integration: batch 2 — priority drafts (#1824 #1779 #1770 #1769 #1678)

.claude/rules/23-cross-boundary-contract-tests.md

@@ -121,6 +121,30 @@ passes the same controls to child sessions or subagents. A runtime discriminator
 such as an empty container ID must have a regression test that would fail if an
 early return were moved back above the generated-config writer.
 
+### Runtime Exit and Diagnostic Correlation Boundaries
+
+Task lifecycle and diagnostic ingestion are also cross-service contracts. When a
+runtime-owned exit can end an agent prompt or session, tests MUST prove the real
+runtime path emits exactly one terminal callback and that the callback reaches
+the control-plane task transition. Clearing local prompt state alone is not a
+terminal outcome.
+
+Intentional lifecycle writers such as user, parent-agent, or orchestrator stops
+MUST use the canonical cancellation status, write the corresponding status
+event, synchronize linked trigger executions, and run terminal cleanup. Test the
+compare-and-set behavior so an intentional stop cannot overwrite a concurrent
+fatal failure and hide the original cause.
+
+When observability producers cannot supply task or session identifiers, start
+the contract test with that least-correlated producer payload. Exercise the real
+ingestion and enrichment boundary, then prove that:
+
+- one authoritative candidate is enriched with its task and session identifiers;
+- missing, cross-node, cross-session, stale, and ambiguous candidates remain
+  uncorrelated;
+- retries may add previously missing correlation but cannot rebind an incident
+  to a different task or session.
+
 ### Why This Rule Exists
 
 The R2 file upload feature shipped with two cross-boundary contract mismatches:

.claude/rules/48-stale-while-revalidate-ui.md

@@ -100,10 +100,25 @@ modifying an existing one, use `useQuery`/`useMutation` instead of hand-rolled
 - Use `queryClient.invalidateQueries(...)` after mutations instead of
   `await reload()` chains threaded through context.
 - Use `refetchInterval` instead of hand-rolled `setInterval` polls.
+- Every authenticated query key must include the resolved user identity (or an
+  equivalent tenant/session namespace). Clear the previous namespace and gate
+  protected children while that identity changes so cached data from one
+  account can never render for another account, even for a single frame.
 
 Hand-rolled loaders are only acceptable for genuinely non-query state
 (WebSockets, streaming, imperative one-shots).
 
+### 5. Responsive shells MUST preserve routed subtree identity
+
+Changing between mobile and desktop chrome must not remount the routed page,
+chat, composer, or media subtree. When breakpoint branches use different
+sibling structures, give shared stateful slots stable keys (or keep one shared
+slot outside the branches) so React can reconcile them across positions.
+
+Every responsive shell change must include a portrait-to-landscape regression
+test that crosses the actual breakpoint and proves local child state and mount
+identity survive. A static test at one viewport is insufficient.
+
 ## Interaction-Effect Trace Requirement
 
 When adding any state change that a `useEffect` in the same tree observes
@@ -123,3 +138,5 @@ Before committing UI data-fetching or context changes:
 - [ ] Spinners gate only on "no data yet", never on "refetch in flight"
 - [ ] Mutations invalidate/refresh data without unmounting visible content
 - [ ] New fetch surfaces use TanStack Query (or document why not)
+- [ ] Authenticated query keys are identity-scoped and account transitions are gated
+- [ ] Breakpoint changes preserve routed and media subtree identity

.claude/skills/env-reference/SKILL.md

@@ -114,6 +114,24 @@ See `apps/api/.env.example` for the full list. Key variables:
 - `DEPLOYMENT_RELEASE_RETENTION_LAST_RUN_KV_KEY` — KV interval marker (default: `cleanup:deployment-releases:last-run`)
 - `COMPOSE_IMAGE_ARTIFACT_CLEANUP_BATCH_SIZE` — Maximum abandoned compose archives deleted per daily run (default: `250`)
 
+### Guided Agent Credential Setup
+
+- `MAX_CONCURRENT_SETUP_SESSIONS` — Concurrent Cloudflare Sandbox setup-session cap (default: `2`)
+- `SETUP_SESSION_TTL_MS` — Setup-session lifetime before teardown (default: `900000`)
+- `SETUP_SESSION_CAPTURE_POLL_MS` — Device-login and credential-capture poll interval (default: `3000`)
+- `CODEX_DEVICE_AUTH_REQUEST_TIMEOUT_MS` — Codex app-server JSON-RPC request timeout (default: `30000`)
+- `CLAUDE_SETUP_ENTER_DELAY_MS` — Delay before sending Enter as a separate stdin write after Claude's browser-displayed code is pasted into the CLI (default: `1000`)
+- `CLAUDE_SETUP_EXCHANGE_TIMEOUT_MS` — Maximum wait for Claude's CLI exchange to finish after code submission (default: `120000`)
+- `CLAUDE_SETUP_REJECTION_SETTLE_MS` — Wait for Ink redraws to settle before classifying the Claude CLI OAuth error line (default: `400`)
+- `CLAUDE_SETUP_VERIFICATION_POLL_MS` — Poll interval for the browser-code handoff file inside the Claude setup sandbox (default: `500`)
+- `CLAUDE_SETUP_TTY_COLUMNS` — PTY width used for `claude setup-token` to reduce opaque-token wrapping (default: `512`)
+- `CLAUDE_SETUP_OUTPUT_BUFFER_BYTES` — Maximum in-memory Claude PTY output retained for parsing (default: `32768`)
+- `CLAUDE_VERIFICATION_CODE_MAX_LENGTH` — Maximum accepted browser-displayed `code#state` length (default: `1024`)
+- `CLAUDE_SETUP_ERROR_DETAIL_MAX_LENGTH` — Maximum sanitized Claude CLI diagnostic surfaced to the user (default: `160`)
+- `CLAUDE_OAUTH_TOKEN_MAX_LENGTH` — Maximum captured Claude OAuth token length (default: `8192`)
+- `SETUP_SESSION_SWEEP_MAX_CANDIDATES` — Maximum expired setup sessions torn down per sweep (default: `50`)
+- `POOL_LEASE_BUFFER_MS` — Grace after the session TTL before a leaked setup-pool lease self-prunes (default: `300000`)
+
 ### Operational Control Loops
 
 - `CRON_SWEEPS_ENABLED_KV_KEY` — Fail-open KV brake key for the five-minute operational sweep (default: `control-loops:cron-enabled`)
@@ -214,9 +232,12 @@ by the read-only cron-liveness check.
 - `TASK_LIST_MAX_PAGE_SIZE` — Maximum task/project list page size
 - `CHAT_SESSION_MESSAGE_LIMIT` — Default page size for chat session message REST responses when no limit is requested — used by the 3s poll and load-more (default: 500)
 - `CHAT_SESSION_MESSAGE_MAX` — Ceiling any chat session message request is clamped to; the initial full-conversation load requests up to this (default: 50000)
+- `MCP_TRIGGER_LIST_LIMIT` — Default result count for the `list_triggers` MCP tool (default: 20)
+- `MCP_TRIGGER_LIST_MAX` — Maximum result count accepted by the `list_triggers` MCP tool (default: 100)
 
 ### Timeouts
 
+- `ORCHESTRATOR_STOP_CAS_MAX_ATTEMPTS` — Maximum task-status compare-and-set attempts after a parent hard-stops a child runtime (default: 2)
 - `TASK_CALLBACK_TIMEOUT_MS` — Timeout budget for delegated-task callback processing
 - `TASK_CALLBACK_RETRY_MAX_ATTEMPTS` — Retry budget for delegated-task callback processing
 - `TASK_RECONCILIATION_IDLE_MS` — Idle threshold before a visible task reconciliation check-in (default: 300000)

.github/workflows/deploy-reusable.yml

@@ -616,6 +616,11 @@ jobs:
           VITE_PUBLIC_WEBSITE_URL: ${{ vars.PUBLIC_WEBSITE_URL || '' }}
           VITE_FEATURE_MULTI_TERMINAL: 'true'
           VITE_DEBUG_DIAGNOSIS_EVENT_MAX_PAGES: ${{ vars.VITE_DEBUG_DIAGNOSIS_EVENT_MAX_PAGES || '100' }}
+          VITE_PROJECT_LIST_LIMIT: ${{ vars.VITE_PROJECT_LIST_LIMIT || '50' }}
+          VITE_PROJECT_POLL_INTERVAL_MS: ${{ vars.VITE_PROJECT_POLL_INTERVAL_MS || '30000' }}
+          VITE_SIDEBAR_PROJECT_POLL_INTERVAL_MS: ${{ vars.VITE_SIDEBAR_PROJECT_POLL_INTERVAL_MS || '60000' }}
+          VITE_PROJECT_PREFETCH_DELAY_MS: ${{ vars.VITE_PROJECT_PREFETCH_DELAY_MS || '120' }}
+          VITE_BACKGROUND_FETCH_DELAY_MS: ${{ vars.VITE_BACKGROUND_FETCH_DELAY_MS || '150' }}
 
       # Bake the deployment-built vm-agent before Wrangler builds the raw container.
       - name: Setup Go for Container Runtime

.github/workflows/scheduler-lifecycle.yml

@@ -0,0 +1,48 @@
+name: Scheduler Lifecycle Exploration
+
+on:
+  schedule:
+    - cron: '33 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: scheduler-lifecycle-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  explore:
+    name: Explore Scheduler Lifecycles
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Build API dependencies
+        run: pnpm exec turbo run build --filter=@simple-agent-manager/api...
+
+      - name: Explore generated scheduler lifecycles
+        run: |
+          set -o pipefail
+          pnpm --filter @simple-agent-manager/api test:scheduler:nightly 2>&1 | tee scheduler-lifecycle.log
+
+      - name: Upload replay diagnostics
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: scheduler-lifecycle-replay-${{ github.run_id }}
+          path: scheduler-lifecycle.log
+          if-no-files-found: error
+          retention-days: 14

apps/api/.env.example

@@ -77,6 +77,26 @@ BASE_DOMAIN=workspaces.example.com
 # WEBHOOK_DELIVERY_MAX_PAGE_SIZE=100
 # WEBHOOK_DELIVERY_PROCESSING_LEASE_SECONDS=300
 
+# Guided agent credential setup via Cloudflare Sandbox
+# MAX_CONCURRENT_SETUP_SESSIONS=2
+# SETUP_SESSION_TTL_MS=900000
+# SETUP_SESSION_CAPTURE_POLL_MS=3000
+# CODEX_DEVICE_AUTH_REQUEST_TIMEOUT_MS=30000
+# Claude Code v2.1.220 treats a large pasted code plus inline carriage return as
+# text; keep Enter as a separate write after this settle delay.
+# CLAUDE_SETUP_ENTER_DELAY_MS=1000
+# CLAUDE_SETUP_EXCHANGE_TIMEOUT_MS=120000
+# Wait for Ink redraw output to settle before classifying a mangled OAuth error.
+# CLAUDE_SETUP_REJECTION_SETTLE_MS=400
+# CLAUDE_SETUP_VERIFICATION_POLL_MS=500
+# CLAUDE_SETUP_TTY_COLUMNS=512
+# CLAUDE_SETUP_OUTPUT_BUFFER_BYTES=32768
+# CLAUDE_VERIFICATION_CODE_MAX_LENGTH=1024
+# CLAUDE_SETUP_ERROR_DETAIL_MAX_LENGTH=160
+# CLAUDE_OAUTH_TOKEN_MAX_LENGTH=8192
+# SETUP_SESSION_SWEEP_MAX_CANDIDATES=50
+# POOL_LEASE_BUFFER_MS=300000
+
 # NOTE: Hetzner tokens are NOT platform secrets.
 # Users provide their own Hetzner API tokens through the Settings UI.
 # These are stored encrypted (per-user) in the database.
@@ -532,13 +552,16 @@ INFOMANIAK_IP_POLL_INTERVAL_MS=3000
 # ORCHESTRATOR_MAX_RETRIES_PER_TASK=3        # Max retry attempts per task via retry_subtask
 # ORCHESTRATOR_DEPENDENCY_MAX_EDGES=50       # Max dependency edges per project via add_dependency
 # ORCHESTRATOR_STOP_GRACE_MS=5000            # Grace period before hard stop after warning (ms)
+# ORCHESTRATOR_STOP_CAS_MAX_ATTEMPTS=2        # Task-status CAS attempts after hard stop
 # ORCHESTRATOR_MESSAGE_MAX_LENGTH=32768      # Max length for injected messages to child agents
 # ORCHESTRATOR_ZERO_TASK_GRACE_MS=600000      # 10 minutes — allow tasks to land before terminalizing an empty mission
 # ORCHESTRATOR_MAX_MISSION_LIFETIME_MS=86400000 # 24 hours — force terminal completion of a stuck mission
 
-# MCP get_session_messages limits
+# MCP list/read limits
 # MCP_MESSAGE_LIST_LIMIT=50              # Default number of raw tokens fetched per request
 # MCP_MESSAGE_LIST_MAX=200               # Max raw tokens per request (before grouping into logical messages)
+# MCP_TRIGGER_LIST_LIMIT=20              # Default page size for list_triggers
+# MCP_TRIGGER_LIST_MAX=100               # Max page size for list_triggers
 
 # MCP idea management limits
 # MCP_IDEA_CONTENT_MAX_LENGTH=65536      # Max length for idea content/description (64 KB)

apps/api/package.json

@@ -9,6 +9,8 @@
     "build": "tsc",
     "dev": "wrangler dev --port ${WRANGLER_PORT:-8787}",
     "test": "vitest run",
+    "test:scheduler": "vitest run tests/simulation/scheduler-lifecycle-simulation.test.ts",
+    "test:scheduler:nightly": "SCHEDULER_SIM_PROFILE=nightly vitest run tests/simulation/scheduler-lifecycle-simulation.test.ts",
     "test:debugging-workers": "vitest run --config vitest.debugging.workers.config.ts",
     "test:workers": "vitest run --config vitest.workers.config.ts",
     "test:watch": "vitest",