@zq-silk/yui 2.10.0 → 2.12.0

package/dist/controller/jobSupervisor.js

@@ -20,6 +20,7 @@ import { recordOperationEvidence } from "../kernel/operationFacts.js";
 import { wakeReason } from "../scheduler/wakeReason.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { readProcessStartIdentity } from "../core/fileLockOwner.js";
+import { processBusinessResult, resultDigest, runReference, validateBusinessResult } from "../job/jobBusinessResult.js";
 const DEFAULT_STEP_TIMEOUT_MS = 30 * 60_000;
 const HEARTBEAT_STALE_MS = 2 * 60_000;
 const SIGKILL_GRACE_MS = 30_000;
@@ -31,6 +32,7 @@ export class DurableJobSupervisor {
     #wake;
     #onError;
     #authorizeStart;
+    #reconcileDelegation;
     // f5: Composite key (taskId/jobId) because job IDs are Task-local — every
     // Task has a job-1, so a Task-local key would cross-kill healthy runners.
     #sigkillAt = new Map();
@@ -42,6 +44,7 @@ export class DurableJobSupervisor {
         this.#wake = options.wake ?? (() => undefined);
         this.#onError = options.onError ?? (() => undefined);
         this.#authorizeStart = options.authorizeStart;
+        this.#reconcileDelegation = options.reconcileDelegation;
     }
     reconcile(now) {
         const jobs = this.#store.listActiveDurableJobs();
@@ -67,7 +70,38 @@ export class DurableJobSupervisor {
             }
         }
     }
+    /** Explicit collection only. Never admits, spawns, cancels or retries work. */
+    confirmResult(namespace, runId, now) {
+        const run = this.#store.listActiveDurableJobs()
+            .find(run => executionNamespace(run) === namespace && run.id === runId);
+        if (!run)
+            return;
+        if (run.delegation) {
+            this.#reconcileDelegation?.(run, now);
+            return;
+        }
+        if (run.status === "queued") {
+            const spawned = this.#spawnedProcessFromEvidence(run, this.#artifacts.readStartMarker(namespace, runId));
+            if (spawned)
+                this.#adoptAndContinue(run, spawned, now);
+        }
+        else {
+            const exit = this.#artifacts.readExitJson(namespace, runId);
+            if (exit)
+                this.#harvestExit(run, exit, now);
+            else if (run.process) {
+                const identity = this.#process.processStartIdentity(run.process.pid);
+                if (identity === undefined || identity !== run.process.startIdentity
+                    || !this.#process.isProcessAlive(run.process.pid))
+                    this.#handleDeadProcess(run, now);
+            }
+        }
+    }
     #reconcileJob(job, now) {
+        if (job.delegation) {
+            this.#reconcileDelegation?.(job, now);
+            return;
+        }
         if (job.status === "queued") {
             this.#reconcileQueued(job, now);
             return;
@@ -155,6 +189,8 @@ export class DurableJobSupervisor {
         }
     }
     #startJob(job, now) {
+        if (job.delegation)
+            throw new Error("Task delegation cannot start a process.");
         try {
             this.#authorizeStart(job);
         }
@@ -298,6 +334,7 @@ export class DurableJobSupervisor {
             evidenceSource: "exit-artifact",
             steps: exit.steps
         };
+        const business = this.#businessResult(job, result);
         // rr4/finding-7: The terminal transition and the Leader wakeup must be
         // atomic. Compose complete + wakeupNotified and pass the wakeup param so
         // the adapter enqueues the Leader mailbox entry in the same transaction.
@@ -306,11 +343,11 @@ export class DurableJobSupervisor {
         const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => {
             let completed;
             try {
-                completed = completeDurableJob(current, result, now);
+                completed = completeDurableJob(current, result, now, business);
             }
             catch {
                 completed = completeDurableJob(current, {
-                    outcome: "failed", exitCode: null, signal: null,
+                    outcome: "unknown-needs-attention", exitCode: null, signal: null,
                     unknownReason: "runner output is invalid; original receipt is retained",
                     steps: []
                 }, now);
@@ -329,7 +366,7 @@ export class DurableJobSupervisor {
             // The runner died without exit.json, but its step checkpoint covered
             // every planned step: the outcome is still provable from durable
             // evidence. No false pass — the checkpoint is the runner's own record.
-            const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => markDurableJobWakeupNotified(completeDurableJob(current, { ...proven, evidenceSource: "checkpoint" }, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => markDurableJobWakeupNotified(completeDurableJob(current, { ...proven, evidenceSource: "checkpoint" }, now, this.#businessResult(current, { ...proven, evidenceSource: "checkpoint" })), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
             this.#deliverTerminalEvent(terminal);
         }
         else {
@@ -339,6 +376,34 @@ export class DurableJobSupervisor {
         }
         this.#sigkillAt.delete(this.#sigkillKey(job));
     }
+    #businessResult(job, result) {
+        const fallback = processBusinessResult(job, result);
+        if ("taskId" in job)
+            return fallback;
+        // The runner records this only when its cancel fence is seen before the
+        // first step. No domain action ran, so no business receipt is expected.
+        if (result.outcome === "cancelled" && result.steps.length === 0)
+            return fallback;
+        if (job.action === "system.noop")
+            return { ...fallback, data: { action: "system.noop" } };
+        const raw = this.#artifacts.readBusinessResult?.(executionNamespace(job), job.id);
+        if (raw !== null && raw !== undefined) {
+            try {
+                const business = validateBusinessResult(JSON.parse(raw), runReference(job));
+                const sourceRun = runReference(job);
+                return { ...business, evidence: [...business.evidence, {
+                            kind: "execution-evidence", owner: sourceRun, sourceRun,
+                            version: resultDigest(raw), locator: `${job.artifactsLocator}/business-result.json`
+                        }, ...fallback.evidence] };
+            }
+            catch {
+                return { ...fallback, outcome: "unknown-needs-attention",
+                    summary: "Invalid business result receipt; inspect retained execution evidence. Do not replay the action." };
+            }
+        }
+        return { ...fallback, outcome: "unknown-needs-attention",
+            summary: "Business result receipt is missing; process completion does not prove the business outcome. Do not replay the action." };
+    }
     /**
      * f7/rr5: Deliver a terminal notice to the runtime inbox channel when a
      * Job reaches a terminal state. The notice is best-effort: the terminal
@@ -375,6 +440,8 @@ function wakeupRefs(job) {
  * checkpoint covers every planned step exactly, by name.
  */
 function proveOutcomeFromCheckpoint(job, checkpoint) {
+    if (job.delegation)
+        return null;
     const byName = new Map(checkpoint.completedSteps.map((step) => [step.name, step]));
     if (byName.size !== checkpoint.completedSteps.length)
         return null;
@@ -501,6 +568,19 @@ export function createFileArtifactPort(home) {
         },
         readReadyFile(taskId, jobId) {
             return readJsonFile(join(home, "artifacts", "jobs", taskId, jobId, "ready.json"));
+        },
+        readBusinessResult(taskId, jobId) {
+            const path = join(home, "artifacts", "jobs", taskId, jobId, "business-result.json");
+            try {
+                if (statSync(path).size > 256 * 1024)
+                    return "oversized business result";
+                return readFileSync(path, "utf8");
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    return null;
+                throw error; // A transient collection failure is not absence or permission to rerun.
+            }
         }
     };
 }

package/dist/controller/jobTaskDelegationControl.js

@@ -0,0 +1,193 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createTaskAggregate } from "../commands/taskCommands.js";
+import { isDurableJobTerminal, validateDurableJob } from "../job/durableJob.js";
+import { resultDigest, runReference } from "../job/jobBusinessResult.js";
+import { validateTaskJobConfiguration, workItemDefinitionDigest } from "../job/taskDelegation.js";
+import { assertCallerAuthorized } from "./jobControl.js";
+import { enqueueWork } from "../coordination/workMailboxQueue.js";
+import { isDeepStrictEqual } from "node:util";
+/** Scope authorization is performed by the Job ingress; provenance adds none. */
+export function authorizeTaskJob(store, job, caller, write) {
+    if (job.configuration.kind !== "task")
+        throw new Error("Not a Task delegation.");
+    validateTaskJobConfiguration(job.configuration);
+    if (caller.scope === "task") {
+        if (!write && caller.role === "leader")
+            return;
+        // Creating another Task is a cross-Task effect, not inherited authority.
+        if (caller.role !== "leader" || job.configuration.target.kind === "new"
+            || job.configuration.target.taskId !== caller.taskId) {
+            throw new Error("Task delegation requires exact target authority; source Job scope grants no cross-Task permission.");
+        }
+        assertCallerAuthorized(store, caller, caller.taskId);
+        if (write) {
+            const session = store.getTaskRoleSessionSet(caller.taskId, "leader");
+            const effective = session?.sessions[session.activeAgentId]?.effective;
+            if (effective?.executionAuthority !== "delivery" || effective.profileAccess !== "write") {
+                throw new Error("Task delegation requires a current writable delivery Session.");
+            }
+        }
+    }
+    if (!write)
+        return;
+    if (job.scope.kind === "task") {
+        const source = store.getTask(job.scope.taskId);
+        if (!source || source.status !== "active" || source.executionGate.state !== "enabled")
+            throw new Error("Source Task is not executable.");
+    }
+    const target = job.configuration.target;
+    if (target.kind === "new") {
+        for (const binding of target.projectBindings) {
+            const project = store.listProjects().find(project => project.id === binding.projectId);
+            if (!project || project.status !== "active")
+                throw new Error("Target Project is not active.");
+        }
+    }
+    else {
+        const task = store.getTask(target.taskId);
+        const work = store.getWorkItem(target.taskId, target.workItemId);
+        if (!task || task.status !== "active" || task.executionGate.state !== "enabled"
+            || !work || work.status !== "open" || work.revision !== target.revision) {
+            throw new Error("An exact open WorkItem revision in an executable Task is required.");
+        }
+    }
+}
+/** Inside Run admission's transaction: Task/Leader + Run + association commit together. */
+export function admitTaskJob(store, job, caller, trigger, requestId, now, retryOf) {
+    const config = job.configuration;
+    const id = job.scope.kind === "global" ? `job-${randomUUID()}` : store.nextDurableJobId(job.scope.taskId);
+    const sourceRun = { scope: job.scope, runId: id };
+    const target = config.target;
+    const taskId = target.kind === "new" ? createTaskAggregate(store, target.title, {
+        description: target.description, projectBindings: target.projectBindings,
+        ...(target.type === undefined ? {} : { type: target.type })
+    }, now, [], { kind: "job-run", jobId: job.id, run: sourceRun }).task.id : target.taskId;
+    const delegation = { taskId, goal: config.goal,
+        ...(target.kind === "work-item" ? { workItemId: target.workItemId, workItemRevision: target.revision,
+            workItemDefinitionDigest: workItemDefinitionDigest(store.getWorkItem(taskId, target.workItemId)) } : {}) };
+    const actorId = caller.scope === "user" ? "user" : `${caller.scope}:${caller.role}`;
+    const inputDigest = resultDigest(JSON.stringify([job, trigger, retryOf]));
+    const locator = `artifacts/jobs/${job.scope.kind === "global" ? "global" : job.scope.taskId}/${id}`;
+    const run = validateDurableJob({
+        schemaVersion: 1,
+        ...(job.scope.kind === "global" ? { scope: "global" }
+            : { taskId: job.scope.taskId, owner: { kind: "task" } }),
+        id, definitionId: job.id, definitionRevision: job.revision, trigger,
+        delegation, artifactsLocator: locator,
+        idempotencyKey: createHash("sha256").update(JSON.stringify([actorId, requestId])).digest("hex"),
+        operation: { requestId, actorId, inputDigest, authorityRef: inputDigest,
+            targetId: taskId, capability: "job.run", implementation: { id: "yui:task-delegation", generation: "1" },
+            effect: "confirmed", receiptRefs: [`tasks/${taskId}`], partialResultRefs: [] },
+        status: "running", startedAt: now.toISOString(),
+        ...(retryOf === undefined ? {} : { retryOf }),
+        createdAt: now.toISOString(), updatedAt: now.toISOString()
+    });
+    saveRun(store, run);
+    if (config.goal === "task-created")
+        return reconcileTaskDelegation(store, run, now);
+    return run;
+}
+function saveRun(store, run) {
+    if ("taskId" in run)
+        store.saveDurableJob(run.taskId, run);
+    else
+        store.saveGlobalJobRun(run);
+}
+/** Collection is transactional, repeatable, and never executes/activates/stops a Task. */
+export function reconcileTaskDelegation(store, observed, now) {
+    return store.transaction(tx => {
+        const run = "taskId" in observed ? tx.getDurableJob(observed.taskId, observed.id) : tx.getGlobalJobRun(observed.id);
+        if (!run || !run.delegation || isDurableJobTerminal(run.status))
+            return run ?? observed;
+        const link = run.delegation;
+        const task = tx.getTask(link.taskId);
+        if (!task)
+            throw new Error("Delegated Task is missing; preserve the exact Run for inspection.");
+        if (link.goal !== "work-item" && (task.source?.jobId !== run.definitionId
+            || !isDeepStrictEqual(task.source.run, runReference(run)))) {
+            throw new Error("Delegated Task creation source does not match the exact Run.");
+        }
+        let outcome;
+        let summary = "";
+        let evidence = [];
+        if (link.goal === "task-created") {
+            outcome = "succeeded";
+            summary = `Explicit creation goal met: ${task.id}; no delivery completion is claimed.`;
+            const event = tx.listEventsByType(task.id, ["task.created"])[0];
+            if (!event)
+                throw new Error("Delegated Task creation evidence is missing.");
+            evidence = [{ kind: "task-result", owner: { kind: "task", taskId: task.id },
+                    sourceRun: runReference(run), version: resultDigest(JSON.stringify(event)), locator: `events/${event.id}` }];
+        }
+        else if (link.goal === "work-item") {
+            const work = tx.getWorkItem(task.id, link.workItemId);
+            if (!work || workItemDefinitionDigest(work) !== link.workItemDefinitionDigest) {
+                outcome = "unknown-needs-attention";
+                summary = "Delegated WorkItem requirements changed or are missing; inspect the exact scope.";
+            }
+            else if (work.status === "retired") {
+                outcome = "failed";
+                summary = `Delegated WorkItem retired: ${work.id}.`;
+            }
+            else if (work.status === "accepted") {
+                const candidate = work.candidates.find(candidate => candidate.id === work.acceptedCandidateId
+                    && candidate.workItemRevision >= link.workItemRevision);
+                if (!candidate)
+                    throw new Error("Accepted delegation has no exact Candidate; preserve evidence.");
+                outcome = "succeeded";
+                summary = work.outcome ?? candidate.summary;
+                evidence = [{ kind: "work-item-result", owner: { kind: "task", taskId: task.id },
+                        sourceRun: runReference(run), version: resultDigest(JSON.stringify(candidate)),
+                        locator: `work-items/${work.id}/candidates/${candidate.id}` }];
+            }
+        }
+        else {
+            // The never-rewritten completion event identifies the exact lifecycle,
+            // even if the Task is reopened before this collector runs.
+            const event = tx.listEventsByType(task.id, ["task.completed"]).find(event => event.createdAt >= run.createdAt);
+            if (event) {
+                outcome = "succeeded";
+                summary = String(event.payload.summary);
+                evidence = [{ kind: "task-result", owner: { kind: "task", taskId: task.id },
+                        sourceRun: runReference(run), version: resultDigest(JSON.stringify(event)), locator: `events/${event.id}` }];
+            }
+            else if (task.status === "cancelled" || (task.status === "archived" && task.completedAt === undefined)) {
+                outcome = "failed";
+                summary = `Delegated Task ended without the requested delivery: ${task.id}.`;
+            }
+            else if (task.completedAt !== undefined) {
+                outcome = "unknown-needs-attention";
+                summary = "Task reports completion without immutable completion-event evidence; inspect the target.";
+            }
+        }
+        // Like process collection, already-proven delivery wins over a late cancel.
+        // Cancelling an unsettled wait never fabricates target resource quiescence.
+        if (!outcome && run.cancelRequestedAt) {
+            outcome = "cancelled";
+            summary = "This Run's delegation was cancelled; the target Task/Leader/WorkItem was not stopped. Inspect its own resources separately.";
+        }
+        if (!outcome)
+            return run;
+        const businessResult = { schemaVersion: 1, sourceRun: runReference(run), outcome,
+            summary, evidence };
+        const next = validateDurableJob({ ...run, status: outcome, businessResult, wakeupNotified: true,
+            terminalAt: now.toISOString(), updatedAt: now.toISOString() });
+        saveRun(tx, next);
+        if ("taskId" in run)
+            enqueueWork(tx, { kind: "role", taskId: run.taskId, roleName: "leader" }, "job-finished", now, [{ type: "task", id: run.taskId }]);
+        else if (run.operation.actorId !== "user")
+            enqueueWork(tx, { kind: "operator" }, "global-job-finished", now, [{ type: "global-job-run", id: run.id }], { source: "global-job", dedupeKey: `operator-global-job-run:${run.id}` });
+        return next;
+    });
+}
+/** Bounded projection only; source permissions never open the target's Context. */
+export function taskDelegationView(store, run) {
+    if (!run.delegation)
+        return null;
+    const task = store.getTask(run.delegation.taskId);
+    return { ...run.delegation, taskStatus: task?.status ?? null,
+        executionGate: task?.executionGate.state ?? null,
+        openInputs: store.listInputRequests(run.delegation.taskId).filter(input => input.status === "open").length,
+        result: run.businessResult ?? null,
+        cancellation: run.cancelRequestedAt ? "requested; target resources not stopped" : null };
+}

package/dist/controller/runtime.js

@@ -57,7 +57,9 @@ import { AgentHostProviderSessionBusyError, AgentHostProviderTurnFenceError, Fil
 import { deliverGlobalInputs } from "./globalInputDelivery.js";
 import { authorizeJobStart } from "./jobControl.js";
 import { authorizeGlobalJobStart, createJobDefinitionControl } from "./jobDefinitionControl.js";
+import { reconcileTaskDelegation } from "./jobTaskDelegationControl.js";
 import { createScheduleControl, reconcileSchedules } from "./scheduleControl.js";
+import { reconcileProjectSync } from "../job/projectSync.js";
 import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
 import { createProviderRetryHooks } from "./providerRetryDelivery.js";
 import { createRuntimeResourceActivityTracker } from "./resourceInventory.js";
@@ -488,6 +490,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             process: kernel.runner,
             artifacts: createFileArtifactPort(home),
             authorizeStart: (job) => "taskId" in job ? authorizeJobStart(store, job) : authorizeGlobalJobStart(store, job),
+            reconcileDelegation: (job, now) => { reconcileTaskDelegation(store, job, now); },
             // rr6/f1: Bounded supervision wake. The supervisor signals the Controller
             // after spawning a runner (queued→running adoption) and when a runner
             // exits (terminal harvest), so a quick job converges without waiting for
@@ -575,7 +578,10 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             jobDefinitions: createJobDefinitionControl(store, home),
             schedules: {
                 control: createScheduleControl(store, home),
-                reconcile: now => reconcileSchedules(store, home, now, options.onError)
+                reconcile: now => {
+                    reconcileProjectSync(store, now, options.onError);
+                    reconcileSchedules(store, home, now, options.onError);
+                }
             },
             capabilityDispatcher: createCapabilityDispatcher(kernel.capabilities),
             ...(continuationReconciler === undefined ? {} : { continuationReconciler }),

package/dist/controller/scheduleControl.js

@@ -1,11 +1,14 @@
+import { randomUUID } from "node:crypto";
 import { requireKnownFields } from "../domain/validation.js";
-import { nextScheduleDue, scheduleId, validateSchedule } from "../schedule/schedule.js";
-import { admitJobRun, authorizeDefinition, authorizeScope, createJobDefinitionControl } from "./jobDefinitionControl.js";
+import { nextScheduleDue, scheduleId, validateSchedule, validateScheduleTarget } from "../schedule/schedule.js";
+import { admitJobRun, instantiateJobRun, authorizeDefinition, authorizeScope, authorizeRunRead } from "./jobDefinitionControl.js";
 import { jobAuthorityBinding } from "./jobControl.js";
 import { createGlobalRoleMessage } from "../message/message.js";
 import { createTaskEvent } from "../event/taskEvent.js";
 import { enqueueSupervisorEvent } from "../scheduler/operatorEvent.js";
 import { redactLaunchText } from "../runtime/launchDiagnostics.js";
+import { requireScheduleService, scheduleServiceBinding } from "../job/scheduleService.js";
+import { updateProjectSync } from "../job/projectSync.js";
 function binding(store, caller, scope) {
     return jobAuthorityBinding(store, caller.scope, caller.role, scope.kind === "task" ? scope.taskId : "");
 }
@@ -19,13 +22,35 @@ function authorizeSchedule(store, schedule, caller, write) {
 function fence(schedule, now) {
     return new Date(Math.max(now.getTime(), Date.parse(schedule?.processedThrough ?? "") || 0));
 }
-export function createScheduleControl(store, home) {
+function authorization(store, plan, job, caller, now, requested, previous) {
+    if (requested !== undefined && requested !== "session" && requested !== "service")
+        throw new Error("Invalid Schedule authorization choice.");
+    if (plan.target.kind === "new-job" && plan.target.definitionRevision !== job.revision) {
+        throw new Error("Source Job revision changed; select its exact available revision.");
+    }
+    if (requested === "service") {
+        const grantId = randomUUID();
+        return { kind: "service", service: "schedule", grantId, revoked: false, jobRevision: job.revision,
+            grantedBy: structuredClone(caller), grantedAt: now.toISOString(),
+            binding: scheduleServiceBinding(store, plan, job, grantId) };
+    }
+    if (requested === undefined && previous?.kind === "service") {
+        if (previous.revoked || previous.binding !== scheduleServiceBinding(store, plan, job, previous.grantId)) {
+            throw new Error("Changed or revoked service authority requires explicit authorization=service.");
+        }
+        return previous;
+    }
+    if (caller.scope === "user")
+        throw new Error("Public Schedule creation/rebinding requires explicit authorization=service.");
+    return { kind: "session", caller: structuredClone(caller), binding: binding(store, caller, plan.scope), jobRevision: job.revision };
+}
+export function createScheduleControl(store, _home) {
     return (value, now) => {
         if (value === null || typeof value !== "object" || Array.isArray(value))
             throw new Error("Invalid Schedule request.");
-        requireKnownFields(value, ["op", "scope", "caller", "id", "jobId", "rule", "expectedRevision"], "Schedule request");
+        requireKnownFields(value, ["op", "scope", "caller", "id", "jobId", "target", "authorization", "rule", "expectedRevision"], "Schedule request");
         const input = value;
-        authorizeScope(store, input.scope, input.caller);
+        authorizeScope(store, input.scope, input.caller, true);
         return store.transaction(tx => {
             if (input.op === "list") {
                 return tx.listSchedules(input.scope).filter(s => {
@@ -45,9 +70,13 @@ export function createScheduleControl(store, home) {
                 const job = tx.getJobDefinition(input.scope, input.jobId);
                 if (job === null)
                     throw new Error("Schedule Job definition is missing.");
+                if (job.builtin)
+                    throw new Error("Builtin Job has one installed Schedule; manage that Schedule instead.");
                 if (previous !== null) {
                     authorizeSchedule(tx, previous, input.caller, false);
-                    if (previous.jobId !== input.jobId || JSON.stringify(previous.rule) !== JSON.stringify(input.rule)) {
+                    if (previous.jobId !== input.jobId || JSON.stringify(previous.rule) !== JSON.stringify(input.rule)
+                        || JSON.stringify(previous.target) !== JSON.stringify(input.target ?? { kind: "existing-job" })
+                        || (input.authorization !== undefined && previous.authorization.kind !== input.authorization)) {
                         throw new Error("Schedule id already exists; use update with its revision.");
                     }
                     return previous;
@@ -56,10 +85,12 @@ export function createScheduleControl(store, home) {
                 const due = nextScheduleDue(input.rule, now);
                 if (due === null)
                     throw new Error("A new once Schedule must be in the future.");
+                const target = validateScheduleTarget(input.target ?? { kind: "existing-job" });
                 const schedule = validateSchedule({
                     schemaVersion: 1, id: input.id, scope: structuredClone(input.scope), jobId: input.jobId,
+                    target,
                     rule: structuredClone(input.rule), state: "enabled", revision: 1, generation: 1, nextDue: due,
-                    authorization: { caller: structuredClone(input.caller), binding: binding(tx, input.caller, input.scope), jobRevision: job.revision },
+                    authorization: authorization(tx, { id: input.id, scope: input.scope, jobId: input.jobId, target }, job, input.caller, now, input.authorization),
                     createdAt: now.toISOString(), updatedAt: now.toISOString()
                 });
                 tx.saveSchedule(schedule);
@@ -69,20 +100,40 @@ export function createScheduleControl(store, home) {
                 throw new Error("Schedule not found.");
             authorizeSchedule(tx, previous, input.caller, false);
             if (input.op === "show") {
-                const runs = createJobDefinitionControl(tx, home)({
-                    op: "runs", scope: input.scope, id: previous.jobId, caller: input.caller
-                }, now);
-                const ownRuns = runs.filter(r => r.trigger.source === "schedule" && r.trigger.key.startsWith(`${previous.id}:`));
+                const runs = input.scope.kind === "task" ? tx.listDurableJobs(input.scope.taskId) : tx.listGlobalJobRuns();
+                const ownRuns = runs.filter(run => {
+                    if (run.trigger.source !== "schedule" || !run.trigger.key.startsWith(`${previous.id}:`))
+                        return false;
+                    try {
+                        authorizeRunRead(tx, run, input.caller);
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                });
                 const lastSuccess = ownRuns.filter(r => r.status === "succeeded")
                     .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0] ?? null;
-                return { schedule: previous, lastSuccess };
+                return { schedule: previous, lastSuccess, runs: ownRuns };
             }
             if (previous.revision !== input.expectedRevision)
                 throw new Error("Schedule revision changed; read it before modifying.");
+            if (previous.builtin) {
+                if (input.jobId !== undefined || input.target !== undefined || input.authorization !== undefined) {
+                    throw new Error("Builtin Schedule target and service registration cannot be overridden.");
+                }
+                return updateProjectSync(tx, previous, input.op, input.rule, now);
+            }
             let next;
             if (input.op === "disable") {
                 next = { ...previous, state: "disabled", reason: "Explicitly disabled; no future admission. Existing Runs are unchanged." };
             }
+            else if (input.op === "revoke") {
+                if (previous.authorization.kind !== "service")
+                    throw new Error("Only a service grant can be revoked; disable Session plans.");
+                next = { ...previous, state: "disabled", authorization: { ...previous.authorization, revoked: true },
+                    reason: "Service authorization explicitly revoked; future admission and not-yet-started service Runs are denied." };
+            }
             else if (input.op === "enable" || input.op === "update") {
                 if (input.op === "enable" && ["completed", "retired"].includes(previous.state)) {
                     throw new Error("Completed/retired Schedule requires an explicit future rule update.");
@@ -90,7 +141,10 @@ export function createScheduleControl(store, home) {
                 const jobId = input.op === "update" ? input.jobId ?? previous.jobId : previous.jobId;
                 scheduleId(jobId);
                 const rule = input.op === "update" ? input.rule : previous.rule;
+                const target = validateScheduleTarget(input.op === "update" ? input.target ?? previous.target : previous.target);
                 const job = authorizeSchedule(tx, { ...previous, jobId }, input.caller, true);
+                if (job.builtin)
+                    throw new Error("Builtin Job has one installed Schedule.");
                 const after = fence(previous, now);
                 // Once overlap/disabled intent keeps its original due instant on enable.
                 const nextDue = input.op === "enable" && rule.kind === "once"
@@ -98,11 +152,11 @@ export function createScheduleControl(store, home) {
                 if (nextDue === null)
                     throw new Error("Rule must have a future occurrence.");
                 next = {
-                    ...previous, jobId, rule: structuredClone(rule), nextDue,
+                    ...previous, jobId, target, rule: structuredClone(rule), nextDue,
                     state: input.op === "enable" || previous.state === "enabled" ? "enabled" : "disabled",
                     generation: previous.generation + (input.op === "update" ? 1 : 0),
                     processedThrough: after.toISOString(),
-                    authorization: { caller: structuredClone(input.caller), binding: binding(tx, input.caller, input.scope), jobRevision: job.revision }
+                    authorization: authorization(tx, { ...previous, jobId, target }, job, input.caller, now, input.authorization, previous.authorization)
                 };
                 const { reason: _reason, ...withoutReason } = next;
                 next = withoutReason;
@@ -133,18 +187,27 @@ export function reconcileSchedules(store, home, now, onError = () => { }, limit
                         return;
                     }
                 }
-                const job = authorizeSchedule(tx, schedule, schedule.authorization.caller, true);
+                const auth = schedule.authorization;
+                const service = auth.kind === "service" ? { scheduleId: schedule.id, grantId: auth.grantId } : undefined;
+                if (service)
+                    requireScheduleService(tx, service);
+                const caller = auth.kind === "session" ? auth.caller : { scope: "user" };
+                const job = authorizeSchedule(tx, schedule, caller, true);
                 if (job.revision !== schedule.authorization.jobRevision
-                    || binding(tx, schedule.authorization.caller, schedule.scope) !== schedule.authorization.binding) {
+                    || (auth.kind === "session" && binding(tx, caller, schedule.scope) !== auth.binding)) {
                     throw new Error("Schedule authority or Job revision changed; inspect and explicitly enable.");
                 }
-                const result = admitJobRun(tx, home, schedule.scope, schedule.jobId, schedule.authorization.caller, { source: "schedule", key: `${schedule.id}:${schedule.generation}:${dueAt}` }, now);
+                const trigger = { source: "schedule", key: `${schedule.id}:${schedule.generation}:${dueAt}` };
+                const result = schedule.target.kind === "existing-job"
+                    ? admitJobRun(tx, home, schedule.scope, schedule.jobId, caller, trigger, now, undefined, service)
+                    : instantiateJobRun(tx, home, schedule.scope, schedule.jobId, schedule.target.definitionRevision, caller, trigger, now, service);
                 const overlap = result.reason === "overlap";
                 const nextDue = overlap && schedule.rule.kind === "once" ? dueAt : nextScheduleDue(schedule.rule, after);
                 tx.saveSchedule({
                     ...schedule, nextDue, state: nextDue === null ? "completed" : "enabled",
                     processedThrough: after.toISOString(), revision: schedule.revision + 1,
-                    lastAttempt: { at: now.toISOString(), dueAt, outcome: overlap ? "overlap" : "admitted", runId: result.run.id },
+                    lastAttempt: { at: now.toISOString(), dueAt, generation: schedule.generation,
+                        outcome: overlap ? "overlap" : "admitted", jobId: result.run.definitionId, runId: result.run.id },
                     updatedAt: now.toISOString()
                 });
             });
@@ -157,14 +220,14 @@ export function reconcileSchedules(store, home, now, onError = () => { }, limit
                 if (current?.state !== "enabled" || current.revision !== candidate.revision)
                     return;
                 tx.saveSchedule({ ...current, state: "needs-attention", reason, revision: current.revision + 1,
-                    lastAttempt: { at: now.toISOString(), dueAt: current.nextDue, outcome: "blocked", reason },
+                    lastAttempt: { at: now.toISOString(), dueAt: current.nextDue, generation: current.generation, outcome: "blocked", reason },
                     updatedAt: now.toISOString() });
                 if (current.scope.kind === "task") {
                     const event = createTaskEvent(tx.nextEventId(current.scope.taskId), current.scope.taskId, "schedule.needs-attention", { scheduleId: current.id, reason }, now);
                     tx.saveEvent(current.scope.taskId, event);
                     enqueueSupervisorEvent(tx, event, "leader", "schedule-needs-attention", now);
                 }
-                else {
+                else if (tx.getGlobalRole("operator") !== null) {
                     tx.saveGlobalRoleMessage(createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), "operator", `Yui-Summary: Schedule ${current.id} needs attention; no Run was admitted.\n`
                         + `Reason: ${reason}\nRead: yui schedule show --global --schedule ${current.id}\n`
                         + "Inspect the original intent before explicitly enabling; no new authority is implied.", "system", { type: "system" }, now, { inputControl: { action: "queue", requestId: `schedule-attention:${current.id}:${current.revision}` } }));

package/dist/integration/gitIntegrationService.js

@@ -460,6 +460,8 @@ export class GitIntegrationService {
      */
     async #resumeCheckJob(attempt, workspace, path, repositoryPath, gate) {
         const job = await this.jobPort.getJob(attempt.taskId, attempt.jobId);
+        if (job.delegation)
+            throw new Error("Task delegation is not an Integration check Job.");
         assertCheckJobIdentity(attempt, job, path);
         await assertIntegrationCandidate(path, job.head, workspace.branch);
         await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.beforeCommit, this.#targetCheckout(attempt));