityId": { "type": "null" },
+                            "residualInventorySha256": { "type": "null" },
+                            "allowedPhases": {
+                                "type": "array", "minItems": 5, "maxItems": 5, "uniqueItems": true,
+                                "items": { "enum": ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"] }
+                            }
+                        }
+                    }
+                },
+                {
+                    "if": { "properties": { "capabilityKind": { "const": "cleanup-only" } } },
+                    "then": {
+                        "properties": {
+                            "originalCapabilityId": { "$ref": "#/$defs/capabilityId" },
+                            "residualInventorySha256": { "$ref": "#/$defs/sha256" },
+                            "allowedPhases": { "const": ["cleanup"] }
+                        }
+                    }
+                }
+            ]
+        },
+        "envelope": { "$ref": "#/$defs/signatureEnvelope" }
+    },
+    "$defs": {
+        "timestamp": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{1,3})?Z$" },
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "runId": { "type": "string", "pattern": "^phase-a-[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$" },
+        "receiptId": { "type": "string", "pattern": "^(?:approval-receipt|taskforce-approval)-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+        "capabilityId": { "type": "string", "pattern": "^run-capability-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+        "principalArn": { "type": "string", "pattern": "^arn:aws:iam::[0-9]{12}:(?:user|role)/[A-Za-z0-9+=,.@_/-]{1,512}$|^arn:aws:sts::[0-9]{12}:assumed-role/[A-Za-z0-9+=,.@_/-]{1,512}$" },
+        "roleArn": { "type": "string", "pattern": "^arn:aws:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$" },
+        "httpsIssuer": { "type": "string", "pattern": "^https://[A-Za-z0-9.-]+(?::[0-9]+)?(?:/[A-Za-z0-9._~!$&'()*+,;=:@%-]+)*$", "maxLength": 240 },
+        "roleMap": {
+            "type": "object", "additionalProperties": false,
+            "required": ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"],
+            "properties": {
+                "bootstrap": { "$ref": "#/$defs/roleArn" }, "ami-build": { "$ref": "#/$defs/roleArn" },
+                "provenance": { "$ref": "#/$defs/roleArn" }, "runtime": { "$ref": "#/$defs/roleArn" },
+                "cleanup": { "$ref": "#/$defs/roleArn" }
+            }
+        },
+        "signatureEnvelope": {
+            "type": "object", "additionalProperties": false,
+            "required": ["algorithm", "keyId", "payloadSha256", "signature"],
+            "properties": {
+                "algorithm": { "const": "Ed25519" },
+                "keyId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                "payloadSha256": { "$ref": "#/$defs/sha256" },
+                "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
+            }
+        }
+    }
+}

package/dist/shared/executorPhaseASchemas/sender-proof.schema.json

@@ -0,0 +1,37 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-sender-proof-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["payload", "envelope"],
+    "properties": {
+        "payload": {
+            "type": "object", "additionalProperties": false,
+            "required": ["schema", "capabilityId", "nonceId", "requestSha256", "phase", "createdAt", "expiresAt"],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-sender-proof-payload/v1" },
+                "capabilityId": { "type": "string", "pattern": "^run-capability-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "nonceId": { "type": "string", "pattern": "^nonce-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "requestSha256": { "$ref": "#/$defs/sha256" },
+                "phase": { "enum": ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"] },
+                "createdAt": { "$ref": "#/$defs/timestamp" },
+                "expiresAt": { "$ref": "#/$defs/timestamp" }
+            }
+        },
+        "envelope": {
+            "type": "object", "additionalProperties": false,
+            "required": ["algorithm", "keyId", "brokerKeyFingerprint", "payloadSha256", "signature"],
+            "properties": {
+                "algorithm": { "const": "Ed25519" },
+                "keyId": { "const": "broker-key" },
+                "brokerKeyFingerprint": { "$ref": "#/$defs/sha256" },
+                "payloadSha256": { "$ref": "#/$defs/sha256" },
+                "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
+            }
+        }
+    },
+    "$defs": {
+        "timestamp": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{1,3})?Z$" },
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+    }
+}

package/dist/shared/executorPhaseASchemas/workload-grant.schema.json

@@ -0,0 +1,68 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-workload-grant-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["payload", "envelope"],
+    "properties": {
+        "payload": {
+            "type": "object", "additionalProperties": false,
+            "required": [
+                "schema", "grantId", "capabilityId", "capabilitySha256", "receiptId", "receiptSha256",
+                "workspaceId", "taskId", "actorUserId", "runId", "phase", "roleArn", "accountId", "region",
+                "sourceIdentity", "sessionTags", "brokerKeyFingerprint", "nonceId", "senderProofSha256",
+                "policySha256", "issuedAt", "expiresAt"
+            ],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-workload-grant-payload/v1" },
+                "grantId": { "type": "string", "pattern": "^workload-grant-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "capabilityId": { "type": "string", "pattern": "^run-capability-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "capabilitySha256": { "$ref": "#/$defs/sha256" },
+                "receiptId": { "type": "string", "pattern": "^(?:approval-receipt|taskforce-approval)-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "receiptSha256": { "$ref": "#/$defs/sha256" },
+                "workspaceId": { "type": "string", "pattern": "^workspace-[A-Za-z0-9_-]{8,128}$" },
+                "taskId": { "type": "string", "pattern": "^task-[A-Za-z0-9_-]{8,128}$" },
+                "actorUserId": { "type": "string", "pattern": "^user-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "runId": { "type": "string", "pattern": "^phase-a-[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$" },
+                "phase": { "enum": ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"] },
+                "roleArn": { "$ref": "#/$defs/roleArn" },
+                "accountId": { "type": "string", "pattern": "^[0-9]{12}$" },
+                "region": { "const": "us-west-2" },
+                "sourceIdentity": { "type": "string", "pattern": "^tfr\\.[A-Za-z0-9_-]{43}\\.(?:bootstrap|ami-build|provenance|runtime|cleanup)$", "minLength": 55, "maxLength": 58 },
+                "sessionTags": {
+                    "type": "object", "additionalProperties": false,
+                    "required": ["TaskforceRun", "TaskforceReceipt", "TaskforcePhase", "TaskforceWorkspaceHash", "TaskforceSource"],
+                    "properties": {
+                        "TaskforceRun": { "type": "string", "minLength": 1, "maxLength": 128 },
+                        "TaskforceReceipt": { "type": "string", "minLength": 1, "maxLength": 128 },
+                        "TaskforcePhase": { "enum": ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"] },
+                        "TaskforceWorkspaceHash": { "$ref": "#/$defs/sha256" },
+                        "TaskforceSource": { "type": "string", "pattern": "^[a-f0-9]{40}$" }
+                    }
+                },
+                "brokerKeyFingerprint": { "$ref": "#/$defs/sha256" },
+                "nonceId": { "type": "string", "pattern": "^nonce-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "senderProofSha256": { "$ref": "#/$defs/sha256" },
+                "policySha256": { "$ref": "#/$defs/sha256" },
+                "issuedAt": { "$ref": "#/$defs/timestamp" },
+                "expiresAt": { "$ref": "#/$defs/timestamp" }
+            }
+        },
+        "envelope": { "$ref": "#/$defs/signatureEnvelope" }
+    },
+    "$defs": {
+        "timestamp": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{1,3})?Z$" },
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "roleArn": { "type": "string", "pattern": "^arn:aws:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$" },
+        "signatureEnvelope": {
+            "type": "object", "additionalProperties": false,
+            "required": ["algorithm", "keyId", "payloadSha256", "signature"],
+            "properties": {
+                "algorithm": { "const": "Ed25519" },
+                "keyId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                "payloadSha256": { "$ref": "#/$defs/sha256" },
+                "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
+            }
+        }
+    }
+}

package/dist/shared/executorPhaseASchemas/workload-jwt-claims.schema.json

@@ -0,0 +1,67 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-workload-jwt-claims-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["iss", "aud", "sub", "iat", "nbf", "exp", "jti", "https://aws.amazon.com/source_identity", "https://aws.amazon.com/tags", "taskforce"],
+    "properties": {
+        "iss": { "type": "string", "pattern": "^https://[^/]+$", "maxLength": 256 },
+        "aud": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "sub": { "type": "string", "pattern": "^tfr:[A-Za-z0-9_-]{43}:(bootstrap|ami-build|provenance|runtime|cleanup)$" },
+        "iat": { "type": "integer", "minimum": 0 },
+        "nbf": { "type": "integer", "minimum": 0 },
+        "exp": { "type": "integer", "minimum": 0 },
+        "jti": { "type": "string", "pattern": "^token-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+        "https://aws.amazon.com/source_identity": { "type": "string", "pattern": "^tfr\\.[A-Za-z0-9_-]{43}\\.(bootstrap|ami-build|provenance|runtime|cleanup)$", "maxLength": 64 },
+        "https://aws.amazon.com/tags": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["principal_tags", "transitive_tag_keys"],
+            "properties": {
+                "principal_tags": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["TaskforceRun", "TaskforceReceipt", "TaskforcePhase", "TaskforceWorkspaceHash", "TaskforceSource"],
+                    "properties": {
+                        "TaskforceRun": { "$ref": "#/$defs/singleTag" },
+                        "TaskforceReceipt": { "$ref": "#/$defs/singleTag" },
+                        "TaskforcePhase": { "$ref": "#/$defs/singleTag" },
+                        "TaskforceWorkspaceHash": { "$ref": "#/$defs/singleTag" },
+                        "TaskforceSource": { "$ref": "#/$defs/singleTag" }
+                    }
+                },
+                "transitive_tag_keys": {
+                    "const": ["TaskforceRun", "TaskforceReceipt", "TaskforcePhase", "TaskforceWorkspaceHash", "TaskforceSource"]
+                }
+            }
+        },
+        "taskforce": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["schema", "receiptId", "receiptSha256", "workspaceId", "taskId", "runId", "sourceCommit", "accountId", "region", "availabilityZone", "logicalEnvelopeSha256", "budgetsSha256", "roleArn", "brokerKeyFingerprint", "grantId", "grantSha256", "senderProofSha256"],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-workload-jwt-claims/v1" },
+                "receiptId": { "type": "string", "maxLength": 160 },
+                "receiptSha256": { "$ref": "#/$defs/sha256" },
+                "workspaceId": { "type": "string", "maxLength": 160 },
+                "taskId": { "type": "string", "maxLength": 160 },
+                "runId": { "type": "string", "maxLength": 72 },
+                "sourceCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+                "accountId": { "type": "string", "pattern": "^[0-9]{12}$" },
+                "region": { "const": "us-west-2" },
+                "availabilityZone": { "type": "string", "pattern": "^us-west-2[a-z]$" },
+                "logicalEnvelopeSha256": { "$ref": "#/$defs/sha256" },
+                "budgetsSha256": { "$ref": "#/$defs/sha256" },
+                "roleArn": { "type": "string", "maxLength": 620 },
+                "brokerKeyFingerprint": { "$ref": "#/$defs/sha256" },
+                "grantId": { "type": "string", "maxLength": 160 },
+                "grantSha256": { "$ref": "#/$defs/sha256" },
+                "senderProofSha256": { "$ref": "#/$defs/sha256" }
+            }
+        }
+    },
+    "$defs": {
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "singleTag": { "type": "array", "minItems": 1, "maxItems": 1, "items": { "type": "string", "minLength": 1, "maxLength": 256 } }
+    }
+}

package/dist/shared/executorPhaseATiming.d.ts

@@ -0,0 +1 @@
+export declare const EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS = 5000;

package/dist/shared/executorPhaseATiming.js

@@ -0,0 +1 @@
+export const EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS = 5_000;

package/dist/shared/planningIdentity.js

@@ -75,5 +75,5 @@ export function resolvePlanningIdentity(input) {
 export function planningIdentityColorToken(color) {
     return color
         ? `var(--planning-identity-${color})`
-        : 'var(--planning-progress-empty)';
+        : 'var(--planning-identity-default)';
 }

package/dist/shared/productLogoKeys.d.ts

@@ -0,0 +1,2 @@
+export declare const PRODUCT_LOGO_KEYS: readonly ["antigravity", "chatgpt", "claude-chat", "claude-code", "cline", "codex", "cursor", "gemini-chat", "gemini-cli", "grok", "grok-chat", "kiro", "mistral-chat", "perplexity-chat", "vscode", "windsurf"];
+export type ProductLogoKey = typeof PRODUCT_LOGO_KEYS[number];

package/dist/shared/productLogoKeys.js

@@ -0,0 +1,18 @@
+export const PRODUCT_LOGO_KEYS = [
+    'antigravity',
+    'chatgpt',
+    'claude-chat',
+    'claude-code',
+    'cline',
+    'codex',
+    'cursor',
+    'gemini-chat',
+    'gemini-cli',
+    'grok',
+    'grok-chat',
+    'kiro',
+    'mistral-chat',
+    'perplexity-chat',
+    'vscode',
+    'windsurf',
+];

package/dist/shared/taskforceAgentDefinition.d.ts

@@ -14,7 +14,6 @@ export interface AgentModelSelection {
     modelSource: TaskforceAgentModelSource;
     tier: ModelGatewayTier;
     connectionScope?: TaskforceAgentConnectionScope;
-    connectionId?: string | null;
 }
 export interface AgentBehaviorConfig {
     personality?: {

package/dist/shared/taskforceAgentDefinition.js

@@ -1,4 +1,4 @@
-import { getTaskforceAgentModel, isTaskforceAgentModelVisible, isTaskforceAgentModelSource, normalizeTaskforceAgentConnectionScope, normalizeTaskforceAgentModelSource, } from './taskforceAgentModels.js';
+import { getTaskforceAgentModel, isTaskforceAgentModelSource, normalizeTaskforceAgentConnectionScope, normalizeTaskforceAgentModelSource, } from './taskforceAgentModels.js';
 export const AGENT_DEFINITION_SCHEMA_VERSION = 1;
 const FIELD_LIMITS = {
     name: 80,
@@ -281,7 +281,7 @@ export function inspectAgentDefinition(value) {
         issue(issues, 'invalid_model_selection', 'model', 'A model selection object is required.');
     }
     else {
-        reportUnknownKeys(value.model, ['providerKey', 'modelKey', 'modelSource', 'tier', 'connectionScope', 'connectionId'], 'model', issues);
+        reportUnknownKeys(value.model, ['providerKey', 'modelKey', 'modelSource', 'tier', 'connectionScope'], 'model', issues);
         const providerKey = readRequiredString(value.model.providerKey, 'model.providerKey', FIELD_LIMITS.capability, issues);
         const modelKey = readRequiredString(value.model.modelKey, 'model.modelKey', FIELD_LIMITS.capability, issues);
         const catalogModel = getTaskforceAgentModel(modelKey);
@@ -305,13 +305,11 @@ export function inspectAgentDefinition(value) {
         if (value.model.connectionScope !== undefined && !connectionScope) {
             issue(issues, 'invalid_model_connection_scope', 'model.connectionScope', 'Must be taskforce, workspace, personal, or local_dev when provided.');
         }
-        if (catalogModel && !isTaskforceAgentModelVisible(catalogModel)) {
-            issue(issues, 'model_unavailable', 'model.modelKey', 'The selected model is not available in this runtime.');
+        if (modelSource === 'subscription_dev'
+            && connectionScope !== 'personal'
+            && connectionScope !== 'local_dev') {
+            issue(issues, 'invalid_subscription_dev_connection_scope', 'model.connectionScope', 'Subscription-dev models require personal or legacy local_dev connection scope.');
         }
-        if (modelSource === 'subscription_dev' && connectionScope !== 'local_dev') {
-            issue(issues, 'invalid_subscription_dev_connection_scope', 'model.connectionScope', 'Subscription-dev models require local_dev connection scope.');
-        }
-        const connectionId = readOptionalString(value.model.connectionId, 'model.connectionId', FIELD_LIMITS.referenceId, issues);
         if (catalogModel && catalogModel.providerKey === providerKey && modelSource === catalogModel.source && MODEL_TIERS.has(value.model.tier)) {
             model = {
                 providerKey: catalogModel.providerKey,
@@ -319,7 +317,6 @@ export function inspectAgentDefinition(value) {
                 modelSource,
                 tier: value.model.tier,
                 ...(connectionScope ? { connectionScope } : {}),
-                ...(connectionId ? { connectionId } : {}),
             };
         }
     }

package/dist/shared/taskforceAgentModels.js

@@ -300,8 +300,10 @@ export function normalizeTaskforceAgentModelKey(value, providerKey) {
 }
 export function normalizeTaskforceAgentModelSelection(input) {
     const providerKey = normalizeTaskforceAgentProviderKey(input.providerKey);
-    const modelKey = normalizeTaskforceAgentModelKey(input.modelKey, providerKey);
-    const model = getTaskforceAgentModel(modelKey);
+    const requestedModel = getTaskforceAgentModel(input.modelKey);
+    const model = requestedModel?.providerKey === providerKey
+        ? requestedModel
+        : getTaskforceAgentModel(normalizeTaskforceAgentModelKey(input.modelKey, providerKey));
     if (!model)
         return null;
     if (input.modelSource !== undefined
@@ -318,7 +320,9 @@ export function normalizeTaskforceAgentModelSelection(input) {
         && !connectionScope) {
         return null;
     }
-    if (modelSource === 'subscription_dev' && connectionScope !== 'local_dev') {
+    if (modelSource === 'subscription_dev'
+        && connectionScope !== 'personal'
+        && connectionScope !== 'local_dev') {
         return null;
     }
     const connectionId = String(input.connectionId || '').trim();