Scope task run isolation

AgentCompany-New/src/main/database/migrations/035-task-run-isolation.ts

@@ -0,0 +1,16 @@
+export const taskRunIsolationSchema = `
+  alter table task_runs add column execution_context_id text;
+  alter table task_runs add column service_identity_id text references service_identities(id) on delete set null;
+  alter table task_runs add column workspace_mount_json text not null default '[]';
+  alter table task_runs add column secret_scope_json text not null default '{}';
+
+  create unique index if not exists idx_task_runs_execution_context
+    on task_runs(execution_context_id)
+    where execution_context_id is not null;
+  create index if not exists idx_task_runs_service_identity
+    on task_runs(service_identity_id)
+    where service_identity_id is not null;
+
+  insert into schema_migrations(version, name, applied_at)
+  values (35, 'task_run_isolation', datetime('now'));
+`;

AgentCompany-New/src/main/database/schema.ts

@@ -33,6 +33,7 @@ import { providerRequestWorkspaceSchema } from "./migrations/031-provider-reques
 import { browserActionMetadataSchema } from "./migrations/032-browser-action-metadata";
 import { auditEventImmutabilitySchema } from "./migrations/033-audit-event-immutability";
 import { providerAuthSessionsSchema } from "./migrations/034-provider-auth-sessions";
+import { taskRunIsolationSchema } from "./migrations/035-task-run-isolation";
 
 interface Migration {
   version: number;
@@ -75,6 +76,7 @@ const MIGRATIONS: Migration[] = [
   { version: 32, name: "browser_action_metadata", sql: browserActionMetadataSchema },
   { version: 33, name: "audit_event_immutability", sql: auditEventImmutabilitySchema },
   { version: 34, name: "provider_auth_sessions", sql: providerAuthSessionsSchema },
+  { version: 35, name: "task_run_isolation", sql: taskRunIsolationSchema },
 ];
 
 const SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;