@zq-silk/yui 2.8.0 → 2.9.0

package/dist/controller/jobSupervisor.js

@@ -15,7 +15,7 @@ import { spawn } from "node:child_process";
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { cancelQueuedDurableJob, completeDurableJob, isDurableJobTerminal, markDurableJobUnknown, markDurableJobWakeupNotified, rejectQueuedDurableJob, startDurableJob, touchDurableJobHeartbeat } from "../job/durableJob.js";
+import { cancelQueuedDurableJob, completeDurableJob, isDurableJobTerminal, markDurableJobUnknown, markDurableJobWakeupNotified, rejectQueuedDurableJob, startDurableJob, touchDurableJobHeartbeat, executionNamespace } from "../job/durableJob.js";
 import { recordOperationEvidence } from "../kernel/operationFacts.js";
 import { wakeReason } from "../scheduler/wakeReason.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
@@ -45,12 +45,23 @@ export class DurableJobSupervisor {
     }
     reconcile(now) {
         const jobs = this.#store.listActiveDurableJobs();
-        for (const job of jobs) {
+        const refresh = (job) => !("taskId" in job) && job.action === "project.refresh";
+        const waiting = (job) => refresh(job) && job.status === "queued"
+            && job.operation.effect === "none" && !job.cancelRequestedAt;
+        // Harvest/recover existing attempts first. Network operations remain in
+        // detached runners, with at most four outstanding Project refreshes.
+        const ordered = [...jobs.filter(job => !waiting(job)), ...jobs.filter(waiting)];
+        for (const job of ordered) {
             try {
+                if (waiting(job)) {
+                    const occupied = this.#store.listActiveDurableJobs().filter(candidate => refresh(candidate) && (candidate.status === "running" || candidate.operation.effect !== "none"));
+                    if (occupied.length >= 4)
+                        break;
+                }
                 this.#reconcileJob(job, now);
             }
             catch (error) {
-                this.#onError(new Error(`DurableJob supervision failed for ${job.taskId}/${job.id}: `
+                this.#onError(new Error(`DurableJob supervision failed for ${executionNamespace(job)}/${job.id}: `
                     + `${error instanceof Error ? error.message : String(error)}. `
                     + "Inspect retained process/artifact evidence before retry or cancellation; effects remain unconfirmed.", { cause: error }));
             }
@@ -68,14 +79,14 @@ export class DurableJobSupervisor {
     }
     /** Composite key for the SIGKILL deadline map. */
     #sigkillKey(job) {
-        return `${job.taskId}/${job.id}`;
+        return `${executionNamespace(job)}/${job.id}`;
     }
     /** Adopt observed execution, preserve unknown, or start an unattempted request. */
     #reconcileQueued(job, now) {
-        const marker = this.#artifacts.readStartMarker(job.taskId, job.id);
+        const marker = this.#artifacts.readStartMarker(executionNamespace(job), job.id);
         const spawned = this.#spawnedProcessFromEvidence(job, marker);
         if (job.cancelRequestedAt !== undefined) {
-            this.#artifacts.writeCancelFence(job.taskId, job.id);
+            this.#artifacts.writeCancelFence(executionNamespace(job), job.id);
             if (spawned !== null) {
                 this.#process.signalIfOwned(spawned.pid, spawned.startIdentity, "SIGTERM");
             }
@@ -87,13 +98,13 @@ export class DurableJobSupervisor {
         if (job.operation.effect !== "none") {
             // A send intent was committed but no acceptance can be proved. Absence
             // of a file is not proof of no external effect. Never respawn unknown.
-            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(markDurableJobUnknown(current, "runner acceptance is unknown; inspect the original request", current.checkpoint?.completedSteps ?? [], now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => markDurableJobWakeupNotified(markDurableJobUnknown(current, "runner acceptance is unknown; inspect the original request", current.checkpoint?.completedSteps ?? [], now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
             this.#deliverTerminalEvent(terminal);
             return;
         }
         if (job.cancelRequestedAt !== undefined) {
             // No effect attempted. Cancellation and its wake commit atomically.
-            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(cancelQueuedDurableJob(current, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => markDurableJobWakeupNotified(cancelQueuedDurableJob(current, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
             this.#deliverTerminalEvent(terminal);
             return;
         }
@@ -112,7 +123,7 @@ export class DurableJobSupervisor {
         // around the spawn), while ready.json is written by the runner itself
         // before any side effect. A disagreement (PID reuse, spawn retry, stale
         // /proc read) is resolved in favor of ready.json.
-        const ready = this.#artifacts.readReadyFile(job.taskId, job.id);
+        const ready = this.#artifacts.readReadyFile(executionNamespace(job), job.id);
         if (ready !== null) {
             return { pid: ready.pid, startIdentity: ready.startIdentity };
         }
@@ -128,9 +139,9 @@ export class DurableJobSupervisor {
      * process. A request with unobserved acceptance instead stays unknown.
      */
     #adoptAndContinue(job, process, now) {
-        this.#store.transitionDurableJob(job.taskId, job.id, (current) => startDurableJob(current, process, now), now);
+        this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => startDurableJob(current, process, now), now);
         // The runner may already have finished while the Controller was down.
-        const exit = this.#artifacts.readExitJson(job.taskId, job.id);
+        const exit = this.#artifacts.readExitJson(executionNamespace(job), job.id);
         if (exit !== null) {
             this.#harvestExit(job, exit, now);
             return;
@@ -153,18 +164,18 @@ export class DurableJobSupervisor {
         }
         const spec = {
             jobId: job.id,
-            taskId: job.taskId,
+            ...("taskId" in job ? { taskId: job.taskId } : { scope: "global" }),
             workspace: job.workspace,
             env: job.env,
             steps: job.steps,
             defaultStepTimeoutMs: DEFAULT_STEP_TIMEOUT_MS,
-            artifactDir: this.#artifacts.artifactDir(job.taskId, job.id),
+            artifactDir: this.#artifacts.artifactDir(executionNamespace(job), job.id),
             head: job.head
         };
-        const specPath = this.#artifacts.writeSpec(job.taskId, job.id, spec);
+        const specPath = this.#artifacts.writeSpec(executionNamespace(job), job.id, spec);
         let attempted;
         try {
-            attempted = this.#store.transitionDurableJob(job.taskId, job.id, (current) => {
+            attempted = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => {
                 if (current.status !== "queued" || current.operation.effect !== "none") {
                     throw new Error("Job already attempted; inspect the original request.");
                 }
@@ -184,7 +195,7 @@ export class DurableJobSupervisor {
             return;
         // Both the request and possible-effect boundary precede spawn. A missing
         // acceptance after this point is unknown, never permission to respawn.
-        this.#artifacts.writeStartMarker(job.taskId, job.id, {
+        this.#artifacts.writeStartMarker(executionNamespace(job), job.id, {
             pid: 0,
             startIdentity: "pending",
             spawnedAt: now.toISOString()
@@ -194,7 +205,7 @@ export class DurableJobSupervisor {
         // the runner's own ready.json is the fallback: the next reconcile reads
         // ready and adopts. The runner checks ready with O_EXCL and exits if it
         // already exists, preventing duplicate execution.
-        this.#artifacts.writeStartMarker(job.taskId, job.id, {
+        this.#artifacts.writeStartMarker(executionNamespace(job), job.id, {
             pid: spawned.pid,
             startIdentity: spawned.startIdentity ?? String(spawned.pid),
             spawnedAt: now.toISOString()
@@ -206,27 +217,27 @@ export class DurableJobSupervisor {
         // terminalized or no longer exists; the recovery interval stays the
         // cross-restart fallback. No new timer is pinned while the Controller is
         // idle — each wake is a single event-driven signal.
-        spawned.onExit?.(() => this.#wake(job.taskId));
-        this.#wake(job.taskId);
+        spawned.onExit?.(() => this.#wake(executionNamespace(job)));
+        this.#wake(executionNamespace(job));
     }
     #rejectStart(job, error, now) {
         // Only an explicit domain refusal is a known failure. Storage/CAS/runtime
         // errors still propagate; never infer rejection from an unavailable read.
         if (!(error instanceof Error) || error.name !== "CoreJobError")
             throw error;
-        const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(rejectQueuedDurableJob(current, error.message, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+        const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => markDurableJobWakeupNotified(rejectQueuedDurableJob(current, error.message, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
         this.#deliverTerminalEvent(terminal);
     }
     #superviseRunning(job, now) {
         // 1. Harvest exit.json if present.
-        const exit = this.#artifacts.readExitJson(job.taskId, job.id);
+        const exit = this.#artifacts.readExitJson(executionNamespace(job), job.id);
         if (exit !== null) {
             this.#harvestExit(job, exit, now);
             return;
         }
         // 2. Cancel requested: write fence + SIGTERM.
         if (job.cancelRequestedAt !== undefined && job.process !== undefined) {
-            this.#artifacts.writeCancelFence(job.taskId, job.id);
+            this.#artifacts.writeCancelFence(executionNamespace(job), job.id);
             this.#process.signalIfOwned(job.process.pid, job.process.startIdentity, "SIGTERM");
         }
         // 3. Process liveness via pid + startIdentity.
@@ -241,7 +252,7 @@ export class DurableJobSupervisor {
             }
         }
         // 4. Heartbeat freshness.
-        const heartbeatMtime = this.#artifacts.heartbeatMtime(job.taskId, job.id);
+        const heartbeatMtime = this.#artifacts.heartbeatMtime(executionNamespace(job), job.id);
         if (heartbeatMtime !== null) {
             const staleMs = now.getTime() - heartbeatMtime;
             if (staleMs > HEARTBEAT_STALE_MS && job.process !== undefined) {
@@ -255,7 +266,7 @@ export class DurableJobSupervisor {
                 ? Date.parse(job.heartbeatAt)
                 : 0;
             if (heartbeatMtime > recordHeartbeat) {
-                this.#store.transitionDurableJob(job.taskId, job.id, (current) => touchDurableJobHeartbeat(current, new Date(heartbeatMtime)), now);
+                this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => touchDurableJobHeartbeat(current, new Date(heartbeatMtime)), now);
             }
         }
         // 5. SIGKILL escalation.
@@ -268,7 +279,7 @@ export class DurableJobSupervisor {
     #harvestExit(job, exit, now) {
         // Persist the original receipt locator before interpreting its output.
         // A bad schema cannot erase evidence of an already executed runner.
-        this.#store.transitionDurableJob(job.taskId, job.id, (current) => ({
+        this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => ({
             ...current,
             operation: recordOperationEvidence(current.operation, {
                 effect: "confirmed",
@@ -292,7 +303,7 @@ export class DurableJobSupervisor {
         // the adapter enqueues the Leader mailbox entry in the same transaction.
         // A separate #notifyWakeup pass would lose the wakeup if the Controller
         // died between the terminal write and the flag flip.
-        const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => {
+        const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => {
             let completed;
             try {
                 completed = completeDurableJob(current, result, now);
@@ -310,7 +321,7 @@ export class DurableJobSupervisor {
         this.#sigkillAt.delete(this.#sigkillKey(job));
     }
     #handleDeadProcess(job, now) {
-        const checkpoint = this.#artifacts.readCheckpoint(job.taskId, job.id);
+        const checkpoint = this.#artifacts.readCheckpoint(executionNamespace(job), job.id);
         const proven = checkpoint === null ? null : proveOutcomeFromCheckpoint(job, checkpoint);
         // rr4/finding-7: Same atomic wakeup composition as #harvestExit — the
         // terminal transition and the Leader wakeup commit together.
@@ -318,12 +329,12 @@ export class DurableJobSupervisor {
             // The runner died without exit.json, but its step checkpoint covered
             // every planned step: the outcome is still provable from durable
             // evidence. No false pass — the checkpoint is the runner's own record.
-            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(completeDurableJob(current, { ...proven, evidenceSource: "checkpoint" }, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => markDurableJobWakeupNotified(completeDurableJob(current, { ...proven, evidenceSource: "checkpoint" }, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
             this.#deliverTerminalEvent(terminal);
         }
         else {
             const completedSteps = checkpoint?.completedSteps ?? [];
-            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(markDurableJobUnknown(current, "runner process exited without writing exit.json", completedSteps, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            const terminal = this.#store.transitionDurableJob(executionNamespace(job), job.id, (current) => markDurableJobWakeupNotified(markDurableJobUnknown(current, "runner process exited without writing exit.json", completedSteps, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
             this.#deliverTerminalEvent(terminal);
         }
         this.#sigkillAt.delete(this.#sigkillKey(job));
@@ -339,8 +350,10 @@ export class DurableJobSupervisor {
     #deliverTerminalEvent(job) {
         if (job === null || !isDurableJobTerminal(job.status))
             return;
+        if (!("taskId" in job))
+            return; // The durable Operator mailbox owns global notices.
         this.#terminalEvents?.deliverTerminalEvent({
-            taskId: job.taskId,
+            taskId: executionNamespace(job),
             jobId: job.id,
             status: job.status,
             outcome: job.result?.outcome ?? job.status
@@ -348,9 +361,11 @@ export class DurableJobSupervisor {
     }
 }
 function wakeupRefs(job) {
-    const refs = [{ type: "task", id: job.taskId }];
+    if (!("taskId" in job))
+        return [];
+    const refs = [{ type: "task", id: executionNamespace(job) }];
     if (job.owner.kind === "work-item") {
-        refs.push({ type: "work-item", taskId: job.taskId, id: job.owner.workItemId });
+        refs.push({ type: "work-item", taskId: executionNamespace(job), id: job.owner.workItemId });
     }
     return refs;
 }

package/dist/controller/runtime.js

@@ -45,6 +45,7 @@ import { archiveOrdinaryTask } from "../task/ordinaryArchive.js";
 import { createWebSettings } from "../web/webSettings.js";
 import { createModelManagement } from "../models/modelManagement.js";
 import { createWebSkills } from "../web/webSkills.js";
+import { createWebJobs } from "../web/webJobs.js";
 import { isTaskOwnedWorkspace, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { AgentRuntimeObserver } from "./agentRuntimeObserver.js";
 import { createCapabilityDispatcher } from "./capabilityBridge.js";
@@ -55,6 +56,8 @@ import { createEphemeralResourceReaper } from "./ephemeralResourceReaper.js";
 import { AgentHostProviderSessionBusyError, AgentHostProviderTurnFenceError, FileSchedulerStoreAdapter } from "./fileSchedulerStoreAdapter.js";
 import { deliverGlobalInputs } from "./globalInputDelivery.js";
 import { authorizeJobStart } from "./jobControl.js";
+import { authorizeGlobalJobStart, createJobDefinitionControl } from "./jobDefinitionControl.js";
+import { createScheduleControl, reconcileSchedules } from "./scheduleControl.js";
 import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
 import { createProviderRetryHooks } from "./providerRetryDelivery.js";
 import { createRuntimeResourceActivityTracker } from "./resourceInventory.js";
@@ -412,6 +415,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         const web = createControllerWeb(store, {
             previews: () => createTaskPreviews(store, home),
             skills: createWebSkills(store),
+            jobs: createWebJobs(store, home),
             models: createModelManagement(store),
             settings: createWebSettings(store, {
                 environment: options.environment ?? process.env, catalogs,
@@ -483,7 +487,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             store: schedulerStore,
             process: kernel.runner,
             artifacts: createFileArtifactPort(home),
-            authorizeStart: (job) => authorizeJobStart(store, job),
+            authorizeStart: (job) => "taskId" in job ? authorizeJobStart(store, job) : authorizeGlobalJobStart(store, job),
             // rr6/f1: Bounded supervision wake. The supervisor signals the Controller
             // after spawning a runner (queued→running adoption) and when a runner
             // exits (terminal harvest), so a quick job converges without waiting for
@@ -492,7 +496,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             // no-op. The recovery interval stays the cross-restart fallback.
             wake: (taskId) => {
                 try {
-                    runningRuntime?.signal(`task:${taskId}`);
+                    runningRuntime?.signal(taskId === "global" ? "operator" : `task:${taskId}`);
                 }
                 catch {
                     // Controller stopped; the recovery interval remains the fallback.
@@ -568,6 +572,11 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
                 await lifecycleDispatcher("runtime.ensure-role-session", { scope: "global", roleName });
             }, options.onError ?? (() => undefined), deliveryOptions),
             jobControl,
+            jobDefinitions: createJobDefinitionControl(store, home),
+            schedules: {
+                control: createScheduleControl(store, home),
+                reconcile: now => reconcileSchedules(store, home, now, options.onError)
+            },
             capabilityDispatcher: createCapabilityDispatcher(kernel.capabilities),
             ...(continuationReconciler === undefined ? {} : { continuationReconciler }),
             ...(resourceReaper === undefined ? {} : { resourceReaper }),

package/dist/controller/scheduleControl.js

@@ -0,0 +1,176 @@
+import { requireKnownFields } from "../domain/validation.js";
+import { nextScheduleDue, scheduleId, validateSchedule } from "../schedule/schedule.js";
+import { admitJobRun, authorizeDefinition, authorizeScope, createJobDefinitionControl } from "./jobDefinitionControl.js";
+import { jobAuthorityBinding } from "./jobControl.js";
+import { createGlobalRoleMessage } from "../message/message.js";
+import { createTaskEvent } from "../event/taskEvent.js";
+import { enqueueSupervisorEvent } from "../scheduler/operatorEvent.js";
+import { redactLaunchText } from "../runtime/launchDiagnostics.js";
+function binding(store, caller, scope) {
+    return jobAuthorityBinding(store, caller.scope, caller.role, scope.kind === "task" ? scope.taskId : "");
+}
+function authorizeSchedule(store, schedule, caller, write) {
+    const job = store.getJobDefinition(schedule.scope, schedule.jobId);
+    if (job === null)
+        throw new Error("Schedule Job definition is missing.");
+    authorizeDefinition(store, job, caller, write);
+    return job;
+}
+function fence(schedule, now) {
+    return new Date(Math.max(now.getTime(), Date.parse(schedule?.processedThrough ?? "") || 0));
+}
+export function createScheduleControl(store, home) {
+    return (value, now) => {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Invalid Schedule request.");
+        requireKnownFields(value, ["op", "scope", "caller", "id", "jobId", "rule", "expectedRevision"], "Schedule request");
+        const input = value;
+        authorizeScope(store, input.scope, input.caller);
+        return store.transaction(tx => {
+            if (input.op === "list") {
+                return tx.listSchedules(input.scope).filter(s => {
+                    try {
+                        authorizeSchedule(tx, s, input.caller, false);
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+            }
+            scheduleId(input.id);
+            const previous = tx.getSchedule(input.scope, input.id);
+            if (input.op === "create") {
+                scheduleId(input.jobId);
+                const job = tx.getJobDefinition(input.scope, input.jobId);
+                if (job === null)
+                    throw new Error("Schedule Job definition is missing.");
+                if (previous !== null) {
+                    authorizeSchedule(tx, previous, input.caller, false);
+                    if (previous.jobId !== input.jobId || JSON.stringify(previous.rule) !== JSON.stringify(input.rule)) {
+                        throw new Error("Schedule id already exists; use update with its revision.");
+                    }
+                    return previous;
+                }
+                authorizeDefinition(tx, job, input.caller, true);
+                const due = nextScheduleDue(input.rule, now);
+                if (due === null)
+                    throw new Error("A new once Schedule must be in the future.");
+                const schedule = validateSchedule({
+                    schemaVersion: 1, id: input.id, scope: structuredClone(input.scope), jobId: input.jobId,
+                    rule: structuredClone(input.rule), state: "enabled", revision: 1, generation: 1, nextDue: due,
+                    authorization: { caller: structuredClone(input.caller), binding: binding(tx, input.caller, input.scope), jobRevision: job.revision },
+                    createdAt: now.toISOString(), updatedAt: now.toISOString()
+                });
+                tx.saveSchedule(schedule);
+                return schedule;
+            }
+            if (previous === null)
+                throw new Error("Schedule not found.");
+            authorizeSchedule(tx, previous, input.caller, false);
+            if (input.op === "show") {
+                const runs = createJobDefinitionControl(tx, home)({
+                    op: "runs", scope: input.scope, id: previous.jobId, caller: input.caller
+                }, now);
+                const ownRuns = runs.filter(r => r.trigger.source === "schedule" && r.trigger.key.startsWith(`${previous.id}:`));
+                const lastSuccess = ownRuns.filter(r => r.status === "succeeded")
+                    .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0] ?? null;
+                return { schedule: previous, lastSuccess };
+            }
+            if (previous.revision !== input.expectedRevision)
+                throw new Error("Schedule revision changed; read it before modifying.");
+            let next;
+            if (input.op === "disable") {
+                next = { ...previous, state: "disabled", reason: "Explicitly disabled; no future admission. Existing Runs are unchanged." };
+            }
+            else if (input.op === "enable" || input.op === "update") {
+                if (input.op === "enable" && ["completed", "retired"].includes(previous.state)) {
+                    throw new Error("Completed/retired Schedule requires an explicit future rule update.");
+                }
+                const jobId = input.op === "update" ? input.jobId ?? previous.jobId : previous.jobId;
+                scheduleId(jobId);
+                const rule = input.op === "update" ? input.rule : previous.rule;
+                const job = authorizeSchedule(tx, { ...previous, jobId }, input.caller, true);
+                const after = fence(previous, now);
+                // Once overlap/disabled intent keeps its original due instant on enable.
+                const nextDue = input.op === "enable" && rule.kind === "once"
+                    ? previous.nextDue : nextScheduleDue(rule, after);
+                if (nextDue === null)
+                    throw new Error("Rule must have a future occurrence.");
+                next = {
+                    ...previous, jobId, rule: structuredClone(rule), nextDue,
+                    state: input.op === "enable" || previous.state === "enabled" ? "enabled" : "disabled",
+                    generation: previous.generation + (input.op === "update" ? 1 : 0),
+                    processedThrough: after.toISOString(),
+                    authorization: { caller: structuredClone(input.caller), binding: binding(tx, input.caller, input.scope), jobRevision: job.revision }
+                };
+                const { reason: _reason, ...withoutReason } = next;
+                next = withoutReason;
+            }
+            else
+                throw new Error(`Unknown Schedule operation: ${input.op}.`);
+            next = { ...next, revision: previous.revision + 1, updatedAt: now.toISOString() };
+            tx.saveSchedule(next);
+            return next;
+        });
+    };
+}
+/** One bounded pass in the existing Controller. Transactions never spawn. */
+export function reconcileSchedules(store, home, now, onError = () => { }, limit = 100) {
+    for (const candidate of store.listDueSchedules(now.toISOString(), limit)) {
+        try {
+            store.transaction(tx => {
+                const schedule = tx.getSchedule(candidate.scope, candidate.id);
+                if (schedule?.state !== "enabled" || schedule.nextDue === null || Date.parse(schedule.nextDue) > now.getTime())
+                    return;
+                const dueAt = schedule.nextDue;
+                const after = fence(schedule, now);
+                if (schedule.scope.kind === "task") {
+                    const task = tx.getTask(schedule.scope.taskId);
+                    if (task === null || task.status !== "active" || task.executionGate.state !== "enabled") {
+                        tx.saveSchedule({ ...schedule, state: "needs-attention", revision: schedule.revision + 1,
+                            reason: "Task execution unavailable; pending intent retained.", updatedAt: now.toISOString() });
+                        return;
+                    }
+                }
+                const job = authorizeSchedule(tx, schedule, schedule.authorization.caller, true);
+                if (job.revision !== schedule.authorization.jobRevision
+                    || binding(tx, schedule.authorization.caller, schedule.scope) !== schedule.authorization.binding) {
+                    throw new Error("Schedule authority or Job revision changed; inspect and explicitly enable.");
+                }
+                const result = admitJobRun(tx, home, schedule.scope, schedule.jobId, schedule.authorization.caller, { source: "schedule", key: `${schedule.id}:${schedule.generation}:${dueAt}` }, now);
+                const overlap = result.reason === "overlap";
+                const nextDue = overlap && schedule.rule.kind === "once" ? dueAt : nextScheduleDue(schedule.rule, after);
+                tx.saveSchedule({
+                    ...schedule, nextDue, state: nextDue === null ? "completed" : "enabled",
+                    processedThrough: after.toISOString(), revision: schedule.revision + 1,
+                    lastAttempt: { at: now.toISOString(), dueAt, outcome: overlap ? "overlap" : "admitted", runId: result.run.id },
+                    updatedAt: now.toISOString()
+                });
+            });
+        }
+        catch (error) {
+            const reason = redactLaunchText(error instanceof Error ? error.message : String(error));
+            // Admission/advancement rolled back together. Do not retry an unknown error.
+            store.transaction(tx => {
+                const current = tx.getSchedule(candidate.scope, candidate.id);
+                if (current?.state !== "enabled" || current.revision !== candidate.revision)
+                    return;
+                tx.saveSchedule({ ...current, state: "needs-attention", reason, revision: current.revision + 1,
+                    lastAttempt: { at: now.toISOString(), dueAt: current.nextDue, outcome: "blocked", reason },
+                    updatedAt: now.toISOString() });
+                if (current.scope.kind === "task") {
+                    const event = createTaskEvent(tx.nextEventId(current.scope.taskId), current.scope.taskId, "schedule.needs-attention", { scheduleId: current.id, reason }, now);
+                    tx.saveEvent(current.scope.taskId, event);
+                    enqueueSupervisorEvent(tx, event, "leader", "schedule-needs-attention", now);
+                }
+                else {
+                    tx.saveGlobalRoleMessage(createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), "operator", `Yui-Summary: Schedule ${current.id} needs attention; no Run was admitted.\n`
+                        + `Reason: ${reason}\nRead: yui schedule show --global --schedule ${current.id}\n`
+                        + "Inspect the original intent before explicitly enabling; no new authority is implied.", "system", { type: "system" }, now, { inputControl: { action: "queue", requestId: `schedule-attention:${current.id}:${current.revision}` } }));
+                }
+            });
+            onError(new Error(`Schedule ${candidate.id} needs attention: ${reason}`, { cause: error }));
+        }
+    }
+}

package/dist/coordination/workMailbox.js

@@ -315,11 +315,11 @@ function parseTarget(value) {
 function parseRef(value, label) {
     const ref = record(value, label);
     const types = [
-        "task", "run", "work-item", "input", "session", "message", "event"
+        "task", "run", "work-item", "input", "session", "message", "event", "global-job-run"
     ];
     if (!types.includes(ref.type))
         throw new Error(`${label} type is invalid`);
-    if (ref.type === "task" || ref.type === "session") {
+    if (ref.type === "task" || ref.type === "session" || ref.type === "global-job-run") {
         exact(ref, ["type", "id"], label);
         return { type: ref.type, id: requireString(ref.id, `${label} id`) };
     }
@@ -360,7 +360,7 @@ function copyTarget(target) {
 }
 export function copyRef(ref) {
     if (!("taskId" in ref)) {
-        if (ref.type !== "task" && ref.type !== "session") {
+        if (ref.type !== "task" && ref.type !== "session" && ref.type !== "global-job-run") {
             throw new Error(`entity reference taskId is required for ${ref.type}`);
         }
         return { type: ref.type, id: requireText(ref.id, "entity reference id") };

package/dist/external/githubPublicationVerifier.js

@@ -1,5 +1,6 @@
 import { createExecFileCommandRunner, createPinnedCommandRunner } from "./pinnedCommandRunner.js";
 import { redactLaunchText } from "../runtime/launchDiagnostics.js";
+import { canonicalPublicationUrl } from "../task/publicationToolObservation.js";
 const GIT_COMMIT = /^[0-9a-f]{40}$/iu;
 const GITHUB_REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
 const MAX_FAILURE_DETAIL_CHARS = 4_000;
@@ -20,22 +21,24 @@ async function inspectGitHubPullRequest(run, input) {
     if (!PULL_REQUEST_NUMBER.test(input.externalId)) {
         throw new Error(`GitHub pull request id must be numeric: ${input.externalId}.`);
     }
+    const hostname = input.externalUrl === undefined
+        ? "github.com" : new URL(canonicalPublicationUrl(input.externalUrl)).host;
     const result = await run("gh", [
         "pr", "view", input.externalId,
-        "--repo", input.repository,
-        "--json", "number,state,headRefOid,mergeCommit,mergedAt,url"
+        "--repo", `${hostname}/${input.repository}`,
+        "--json", "number,state,headRefOid,mergeCommit,mergedAt,url,baseRefName"
     ]);
     if (result.code !== 0) {
         if (result.code === 127) {
-            throw new Error("GitHub verification requires a trusted gh executable on PATH.");
+            throw new Error("The built-in GitHub adapter needs gh on PATH; alternatively record authorized tool evidence with task publication verify --observation.");
         }
         const detail = boundedFailureDetail(redactLaunchText(result.stderr || result.stdout).trim());
         throw new Error(`gh pr view failed for ${input.repository}#${input.externalId} `
             + `(exit ${result.code})${detail.length === 0 ? "" : `: ${detail}`}`);
     }
-    return parseGitHubPullRequest(result.stdout, input.repository, input.externalId);
+    return parseGitHubPullRequest(result.stdout, input.repository, input.externalId, hostname);
 }
-export function parseGitHubPullRequest(stdout, repository, externalId) {
+export function parseGitHubPullRequest(stdout, repository, externalId, expectedHost = "github.com") {
     let parsed;
     try {
         parsed = JSON.parse(stdout.trim());
@@ -60,6 +63,11 @@ export function parseGitHubPullRequest(stdout, repository, externalId) {
         throw new Error("Merged GitHub PR did not expose a merge commit.");
     }
     const externalUrl = optionalText(record.url);
+    if (externalUrl === undefined
+        || canonicalPublicationUrl(externalUrl, "github")
+            !== canonicalPublicationUrl(`https://${expectedHost}/${repository}/pull/${externalId}`, "github")) {
+        throw new Error("GitHub PR URL does not match the expected service, repository and PR.");
+    }
     const mergedAt = optionalText(record.mergedAt);
     return {
         provider: "github",
@@ -67,6 +75,7 @@ export function parseGitHubPullRequest(stdout, repository, externalId) {
         externalKind: "pull-request",
         externalId,
         ...(externalUrl === undefined ? {} : { externalUrl }),
+        ...(optionalText(record.baseRefName) === undefined ? {} : { targetBranch: optionalText(record.baseRefName) }),
         state,
         headCommit,
         ...(remoteCommit === undefined ? {} : { remoteCommit }),

package/dist/external/gitlabPublicationVerifier.js

@@ -30,7 +30,7 @@ async function inspectGitLabMergeRequest(run, input) {
     ]);
     if (result.code !== 0) {
         if (result.code === 127) {
-            throw new Error("GitLab verification requires a trusted glab executable on PATH.");
+            throw new Error("The built-in GitLab adapter needs glab on PATH; alternatively record authorized tool evidence with task publication verify --observation.");
         }
         const detail = boundedFailureDetail(redactLaunchText(result.stderr || result.stdout).trim());
         throw new Error(`glab api failed for ${input.repository}!${input.externalId} `
@@ -74,6 +74,7 @@ export function parseGitLabMergeRequest(stdout, repository, externalId, expected
         externalKind: "merge-request",
         externalId,
         ...(externalUrl === undefined ? {} : { externalUrl }),
+        ...(optionalText(record.target_branch) === undefined ? {} : { targetBranch: optionalText(record.target_branch) }),
         state,
         headCommit,
         ...(remoteCommit === undefined ? {} : { remoteCommit }),

package/dist/interaction/notificationPresentation.js

@@ -49,11 +49,11 @@ export function wakeChangeLabels(reasons) {
             }
         }))];
 }
-export function wakeMessages(wake, messages) {
+export function wakeMessages(wake, messages, history = false) {
     const ids = new Set(wake.refs?.filter(ref => ref.type === "message" && ref.taskId === wake.taskId).map(ref => ref.id));
     const from = Date.parse(wake.fromCursor), to = Date.parse(wake.toCursor);
-    return messages.filter(message => ids.has(message.id)
-        || Date.parse(message.createdAt) > from && Date.parse(message.createdAt) <= to);
+    return messages.filter(message => message.taskId === wake.taskId && (ids.has(message.id)
+        || (history || wake.refs === undefined) && Date.parse(message.createdAt) > from && Date.parse(message.createdAt) <= to));
 }
 export function taskNotificationPresentation(wake, store) {
     const messages = wakeMessages(wake, store.listMessages(wake.taskId));

package/dist/interaction/operatorPresentation.js

@@ -16,6 +16,11 @@ export function createOperatorBatchPresentation(batchId, items) {
     };
 }
 function renderItem(item) {
+    if (item.kind === "global-job-run")
+        return [
+            `- Global Job Run ${item.run.status}: ${item.run.definitionId}/${item.run.id}`,
+            `  Inspect: yui job run-get --global --job ${item.run.definitionId} --run ${item.run.id}`
+        ];
     if (item.kind === "input-request") {
         const { request } = item;
         return [