@zq-silk/yui 2.10.0 → 2.12.0

package/dist/job/projectRefreshRunner.js

@@ -2,38 +2,74 @@
  * Controlled Project domain action invoked by the artifact-only Job runner.
  * Its catalog connection is read-only; only the shared domain service writes Git.
  */
-import { resolve } from "node:path";
+import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { SqliteTaskStore } from "../storage/sqliteStore.js";
 import { authorizeGlobalJobStart } from "../controller/jobDefinitionControl.js";
 import { refreshRegisteredProject } from "../repository/projectRefresh.js";
 import { projectRefreshDigest } from "./builtinJob.js";
 import { CliError } from "../errors/cliError.js";
+import { writeTextFileAtomically } from "../storage/durableFile.js";
+import { runReference } from "./jobBusinessResult.js";
+import { requireProjectSyncCheckout } from "./projectSync.js";
 export async function runProjectRefresh(home, runId) {
     const store = new SqliteTaskStore(home, { readonly: true });
     try {
         const run = store.getGlobalJobRun(runId);
-        if (!run || run.action !== "project.refresh" || !["queued", "running"].includes(run.status)
-            || run.operation.effect !== "possible" || run.cancelRequestedAt) {
+        if (!run || run.action !== "project.refresh"
+            || !((run.status === "queued" && run.operation.effect === "possible")
+                || (run.status === "running" && run.operation.effect === "confirmed"))
+            || run.cancelRequestedAt) {
             throw new Error("No active admitted project.refresh Run.");
         }
-        authorizeGlobalJobStart(store, run);
-        const result = await refreshRegisteredProject(store, run.projectId, {
-            automatic: true,
-            expectedDigest: projectRefreshDigest({
-                kind: "builtin", action: run.action, projectId: run.projectId, input: run.actionInput
-            }),
-            beforeRefresh: () => {
-                const current = store.getGlobalJobRun(runId);
-                if (!current || !["queued", "running"].includes(current.status) || current.cancelRequestedAt) {
-                    throw new Error("Project refresh Run stopped while waiting for maintenance.");
+        let result;
+        try {
+            // A revoked/stale grant before Git is a known refusal. Persist its
+            // business receipt just like a refusal after waiting for maintenance.
+            authorizeGlobalJobStart(store, run);
+            result = await refreshRegisteredProject(store, run.projectId, {
+                automatic: true,
+                expectedDigest: projectRefreshDigest({
+                    kind: "builtin", action: run.action, projectId: run.projectId, input: run.actionInput
+                }),
+                beforeRefresh: () => {
+                    const current = store.getGlobalJobRun(runId);
+                    if (!current || !["queued", "running"].includes(current.status) || current.cancelRequestedAt) {
+                        throw new Error("Project refresh Run stopped while waiting for maintenance.");
+                    }
+                    authorizeGlobalJobStart(store, current);
+                    const job = store.getJobDefinition({ kind: "global" }, current.definitionId);
+                    if (job?.builtin)
+                        requireProjectSyncCheckout(store, job);
                 }
-                authorizeGlobalJobStart(store, current);
-            }
-        });
-        process.stdout.write(JSON.stringify({ action: run.action, projectId: run.projectId,
+            });
+        }
+        catch (error) {
+            const details = error instanceof CliError ? error.details : {};
+            const partial = details.refresh;
+            const business = {
+                schemaVersion: 1, sourceRun: runReference(run),
+                outcome: partial?.changed === null ? "unknown-needs-attention" : "failed",
+                summary: error instanceof Error ? error.message : String(error),
+                data: JSON.parse(JSON.stringify({ action: run.action, projectId: run.projectId,
+                    target: run.actionInput, observedAt: new Date().toISOString(), details })),
+                evidence: []
+            };
+            writeTextFileAtomically(join(home, run.artifactsLocator, "business-result.json"), JSON.stringify(business) + "\n");
+            throw error;
+        }
+        const data = { action: run.action, projectId: run.projectId,
             trigger: run.trigger, outcome: "succeeded", observedAt: new Date().toISOString(),
-            remoteCheck: { status: "verified", commit: result.toCommit }, refresh: result }) + "\n");
+            remoteCheck: { status: "verified", commit: result.toCommit }, refresh: result };
+        const business = {
+            schemaVersion: 1, sourceRun: runReference(run), outcome: "succeeded",
+            summary: `Project ${run.projectId} refreshed to ${result.toCommit}.`,
+            data: JSON.parse(JSON.stringify(data)), evidence: []
+        };
+        // Persist separately from stdout. If this write fails after Git effects,
+        // the collector reports unknown, never a safely retryable failed action.
+        writeTextFileAtomically(join(home, run.artifactsLocator, "business-result.json"), JSON.stringify(business) + "\n");
+        process.stdout.write(JSON.stringify(data) + "\n");
     }
     finally {
         store.close();

package/dist/job/projectSync.js

@@ -0,0 +1,162 @@
+import { randomUUID } from "node:crypto";
+import { lstatSync, realpathSync } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
+import { join, resolve } from "node:path";
+import { managedProjectPath } from "../repository/project.js";
+import { requireRefreshProject, projectRefreshTargetDigest } from "../repository/projectRefresh.js";
+import { createJobDefinition, reviseJobDefinition, validateJobDefinition } from "./jobDefinition.js";
+import { nextScheduleDue, validateScheduleRule } from "../schedule/schedule.js";
+import { scheduleServiceBinding } from "./scheduleService.js";
+const scope = { kind: "global" };
+const unavailable = "Project sync unavailable: ";
+export const PROJECT_SYNC_INTERVAL_MS = 6 * 60 * 60_000;
+/** Called under the maintenance lock immediately before Git, not a timer probe. */
+export function requireProjectSyncCheckout(store, job) {
+    requireProjectSyncTarget(store, job);
+    const path = managedProjectPath(store.rootDirectory(), job.configuration.kind === "builtin" ? job.configuration.projectId : "");
+    if (realpathSync(path) !== path || !lstatSync(join(path, ".git")).isDirectory()
+        || lstatSync(join(path, ".git")).isSymbolicLink()) {
+        throw new Error("Builtin sync requires its own canonical checkout, not a linked or shared worktree.");
+    }
+}
+/** Current registry and maintenance source, not the builtin label, bound authority. */
+export function requireProjectSyncTarget(store, job) {
+    if (job.builtin !== "project-sync" || job.configuration.kind !== "builtin")
+        throw new Error("Not a builtin Project sync.");
+    validateJobDefinition(job);
+    const project = requireRefreshProject(store, job.configuration.projectId, true);
+    if (resolve(project.path) !== managedProjectPath(store.rootDirectory(), project.id)) {
+        throw new Error("Project sync requires its canonical managed checkout.");
+    }
+    if (!isDeepStrictEqual(job.configuration.input, { targetDigest: projectRefreshTargetDigest(project) })) {
+        throw new Error("Project sync target changed; await registry reconciliation.");
+    }
+    const custom = store.listJobDefinitions(scope).find(other => !other.builtin && !other.instantiation
+        && other.configuration.kind === "builtin" && other.configuration.action === "project.refresh"
+        && other.configuration.projectId === project.id);
+    if (custom)
+        throw new Error(`Existing custom maintenance Job ${custom.id}; builtin sync does not take it over. Explicitly retarget that Job before enabling builtin sync.`);
+}
+function grant(store, plan, job, now) {
+    requireProjectSyncTarget(store, job);
+    const grantId = randomUUID();
+    return { kind: "service", service: "schedule", grantId, revoked: false, jobRevision: job.revision,
+        grantedBy: { scope: "service", service: "project-sync" }, grantedAt: now.toISOString(),
+        binding: scheduleServiceBinding(store, plan, job, grantId) };
+}
+/** Called by the existing Controller Schedule pass, with no timer or Git effects. */
+export function reconcileProjectSync(store, now, onError = () => { }) {
+    const ids = new Set([...store.listProjects().map(p => p.id),
+        ...store.listSchedules(scope).flatMap(s => s.builtin ? [s.builtin.projectId] : [])]);
+    for (const projectId of ids) {
+        try {
+            store.transaction(tx => {
+                const id = `project-sync-${projectId}`;
+                const project = tx.listProjects().find(p => p.id === projectId);
+                let job = tx.getJobDefinition(scope, id);
+                let plan = tx.getSchedule(scope, id);
+                if ((job && job.builtin !== "project-sync") || (plan && !plan.builtin)) {
+                    throw new Error(`Reserved builtin identity ${id} is occupied; existing records were not adopted.`);
+                }
+                if (!job && !project)
+                    return;
+                let changed = false;
+                if (project) {
+                    const configuration = { kind: "builtin", action: "project.refresh", projectId,
+                        input: { targetDigest: projectRefreshTargetDigest(project) } };
+                    if (!job) {
+                        job = validateJobDefinition({ ...createJobDefinition({ id, scope, title: `Project sync · ${project.name}`, configuration }, now),
+                            builtin: "project-sync" });
+                        tx.saveJobDefinition(job);
+                        changed = true;
+                    }
+                    else if (!isDeepStrictEqual(job.configuration, configuration)) {
+                        job = reviseJobDefinition(job, { title: job.title, configuration }, now);
+                        tx.saveJobDefinition(job);
+                        changed = true;
+                    }
+                }
+                if (!job)
+                    throw new Error(`Builtin Project sync definition missing: ${id}.`);
+                let reason;
+                try {
+                    requireProjectSyncTarget(tx, job);
+                }
+                catch (error) {
+                    reason = unavailable + (error instanceof Error ? error.message : String(error));
+                }
+                if (!plan) {
+                    const rule = { kind: "interval", anchor: new Date(now.getTime() + PROJECT_SYNC_INTERVAL_MS).toISOString(),
+                        everyMs: PROJECT_SYNC_INTERVAL_MS };
+                    const grantId = randomUUID();
+                    plan = { schemaVersion: 1, id, scope, jobId: id, target: { kind: "existing-job" }, rule,
+                        builtin: { projectId, enabled: true }, revision: 1, generation: 1,
+                        state: reason ? "needs-attention" : "enabled", nextDue: nextScheduleDue(rule, now),
+                        authorization: { kind: "service", service: "schedule", grantId, revoked: true, jobRevision: job.revision,
+                            grantedBy: { scope: "service", service: "project-sync" }, grantedAt: now.toISOString(),
+                            binding: scheduleServiceBinding(tx, { id, scope, jobId: id, target: { kind: "existing-job" } }, job, grantId) },
+                        ...(reason ? { reason } : {}), createdAt: now.toISOString(), updatedAt: now.toISOString() };
+                    if (!reason)
+                        plan = { ...plan, authorization: grant(tx, plan, job, now) };
+                    tx.saveSchedule(plan);
+                    return;
+                }
+                const original = plan;
+                if (plan.authorization.kind !== "service")
+                    throw new Error("Builtin Schedule requires service authority.");
+                if (reason || !plan.builtin.enabled) {
+                    plan = { ...plan, state: plan.builtin.enabled ? "needs-attention" : "disabled",
+                        reason: reason ?? "Project sync disabled by user.",
+                        authorization: { ...plan.authorization, revoked: true } };
+                }
+                else if (changed || plan.reason?.startsWith(unavailable)) {
+                    const { reason: _reason, ...rest } = plan;
+                    const after = new Date(Math.max(now.getTime(), Date.parse(plan.processedThrough ?? "") || 0));
+                    plan = { ...rest, state: "enabled", nextDue: nextScheduleDue(plan.rule, after),
+                        processedThrough: after.toISOString(), generation: plan.generation + 1,
+                        authorization: grant(tx, plan, job, now) };
+                }
+                // Unchanged dispatch failures are visible, not automatically retried/re-authorized.
+                if (!isDeepStrictEqual(original, plan))
+                    tx.saveSchedule({
+                        ...plan, revision: original.revision + 1, updatedAt: now.toISOString()
+                    });
+            });
+        }
+        catch (error) {
+            onError(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+}
+/** Narrow user override. No alternative writable target or authorization surface. */
+export function updateProjectSync(store, previous, op, rule, now) {
+    if (!previous.builtin || previous.authorization.kind !== "service")
+        throw new Error("Not a builtin Schedule.");
+    if (!["enable", "disable", "revoke", "update"].includes(op))
+        throw new Error("Unsupported builtin Schedule operation.");
+    const nextRule = rule ?? previous.rule;
+    validateScheduleRule(nextRule);
+    if (nextRule.kind === "once" || (nextRule.kind === "interval" && nextRule.everyMs < 60_000)) {
+        throw new Error("Builtin sync requires a recurring rule (interval at least 60000ms, or five-field cron).");
+    }
+    const enabled = op === "enable" ? true : ["disable", "revoke"].includes(op) ? false : previous.builtin.enabled;
+    const after = new Date(Math.max(now.getTime(), Date.parse(previous.processedThrough ?? "") || 0));
+    const { reason: _reason, ...rest } = previous;
+    let next = { ...rest, builtin: { ...previous.builtin, enabled }, rule: structuredClone(nextRule),
+        state: enabled ? "enabled" : "disabled", revision: previous.revision + 1,
+        generation: previous.generation + (op === "update" ? 1 : 0), updatedAt: now.toISOString(),
+        nextDue: nextScheduleDue(nextRule, after), processedThrough: after.toISOString() };
+    if (!enabled)
+        next = { ...next, reason: "Project sync disabled by user.",
+            authorization: { ...previous.authorization, revoked: true } };
+    else {
+        const job = store.getJobDefinition(scope, previous.jobId);
+        if (!job)
+            throw new Error("Builtin definition missing.");
+        requireProjectSyncTarget(store, job);
+        next = { ...next, authorization: previous.authorization.revoked || op === "enable"
+                ? grant(store, next, job, now) : previous.authorization };
+    }
+    store.saveSchedule(next);
+    return next;
+}

package/dist/job/scheduleService.js

@@ -0,0 +1,55 @@
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { requireProjectSyncTarget } from "./projectSync.js";
+/** Internal compiled registration, not a caller identity accepted by RPC. */
+const actions = new Set(["system.noop", "project.refresh"]);
+export function requireServiceTarget(job) {
+    if (job.scope.kind !== "global" || job.configuration.kind !== "builtin"
+        || !actions.has(job.configuration.action))
+        throw new Error("Schedule service is not registered for this scope/action.");
+}
+export function scheduleServiceBinding(store, schedule, job, grantId) {
+    requireServiceTarget(job);
+    return createHash("sha256").update(JSON.stringify([
+        "schedule-service/v1", store.getHomeIdentity().homeId, grantId,
+        schedule.id, schedule.scope, schedule.jobId, schedule.target, job
+    ])).digest("hex");
+}
+export function requireScheduleService(store, ref) {
+    const schedule = store.getSchedule({ kind: "global" }, ref.scheduleId);
+    const auth = schedule?.authorization;
+    if (!schedule || auth?.kind !== "service" || auth.revoked || auth.grantId !== ref.grantId) {
+        throw new Error("Schedule service authority was revoked; no execution was started.");
+    }
+    const source = store.getJobDefinition(schedule.scope, schedule.jobId);
+    if (!source || source.revision !== auth.jobRevision
+        || scheduleServiceBinding(store, schedule, source, auth.grantId) !== auth.binding) {
+        throw new Error("Schedule service target or authority changed; explicitly reauthorize.");
+    }
+    if (schedule.builtin) {
+        if (!schedule.builtin.enabled)
+            throw new Error("Builtin Project sync was disabled.");
+        requireProjectSyncTarget(store, source);
+    }
+    return schedule;
+}
+/** Bind each immutable Run to its exact stored grant, definition and input. */
+export function serviceRunBinding(store, run, schedule) {
+    return createHash("sha256").update(JSON.stringify([
+        "schedule-service-run/v1", store.getHomeIdentity().homeId, schedule.authorization.binding,
+        run.serviceAuthorization, run.id, run.definitionId, run.definitionRevision,
+        run.action, run.projectId, run.actionInput, run.trigger, run.operation.requestId
+    ])).digest("hex");
+}
+export function authorizeServiceJob(store, job, ref, key) {
+    const schedule = requireScheduleService(store, ref);
+    const source = store.getJobDefinition(schedule.scope, schedule.jobId);
+    const matches = schedule.target.kind === "existing-job" ? job.id === source.id
+        : job.instantiation?.sourceId === source.id && job.instantiation.sourceRevision === source.revision
+            && job.instantiation.key === key;
+    if (!matches || !key.startsWith(`${schedule.id}:`)
+        || !isDeepStrictEqual(job.configuration, source.configuration)) {
+        throw new Error("Job is outside the Schedule service authority target.");
+    }
+    return schedule;
+}

package/dist/job/taskDelegation.js

@@ -0,0 +1,48 @@
+import { requireIdentity, requireKnownFields, requireText } from "../domain/validation.js";
+import { createTask, validateTask } from "../task/task.js";
+import { createHash } from "node:crypto";
+/** WorkItem revision also advances on execution/candidate submission. Freeze
+ * requirements, not that mutable progress counter, as the delegated scope. */
+export function workItemDefinitionDigest(work) {
+    return createHash("sha256").update(JSON.stringify([work.title, work.objective, work.acceptance,
+        work.dependsOn, work.writeProjectIds, work.baseRefs ?? null])).digest("hex");
+}
+export function validateTaskJobConfiguration(config) {
+    requireKnownFields(config, ["kind", "goal", "target"], "Task Job");
+    if (config.target.kind === "new") {
+        requireKnownFields(config.target, ["kind", "title", "description", "type", "projectBindings"], "New Task target");
+        if (!["delivery", "task-created"].includes(config.goal))
+            throw new Error("New Task requires a delivery or explicit task-created goal.");
+        requireText(config.target.description, "Task requirements");
+        if (!Array.isArray(config.target.projectBindings))
+            throw new Error("Explicit Task Project bindings required.");
+        for (const binding of config.target.projectBindings) {
+            requireKnownFields(binding, ["projectId", "directory", "baseRef"], "Draft Project binding");
+        }
+        validateTask(createTask("task-1", config.target.title, new Date(0), config.target));
+    }
+    else if (config.target.kind === "work-item" && config.goal === "work-item") {
+        requireKnownFields(config.target, ["kind", "taskId", "workItemId", "revision"], "WorkItem target");
+        requireIdentity(config.target.taskId, "Target Task");
+        requireIdentity(config.target.workItemId, "Target WorkItem");
+        if (!/^task-\d+$/u.test(config.target.taskId) || !/^work-item-\d+$/u.test(config.target.workItemId)
+            || !Number.isSafeInteger(config.target.revision) || config.target.revision < 1)
+            throw new Error("Exact WorkItem scope and revision required.");
+    }
+    else
+        throw new Error("Invalid Task delegation target/goal.");
+}
+export function validateTaskDelegation(value) {
+    requireKnownFields(value, ["taskId", "goal", "workItemId", "workItemRevision", "workItemDefinitionDigest"], "Task delegation");
+    if (!/^task-\d+$/u.test(value.taskId))
+        throw new Error("Invalid delegated Task.");
+    if (value.goal === "work-item") {
+        if (!/^work-item-\d+$/u.test(value.workItemId ?? "")
+            || !Number.isSafeInteger(value.workItemRevision) || value.workItemRevision < 1
+            || !/^[a-f0-9]{64}$/u.test(value.workItemDefinitionDigest ?? ""))
+            throw new Error("Exact delegated WorkItem required.");
+    }
+    else if (!["delivery", "task-created"].includes(value.goal) || value.workItemId !== undefined
+        || value.workItemRevision !== undefined || value.workItemDefinitionDigest !== undefined)
+        throw new Error("Invalid delegated goal.");
+}

package/dist/message/messageContinuation.js

@@ -32,7 +32,7 @@ export function resolveMessageRecipient(store, taskId, roleName, scope) {
 /** Current Assignment authority, independent of eligibility to start a new Run.
  * A Reviewer still owns its frozen clarification when Task main advances. */
 export function messageAssignmentBlocker(store, message) {
-    if (isTaskRecordRetired(store.listEvents(message.taskId), "message", message.id))
+    if (message.id !== undefined && isTaskRecordRetired(store.listEvents(message.taskId), "message", message.id))
         return "message-retired";
     const target = message.recipient;
     if (target?.ownerRunId === undefined)

package/dist/resources/projectResourceService.js

@@ -308,7 +308,7 @@ export function createProjectResources(store, now = () => new Date()) {
                             || (run.workspace && overlaps(run.workspace.root, value.directory.path))))
                         || sessionSets.some((set) => [...Object.values(set.sessions), ...(set.history ?? [])].some((session) => session.status === "active" && references(session.effective.executionEnvironment)))
                         || tx.listDurableJobs(taskId).some((job) => ["queued", "running", "unknown-needs-attention"].includes(job.status)
-                            && overlaps(job.workspace, value.directory.path))))
+                            && !job.delegation && overlaps(job.workspace, value.directory.path))))
                         throw new Error("Environment still has a live or unknown execution reference.");
                 }
                 if (value.directory?.ownership === "preparation") {

package/dist/resources/resourceGc.js

@@ -43,7 +43,7 @@ export function readResourceGcState(store) {
                 }),
                 ...reader.listDurableJobs(task.id).filter(job => job.status === "queued" || job.status === "running"
                     || (job.status === "unknown-needs-attention" && job.acknowledgedAt === undefined))
-                    .map(job => job.workspace)
+                    .flatMap(job => job.delegation ? [] : [job.workspace])
             ])
         };
     });

package/dist/role/role.js

@@ -1,9 +1,11 @@
 import { isDeepStrictEqual } from "node:util";
+import { requireKnownFields } from "../domain/validation.js";
+import { jobScopeKey } from "../job/jobDefinition.js";
 import { validateExecutionEnvironmentSnapshot } from "../resources/projectResource.js";
 import { isAgentAdapterId } from "../agent/adapterCatalog.js";
 import { adapterIdForExecutionComponent, resolveAgentExecutionComponent } from "../agent/executionComponents.js";
 import { defaultRoleAgentConfig, resolveAgentAdapter } from "../executor/agentAdapter.js";
-import { validateRoleSessionSet } from "../executor/agentExecutor.js";
+import { roleAgentSessionRef, validateRoleSessionSet } from "../executor/agentExecutor.js";
 /**
  * The Agent argument is the stored record, not a hand-picked pair of fields.
  * `component` is required for exactly that reason: an Agent registered as the
@@ -159,24 +161,22 @@ export function unbindRoleAgent(role, sessions, agentId, now) {
         const globalSessions = sessions.owner.scope === "global"
             ? sessions
             : null;
-        const targetHistory = globalSessions === null
-            ? []
-            : Object.entries(globalSessions.history ?? {}).filter(([, session]) => (session.agentId === normalizedAgentId));
-        const targetTaskHistory = (taskSessions?.history ?? []).filter((session) => (session.agentId === normalizedAgentId));
-        if (targetSession !== undefined || targetHistory.length > 0 || targetTaskHistory.length > 0) {
+        if (targetSession !== undefined) {
             const remainingSessions = { ...sessions.sessions };
             delete remainingSessions[normalizedAgentId];
-            const remainingHistory = globalSessions === null
+            // Unbinding removes execution selection, not identity evidence. Otherwise
+            // a stopped native-ID-only caller could later be mistaken for public.
+            const history = globalSessions === null
                 ? undefined
-                : Object.fromEntries(Object.entries(globalSessions.history ?? {}).filter(([, session]) => (session.agentId !== normalizedAgentId)));
-            const remainingTaskHistory = taskSessions === null
+                : { ...globalSessions.history, [roleAgentSessionRef(targetSession)]: targetSession };
+            const taskHistory = taskSessions === null
                 ? undefined
-                : (taskSessions.history ?? []).filter((session) => (session.agentId !== normalizedAgentId));
+                : [...(taskSessions.history ?? []), targetSession];
             updatedSessions = validateRoleSessionSet({
                 ...sessions,
                 sessions: remainingSessions,
-                ...(remainingHistory === undefined ? {} : { history: remainingHistory }),
-                ...(remainingTaskHistory === undefined ? {} : { history: remainingTaskHistory }),
+                ...(history === undefined ? {} : { history }),
+                ...(taskHistory === undefined ? {} : { history: taskHistory }),
                 updatedAt: now.toISOString()
             });
         }
@@ -191,6 +191,16 @@ export function unbindRoleAgent(role, sessions, agentId, now) {
 export function validateGlobalRole(role) {
     if (Object.hasOwn(role, "taskId"))
         throw new Error("Global Role cannot carry a Task identity.");
+    if (role.jobOwner !== undefined) {
+        requireKnownFields(role.jobOwner, ["scope", "jobId", "runId"], "Job Role owner");
+        requireKnownFields(role.jobOwner.scope, role.jobOwner.scope.kind === "task" ? ["kind", "taskId"] : ["kind"], "Job Role scope");
+        if (!["task", "global"].includes(role.jobOwner.scope.kind) || role.name === "operator")
+            throw new Error("Invalid Job Role owner.");
+        jobScopeKey(role.jobOwner.scope);
+        requireSafeIdentity(role.jobOwner.jobId, "Job Role owner id");
+        if (role.jobOwner.runId !== undefined)
+            requireSafeIdentity(role.jobOwner.runId, "Job Role Run id");
+    }
     return validateRoleOwner(role);
 }
 export function validateTaskRole(role) {

package/dist/runtime/managedIdentity.js

@@ -1,6 +1,8 @@
-/** Presence is not authentication. Even partial transport identity must not
- * silently acquire the authority of an unbound public caller. */
+/** Yui-specific hints assert managed intent, not authentication. A provider's
+ * CODEX_THREAD_ID alone is only a lookup hint: resolve it in the selected Home
+ * before routing execution. Partial Yui identity must never become public. */
 export function hasManagedIdentity(environment) {
     return ["YUI_SESSION_SCOPE", "YUI_ROLE", "YUI_AGENT_ID", "YUI_NATIVE_SESSION_ID",
-        "YUI_TASK_ID", "YUI_SESSION_MANIFEST", "CODEX_THREAD_ID"].some(key => environment[key] !== undefined);
+        "YUI_TASK_ID", "YUI_SESSION_MANIFEST", "YUI_ADAPTER_ID", "YUI_WORKSPACE"]
+        .some(key => environment[key] !== undefined);
 }

package/dist/runtime/sessionCaller.js

@@ -15,20 +15,19 @@ export function sessionCallerEnvironment(store, env) {
     if (!native || native.trim() !== native || native.includes("\0")) {
         throw new ManagedRuntimeDriftError("Managed native Session identity is invalid.");
     }
-    // Reuse the existing derived active-Session inventory; no new identity index
-    // or scan of every Task body/history is needed.
-    const matches = store.listRuntimeSessionCandidates().filter(session => session.nativeSessionId === (session.adapterId === "codex" ? env.CODEX_THREAD_ID ?? env.YUI_NATIVE_SESSION_ID : env.YUI_NATIVE_SESSION_ID));
+    const identifies = (session) => session.nativeSessionId === (session.adapterId === "codex" ? env.CODEX_THREAD_ID ?? env.YUI_NATIVE_SESSION_ID : env.YUI_NATIVE_SESSION_ID);
+    const matches = store.findNativeSessionSets([env.CODEX_THREAD_ID, env.YUI_NATIVE_SESSION_ID].filter((id) => id !== undefined)).filter(set => [...Object.values(set.sessions), ...Object.values(set.history ?? {})].some(identifies));
+    if (!matches.length && !hasManagedIdentity(env))
+        return env;
     if (matches.length !== 1) {
         throw new ManagedRuntimeDriftError(matches.length
             ? "Native Session identity is ambiguous in this YUI_HOME; no caller authority was selected."
-            : "Native Session is not registered in this YUI_HOME; refusing to infer public user authority.");
+            : "Managed native Session is not registered in this YUI_HOME. Use its original Home/current Session; do not clear identity hints.");
     }
-    const match = matches[0];
-    const set = match.owner.scope === "global" ? store.getGlobalRoleSessionSet(match.owner.roleName)
-        : store.getTaskRoleSessionSet(match.owner.taskId, match.owner.roleName);
-    const session = set?.sessions[match.agentId];
-    if (set === null || session === undefined || session.nativeSessionId !== match.nativeSessionId) {
-        throw new ManagedRuntimeDriftError("Native Session registration changed during caller resolution; read current state again.");
+    const set = matches[0];
+    const session = set.sessions[set.activeAgentId];
+    if (session === undefined || session.status !== "active" || !identifies(session)) {
+        throw new ManagedRuntimeDriftError("Managed native Session is no longer current in this YUI_HOME. Use the current Session; historical identity cannot become public.");
     }
     const hints = {
         YUI_SESSION_SCOPE: set.owner.scope, YUI_ROLE: set.owner.roleName,

package/dist/schedule/schedule.js

@@ -1,6 +1,7 @@
 import { CronExpressionParser } from "cron-parser";
 import { requireKnownFields, requirePositiveInteger, requireTimestamp, requireText } from "../domain/validation.js";
 import { jobScopeKey } from "../job/jobDefinition.js";
+import { parseDurableJobCaller } from "../controller/jobControl.js";
 export function scheduleId(id) {
     if (typeof id !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/u.test(id)) {
         throw new Error("An explicit safe Schedule/Job id is required.");
@@ -49,16 +50,25 @@ export function nextScheduleDue(rule, after) {
     return CronExpressionParser.parse(rule.expression, { currentDate: after, tz: rule.timezone }).next().toISOString();
 }
 export function validateSchedule(value) {
-    requireKnownFields(value, ["schemaVersion", "id", "scope", "jobId", "rule", "revision", "generation",
-        "state", "nextDue", "processedThrough", "authorization", "lastAttempt", "reason", "createdAt", "updatedAt"], "Schedule");
+    requireKnownFields(value, ["schemaVersion", "id", "scope", "jobId", "target", "rule", "revision", "generation",
+        "state", "nextDue", "processedThrough", "authorization", "builtin", "lastAttempt", "reason", "createdAt", "updatedAt"], "Schedule");
     if (value.schemaVersion !== 1)
         throw new Error("Invalid Schedule schema.");
     scheduleId(value.id);
     scheduleId(value.jobId);
+    validateScheduleTarget(value.target);
     if (!["task", "global"].includes(value.scope.kind))
         throw new Error("Invalid Schedule scope.");
     requireKnownFields(value.scope, value.scope.kind === "task" ? ["kind", "taskId"] : ["kind"], "Schedule scope");
     jobScopeKey(value.scope);
+    if (value.builtin !== undefined) {
+        requireKnownFields(value.builtin, ["projectId", "enabled"], "Builtin Schedule");
+        if (!/^project-\d+$/u.test(value.builtin.projectId) || typeof value.builtin.enabled !== "boolean"
+            || value.scope.kind !== "global" || value.id !== `project-sync-${value.builtin.projectId}`
+            || value.jobId !== value.id || value.target.kind !== "existing-job"
+            || value.authorization.kind !== "service")
+            throw new Error("Invalid builtin Schedule.");
+    }
     validateScheduleRule(value.rule);
     requirePositiveInteger(value.revision, "Schedule revision");
     requirePositiveInteger(value.generation, "Schedule generation");
@@ -74,35 +84,75 @@ export function validateSchedule(value) {
         instant(value.processedThrough);
     instant(value.createdAt);
     instant(value.updatedAt);
-    requireKnownFields(value.authorization, ["caller", "binding", "jobRevision"], "Schedule authorization");
     requirePositiveInteger(value.authorization.jobRevision, "Schedule Job revision");
     if (typeof value.authorization.binding !== "string" || !/^[a-f0-9]{64}$/u.test(value.authorization.binding))
         throw new Error("Invalid Schedule authority binding.");
-    const caller = value.authorization.caller;
-    requireKnownFields(caller, ["scope", "taskId", "role", "agentId", "adapterId", "nativeSessionId", "runId"], "Schedule caller");
-    if (typeof caller.role !== "string" || typeof caller.nativeSessionId !== "string")
-        throw new Error("Schedule authority requires a Role and Session.");
-    requireText(caller.role, "Schedule caller role");
-    requireText(caller.nativeSessionId, "Schedule caller Session");
-    if (caller.scope === "global") {
-        if (caller.role !== "operator")
-            throw new Error("Global Schedule authority requires Operator.");
+    if (value.authorization.kind === "service") {
+        requireKnownFields(value.authorization, ["kind", "service", "grantId", "revoked", "binding", "jobRevision", "grantedBy", "grantedAt"], "Schedule service authorization");
+        if (value.scope.kind !== "global" || value.authorization.service !== "schedule"
+            || typeof value.authorization.revoked !== "boolean")
+            throw new Error("Invalid Schedule service scope or registration.");
+        scheduleId(value.authorization.grantId);
+        instant(value.authorization.grantedAt);
+        if (value.authorization.grantedBy.scope === "service") {
+            requireKnownFields(value.authorization.grantedBy, ["scope", "service"], "Builtin service issuer");
+            if (value.authorization.grantedBy.service !== "project-sync" || value.builtin === undefined) {
+                throw new Error("Invalid builtin service issuer.");
+            }
+        }
+        else {
+            const manager = parseDurableJobCaller(value.authorization.grantedBy);
+            if ((manager.scope === "user" && Object.keys(manager).length !== 1)
+                || (manager.scope !== "user" && (manager.scope !== "global" || manager.role !== "operator" || !manager.nativeSessionId))) {
+                throw new Error("Invalid service grant issuer.");
+            }
+        }
     }
-    else if (caller.scope !== "task" || value.scope.kind !== "task" || caller.taskId !== value.scope.taskId) {
-        throw new Error("Schedule caller must belong to its scope.");
+    else {
+        requireKnownFields(value.authorization, ["kind", "caller", "binding", "jobRevision"], "Schedule authorization");
+        if (value.authorization.kind !== "session")
+            throw new Error("Explicit Schedule authorization kind is required.");
+        const caller = value.authorization.caller;
+        requireKnownFields(caller, ["scope", "taskId", "role", "agentId", "adapterId", "nativeSessionId", "runId"], "Schedule caller");
+        if (typeof caller.role !== "string" || typeof caller.nativeSessionId !== "string")
+            throw new Error("Schedule authority requires a Role and Session.");
+        requireText(caller.role, "Schedule caller role");
+        requireText(caller.nativeSessionId, "Schedule caller Session");
+        if (caller.scope === "global") {
+            if (caller.role !== "operator")
+                throw new Error("Global Schedule authority requires Operator.");
+        }
+        else if (caller.scope !== "task" || value.scope.kind !== "task" || caller.taskId !== value.scope.taskId) {
+            throw new Error("Schedule caller must belong to its scope.");
+        }
     }
     if (value.reason !== undefined)
         requireText(value.reason, "Schedule reason");
     if (value.lastAttempt !== undefined) {
-        requireKnownFields(value.lastAttempt, ["at", "dueAt", "outcome", "runId", "reason"], "Schedule attempt");
+        requireKnownFields(value.lastAttempt, ["at", "dueAt", "outcome", "runId", "jobId", "generation", "reason"], "Schedule attempt");
         instant(value.lastAttempt.at);
         instant(value.lastAttempt.dueAt);
         if (!["admitted", "overlap", "blocked"].includes(value.lastAttempt.outcome))
             throw new Error("Invalid Schedule attempt.");
         if (value.lastAttempt.runId !== undefined)
             requireText(value.lastAttempt.runId, "Schedule Run id");
+        if (value.lastAttempt.jobId !== undefined)
+            scheduleId(value.lastAttempt.jobId);
+        if (value.lastAttempt.generation !== undefined)
+            requirePositiveInteger(value.lastAttempt.generation, "Schedule attempt generation");
         if (value.lastAttempt.reason !== undefined)
             requireText(value.lastAttempt.reason, "Schedule attempt reason");
     }
     return value;
 }
+export function validateScheduleTarget(target) {
+    if (target?.kind === "existing-job")
+        requireKnownFields(target, ["kind"], "Schedule target");
+    else if (target?.kind === "new-job") {
+        requireKnownFields(target, ["kind", "definitionRevision"], "Schedule target");
+        requirePositiveInteger(target.definitionRevision, "Schedule source definition revision");
+    }
+    else
+        throw new Error("Invalid Schedule target.");
+    return target;
+}