@zq-silk/yui 2.11.0 → 2.12.0

package/dist/controller/jobTaskDelegationControl.js

@@ -0,0 +1,193 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createTaskAggregate } from "../commands/taskCommands.js";
+import { isDurableJobTerminal, validateDurableJob } from "../job/durableJob.js";
+import { resultDigest, runReference } from "../job/jobBusinessResult.js";
+import { validateTaskJobConfiguration, workItemDefinitionDigest } from "../job/taskDelegation.js";
+import { assertCallerAuthorized } from "./jobControl.js";
+import { enqueueWork } from "../coordination/workMailboxQueue.js";
+import { isDeepStrictEqual } from "node:util";
+/** Scope authorization is performed by the Job ingress; provenance adds none. */
+export function authorizeTaskJob(store, job, caller, write) {
+    if (job.configuration.kind !== "task")
+        throw new Error("Not a Task delegation.");
+    validateTaskJobConfiguration(job.configuration);
+    if (caller.scope === "task") {
+        if (!write && caller.role === "leader")
+            return;
+        // Creating another Task is a cross-Task effect, not inherited authority.
+        if (caller.role !== "leader" || job.configuration.target.kind === "new"
+            || job.configuration.target.taskId !== caller.taskId) {
+            throw new Error("Task delegation requires exact target authority; source Job scope grants no cross-Task permission.");
+        }
+        assertCallerAuthorized(store, caller, caller.taskId);
+        if (write) {
+            const session = store.getTaskRoleSessionSet(caller.taskId, "leader");
+            const effective = session?.sessions[session.activeAgentId]?.effective;
+            if (effective?.executionAuthority !== "delivery" || effective.profileAccess !== "write") {
+                throw new Error("Task delegation requires a current writable delivery Session.");
+            }
+        }
+    }
+    if (!write)
+        return;
+    if (job.scope.kind === "task") {
+        const source = store.getTask(job.scope.taskId);
+        if (!source || source.status !== "active" || source.executionGate.state !== "enabled")
+            throw new Error("Source Task is not executable.");
+    }
+    const target = job.configuration.target;
+    if (target.kind === "new") {
+        for (const binding of target.projectBindings) {
+            const project = store.listProjects().find(project => project.id === binding.projectId);
+            if (!project || project.status !== "active")
+                throw new Error("Target Project is not active.");
+        }
+    }
+    else {
+        const task = store.getTask(target.taskId);
+        const work = store.getWorkItem(target.taskId, target.workItemId);
+        if (!task || task.status !== "active" || task.executionGate.state !== "enabled"
+            || !work || work.status !== "open" || work.revision !== target.revision) {
+            throw new Error("An exact open WorkItem revision in an executable Task is required.");
+        }
+    }
+}
+/** Inside Run admission's transaction: Task/Leader + Run + association commit together. */
+export function admitTaskJob(store, job, caller, trigger, requestId, now, retryOf) {
+    const config = job.configuration;
+    const id = job.scope.kind === "global" ? `job-${randomUUID()}` : store.nextDurableJobId(job.scope.taskId);
+    const sourceRun = { scope: job.scope, runId: id };
+    const target = config.target;
+    const taskId = target.kind === "new" ? createTaskAggregate(store, target.title, {
+        description: target.description, projectBindings: target.projectBindings,
+        ...(target.type === undefined ? {} : { type: target.type })
+    }, now, [], { kind: "job-run", jobId: job.id, run: sourceRun }).task.id : target.taskId;
+    const delegation = { taskId, goal: config.goal,
+        ...(target.kind === "work-item" ? { workItemId: target.workItemId, workItemRevision: target.revision,
+            workItemDefinitionDigest: workItemDefinitionDigest(store.getWorkItem(taskId, target.workItemId)) } : {}) };
+    const actorId = caller.scope === "user" ? "user" : `${caller.scope}:${caller.role}`;
+    const inputDigest = resultDigest(JSON.stringify([job, trigger, retryOf]));
+    const locator = `artifacts/jobs/${job.scope.kind === "global" ? "global" : job.scope.taskId}/${id}`;
+    const run = validateDurableJob({
+        schemaVersion: 1,
+        ...(job.scope.kind === "global" ? { scope: "global" }
+            : { taskId: job.scope.taskId, owner: { kind: "task" } }),
+        id, definitionId: job.id, definitionRevision: job.revision, trigger,
+        delegation, artifactsLocator: locator,
+        idempotencyKey: createHash("sha256").update(JSON.stringify([actorId, requestId])).digest("hex"),
+        operation: { requestId, actorId, inputDigest, authorityRef: inputDigest,
+            targetId: taskId, capability: "job.run", implementation: { id: "yui:task-delegation", generation: "1" },
+            effect: "confirmed", receiptRefs: [`tasks/${taskId}`], partialResultRefs: [] },
+        status: "running", startedAt: now.toISOString(),
+        ...(retryOf === undefined ? {} : { retryOf }),
+        createdAt: now.toISOString(), updatedAt: now.toISOString()
+    });
+    saveRun(store, run);
+    if (config.goal === "task-created")
+        return reconcileTaskDelegation(store, run, now);
+    return run;
+}
+function saveRun(store, run) {
+    if ("taskId" in run)
+        store.saveDurableJob(run.taskId, run);
+    else
+        store.saveGlobalJobRun(run);
+}
+/** Collection is transactional, repeatable, and never executes/activates/stops a Task. */
+export function reconcileTaskDelegation(store, observed, now) {
+    return store.transaction(tx => {
+        const run = "taskId" in observed ? tx.getDurableJob(observed.taskId, observed.id) : tx.getGlobalJobRun(observed.id);
+        if (!run || !run.delegation || isDurableJobTerminal(run.status))
+            return run ?? observed;
+        const link = run.delegation;
+        const task = tx.getTask(link.taskId);
+        if (!task)
+            throw new Error("Delegated Task is missing; preserve the exact Run for inspection.");
+        if (link.goal !== "work-item" && (task.source?.jobId !== run.definitionId
+            || !isDeepStrictEqual(task.source.run, runReference(run)))) {
+            throw new Error("Delegated Task creation source does not match the exact Run.");
+        }
+        let outcome;
+        let summary = "";
+        let evidence = [];
+        if (link.goal === "task-created") {
+            outcome = "succeeded";
+            summary = `Explicit creation goal met: ${task.id}; no delivery completion is claimed.`;
+            const event = tx.listEventsByType(task.id, ["task.created"])[0];
+            if (!event)
+                throw new Error("Delegated Task creation evidence is missing.");
+            evidence = [{ kind: "task-result", owner: { kind: "task", taskId: task.id },
+                    sourceRun: runReference(run), version: resultDigest(JSON.stringify(event)), locator: `events/${event.id}` }];
+        }
+        else if (link.goal === "work-item") {
+            const work = tx.getWorkItem(task.id, link.workItemId);
+            if (!work || workItemDefinitionDigest(work) !== link.workItemDefinitionDigest) {
+                outcome = "unknown-needs-attention";
+                summary = "Delegated WorkItem requirements changed or are missing; inspect the exact scope.";
+            }
+            else if (work.status === "retired") {
+                outcome = "failed";
+                summary = `Delegated WorkItem retired: ${work.id}.`;
+            }
+            else if (work.status === "accepted") {
+                const candidate = work.candidates.find(candidate => candidate.id === work.acceptedCandidateId
+                    && candidate.workItemRevision >= link.workItemRevision);
+                if (!candidate)
+                    throw new Error("Accepted delegation has no exact Candidate; preserve evidence.");
+                outcome = "succeeded";
+                summary = work.outcome ?? candidate.summary;
+                evidence = [{ kind: "work-item-result", owner: { kind: "task", taskId: task.id },
+                        sourceRun: runReference(run), version: resultDigest(JSON.stringify(candidate)),
+                        locator: `work-items/${work.id}/candidates/${candidate.id}` }];
+            }
+        }
+        else {
+            // The never-rewritten completion event identifies the exact lifecycle,
+            // even if the Task is reopened before this collector runs.
+            const event = tx.listEventsByType(task.id, ["task.completed"]).find(event => event.createdAt >= run.createdAt);
+            if (event) {
+                outcome = "succeeded";
+                summary = String(event.payload.summary);
+                evidence = [{ kind: "task-result", owner: { kind: "task", taskId: task.id },
+                        sourceRun: runReference(run), version: resultDigest(JSON.stringify(event)), locator: `events/${event.id}` }];
+            }
+            else if (task.status === "cancelled" || (task.status === "archived" && task.completedAt === undefined)) {
+                outcome = "failed";
+                summary = `Delegated Task ended without the requested delivery: ${task.id}.`;
+            }
+            else if (task.completedAt !== undefined) {
+                outcome = "unknown-needs-attention";
+                summary = "Task reports completion without immutable completion-event evidence; inspect the target.";
+            }
+        }
+        // Like process collection, already-proven delivery wins over a late cancel.
+        // Cancelling an unsettled wait never fabricates target resource quiescence.
+        if (!outcome && run.cancelRequestedAt) {
+            outcome = "cancelled";
+            summary = "This Run's delegation was cancelled; the target Task/Leader/WorkItem was not stopped. Inspect its own resources separately.";
+        }
+        if (!outcome)
+            return run;
+        const businessResult = { schemaVersion: 1, sourceRun: runReference(run), outcome,
+            summary, evidence };
+        const next = validateDurableJob({ ...run, status: outcome, businessResult, wakeupNotified: true,
+            terminalAt: now.toISOString(), updatedAt: now.toISOString() });
+        saveRun(tx, next);
+        if ("taskId" in run)
+            enqueueWork(tx, { kind: "role", taskId: run.taskId, roleName: "leader" }, "job-finished", now, [{ type: "task", id: run.taskId }]);
+        else if (run.operation.actorId !== "user")
+            enqueueWork(tx, { kind: "operator" }, "global-job-finished", now, [{ type: "global-job-run", id: run.id }], { source: "global-job", dedupeKey: `operator-global-job-run:${run.id}` });
+        return next;
+    });
+}
+/** Bounded projection only; source permissions never open the target's Context. */
+export function taskDelegationView(store, run) {
+    if (!run.delegation)
+        return null;
+    const task = store.getTask(run.delegation.taskId);
+    return { ...run.delegation, taskStatus: task?.status ?? null,
+        executionGate: task?.executionGate.state ?? null,
+        openInputs: store.listInputRequests(run.delegation.taskId).filter(input => input.status === "open").length,
+        result: run.businessResult ?? null,
+        cancellation: run.cancelRequestedAt ? "requested; target resources not stopped" : null };
+}

package/dist/controller/runtime.js

@@ -57,7 +57,9 @@ import { AgentHostProviderSessionBusyError, AgentHostProviderTurnFenceError, Fil
 import { deliverGlobalInputs } from "./globalInputDelivery.js";
 import { authorizeJobStart } from "./jobControl.js";
 import { authorizeGlobalJobStart, createJobDefinitionControl } from "./jobDefinitionControl.js";
+import { reconcileTaskDelegation } from "./jobTaskDelegationControl.js";
 import { createScheduleControl, reconcileSchedules } from "./scheduleControl.js";
+import { reconcileProjectSync } from "../job/projectSync.js";
 import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
 import { createProviderRetryHooks } from "./providerRetryDelivery.js";
 import { createRuntimeResourceActivityTracker } from "./resourceInventory.js";
@@ -488,6 +490,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             process: kernel.runner,
             artifacts: createFileArtifactPort(home),
             authorizeStart: (job) => "taskId" in job ? authorizeJobStart(store, job) : authorizeGlobalJobStart(store, job),
+            reconcileDelegation: (job, now) => { reconcileTaskDelegation(store, job, now); },
             // rr6/f1: Bounded supervision wake. The supervisor signals the Controller
             // after spawning a runner (queued→running adoption) and when a runner
             // exits (terminal harvest), so a quick job converges without waiting for
@@ -575,7 +578,10 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             jobDefinitions: createJobDefinitionControl(store, home),
             schedules: {
                 control: createScheduleControl(store, home),
-                reconcile: now => reconcileSchedules(store, home, now, options.onError)
+                reconcile: now => {
+                    reconcileProjectSync(store, now, options.onError);
+                    reconcileSchedules(store, home, now, options.onError);
+                }
             },
             capabilityDispatcher: createCapabilityDispatcher(kernel.capabilities),
             ...(continuationReconciler === undefined ? {} : { continuationReconciler }),

package/dist/controller/scheduleControl.js

@@ -1,11 +1,14 @@
+import { randomUUID } from "node:crypto";
 import { requireKnownFields } from "../domain/validation.js";
-import { nextScheduleDue, scheduleId, validateSchedule } from "../schedule/schedule.js";
-import { admitJobRun, authorizeDefinition, authorizeScope, createJobDefinitionControl } from "./jobDefinitionControl.js";
+import { nextScheduleDue, scheduleId, validateSchedule, validateScheduleTarget } from "../schedule/schedule.js";
+import { admitJobRun, instantiateJobRun, authorizeDefinition, authorizeScope, authorizeRunRead } from "./jobDefinitionControl.js";
 import { jobAuthorityBinding } from "./jobControl.js";
 import { createGlobalRoleMessage } from "../message/message.js";
 import { createTaskEvent } from "../event/taskEvent.js";
 import { enqueueSupervisorEvent } from "../scheduler/operatorEvent.js";
 import { redactLaunchText } from "../runtime/launchDiagnostics.js";
+import { requireScheduleService, scheduleServiceBinding } from "../job/scheduleService.js";
+import { updateProjectSync } from "../job/projectSync.js";
 function binding(store, caller, scope) {
     return jobAuthorityBinding(store, caller.scope, caller.role, scope.kind === "task" ? scope.taskId : "");
 }
@@ -19,13 +22,35 @@ function authorizeSchedule(store, schedule, caller, write) {
 function fence(schedule, now) {
     return new Date(Math.max(now.getTime(), Date.parse(schedule?.processedThrough ?? "") || 0));
 }
-export function createScheduleControl(store, home) {
+function authorization(store, plan, job, caller, now, requested, previous) {
+    if (requested !== undefined && requested !== "session" && requested !== "service")
+        throw new Error("Invalid Schedule authorization choice.");
+    if (plan.target.kind === "new-job" && plan.target.definitionRevision !== job.revision) {
+        throw new Error("Source Job revision changed; select its exact available revision.");
+    }
+    if (requested === "service") {
+        const grantId = randomUUID();
+        return { kind: "service", service: "schedule", grantId, revoked: false, jobRevision: job.revision,
+            grantedBy: structuredClone(caller), grantedAt: now.toISOString(),
+            binding: scheduleServiceBinding(store, plan, job, grantId) };
+    }
+    if (requested === undefined && previous?.kind === "service") {
+        if (previous.revoked || previous.binding !== scheduleServiceBinding(store, plan, job, previous.grantId)) {
+            throw new Error("Changed or revoked service authority requires explicit authorization=service.");
+        }
+        return previous;
+    }
+    if (caller.scope === "user")
+        throw new Error("Public Schedule creation/rebinding requires explicit authorization=service.");
+    return { kind: "session", caller: structuredClone(caller), binding: binding(store, caller, plan.scope), jobRevision: job.revision };
+}
+export function createScheduleControl(store, _home) {
     return (value, now) => {
         if (value === null || typeof value !== "object" || Array.isArray(value))
             throw new Error("Invalid Schedule request.");
-        requireKnownFields(value, ["op", "scope", "caller", "id", "jobId", "rule", "expectedRevision"], "Schedule request");
+        requireKnownFields(value, ["op", "scope", "caller", "id", "jobId", "target", "authorization", "rule", "expectedRevision"], "Schedule request");
         const input = value;
-        authorizeScope(store, input.scope, input.caller);
+        authorizeScope(store, input.scope, input.caller, true);
         return store.transaction(tx => {
             if (input.op === "list") {
                 return tx.listSchedules(input.scope).filter(s => {
@@ -45,9 +70,13 @@ export function createScheduleControl(store, home) {
                 const job = tx.getJobDefinition(input.scope, input.jobId);
                 if (job === null)
                     throw new Error("Schedule Job definition is missing.");
+                if (job.builtin)
+                    throw new Error("Builtin Job has one installed Schedule; manage that Schedule instead.");
                 if (previous !== null) {
                     authorizeSchedule(tx, previous, input.caller, false);
-                    if (previous.jobId !== input.jobId || JSON.stringify(previous.rule) !== JSON.stringify(input.rule)) {
+                    if (previous.jobId !== input.jobId || JSON.stringify(previous.rule) !== JSON.stringify(input.rule)
+                        || JSON.stringify(previous.target) !== JSON.stringify(input.target ?? { kind: "existing-job" })
+                        || (input.authorization !== undefined && previous.authorization.kind !== input.authorization)) {
                         throw new Error("Schedule id already exists; use update with its revision.");
                     }
                     return previous;
@@ -56,10 +85,12 @@ export function createScheduleControl(store, home) {
                 const due = nextScheduleDue(input.rule, now);
                 if (due === null)
                     throw new Error("A new once Schedule must be in the future.");
+                const target = validateScheduleTarget(input.target ?? { kind: "existing-job" });
                 const schedule = validateSchedule({
                     schemaVersion: 1, id: input.id, scope: structuredClone(input.scope), jobId: input.jobId,
+                    target,
                     rule: structuredClone(input.rule), state: "enabled", revision: 1, generation: 1, nextDue: due,
-                    authorization: { caller: structuredClone(input.caller), binding: binding(tx, input.caller, input.scope), jobRevision: job.revision },
+                    authorization: authorization(tx, { id: input.id, scope: input.scope, jobId: input.jobId, target }, job, input.caller, now, input.authorization),
                     createdAt: now.toISOString(), updatedAt: now.toISOString()
                 });
                 tx.saveSchedule(schedule);
@@ -69,20 +100,40 @@ export function createScheduleControl(store, home) {
                 throw new Error("Schedule not found.");
             authorizeSchedule(tx, previous, input.caller, false);
             if (input.op === "show") {
-                const runs = createJobDefinitionControl(tx, home)({
-                    op: "runs", scope: input.scope, id: previous.jobId, caller: input.caller
-                }, now);
-                const ownRuns = runs.filter(r => r.trigger.source === "schedule" && r.trigger.key.startsWith(`${previous.id}:`));
+                const runs = input.scope.kind === "task" ? tx.listDurableJobs(input.scope.taskId) : tx.listGlobalJobRuns();
+                const ownRuns = runs.filter(run => {
+                    if (run.trigger.source !== "schedule" || !run.trigger.key.startsWith(`${previous.id}:`))
+                        return false;
+                    try {
+                        authorizeRunRead(tx, run, input.caller);
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                });
                 const lastSuccess = ownRuns.filter(r => r.status === "succeeded")
                     .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0] ?? null;
-                return { schedule: previous, lastSuccess };
+                return { schedule: previous, lastSuccess, runs: ownRuns };
             }
             if (previous.revision !== input.expectedRevision)
                 throw new Error("Schedule revision changed; read it before modifying.");
+            if (previous.builtin) {
+                if (input.jobId !== undefined || input.target !== undefined || input.authorization !== undefined) {
+                    throw new Error("Builtin Schedule target and service registration cannot be overridden.");
+                }
+                return updateProjectSync(tx, previous, input.op, input.rule, now);
+            }
             let next;
             if (input.op === "disable") {
                 next = { ...previous, state: "disabled", reason: "Explicitly disabled; no future admission. Existing Runs are unchanged." };
             }
+            else if (input.op === "revoke") {
+                if (previous.authorization.kind !== "service")
+                    throw new Error("Only a service grant can be revoked; disable Session plans.");
+                next = { ...previous, state: "disabled", authorization: { ...previous.authorization, revoked: true },
+                    reason: "Service authorization explicitly revoked; future admission and not-yet-started service Runs are denied." };
+            }
             else if (input.op === "enable" || input.op === "update") {
                 if (input.op === "enable" && ["completed", "retired"].includes(previous.state)) {
                     throw new Error("Completed/retired Schedule requires an explicit future rule update.");
@@ -90,7 +141,10 @@ export function createScheduleControl(store, home) {
                 const jobId = input.op === "update" ? input.jobId ?? previous.jobId : previous.jobId;
                 scheduleId(jobId);
                 const rule = input.op === "update" ? input.rule : previous.rule;
+                const target = validateScheduleTarget(input.op === "update" ? input.target ?? previous.target : previous.target);
                 const job = authorizeSchedule(tx, { ...previous, jobId }, input.caller, true);
+                if (job.builtin)
+                    throw new Error("Builtin Job has one installed Schedule.");
                 const after = fence(previous, now);
                 // Once overlap/disabled intent keeps its original due instant on enable.
                 const nextDue = input.op === "enable" && rule.kind === "once"
@@ -98,11 +152,11 @@ export function createScheduleControl(store, home) {
                 if (nextDue === null)
                     throw new Error("Rule must have a future occurrence.");
                 next = {
-                    ...previous, jobId, rule: structuredClone(rule), nextDue,
+                    ...previous, jobId, target, rule: structuredClone(rule), nextDue,
                     state: input.op === "enable" || previous.state === "enabled" ? "enabled" : "disabled",
                     generation: previous.generation + (input.op === "update" ? 1 : 0),
                     processedThrough: after.toISOString(),
-                    authorization: { caller: structuredClone(input.caller), binding: binding(tx, input.caller, input.scope), jobRevision: job.revision }
+                    authorization: authorization(tx, { ...previous, jobId, target }, job, input.caller, now, input.authorization, previous.authorization)
                 };
                 const { reason: _reason, ...withoutReason } = next;
                 next = withoutReason;
@@ -133,18 +187,27 @@ export function reconcileSchedules(store, home, now, onError = () => { }, limit
                         return;
                     }
                 }
-                const job = authorizeSchedule(tx, schedule, schedule.authorization.caller, true);
+                const auth = schedule.authorization;
+                const service = auth.kind === "service" ? { scheduleId: schedule.id, grantId: auth.grantId } : undefined;
+                if (service)
+                    requireScheduleService(tx, service);
+                const caller = auth.kind === "session" ? auth.caller : { scope: "user" };
+                const job = authorizeSchedule(tx, schedule, caller, true);
                 if (job.revision !== schedule.authorization.jobRevision
-                    || binding(tx, schedule.authorization.caller, schedule.scope) !== schedule.authorization.binding) {
+                    || (auth.kind === "session" && binding(tx, caller, schedule.scope) !== auth.binding)) {
                     throw new Error("Schedule authority or Job revision changed; inspect and explicitly enable.");
                 }
-                const result = admitJobRun(tx, home, schedule.scope, schedule.jobId, schedule.authorization.caller, { source: "schedule", key: `${schedule.id}:${schedule.generation}:${dueAt}` }, now);
+                const trigger = { source: "schedule", key: `${schedule.id}:${schedule.generation}:${dueAt}` };
+                const result = schedule.target.kind === "existing-job"
+                    ? admitJobRun(tx, home, schedule.scope, schedule.jobId, caller, trigger, now, undefined, service)
+                    : instantiateJobRun(tx, home, schedule.scope, schedule.jobId, schedule.target.definitionRevision, caller, trigger, now, service);
                 const overlap = result.reason === "overlap";
                 const nextDue = overlap && schedule.rule.kind === "once" ? dueAt : nextScheduleDue(schedule.rule, after);
                 tx.saveSchedule({
                     ...schedule, nextDue, state: nextDue === null ? "completed" : "enabled",
                     processedThrough: after.toISOString(), revision: schedule.revision + 1,
-                    lastAttempt: { at: now.toISOString(), dueAt, outcome: overlap ? "overlap" : "admitted", runId: result.run.id },
+                    lastAttempt: { at: now.toISOString(), dueAt, generation: schedule.generation,
+                        outcome: overlap ? "overlap" : "admitted", jobId: result.run.definitionId, runId: result.run.id },
                     updatedAt: now.toISOString()
                 });
             });
@@ -157,14 +220,14 @@ export function reconcileSchedules(store, home, now, onError = () => { }, limit
                 if (current?.state !== "enabled" || current.revision !== candidate.revision)
                     return;
                 tx.saveSchedule({ ...current, state: "needs-attention", reason, revision: current.revision + 1,
-                    lastAttempt: { at: now.toISOString(), dueAt: current.nextDue, outcome: "blocked", reason },
+                    lastAttempt: { at: now.toISOString(), dueAt: current.nextDue, generation: current.generation, outcome: "blocked", reason },
                     updatedAt: now.toISOString() });
                 if (current.scope.kind === "task") {
                     const event = createTaskEvent(tx.nextEventId(current.scope.taskId), current.scope.taskId, "schedule.needs-attention", { scheduleId: current.id, reason }, now);
                     tx.saveEvent(current.scope.taskId, event);
                     enqueueSupervisorEvent(tx, event, "leader", "schedule-needs-attention", now);
                 }
-                else {
+                else if (tx.getGlobalRole("operator") !== null) {
                     tx.saveGlobalRoleMessage(createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), "operator", `Yui-Summary: Schedule ${current.id} needs attention; no Run was admitted.\n`
                         + `Reason: ${reason}\nRead: yui schedule show --global --schedule ${current.id}\n`
                         + "Inspect the original intent before explicitly enabling; no new authority is implied.", "system", { type: "system" }, now, { inputControl: { action: "queue", requestId: `schedule-attention:${current.id}:${current.revision}` } }));

package/dist/integration/gitIntegrationService.js

@@ -460,6 +460,8 @@ export class GitIntegrationService {
      */
     async #resumeCheckJob(attempt, workspace, path, repositoryPath, gate) {
         const job = await this.jobPort.getJob(attempt.taskId, attempt.jobId);
+        if (job.delegation)
+            throw new Error("Task delegation is not an Integration check Job.");
         assertCheckJobIdentity(attempt, job, path);
         await assertIntegrationCandidate(path, job.head, workspace.branch);
         await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.beforeCommit, this.#targetCheckout(attempt));

package/dist/job/agentJob.js

@@ -0,0 +1,131 @@
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { requireIdentity, requireKnownFields, requirePositiveInteger, requireText, requireTimestamp } from "../domain/validation.js";
+import { jobScopeKey } from "./jobDefinition.js";
+import { validateBusinessResult } from "./jobBusinessResult.js";
+import { validateRunArtifacts, artifactsAppendOnly } from "../artifacts/jobArtifact.js";
+export function validateAgentJobConfiguration(config) {
+    requireKnownFields(config, ["kind", "target", "input", "concurrency"], "Agent Job configuration");
+    if (config.kind !== "agent")
+        throw new Error("Invalid Agent Job executor.");
+    requireText(config.input, "Agent Job input");
+    if (Buffer.byteLength(config.input) > 65536)
+        throw new Error("Agent Job input exceeds 64 KiB.");
+    if (config.concurrency !== undefined && !["serial", "isolated"].includes(config.concurrency)) {
+        throw new Error("Invalid Agent Job concurrency.");
+    }
+    const target = config.target;
+    if (target.kind === "operator")
+        requireKnownFields(target, ["kind"], "Operator target");
+    else if (target.kind === "task") {
+        requireKnownFields(target, ["kind", "taskId", "roleName", "ownerRunId"], "Task Agent target");
+        jobScopeKey({ kind: "task", taskId: target.taskId });
+        requireIdentity(target.roleName, "Task Role");
+        if (target.roleName !== "leader" && !target.ownerRunId)
+            throw new Error("Task Agent target requires its exact Assignment ownerRunId.");
+        if (target.ownerRunId !== undefined)
+            requireIdentity(target.ownerRunId, "Assignment Run");
+    }
+    else if (target.kind === "job") {
+        requireKnownFields(target, ["kind", "agentId"], "Job Agent target");
+        requireIdentity(target.agentId, "Job Agent");
+    }
+    else
+        throw new Error("Unknown Agent Job target.");
+    if (config.concurrency === "isolated" && target.kind !== "job") {
+        throw new Error("Isolated concurrency requires a Job-owned Agent; shared roles are serial.");
+    }
+}
+export function jobAgentRoleName(scope, jobId, runId) {
+    return `job-${createHash("sha256").update(JSON.stringify([scope, jobId, runId ?? null])).digest("hex").slice(0, 32)}`;
+}
+export function validateAgentJobRun(run) {
+    requireKnownFields(run, ["schemaVersion", "executor", "id", "scope", "definitionId", "definitionRevision",
+        "configuration", "trigger", "retryOf", "status", "attempts", "businessResult", "cancelRequestedAt",
+        "createdAt", "updatedAt", "terminalAt", "artifacts"], "Agent JobRun");
+    if (run.schemaVersion !== 1 || run.executor !== "agent")
+        throw new Error("Invalid Agent JobRun.");
+    requireIdentity(run.id, "Agent JobRun id");
+    requireIdentity(run.definitionId, "Agent Job id");
+    requirePositiveInteger(run.definitionRevision, "Agent Job revision");
+    requireKnownFields(run.scope, run.scope.kind === "task" ? ["kind", "taskId"] : ["kind"], "Agent Job scope");
+    if (!["task", "global"].includes(run.scope.kind))
+        throw new Error("Invalid Agent Job scope.");
+    jobScopeKey(run.scope);
+    validateAgentJobConfiguration(run.configuration);
+    requireKnownFields(run.trigger, ["source", "key"], "Agent Job trigger");
+    if (!["manual", "retry", "schedule"].includes(run.trigger.source))
+        throw new Error("Invalid Agent Job trigger.");
+    requireText(run.trigger.key, "Agent Job trigger key");
+    if (!["queued", "running", "succeeded", "failed", "cancelled", "timed-out", "unknown-needs-attention"].includes(run.status)) {
+        throw new Error("Invalid Agent JobRun status.");
+    }
+    requireTimestamp(run.createdAt, "Agent JobRun createdAt");
+    requireTimestamp(run.updatedAt, "Agent JobRun updatedAt");
+    for (const value of [run.cancelRequestedAt, run.terminalAt])
+        if (value !== undefined)
+            requireTimestamp(value, "Agent JobRun timestamp");
+    if (!Array.isArray(run.attempts) || !run.attempts.length || run.attempts.length > 128)
+        throw new Error("Invalid Agent Job attempts.");
+    for (const attempt of run.attempts) {
+        requireKnownFields(attempt, ["messageId", "recipient", "createdAt", "execution", "terminal"], "Agent Job attempt");
+        requireIdentity(attempt.messageId, "Agent Job message");
+        requireTimestamp(attempt.createdAt, "Agent Job attempt timestamp");
+        const recipient = attempt.recipient;
+        requireKnownFields(recipient, recipient.scope === "task"
+            ? ["scope", "taskId", "roleName", "ownerRunId"] : ["scope", "roleName"], "Agent Job recipient");
+        if (!["task", "global"].includes(recipient.scope))
+            throw new Error("Invalid Agent Job recipient.");
+        requireIdentity(recipient.roleName, "Agent Job recipient Role");
+        if (recipient.scope === "task")
+            jobScopeKey({ kind: "task", taskId: recipient.taskId });
+        if (attempt.execution) {
+            requireKnownFields(attempt.execution, ["nativeSessionId", "attemptId", "nativeTurnId"], "Agent Job execution");
+            for (const value of Object.values(attempt.execution)) {
+                if (typeof value !== "string")
+                    throw new Error("Invalid Agent execution identity.");
+                requireText(value, "Agent Job execution identity");
+            }
+        }
+        if (attempt.terminal) {
+            requireKnownFields(attempt.terminal, ["status", "observedAt"], "Agent Turn terminal");
+            if (!attempt.execution || !["completed", "failed", "cancelled"].includes(attempt.terminal.status))
+                throw new Error("Invalid Agent terminal evidence.");
+            requireTimestamp(attempt.terminal.observedAt, "Agent terminal observation");
+        }
+    }
+    if (run.businessResult) {
+        validateBusinessResult(run.businessResult, { scope: run.scope, runId: run.id });
+        if (run.status !== run.businessResult.outcome || !run.terminalAt)
+            throw new Error("Agent result and terminal disagree.");
+    }
+    else if (["succeeded", "failed", "cancelled", "timed-out"].includes(run.status)) {
+        throw new Error("Agent Job terminal requires an explicit business result.");
+    }
+    validateRunArtifacts(run);
+    return run;
+}
+export function assertAgentJobRunTransition(previous, next) {
+    const mutable = ["status", "attempts", "businessResult", "cancelRequestedAt", "updatedAt", "terminalAt", "artifacts"];
+    for (const key of new Set([...Object.keys(previous), ...Object.keys(next)])) {
+        if (!mutable.includes(key) && !isDeepStrictEqual(previous[key], next[key]))
+            throw new Error("Agent Job snapshot is immutable.");
+    }
+    if (previous.businessResult && (!isDeepStrictEqual(previous.businessResult, next.businessResult)
+        || previous.status !== next.status || previous.terminalAt !== next.terminalAt
+        || previous.attempts.length !== next.attempts.length))
+        throw new Error("Agent Job result is immutable.");
+    if (!artifactsAppendOnly(previous, next))
+        throw new Error("Agent Job artifacts are append-only.");
+    if (previous.cancelRequestedAt !== undefined && previous.cancelRequestedAt !== next.cancelRequestedAt)
+        throw new Error("Cancellation is immutable.");
+    if (Date.parse(next.updatedAt) < Date.parse(previous.updatedAt) || next.attempts.length < previous.attempts.length)
+        throw new Error("Agent Job history cannot move backwards.");
+    previous.attempts.forEach((attempt, index) => {
+        const updated = next.attempts[index];
+        if (!isDeepStrictEqual({ ...attempt, execution: undefined, terminal: undefined }, { ...updated, execution: undefined, terminal: undefined })
+            || attempt.execution && !isDeepStrictEqual(attempt.execution, updated.execution)
+            || attempt.terminal && !isDeepStrictEqual(attempt.terminal, updated.terminal))
+            throw new Error("Agent attempt evidence is immutable.");
+    });
+}

package/dist/job/agentJobObservation.js

@@ -0,0 +1,61 @@
+import { isDeepStrictEqual } from "node:util";
+import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
+export function jobAttemptOwnsInput(store, attempt, binding) {
+    const { recipient, messageId } = attempt;
+    const inputs = [binding.run?.input];
+    if (binding.run && binding.retry?.currentAttemptId === binding.run.attemptId)
+        inputs.push(binding.retry.input);
+    return inputs.some(input => {
+        if (recipient.scope === "global")
+            return input?.kind === "message"
+                && input.roleName === recipient.roleName && input.messageId === messageId;
+        if (input?.kind === "wake" && input.taskId === recipient.taskId)
+            return store.getTaskWake(recipient.taskId, input.wakeId)
+                ?.refs?.some(ref => ref.type === "message" && ref.id === messageId) === true;
+        return input?.kind === "run" && input.taskId === recipient.taskId
+            && store.listMessages(recipient.taskId).find(message => message.id === messageId)?.continuation?.runId === input.runId;
+    });
+}
+/** Collect existing Provider evidence at its owning transaction. No submission,
+ * retry, inferred business result, or transcript parsing occurs here. */
+export function recordJobAgentObservation(store, recipient, binding, now) {
+    if (!binding?.run)
+        return;
+    for (const run of store.listAgentJobRunsForRole(recipient)) {
+        const last = run.attempts.at(-1);
+        if (!jobAttemptOwnsInput(store, last, binding))
+            continue;
+        const turn = binding.run;
+        const attempts = [...run.attempts];
+        let attempt = last;
+        if (turn.nativeTurnId && ["accepted", "completed", "failed", "cancelled"].includes(turn.status)) {
+            const execution = { nativeSessionId: currentProviderConversation(binding).conversationId,
+                attemptId: turn.attemptId, nativeTurnId: turn.nativeTurnId };
+            if (last.execution && !isDeepStrictEqual(last.execution, execution)) {
+                const retry = binding.retry;
+                // Only the existing bounded retry owner may prove a successor of the
+                // same original input. Session changes/other native Turns never do.
+                if (run.businessResult || retry?.currentAttemptId !== execution.attemptId
+                    || retry.failureAttemptId !== last.execution.attemptId || retry.failedNativeTurnId !== last.execution.nativeTurnId
+                    || retry.nativeSessionId !== last.execution.nativeSessionId)
+                    continue;
+                attempts[attempts.length - 1] = { ...last, terminal: last.terminal ?? { status: "failed", observedAt: retry.updatedAt } };
+                attempt = { messageId: last.messageId, recipient: last.recipient, createdAt: turn.submittedAt, execution };
+                attempts.push(attempt);
+            }
+            else
+                attempt = { ...last, execution };
+            if (["completed", "failed", "cancelled"].includes(turn.status))
+                attempt = { ...attempt,
+                    terminal: attempt.terminal ?? { status: turn.status, observedAt: now.toISOString() } };
+            attempts[attempts.length - 1] = attempt;
+        }
+        const status = run.businessResult ? run.status : turn.status === "delivery-unknown" ? "unknown-needs-attention"
+            : attempt.execution ? "running" : run.status;
+        if (status === run.status && isDeepStrictEqual(attempts, run.attempts))
+            continue;
+        const next = { ...run, status, attempts,
+            updatedAt: new Date(Math.max(now.getTime(), Date.parse(run.updatedAt))).toISOString() };
+        store.saveAgentJobRun(next);
+    }
+}