@zq-silk/yui 0.15.7 → 0.15.8

package/dist/controller/jobControl.js

@@ -14,6 +14,7 @@ import { acknowledgeUnknownDurableJob, createDurableJob, durableJobIdempotencyKe
 import { activeLiveRoleAgentSession } from "../executor/agentExecutor.js";
 import { CallAuthority } from "../kernel/callAuthority.js";
 import { redactLaunchText } from "../runtime/launchDiagnostics.js";
+import { requireManagedTaskCaller } from "../runtime/managedCaller.js";
 export function createDurableJobControl(store) {
     const authority = createJobCallAuthority(store);
     return {
@@ -158,16 +159,22 @@ function jobAuthorityBinding(store, scope, roleName, taskId) {
     // Authenticate the live launch at ingress, but bind accepted Jobs to the
     // caller's durable Session identity, not its disposable Host generation.
     if (scope === "task") {
-        const role = store.getRole(taskId, roleName);
         const sessions = store.getTaskRoleSessionSet(taskId, roleName);
         const session = activeLiveRoleAgentSession(sessions);
-        const hash = role === null ? null : store.getJobCallerKeyHash(taskId, roleName, role.activeAgentId);
-        if (hash === null || role === null || sessions?.activeAgentId !== role.activeAgentId
-            || session === null || session.agentId !== role.activeAgentId) {
+        if (session === null) {
             throw jobDomainError("Current Job caller Session is unavailable.");
         }
+        try {
+            requireManagedTaskCaller(store, {
+                YUI_SESSION_SCOPE: "task", YUI_TASK_ID: taskId, YUI_ROLE: roleName,
+                YUI_NATIVE_SESSION_ID: session.nativeSessionId
+            });
+        }
+        catch {
+            throw jobDomainError("Job caller binding was revoked; no execution was started.");
+        }
         return createHash("sha256").update(JSON.stringify([
-            hash, session.agentId, session.adapterId, session.nativeSessionId
+            session.agentId, session.adapterId, session.nativeSessionId
         ])).digest("hex");
     }
     const role = store.getGlobalRole(roleName);
@@ -212,6 +219,12 @@ function assertNonSecretJobInput(params) {
 function validateStartParams(store, params) {
     validateJobTarget(store, params);
     assertCallerAuthorized(store, params.caller, params.taskId);
+    if (params.caller.scope === "task") {
+        const session = store.getTaskRoleSessionSet(params.taskId, params.caller.role);
+        if (session?.sessions[session.activeAgentId]?.effective.executionAuthority !== "delivery") {
+            throw jobControlError("UNAUTHORIZED", "Managed workspace Jobs require a delivery Session; Task activation does not upgrade planning authority.");
+        }
+    }
 }
 function validateJobTarget(store, params) {
     // The Task must be active — a terminal Task cannot run jobs.
@@ -303,69 +316,39 @@ function validateJobTarget(store, params) {
 /**
  * rr8/rr12: Bind the declared job owner to the caller's managed identity. The
  * Controller validates the declared owner/workspace and verifies the caller
- * against durable Turn/Session state — a self-reported role or scope is never
+ * against durable AgentRun/Session state — a self-reported role or scope is never
  * authority on its own. The rules:
  *
  * - `user` (non-managed): rejected because it has no managed Session identity.
  * - `global`: full Task authority after current Role Session verification.
  * - `task` + mismatched taskId: rejected.
- * - `task` + missing `turnId`: rejected (a managed caller must bind to a Turn).
- * - `task` + Turn not found / not active / `roleName !== role`: rejected — the
- *   claimed Role must be the real Role of an active Turn.
- * - `task`: full authority inside the matching Task after active Turn and
- *   per-Session caller-key verification; Role does not narrow it.
+ * - A non-Leader Task caller requires its current active Assignment.
+ * - A Leader Task caller requires its current, unrevoked native Session.
+ * - `task`: authority inside the matching Task after current Session and
+ *   native Session verification; Role does not narrow it.
  */
 /**
- * rr13: `job.start`/`job.cancel` caller authorization at the Controller
- * boundary. Every identity claim the Controller can verify from durable state
- * (role and turnId) is replayable by any client in the
- * same authoritative Controller. The channel itself is therefore not
- * authenticated by those claims alone. A non-replayable per-Session caller key
- * closes the gap:
- *
- * - `user` scope: **rejected outright** for start/cancel. A bare shell or a
- *   managed Session that sheds its identity has no managed Session binding.
- * - `global` scope: verified against the current global Role Session.
- * - `task` scope: the caller must present `callerKey` — the
- *   `YUI_JOB_CALLER_KEY` injected at its native Session launch. The Controller
- *   hashes it (SHA-256) and compares against the durable `jobCallerKeyHashes`
- *   map for the caller's Role + Agent. An absent hash or a
- *   mismatched key is UNAUTHORIZED.
- *
- * The existing Turn binding checks run after the key check, so a forged
- * identity that also lacks the key is rejected at the channel boundary.
+ * Verify the caller's current native Session and Task scope. This local Home
+ * identity contract does not defend against another process with the same
+ * user's filesystem access. Bare user calls cannot start or cancel Jobs.
  */
 function assertCallerAuthorized(store, caller, taskId) {
     if (caller.scope === "user") {
         // rr13: A user-scope caller has no per-Session channel binding. Every
         // durable-state claim it could carry is replayable
         // by any client in the same Home. Reject outright (fail-closed).
-        throw jobControlError("UNAUTHORIZED", "job.start/job.cancel requires a managed Session caller key; user scope is rejected.");
+        throw jobControlError("UNAUTHORIZED", "job.start/job.cancel requires a managed native Session; user scope is rejected.");
     }
     if (caller.scope === "global") {
         const roleName = caller.role;
-        const agentId = caller.agentId;
+        const agentId = roleName === undefined ? undefined : store.getGlobalRole(roleName)?.activeAgentId;
         const role = roleName === undefined ? null : store.getGlobalRole(roleName);
         const binding = role === null || agentId === undefined
             ? undefined
             : role.agentBindings[role.activeAgentId];
         const sessions = roleName === undefined ? null : store.getGlobalRoleSessionSet(roleName);
         const session = activeLiveRoleAgentSession(sessions);
-        if (role === null
-            || binding === undefined
-            || agentId === undefined
-            || caller.adapterId === undefined
-            || caller.runtimeGenerationId === undefined
-            || sessions === null
-            || sessions.activeAgentId !== role.activeAgentId
-            || session === null
-            || binding.agentId !== agentId
-            || binding.adapterId !== caller.adapterId
-            || session.agentId !== agentId
-            || session.adapterId !== caller.adapterId
-            || session.runtimeGenerationId !== caller.runtimeGenerationId
-            || (caller.nativeSessionId !== undefined
-                && session.nativeSessionId !== caller.nativeSessionId)) {
+        if (role === null || binding === undefined || agentId === undefined || sessions === null || sessions.activeAgentId !== role.activeAgentId || session === null || binding.agentId !== agentId || session.agentId !== agentId || session.adapterId !== binding.adapterId || caller.nativeSessionId === undefined || session.nativeSessionId !== caller.nativeSessionId) {
             throw jobControlError("UNAUTHORIZED", "DurableJob control requires the current managed global Agent Session.");
         }
         return;
@@ -373,37 +356,29 @@ function assertCallerAuthorized(store, caller, taskId) {
     if (caller.taskId !== taskId) {
         throw jobControlError("UNAUTHORIZED", "A managed Task Session may not start or cancel Jobs for a different Task.");
     }
-    // The Turn is resolved from durable state rather than presented by the
-    // caller: a long-lived Session process cannot hold a current Turn in its
-    // frozen environment, and its own claim would add nothing the store does
-    // not already own.
-    const run = caller.role === undefined ? null : store.getActiveTurn(taskId, caller.role);
-    const currentRole = caller.role === undefined ? null : store.getRole(taskId, caller.role);
-    if (run === null || run.status !== "active" || currentRole === null
-        || currentRole.activeAgentId !== run.effective.agentId) {
-        throw jobControlError("UNAUTHORIZED", "A managed Task Session's Role is not bound to an active Turn.");
-    }
-    const sessions = store.getTaskRoleSessionSet(taskId, currentRole.name);
+    // A long-lived Session is the Leader's identity, not its execution
+    // occupancy. Non-Leader callers still require their active Assignment.
+    const current = (() => {
+        try {
+            return requireManagedTaskCaller(store, {
+                YUI_SESSION_SCOPE: "task", YUI_TASK_ID: taskId, YUI_ROLE: caller.role,
+                YUI_NATIVE_SESSION_ID: caller.nativeSessionId
+            });
+        }
+        catch (error) {
+            throw jobControlError("UNAUTHORIZED", error instanceof Error ? error.message : String(error));
+        }
+    })();
+    if (current.roleName !== "leader" && current.currentRunId === undefined) {
+        throw jobControlError("UNAUTHORIZED", "A managed Task Session's Role is not bound to an active AgentRun.");
+    }
+    const sessions = store.getTaskRoleSessionSet(taskId, current.roleName);
     const session = activeLiveRoleAgentSession(sessions);
-    if (sessions?.activeAgentId !== currentRole.activeAgentId || session === null
-        || session.agentId !== run.effective.agentId || session.adapterId !== run.effective.adapterId) {
+    if (sessions?.activeAgentId !== current.agentId || session === null
+        || session.agentId !== current.agentId || session.adapterId !== current.adapterId
+        || caller.nativeSessionId === undefined || session.nativeSessionId !== caller.nativeSessionId) {
         throw jobControlError("UNAUTHORIZED", "DurableJob control requires the current live Task Session.");
     }
-    // rr13: Verify the non-replayable per-Session caller key. The key is injected
-    // at native Session launch and never persisted in plaintext; only its SHA-256
-    // hash is durable. A client with database read access can see the hash but cannot
-    // recover the key.
-    if (caller.callerKey === undefined) {
-        throw jobControlError("UNAUTHORIZED", "job.start/job.cancel requires a managed Session caller key.");
-    }
-    const expectedHash = store.getJobCallerKeyHash(taskId, caller.role ?? "", currentRole.activeAgentId);
-    if (expectedHash === null) {
-        throw jobControlError("UNAUTHORIZED", "The managed Session has no durable caller key; it must be relaunched.");
-    }
-    const presentedHash = createHash("sha256").update(caller.callerKey).digest("hex");
-    if (presentedHash !== expectedHash) {
-        throw jobControlError("UNAUTHORIZED", "The managed Session caller key does not match the durable hash.");
-    }
 }
 /**
  * Resolve the managed workspace for the job's owner. Returns null if no
@@ -448,7 +423,7 @@ function readGitHead(path) {
     }
 }
 function isTerminalWorkItemStatus(status) {
-    return status === "completed" || status === "failed" || status === "retired";
+    return status === "accepted" || status === "retired";
 }
 /**
  * Strict `job.start` params parsing. Throws CoreApplicationError-shaped errors
@@ -617,8 +592,8 @@ function parseCaller(value) {
     }
     const record = value;
     const allowed = new Set([
-        "scope", "taskId", "role", "agentId", "adapterId", "runtimeGenerationId", "nativeSessionId",
-        "turnId", "callerKey"
+        "scope", "taskId", "role", "agentId", "adapterId", "nativeSessionId",
+        "runId"
     ]);
     for (const key of Object.keys(record)) {
         if (!allowed.has(key)) {
@@ -638,22 +613,16 @@ function parseCaller(value) {
     const role = optionalId("role");
     const agentId = optionalId("agentId");
     const adapterId = optionalId("adapterId");
-    const runtimeGenerationId = optionalId("runtimeGenerationId");
     const nativeSessionId = optionalId("nativeSessionId");
-    const turnId = optionalId("turnId");
-    const callerKey = record.callerKey === undefined
-        ? undefined
-        : requiredId(record.callerKey, "job caller callerKey");
+    const runId = optionalId("runId");
     return {
         scope: record.scope,
         ...(taskId === undefined ? {} : { taskId }),
         ...(role === undefined ? {} : { role }),
         ...(agentId === undefined ? {} : { agentId }),
         ...(adapterId === undefined ? {} : { adapterId }),
-        ...(runtimeGenerationId === undefined ? {} : { runtimeGenerationId }),
         ...(nativeSessionId === undefined ? {} : { nativeSessionId }),
-        ...(turnId === undefined ? {} : { turnId }),
-        ...(callerKey === undefined ? {} : { callerKey })
+        ...(runId === undefined ? {} : { runId })
     };
 }
 function parseStringMap(value, label) {

package/dist/controller/resourceInventory.js

@@ -32,11 +32,10 @@ export function createRuntimeResourceActivityTracker() {
             || roleKey === undefined)
             return reject();
         const identityKey = JSON.stringify([
-            identity.turnId,
+            identity.runId,
             identity.agentId,
             identity.adapterId,
-            identity.nativeSessionId ?? null,
-            identity.runtimeGenerationId ?? null
+            identity.nativeSessionId ?? null
         ]);
         const current = {
             identity: identityKey,
@@ -113,7 +112,7 @@ export function buildControllerResourceInventory(facts) {
             for (const process of paneProcesses)
                 claimed.add(process.pid);
             const role = findRole(homeFact.roles, pane);
-            const terminalIsolation = role?.taskStatus === "retired"
+            const terminalIsolation = (role?.taskStatus === "cancelled" && role.taskRetirementIsolated === true)
                 || role?.taskStatus === "archived";
             resources.push(processResource({
                 kind: "agent-session",
@@ -123,7 +122,7 @@ export function buildControllerResourceInventory(facts) {
                     : terminalIsolation ? "safe" : "protected",
                 reasonCode: role === undefined
                     ? pane.dead ? "dead-orphan-pane" : "orphan-pane"
-                    : terminalIsolation ? `${role.taskStatus}-task-pane` : "owned-role-pane",
+                    : terminalIsolation ? (role.taskStatus === "cancelled" ? "retired-task-pane" : "archived-task-pane") : "owned-role-pane",
                 yuiHome,
                 owner: role === undefined ? { kind: "none" } : roleOwner(role),
                 processes: paneProcesses,
@@ -261,8 +260,7 @@ function roleOwner(role) {
             agentId: role.agentId,
             ...(role.adapterId === undefined ? {} : { adapterId: role.adapterId }),
             ...(role.nativeSessionId === undefined ? {} : { nativeSessionId: role.nativeSessionId }),
-            ...(role.runtimeGenerationId === undefined ? {} : { runtimeGenerationId: role.runtimeGenerationId }),
-            ...(role.turnId === undefined ? {} : { turnId: role.turnId })
+            ...(role.runId === undefined ? {} : { runId: role.runId })
         };
     }
     return {
@@ -274,8 +272,7 @@ function roleOwner(role) {
         agentId: role.agentId,
         ...(role.adapterId === undefined ? {} : { adapterId: role.adapterId }),
         ...(role.nativeSessionId === undefined ? {} : { nativeSessionId: role.nativeSessionId }),
-        ...(role.runtimeGenerationId === undefined ? {} : { runtimeGenerationId: role.runtimeGenerationId }),
-        ...(role.turnId === undefined ? {} : { turnId: role.turnId })
+        ...(role.runId === undefined ? {} : { runId: role.runId })
     };
 }
 function processTree(processes, rootPid) {
@@ -432,34 +429,18 @@ function optionalCounterFields(processes, field) {
             : { ioWriteBytes: sum(values) };
 }
 function matchesResourceIdentity(identity, owner) {
-    if (identity === undefined
-        || typeof identity.taskId !== "string"
-        || identity.taskId.length === 0
-        || typeof identity.roleName !== "string"
-        || identity.roleName.length === 0
-        || typeof identity.turnId !== "string"
-        || identity.turnId.length === 0
-        || typeof identity.agentId !== "string"
-        || identity.agentId.length === 0
-        || typeof identity.adapterId !== "string"
-        || identity.adapterId.length === 0
-        || (identity.nativeSessionId !== undefined && !hasIdentityText(identity.nativeSessionId))
-        || (identity.runtimeGenerationId !== undefined && !hasIdentityText(identity.runtimeGenerationId)))
+    if (identity === undefined || typeof identity.taskId !== "string" || identity.taskId.length === 0 || typeof identity.roleName !== "string" || identity.roleName.length === 0 || typeof identity.runId !== "string" || identity.runId.length === 0 || typeof identity.agentId !== "string" || identity.agentId.length === 0 || typeof identity.adapterId !== "string" || identity.adapterId.length === 0 || !hasIdentityText(identity.nativeSessionId))
         return false;
     if (owner.kind !== "task-role"
         || owner.taskId !== identity.taskId
         || owner.roleName !== identity.roleName
-        || owner.turnId !== identity.turnId
+        || owner.runId !== identity.runId
         || owner.agentId !== identity.agentId
         || owner.adapterId !== identity.adapterId)
         return false;
-    if (!hasIdentityText(identity.nativeSessionId) && !hasIdentityText(identity.runtimeGenerationId))
-        return false;
     if (identity.nativeSessionId !== undefined
         && owner.nativeSessionId !== identity.nativeSessionId)
         return false;
-    if (identity.runtimeGenerationId !== undefined && owner.runtimeGenerationId !== identity.runtimeGenerationId)
-        return false;
     return true;
 }
 function hasIdentityText(value) {

package/dist/controller/resourceInventoryLinux.js

@@ -14,7 +14,7 @@ import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
 import { buildControllerResourceInventory } from "./resourceInventory.js";
 import { CONTROLLER_DOMAIN_PATH, EPHEMERAL_DOMAIN_GRACE_MS, ephemeralDomainFingerprint, readEphemeralDomainIdentity, readLinuxProcessStartIdentity } from "./domainIdentity.js";
 const LINUX_PROCESS_SCAN_BATCH_SIZE = 64;
-export const INVENTORY_EVENT_LOOP_TURN_BUDGET_MS = 25;
+export const INVENTORY_EVENT_LOOP_RUN_BUDGET_MS = 25;
 export async function scanControllerResourceInventory(options) {
     const currentHome = resolve(options.currentHome);
     const environment = options.environment ?? process.env;
@@ -282,17 +282,17 @@ export async function forEachInEventLoopBatches(entries, batchSize, visit, timin
         throw new Error("Event-loop batch size must be a positive integer.");
     }
     const now = timing.now ?? (() => performance.now());
-    let turnStartedAt = now();
-    let entriesInTurn = 0;
+    let runStartedAt = now();
+    let entriesInRun = 0;
     for (let index = 0; index < entries.length; index += 1) {
         visit(entries[index], index);
-        entriesInTurn += 1;
+        entriesInRun += 1;
         if (index + 1 < entries.length
-            && (entriesInTurn >= batchSize
-                || now() - turnStartedAt >= INVENTORY_EVENT_LOOP_TURN_BUDGET_MS)) {
+            && (entriesInRun >= batchSize
+                || now() - runStartedAt >= INVENTORY_EVENT_LOOP_RUN_BUDGET_MS)) {
             await new Promise((resolve) => setImmediate(resolve));
-            turnStartedAt = now();
-            entriesInTurn = 0;
+            runStartedAt = now();
+            entriesInRun = 0;
         }
     }
 }
@@ -634,13 +634,12 @@ function loadHomeState(home, warnings, options) {
                 agentId,
                 ...(adapterId === undefined ? {} : { adapterId }),
                 ...(session === null ? {} : { nativeSessionId: session.nativeSessionId }),
-                ...(session?.runtimeGenerationId === undefined ? {} : { runtimeGenerationId: session.runtimeGenerationId })
             };
         });
         const appendTaskRole = (task, role) => {
             const session = activeLiveRoleAgentSession(store.getRoleSessionSet(task.id, role.name));
             const binding = role.agentBindings[role.activeAgentId];
-            const run = store.getActiveTurn(task.id, role.name);
+            const run = store.getActiveRun(task.id, role.name);
             const agentId = session?.effective.agentId ?? role.activeAgentId;
             const adapterId = session?.effective.adapterId ?? binding?.adapterId;
             roles.push({
@@ -648,17 +647,17 @@ function loadHomeState(home, warnings, options) {
                 taskId: task.id,
                 taskTitle: task.title,
                 taskStatus: task.status,
+                taskRetirementIsolated: task.retirementIsolation === true,
                 roleName: role.name,
                 agentId,
                 ...(adapterId === undefined ? {} : { adapterId }),
                 ...(session === null ? {} : { nativeSessionId: session.nativeSessionId }),
-                ...(session?.runtimeGenerationId === undefined ? {} : { runtimeGenerationId: session.runtimeGenerationId }),
-                ...(run === null ? {} : { turnId: run.id })
+                ...(run === null ? {} : { runId: run.id })
             });
         };
         // The current SQLite store owns bounded active-Task and current-Session
         // indexes. Use them only as selectors, then point-read the authoritative
-        // Task/Role/Session/Turn records so an index row cannot bypass ownership
+        // Task/Role/Session/AgentRun records so an index row cannot bypass ownership
         // fences.
         const indexedTaskIds = [...new Set(store.listActiveTaskIds())].sort(numericCompare);
         const sessionCandidates = store.listRuntimeSessionCandidates({ scope: "task" });