taskchef 7.3.0 → 7.5.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "7.3.0",
+  "version": "7.5.0",
   "description": "Dispatch work from a data-only workspace to visible Codex project tasks.",
   "author": {
     "name": "Favo Yang",

package/README.md

@@ -3,11 +3,11 @@
 TaskChef is a local dispatch desk for Codex. Give one dispatcher a request and
 it records each independently useful outcome, creates a normal Codex task in
 the right project, and returns immediately. The executor task is where live
-work, approvals, and follow-ups happen; TaskChef keeps the latest compact
-snapshot for navigation and reporting.
+work, approvals, and follow-ups happen; TaskChef keeps every semantic result
+while projecting the latest one for compact navigation and reporting.
 
 ```text
-request -> recorded TaskChef task -> Codex executor -> current state + last result
+request -> recorded TaskChef task -> Codex executor -> current state + result history
 ```
 
 ## Which document should I read?
@@ -33,7 +33,8 @@ npm install --global taskchef
 
 The plugin provides four skills and a local MCP server. The npm installation
 puts the `taskchef` CLI on `PATH`. TaskChef installs no hooks, schedules,
-daemons, or background identity search.
+daemons, login items, system services, or background identity search and needs
+no elevated permissions.
 
 ## Bootstrap and configure
 
@@ -48,7 +49,7 @@ The canonical workspace is `~/.agents/taskchef`. TaskChef owns only:
 ```text
 AGENTS.md       managed dispatcher instructions plus user additions
 taskchef.json   schema-2 configured projects and routing metadata
-tasks.jsonl     one schema-4/5 snapshot per task (new writes use schema 5)
+tasks.jsonl     one task snapshot per line (schema 6; schema 4/5 migration supported)
 ```
 
 List or change routing targets conversationally:
@@ -93,6 +94,12 @@ reads the executor's own `CODEX_THREAD_ID`, self-links, and reports lifecycle
 state. Independent outcomes may become separate executors; dependent work
 should stay together.
 
+At the start of every dispatcher turn, the managed workspace instructions ask
+the MCP server to best-effort ensure the dashboard. A startup failure never
+blocks an answer, report, or delegation. Every dispatcher response ends with
+the stable [TaskChef Dashboard](http://127.0.0.1:3210/) link; a created-task
+directive remains on the preceding line so dispatch still returns immediately.
+
 For example, TaskChef generates this shape:
 
 ```text
@@ -112,10 +119,12 @@ when a turn starts and one semantic outcome before that same turn ends:
 - `failed`: the executor or creation attempt ended unsuccessfully.
 
 A native approval prompt is live Codex state, not `needs_input`.
-TaskChef stores the current reported execution state and separately preserves
-the last concise semantic result. A follow-up therefore appears as `working`
-immediately without erasing the previous outcome. TaskChef does not store the
-transcript or a lifecycle event log.
+TaskChef stores the current reported execution state and appends every concise
+semantic result to `results`. A follow-up therefore appears as `working`
+immediately without erasing any prior outcome. The final entry is exposed as a
+derived `lastResult` compatibility alias; it is not persisted independently and
+is planned for removal in the next major version after callers move to
+`results.at(-1)`. TaskChef does not store transcripts or non-semantic events.
 
 Delegated tasks created by earlier TaskChef versions remain compatible: their
 inline executor protocol still parses, self-links, and may use the deprecated
@@ -146,12 +155,39 @@ an unambiguous eight-character prefix.
 
 ## Dashboard
 
+Dispatcher turns call the input-free `ensure_dashboard` MCP tool. It starts at
+most one dashboard inside the existing TaskChef MCP process on
+`127.0.0.1:3210`, or reuses a listener only when its bounded `/api/health`
+identity proves the exact TaskChef/dashboard-server version and the same
+canonical workspace. The response says `started` or `reused` and includes the
+stable URL, canonical workspace, and versions.
+
+The in-process dashboard closes with the MCP process. Closing Codex or reloading
+the plugin may therefore stop the dashboard; the next dispatcher turn restores
+it. TaskChef adds no OS-persistent component.
+
+For manual development, run the foreground CLI:
+
 ```sh
 taskchef dashboard
+taskchef dashboard --port 3211
 ```
 
 The loopback dashboard watches `tasks.jsonl`, groups current states, and opens
-linked Codex tasks. It does not mutate TaskChef data and prints its local URL.
+linked Codex tasks. List snapshots and SSE events carry only the latest-result
+projection; opening task details fetches the full newest-first result history.
+It does not mutate TaskChef data and prints its local URL.
+When a compatible foreground dashboard already owns port 3210,
+`ensure_dashboard` reuses it but does not take ownership. If an unknown,
+different-workspace, or stale-version process owns the port, TaskChef reports a
+concise conflict and never kills or replaces that process. The foreground CLI
+similarly asks you to stop the listener or choose another `--port`.
+
+The health endpoint contains only a fixed service marker, health schema,
+TaskChef version, dashboard-server version, and canonical workspace. It exposes
+no task data, credentials, environment variables, process control, or secrets.
+
+![Task detail result history](docs/images/result-history-dashboard.jpg)
 
 ## Common recovery
 
@@ -160,20 +196,27 @@ Check the managed workspace:
 ```sh
 taskchef doctor
 taskchef workspace init
+taskchef workspace migrate
 taskchef doctor
 ```
 
-`doctor` is read-only. `workspace init` creates missing current-schema files
-and refreshes managed instructions; it does not migrate unsupported
-configuration or task records.
+`doctor` is read-only. `workspace init` creates missing files and refreshes
+managed instructions. `workspace migrate` explicitly upgrades supported schema
+4/5 task lines to schema 6 under the workspace lock. It validates the complete
+source and converted log before writing, creates an exclusive `tasks.jsonl.pre-v6-*.bak`
+backup, atomically replaces the log, validates the result, and becomes an
+idempotent no-op after migration. If replacement fails, the original remains
+or the reported backup can be restored; unsupported or invalid input is rejected
+before a backup or rewrite.
 
 If a new record has no thread ID, the executor is link-pending. Reopen that
 executor so its first action can retry `link_task`. Do not guess an identity
 or edit `tasks.jsonl`. If native task creation failed, the record is retained
 as `failed` with null thread and turn IDs.
 
-If an unsupported workspace must be retained, keep it as a backup and create a
-new current workspace. TaskChef provides no conversion or merge command.
+Schemas other than 4, 5, and 6 remain unsupported. Retain such a workspace
+unchanged and create a current workspace; the migration command deliberately
+does not guess how to convert unknown formats.
 
 ## Boundaries
 

package/assets/taskchef-dispatcher-instructions.md

@@ -3,6 +3,9 @@
 
 This folder is the canonical per-user TaskChef dispatcher workspace.
 
+- Early in every dispatcher turn, best-effort call the TaskChef
+  `ensure_dashboard` MCP tool. Dashboard startup failure must not block direct
+  TaskChef answers, reporting, or delegation.
 - Use `$taskchef-bootstrap` when initializing or refreshing this workspace,
   changing or listing its configured projects, running TaskChef doctor,
   or repairing its managed instructions.
@@ -20,4 +23,10 @@ This folder is the canonical per-user TaskChef dispatcher workspace.
   write status or results to this workspace.
 - Explicit invocations of TaskChef skills from other Codex projects use this
   same workspace and task history through TaskChef's global resolution rules.
+- Every final response in this dispatcher workspace must end with this exact
+  clickable link on its final non-empty line:
+  `[TaskChef Dashboard](http://127.0.0.1:3210/)`. Keep any
+  `::created-thread{...}` directive required by delegation on its own line
+  immediately before the dashboard link so the immediate-return contract still
+  holds. Include the link even when `ensure_dashboard` failed.
 <!-- taskchef:dispatcher-instructions:end -->

package/docs/spec.md

@@ -23,7 +23,8 @@ is dated research, not contract.
 | **Self-linking** | The executor's one-way registration of its own canonical Codex UUIDv7 from `CODEX_THREAD_ID`. |
 | **Link-pending** | A working task whose `threadId` is null and `updatedBy` is `dispatcher`. |
 | **Current execution state** | The latest reported executor turn and its `working`, `needs_input`, `completed`, or `failed` status. |
-| **Last semantic result** | The most recent `completed`, `needs_input`, or `failed` outcome, preserved separately while a newer turn is working. |
+| **Result history** | The ordered collection of every accepted `completed`, `needs_input`, or `failed` per-turn outcome. |
+| **Last semantic result** | The final result-history entry, exposed through the derived `lastResult` compatibility alias. |
 | **Current turn ID** | The canonical Codex UUIDv7 returned by an exact native read of the linked executor for the turn being reported. |
 | **Dashboard** | The loopback, read-only UI derived from validated workspace snapshots and bounded native actions. |
 | **Skill** | One packaged agent procedure: `taskchef-bootstrap`, `taskchef-delegate`, `taskchef-executor`, or `taskchef-report`. |
@@ -39,8 +40,8 @@ is dated research, not contract.
   privacy, and idempotency. It MUST NOT dispatch the owned assignment again.
 - `taskchef-report` MUST own on-demand reporting. It MUST NOT poll or persist
   inferred state.
-- The MCP server MUST expose four primary lifecycle tools plus the deprecated
-  `report_result` compatibility alias specified below.
+- The MCP server MUST expose `ensure_dashboard`, four primary lifecycle tools,
+  and the deprecated `report_result` compatibility alias specified below.
 - The CLI MAY administer and inspect the workspace, but MUST NOT provide a
   second agent lifecycle protocol.
 - The dashboard MUST be read-only with respect to dispatcher files.
@@ -67,10 +68,10 @@ Names and paths MUST be unique. Git projects MUST be exact Git roots.
 Repository URLs MUST canonicalize to `https://github.com/<owner>/<repository>`
 and be case-insensitively deduplicated.
 
-`tasks.jsonl` MUST contain zero or more newline-terminated schema-4 or schema-5
-records, one per line. Schema 4 is read compatibility for the previously
-released format; every new record and state mutation MUST write schema 5.
-Other schemas or unsupported fields MUST be rejected without conversion.
+`tasks.jsonl` MUST contain zero or more newline-terminated schema-4, schema-5,
+or schema-6 records, one per line. Schemas 4 and 5 are supported migration/read
+formats; every new record and state mutation MUST write schema 6. Other schemas
+or unsupported fields MUST be rejected without conversion.
 Reads and writes MUST reject symlinked managed files. Mutations
 MUST hold the shared workspace lock and replace state atomically; read-only
 operations MUST NOT require write permission.
@@ -81,7 +82,7 @@ Every record MUST contain exactly these fields:
 
 | Field | Contract |
 | --- | --- |
-| `schemaVersion` | Integer `5`; schema-4 records remain readable until their next mutation. |
+| `schemaVersion` | Integer `6`; schema-4/5 records remain readable until explicit migration or their next mutation. |
 | `id` | Unique safe TaskChef ID; delegation uses a lowercase full UUID. |
 | `project` | Immutable configured-project snapshot. |
 | `title` | Non-empty display title. |
@@ -93,13 +94,26 @@ Every record MUST contain exactly these fields:
 | `turnId` | Null before turn reporting; otherwise the current reported turn. Linked MCP journeys use a canonical Codex UUIDv7. |
 | `updatedAt` | ISO 8601 timestamp not earlier than `createdAt` or the prior `updatedAt`; clock rollback cannot backdate a transition. |
 | `updatedBy` | `dispatcher` or `mcp`. |
-| `lastResult` | Null before a semantic result; otherwise `{status, summary, turnId, updatedAt}` preserving the latest semantic result. |
+| `results` | Ordered oldest-first array of `{status, summary, turnId, updatedAt}` semantic results, with unique turn IDs and nondecreasing timestamps. |
+
+Returned Task objects MUST additionally expose `lastResult` as null for an empty
+history or the final `results` entry. `lastResult` MUST be derived and MUST NOT
+be persisted in schema 6. It is a compatibility alias for schema-4/5, CLI,
+MCP, reporting-skill, and dashboard-list callers, with removal planned for the
+next major version after callers migrate to `results.at(-1)`.
 
 Task IDs and non-null thread identities MUST be unique. The immutable intent
 fields MUST NOT change after recording.
 
 ## Required lifecycle
 
+At the start of every dispatcher turn, the dispatcher SHOULD call
+`ensure_dashboard` best-effort. Failure MUST NOT block direct TaskChef answers,
+reporting, or delegation. Every dispatcher final response MUST end with the
+exact clickable `[TaskChef Dashboard](http://127.0.0.1:3210/)` link even when
+ensure failed. A created-thread directive MUST remain on its own line before
+the final link, preserving the delegate skill's immediate-return contract.
+
 1. The dispatcher MUST call `prepare_dispatch` once per outcome.
 2. It MUST choose exactly one configured project and exact native-project path.
 3. It MUST build the instruction with the user's outcome beginning on line 1
@@ -144,6 +158,43 @@ path. Success returns both one text content item and the stated structured
 object. Validation, marker, identity, uniqueness, freshness, or filesystem
 failures are surfaced as tool errors and MUST NOT partially mutate the log.
 
+### `ensure_dashboard`
+
+**Caller:** dispatcher. **Mutation:** starts at most one in-process loopback
+HTTP server; it does not mutate dispatcher workspace files.
+
+**Input:** empty object.
+
+**Structured output:**
+
+```text
+{ dashboard: {
+  action: "started" | "reused",
+  url: "http://127.0.0.1:3210/",
+  workspace: string,
+  taskchefVersion: string,
+  serverVersion: string
+} }
+```
+
+Calls MUST serialize within one MCP process. The first call starts an owned
+dashboard or reuses an exact compatible listener; later and concurrent calls
+are idempotent and report reuse after the single start. The stable default MUST
+bind only to `127.0.0.1:3210` and MUST NOT accept a model-supplied workspace,
+host, or port.
+
+Before reuse, TaskChef MUST query a bounded loopback identity endpoint and
+require the exact fixed service/schema, TaskChef version, dashboard-server
+version, and canonical workspace. An unknown, malformed, different-workspace,
+or stale-version listener MUST produce a concise actionable conflict. TaskChef
+MUST NOT kill, replace, signal, or otherwise control that listener. A startup
+failure MUST leave no owned listener. The MCP server MUST close its owned
+dashboard when its transport or process shuts down; it MUST NOT close a reused
+external foreground server.
+
+**Annotations:** `readOnlyHint: false`, `destructiveHint: false`,
+`openWorldHint: false`.
+
 ### `prepare_dispatch`
 
 **Caller:** dispatcher. **Mutation:** none.
@@ -187,7 +238,8 @@ new preparation values, though it writes no state.
 
 **Structured output:** `{ task: Task }`.
 
-The returned task has schema 5, `working`, null summary/turn/thread/lastResult,
+The returned task has schema 6, `working`, null summary/turn/thread/lastResult,
+an empty `results` array,
 `updatedBy: dispatcher`, and equal creation/update timestamps. Duplicate IDs,
 unknown projects, malformed markers, and invalid input fail. Repeating a
 successful call is not idempotent; it fails as a duplicate.
@@ -216,7 +268,7 @@ marker, or ineligible state fails.
 ### `report_state`
 
 **Caller:** executor, or dispatcher only for native creation failure.
-**Mutation:** replaces the current state atomically and preserves `lastResult`.
+**Mutation:** replaces the current state atomically and preserves `results`.
 
 **Input:**
 
@@ -235,8 +287,10 @@ the current turn and last semantic result. A semantic state MUST match the
 current working turn. Repeating an identical state is idempotent; conflicting
 or older state fails. A null-identity record accepts only a fresh executor
 creation `failed` state with both IDs null. Success sets the current state and
-preserves the semantic state in `lastResult`; starting newer work does not erase
-that result.
+appends a semantic result to `results`; starting newer work preserves the entire
+collection. An identical retry for any settled turn returns success without an
+append. A different result for a settled turn, a stale turn, or a semantic
+result that does not match the active working turn MUST fail.
 
 **Annotations:** `readOnlyHint: false`, `destructiveHint: true`,
 `openWorldHint: false`.
@@ -245,10 +299,10 @@ that result.
 
 `report_result` retains the prior semantic-only input shape and statuses as a
 temporary compatibility alias. It implicitly accepts a fresh supplied turn and
-stores its semantic result, including for supported schema-4 records and
+stores its semantic result, including for supported schema-4/5 records and
 low-level opaque direct records. It does not accept `working`. New executor
-instructions MUST use `report_state`. Successful mutation upgrades schema 4 to
-schema 5; unsupported schemas remain rejected.
+instructions MUST use `report_state`. Successful mutation upgrades schema 4/5
+to schema 6; unsupported schemas remain rejected.
 
 ## Reporting and dashboard
 
@@ -258,11 +312,33 @@ state overrides cache. An inactive task does not prove completion. Focused
 reports MAY read a selected task once when metadata is newer or evidence is
 uncertain. Reports MUST NOT poll or classify assistant prose.
 
+Task lists, summaries, and broad reports MUST use the final result by default.
 The dashboard MUST bind only to loopback, validate the current workspace
-snapshot, and avoid sessions or shared client state. Direct thread navigation
+snapshot, and avoid sessions or shared client state. `GET /api/health` MUST
+return only the bounded service identity, health schema, exact TaskChef and
+dashboard-server versions, and canonical workspace. It MUST NOT return task
+records, secrets, credentials, environment values, or process-control data.
+Identity remains available while an already-started monitor retains its last
+valid snapshot after a later invalid task log; an invalid initial log MAY fail
+startup safely. Direct thread navigation
 MUST require a canonical Codex UUIDv7. Otherwise it MAY open the revalidated
 configured project. Project paths from task history MUST be matched against
 current configuration before use.
+Snapshot and SSE list payloads MUST omit full `results` history and include the
+derived latest-result projection. The bounded per-task detail endpoint MAY
+return the full validated task so the dialog can render history newest first.
+
+## Task-log migration
+
+`workspace migrate` MUST explicitly convert every supported schema-4/5 record
+under the shared lock. A legacy `lastResult`, or a schema-4 current semantic
+state, becomes zero or one initial `results` entry. Migration MUST validate the
+complete source and complete schema-6 candidate before changing the task log,
+create and read back an exclusive recovery backup, atomically replace the log,
+and validate the installed result. A fully schema-6 log MUST be an idempotent
+no-op without another backup. Invalid/unsupported input MUST remain untouched;
+failures after backup creation MUST report the backup path and MUST never
+partially rewrite individual lines.
 
 ## Concurrency and trust
 
@@ -279,3 +355,9 @@ loopback origin, and current configuration before acting.
 TaskChef MUST NOT use lifecycle hooks, schedules, polling, recent-thread search,
 transcript search, title matching, hidden reasoning, or token usage to discover
 identity or infer semantic results.
+
+TaskChef MUST NOT install or require daemons, launchd agents, login items,
+system services, cron jobs, hooks, privileged components, or elevated/system
+permissions for dashboard availability. Availability is best-effort while the
+owning Codex/plugin MCP process is alive and is not guaranteed while Codex is
+closed.

package/docs/workflows.md

@@ -14,16 +14,55 @@ research.
 | `skills/taskchef-executor/SKILL.md` | Own, self-link, execute, and report every executor turn. |
 | `skills/taskchef-bootstrap/SKILL.md` | Initialize current workspace and configure projects. |
 | `skills/taskchef-report/SKILL.md` | Select cached tasks and perform bounded live checks. |
-| `src/mcp.js` | Four primary lifecycle tools, one deprecated alias, and MCP annotations. |
+| `src/mcp.js` | Dashboard ensure, four primary lifecycle tools, one deprecated alias, shutdown ownership, and MCP annotations. |
 | `src/delegation.js` | UUID marker, concise executor-skill invocation shape, and creation-failure handling. |
 | `src/workspace.js` | Current schemas, validation, locking, atomic JSONL writes, linking, and result freshness. |
 | `src/cli.js` | Administration, inspection, diagnostics, and dashboard startup. |
-| `src/dashboard.js` | Validated snapshots, SSE fan-out, and bounded open actions. |
+| `src/dashboard.js` | Versioned health identity, validated compact snapshots, SSE fan-out, on-demand details, and bounded open actions. |
+| `src/dashboard-manager.js` | Concurrent singleton ensure, exact listener reuse, conflicts, and owned shutdown. |
 
 The MCP process resolves `TASKCHEF_WORKSPACE` once and never accepts a model
 supplied path. The CLI resolves `--workspace`, then the environment, then the
 per-user default.
 
+## Dispatcher dashboard lifecycle
+
+The generated managed `AGENTS.md` block makes dashboard maintenance a
+best-effort prelude to every dispatcher turn and keeps response ordering
+centralized instead of duplicating it across delegate/report skills.
+
+```mermaid
+sequenceDiagram
+  autonumber
+  participant D as Dispatcher
+  participant M as TaskChef MCP
+  participant H as Loopback health
+  participant S as Dashboard server
+  D->>M: ensure_dashboard()
+  M->>M: Serialize concurrent ensure calls
+  M->>H: GET 127.0.0.1:3210/api/health
+  alt Exact service, versions, and canonical workspace
+    H-->>M: Bounded compatible identity
+    M-->>D: reused, URL, workspace, versions
+  else No listener
+    H--xM: Connection refused
+    M->>S: Start in this MCP process on 127.0.0.1:3210
+    S-->>M: Owned server
+    M-->>D: started, URL, workspace, versions
+  else Unknown, stale, or different workspace
+    H-->>M: Missing or incompatible identity
+    M-->>D: Actionable conflict, listener untouched
+  end
+  Note over D: Continue even when ensure failed
+  D-->>D: Answer, report, or dispatch
+  Note over D: Created-thread directive, when any, precedes final dashboard link
+```
+
+When the MCP transport or plugin process closes, it closes only the server it
+started. A compatible foreground `taskchef dashboard` listener may be reused
+but remains owned by that CLI process. No TaskChef path terminates an unknown
+listener or installs OS persistence.
+
 ## Normal delegation and self-linking
 
 The dispatcher uses native Codex project discovery for routing and MCP for
@@ -50,7 +89,7 @@ sequenceDiagram
   D->>D: Choose one configured and native project
   D->>M: record_task(id, project, title, instruction, null)
   M->>W: recordTask()
-  W->>W: Lock, validate, append schema-5 snapshot
+  W->>W: Lock, validate, append schema-6 snapshot
   W-->>M: working link-pending task
   M-->>D: task
   D->>C: Create executor with marked instruction
@@ -77,8 +116,8 @@ semantic callbacks.
 ## State reporting
 
 The executor obtains the turn identity from an exact native read of its own
-linked task. `report_state` records live turn state while preserving the last
-semantic result separately.
+linked task. `report_state` records live turn state while preserving the ordered
+semantic result history.
 
 ```mermaid
 sequenceDiagram
@@ -91,13 +130,13 @@ sequenceDiagram
   C-->>E: Current turn ID
   E->>M: report_state(..., working, null)
   M->>W: reportTaskState()
-  W->>W: Store current turn and preserve lastResult
+  W->>W: Store current turn and preserve results
   E->>E: Work, finish, or reach semantic decision
   E->>M: report_state(..., semantic status, summary)
   M->>W: reportTaskState()
   W->>W: Lock and validate identity and freshness
   alt Same current working turn
-    W->>W: Store semantic state and lastResult
+    W->>W: Append semantic result and derive lastResult
     W-->>M: Updated task
     M-->>E: Recorded result
   else Same turn and same result
@@ -134,9 +173,9 @@ sequenceDiagram
   C-->>E: turnB
   E->>M: report_state(..., turnB, working, null)
   M->>W: reportTaskState()
-  W->>W: Require turnB greater and preserve result A
-  W-->>M: working snapshot plus lastResult A
-  M-->>E: working snapshot plus lastResult A
+  W->>W: Require turnB greater and preserve results
+  W-->>M: working snapshot plus history A
+  M-->>E: working snapshot plus history A
   E->>M: report_state(..., turnB, completed, summaryB)
   M->>W: reportTaskState()
   W-->>M: completed snapshot plus result B
@@ -224,7 +263,9 @@ sequenceDiagram
   F-->>D: Filesystem change
   D->>F: Bounded read from one descriptor
   D->>D: Validate current schema and sort
-  D-->>B: SSE snapshot
+  D-->>B: Compact SSE snapshot without results
+  B->>D: GET task detail on demand
+  D-->>B: Full validated history
   B->>D: Open task action
   alt Canonical Codex UUIDv7
     D->>C: Direct thread navigation
@@ -234,9 +275,25 @@ sequenceDiagram
   end
 ```
 
-The dashboard binds to `127.0.0.1`, has no shared session state, limits
-request bodies, and checks origin/authority for stateful local actions. Historical
-project paths are untrusted until matched against current configuration.
+The dashboard binds to `127.0.0.1`, has no shared session state, limits task
+count, file size, result count, and display fields, and checks origin/authority
+for stateful local actions. Its bounded identity endpoint contains no task data
+or secrets. The monitor already validates the complete log, but
+snapshot/SSE list projections omit `results` so repeated updates do not resend
+unnecessary history. A read-only per-task endpoint returns full history only
+when the dialog opens. Historical project paths are untrusted until matched
+against current configuration.
+
+## Schema 4/5 migration
+
+`taskchef workspace migrate` acquires the same workspace lock as lifecycle
+writers, validates the complete legacy log, converts each schema-4/5 latest
+result into zero or one initial schema-6 `results` entry, then validates the
+complete candidate. Before replacement it writes and reads back an exclusive
+`tasks.jsonl.pre-v6-*.bak` file. The task log is replaced atomically and
+validated again. A second run sees only schema 6 and returns unchanged without
+another backup. Unsupported or malformed input fails before backup/rewrite;
+after a later filesystem failure, the reported backup is the recovery source.
 
 ## Concurrency and trust boundaries
 
@@ -251,6 +308,7 @@ summary is cryptographically authenticated; this is a local single-user trust
 model. Managed files, instructions, project snapshots, MCP inputs, and dashboard
 requests are validated at every action boundary.
 
-Configuration schema 2 and task schemas 4 and 5 are accepted. Schema 4 is
-read-only compatibility until a lifecycle mutation upgrades that record to
-schema 5. Other schemas are rejected without rewrite.
+Configuration schema 2 and task schemas 4, 5, and 6 are accepted. Schemas 4/5
+are read/migration compatibility until an explicit migration or lifecycle
+mutation upgrades each record to schema 6. Schema 6 persists `results` only and
+derives `lastResult` for compatibility. Other schemas are rejected without rewrite.

package/index.js

@@ -10,6 +10,7 @@ export {
   initializeWorkspace,
   linkTask,
   listProjects,
+  migrateTaskLog,
   prepareDispatch,
   readConfig,
   listTasks,
@@ -57,10 +58,19 @@ export {
 } from "./src/codex-app.js";
 
 export {
+  DASHBOARD_HEALTH_MAX_BYTES,
+  DASHBOARD_HEALTH_PATH,
   DashboardMonitor,
   createDashboardServer,
   dashboardAuthority,
   sortTasksByMeaningfulUpdate,
 } from "./src/dashboard.js";
 
+export {
+  createDashboardManager,
+  readDashboardIdentity,
+} from "./src/dashboard-manager.js";
+
+export { DASHBOARD_SERVER_VERSION, TASKCHEF_VERSION } from "./src/version.js";
+
 export { createTaskChefMcpServer } from "./src/mcp.js";

package/mcp/server.js

@@ -5,3 +5,15 @@ import { createTaskChefMcpServer } from "../src/mcp.js";
 
 const server = createTaskChefMcpServer();
 await server.connect(new StdioServerTransport());
+
+let shutdownPromise = null;
+const shutdown = () => {
+  shutdownPromise ??= server.close().catch((error) => {
+    process.stderr.write(`TaskChef MCP shutdown failed: ${error.message}\n`);
+    process.exitCode = 1;
+  });
+  return shutdownPromise;
+};
+
+process.once("SIGINT", shutdown);
+process.once("SIGTERM", shutdown);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "7.3.0",
+  "version": "7.5.0",
   "description": "A non-blocking interactive dispatcher for visible Codex tasks.",
   "license": "MIT",
   "author": "Favo Yang",
@@ -26,6 +26,7 @@
     "docs/spec.md",
     "docs/workflows.md",
     "docs/firstmate-taskchef-comparison.md",
+    "docs/images/result-history-dashboard.jpg",
     "index.js",
     "mcp",
     "scripts/benchmark-dispatch-prepare.js",

package/skills/taskchef-bootstrap/SKILL.md

@@ -19,8 +19,10 @@ all deterministic workspace operations.
   dispatcher workspace. Preserve unrelated user-owned paths.
 - Do not dispatch tasks or report on executor threads during bootstrap unless
   the user separately requests those actions.
-- Never create hooks, schedules, polling, or daemons. TaskChef executors
-  self-link through the installed MCP server.
+- Never create hooks, schedules, polling, daemons, login items, or system
+  services. The managed dispatcher instructions own best-effort dashboard
+  startup and final-link guidance; bootstrap only refreshes that managed block.
+  TaskChef executors self-link through the installed MCP server.
 
 ## Initialize and repair
 

package/skills/taskchef-report/SKILL.md

@@ -44,14 +44,16 @@ all deterministic task-log operations.
    detailed read. Native approval is live Codex state, not a `needs_input`
    callback. An inactive status never proves semantic completion; it only
    permits a trustworthy cached MCP result to stand.
-4. In schema 5, treat `status`, `turnId`, and `updatedAt` as the latest reported
-   execution state and treat `lastResult` as the separately preserved semantic
-   result. A `working` state with a non-null `lastResult` means a newer executor
+4. In schema 6, treat `status`, `turnId`, and `updatedAt` as the latest reported
+   execution state and treat `results` as the ordered semantic history.
+   `lastResult` is the derived compatibility alias for `results.at(-1)`; prefer
+   the collection when full history matters and the alias for compact latest-state
+   reporting. A `working` state with a non-null `lastResult` means a newer executor
    turn started after that result; show the prior result as history, not as the
    current outcome. Treat a failed `lastResult` with null thread and turn IDs as
-   a fresh executor-creation failure. No live read is possible or needed.
-   Schema 4 snapshots normalize a structurally complete result into
-   `lastResult` without rewriting their log line. When identity is certain and
+   a fresh executor-creation failure. Schema 4/5 snapshots normalize zero or one
+   semantic result into `results` and `lastResult` without rewriting their log line.
+   No live read is possible or needed for that creation failure. When identity is certain and
    metadata says the thread is inactive, trust the latest semantic result by
    default in a broad overview unless a newer working state makes it historical.
    Do not read every idle terminal task in an overview merely because native