Scope task run isolation

AgentCompany-New/tests/unit/domain-services.test.ts

@@ -23,7 +23,7 @@ describe("domain services", () => {
     const connection = createConnection();
 
     const rows = connection.db.prepare("select version from schema_migrations order by version asc").all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34]);
+    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35]);
     connection.close();
   });
 
@@ -520,6 +520,8 @@ describe("domain services", () => {
     expect(state.projects[0]?.leadAgentId).toBe(state.agents[0]?.id);
     expect(state.tasks[0]?.assigneeAgentId).toBe(state.agents[0]?.id);
     expect(state.taskRuns[0]?.trigger).toBe("bootstrap");
+    expect(state.taskRuns[0]?.executionContextId).toMatch(/^ctx_/);
+    expect(state.taskRuns[0]?.serviceIdentityId).toMatch(/^sid_/);
     connection.close();
   });
 });

AgentCompany-New/tests/unit/migration-service.test.ts

@@ -123,7 +123,7 @@ describe("migration service", () => {
       create table workspaces(id text primary key, org_id text, project_id text);
       create table goals(id text primary key, org_id text, owner_agent_id text);
       create table projects(id text primary key, org_id text, goal_id text, lead_agent_id text);
-      create table task_runs(id text primary key, org_id text, task_id text, agent_id text, provider_id text, provider_request_id text);
+      create table task_runs(id text primary key, org_id text, task_id text, agent_id text, provider_id text, provider_request_id text, service_identity_id text);
       create table approvals(id text primary key, org_id text, decided_by_employee_id text);
       create table approval_routing_rules(id text primary key, org_id text);
       create table approval_assignments(id text primary key, org_id text, approval_id text, routing_rule_id text);
@@ -201,7 +201,7 @@ describe("migration service", () => {
       insert into goals(id, org_id, owner_agent_id) values ('goal-1', 'org-1', 'agent-1');
       insert into projects(id, org_id, goal_id, lead_agent_id) values ('prj-1', 'org-1', 'goal-1', 'agent-1');
       insert into tasks(id, org_id, assignee_agent_id, project_id, goal_id, workspace_id) values ('task-1', 'org-1', 'agent-1', 'prj-1', 'goal-1', 'wsp-1');
-      insert into task_runs(id, org_id, task_id, agent_id, provider_id, provider_request_id) values ('run-1', 'org-1', 'task-1', 'agent-1', 'prov-1', 'req-1');
+      insert into task_runs(id, org_id, task_id, agent_id, provider_id, provider_request_id, service_identity_id) values ('run-1', 'org-1', 'task-1', 'agent-1', 'prov-1', 'req-1', 'sid-1');
       insert into approvals(id, org_id, decided_by_employee_id) values ('approval-1', 'org-1', 'emp-1');
       insert into approval_routing_rules(id, org_id) values ('route-1', 'org-1');
       insert into approval_assignments(id, org_id, approval_id, routing_rule_id) values ('assign-1', 'org-1', 'approval-1', 'route-1');

AgentCompany-New/tests/unit/task-execution-service.test.ts

@@ -126,11 +126,17 @@ describe("task execution service", () => {
     expect(run).toMatchObject({ taskId, agentId: expect.any(String), providerId, state: "completed", errorMessage: null });
     expect(request).toMatchObject({ providerId, workspaceId, state: "succeeded", responseText: "executed:gpt-5.4" });
     expect(skillRuntimeSnapshot).toMatchObject({ agentId, runId });
+    expect(run?.executionContextId).toMatch(/^ctx_/);
+    expect(run?.serviceIdentityId).toMatch(/^sid_/);
+    expect(JSON.parse(run?.workspaceMountJson ?? "[]")).toEqual([expect.objectContaining({ workspaceId, mode: "read_only" })]);
+    expect(JSON.parse(run?.secretScopeJson ?? "{}")).toMatchObject({ providerIds: [providerId], credentialAccess: "provider_runtime_only" });
     expect(skillRuntimeSnapshot?.compiledPrompt).toContain("Verify release readiness");
     expect(skillRuntimeSnapshot?.sourceRevisionIds).toContain(revisionId);
     expect(capturedPrompt).toContain("Task: Draft launch checklist");
     expect(capturedPrompt).toContain("Assignee: Ada (Execution lead)");
     expect(capturedPrompt).toContain("Workspace: Task Workspace");
+    expect(capturedPrompt).toContain("Execution context:");
+    expect(capturedPrompt).toContain("Secret scope:");
     expect(capturedPrompt).toContain("Skill runtime:");
     expect(capturedPrompt).toContain("Tool allowlist:");
     expect(state.auditEvents.some((event) => event.entityType === "task_run" && event.action === "completed")).toBe(true);
@@ -160,6 +166,7 @@ describe("task execution service", () => {
     let employeeId = "";
     let taskId = "";
     let approvalId = "";
+    let workspaceId = "";
 
     connection.transaction(() => {
       orgId = organization.createOrganization({
@@ -171,6 +178,12 @@ describe("task execution service", () => {
       employeeId = (connection.db.prepare("select id from employees where org_id = ?").get(orgId) as { id: string }).id;
       const providerId = openAiProviderId(connection, orgId);
       providers.saveCredential({ orgId, providerId, secret: "sk-live-provider", model: "gpt-5.4" });
+      workspaceId = "wsp_production";
+      const now = new Date().toISOString();
+      connection.db.prepare(`
+        insert into workspaces(id, org_id, name, local_path, repo_url, repo_ref, project_id, is_primary, created_at, updated_at)
+        values (?, ?, ?, ?, ?, ?, null, ?, ?, ?)
+      `).run(workspaceId, orgId, "Production", "C:/work/production", "https://example.com/production.git", "main", 1, now, now);
       const agentId = organization.createAgent({
         orgId,
         name: "Ada",
@@ -190,7 +203,7 @@ describe("task execution service", () => {
         risk: RISK_LEVEL.HIGH,
         projectId: null,
         goalId: null,
-        workspaceId: null,
+        workspaceId,
         priority: TASK_PRIORITY.HIGH,
         requiresFilesystem: true,
       });
@@ -209,6 +222,8 @@ describe("task execution service", () => {
 
     expect(state.approvals.find((approval) => approval.id === approvalId)).toMatchObject({ state: APPROVAL_STATE.APPROVED });
     expect(state.taskRuns.find((run) => run.id === runId)).toMatchObject({ taskId, state: "completed" });
+    expect(JSON.parse(state.taskRuns.find((run) => run.id === runId)?.workspaceMountJson ?? "[]"))
+      .toEqual([expect.objectContaining({ workspaceId, mode: "read_write" })]);
     connection.close();
   });