feat(07-01): wire task quality gates into all creation paths

- Add SaveTaskResult type to contracts.ts (id + optional capabilityWarning)
- IPC handler: validate new tasks, reject with TASK_VALIDATION_FAILED, check capability match
- API server: validate POST /issues and meeting action items before db.saveTask
- Automation service: validate create_task action, skip with warning if invalid
- CapabilityMatchDb interface uses optional skill methods for graceful degradation
- TypeScript compiles cleanly across all process boundaries
- All 241 tests pass with zero regressions

src/main/api-server.ts

@@ -8,6 +8,7 @@ import { canAssignTask, canControlAgent, canManageGoal, canManageOrganization, c
 import { resolveApprovalDecision, shouldAutoApproveApproval } from "./approval-policy";
 import type { AppDatabase } from "./database";
 import { inferTaskType } from "./connector-matching";
+import { validateTaskCreation } from "./task-quality-gates";
 import { dispatchAgentMessage } from "./message-dispatch";
 import type { DesktopEvent, SectionId } from "@shared/types";
 
@@ -561,6 +562,12 @@ export class AgentApiServer {
         this.json(res, 403, { error: "Current agent is not allowed to assign this task to the selected agent" });
         return;
       }
+      const isHeartbeat = input.title.startsWith("[Heartbeat]");
+      const taskValidation = validateTaskCreation({ title: input.title, description: input.description ?? "" }, isHeartbeat);
+      if (!taskValidation.valid) {
+        this.json(res, 422, { error: taskValidation.errors.join("; ") });
+        return;
+      }
 
       let id: string;
       try {
@@ -1582,6 +1589,14 @@ export class AgentApiServer {
       if (actionItems.length > 0) {
         for (const item of actionItems) {
           if (item.title && typeof item.title === "string") {
+            const meetingTaskValidation = validateTaskCreation(
+              { title: item.title, description: item.description ?? `Action item from meeting: ${data.title ?? existing.title}` },
+              false,
+            );
+            if (!meetingTaskValidation.valid) {
+              // Log but skip invalid meeting action items rather than failing the whole request
+              continue;
+            }
             const taskId = this.db.saveTask({
               companyId: token.companyId,
               title: item.title,

src/main/automation-service.ts

@@ -8,6 +8,7 @@ import type {
   RunStatus,
 } from "@shared/types";
 import { dispatchAgentMessage } from "./message-dispatch";
+import { validateTaskCreation } from "./task-quality-gates";
 import type { NotificationOptions } from "./notification-service";
 
 /** Document types considered important enough to gate behind user review when reviewDeliverables is enabled. */
@@ -268,6 +269,12 @@ export function createAutomationService({
         const description = (config.description as string) ?? "";
         const priority = (config.priority as string) ?? "medium";
         const assigneeAgentId = (config.assigneeAgentId as string) ?? null;
+        const isHeartbeat = title.startsWith("[Heartbeat]");
+        const taskValidation = validateTaskCreation({ title, description }, isHeartbeat);
+        if (!taskValidation.valid) {
+          logger.warn(`[automation] Skipping create_task — validation failed: ${taskValidation.errors.join("; ")}`);
+          break;
+        }
         const taskId = db.saveTask({
           companyId: ctx.companyId,
           projectId: ctx.projectId ?? (config.projectId as string) ?? null,

src/main/ipc-core-work-graph-handlers.ts

@@ -11,6 +11,7 @@ import {
 import { getConnectorExecutionReadinessIssue } from "@shared/connector-policy";
 import { resolveApprovalDecision, shouldAutoApproveApproval } from "./approval-policy";
 import { fail, ok, type RegisterCoreHandlersDependencies } from "./ipc-core-common";
+import { validateTaskCreation, checkCapabilityMatch } from "./task-quality-gates";
 
 export function registerCoreWorkGraphHandlers({
   registerHandle,
@@ -314,6 +315,13 @@ export function registerCoreWorkGraphHandlers({
       return fail("INVALID_COMPANY_REFERENCE", `The selected ${invalidReference.label} does not belong to the current company.`);
     }
     const isNew = !parsed.id;
+    if (isNew) {
+      const isHeartbeat = parsed.title.startsWith("[Heartbeat]");
+      const validation = validateTaskCreation(parsed, isHeartbeat);
+      if (!validation.valid) {
+        return fail("TASK_VALIDATION_FAILED", validation.errors.join("; "));
+      }
+    }
     let previousStatus: string | null = null;
     let previousAssigneeAgentId: string | null = null;
     if (!isNew) {
@@ -355,8 +363,17 @@ export function registerCoreWorkGraphHandlers({
         wakeAgentIfPossible(parsed.assigneeAgentId, parsed.companyId, "assignment");
       }
     }
+    let capabilityWarning: string | undefined;
+    if (isNew && parsed.assigneeAgentId) {
+      try {
+        const match = checkCapabilityMatch(db, parsed.assigneeAgentId, parsed.description, parsed.companyId);
+        if (!match.matched) {
+          capabilityWarning = match.warning;
+        }
+      } catch { /* capability check is advisory — never block task creation */ }
+    }
     publishDomainChanged();
-    return ok(id);
+    return ok({ id, capabilityWarning });
   });
 
   registerHandle(IPC_CHANNELS.deleteAgent, async (_event, payload) => {

src/main/task-quality-gates.ts

@@ -20,11 +20,12 @@ export interface CapabilityMatchResult {
   warning?: string;
 }
 
-/** Minimal DB interface for capability matching — keeps the function testable with mocks. */
+/** Minimal DB interface for capability matching — keeps the function testable with mocks.
+ *  Skill methods are optional since the skill system may not be implemented yet (graceful degradation per D-07). */
 export interface CapabilityMatchDb {
   getAgent(id: string): { name: string; capabilities: string };
-  listAgentSkillAssignments(id: string): string[];
-  getCompanySkill(companyId: string, skillId: string): { name: string; description: string | null; slug: string } | null;
+  listAgentSkillAssignments?(id: string): string[];
+  getCompanySkill?(companyId: string, skillId: string): { name: string; description: string | null; slug: string } | null;
 }
 
 // ---------------------------------------------------------------------------
@@ -130,12 +131,14 @@ export function checkCapabilityMatch(
   // Check skill assignments for additional matching (graceful degradation)
   let skillOverlap = 0;
   try {
-    const skillIds = db.listAgentSkillAssignments(agentId);
-    for (const skillId of skillIds) {
-      const skill = db.getCompanySkill(companyId, skillId);
-      if (skill) {
-        const skillWords = tokenize(`${skill.name} ${skill.description ?? ""} ${skill.slug}`);
-        skillOverlap += taskWords.filter((w) => skillWords.includes(w)).length;
+    if (db.listAgentSkillAssignments && db.getCompanySkill) {
+      const skillIds = db.listAgentSkillAssignments(agentId);
+      for (const skillId of skillIds) {
+        const skill = db.getCompanySkill(companyId, skillId);
+        if (skill) {
+          const skillWords = tokenize(`${skill.name} ${skill.description ?? ""} ${skill.slug}`);
+          skillOverlap += taskWords.filter((w) => skillWords.includes(w)).length;
+        }
       }
     }
   } catch {

src/shared/contracts.ts

@@ -518,6 +518,11 @@ export type DesktopResult<T> =
   | { ok: true; data: T }
   | { ok: false; error: { code: string; message: string } };
 
+export interface SaveTaskResult {
+  id: string;
+  capabilityWarning?: string;
+}
+
 export type DesktopApi = {
   loadSnapshot: () => Promise<DesktopResult<ProfileSnapshot>>;
   pickDirectory: () => Promise<DesktopResult<string | null>>;
@@ -531,7 +536,7 @@ export type DesktopApi = {
   requestHire: (input: z.infer<typeof hireRequestSchema>) => Promise<DesktopResult<{ agentId: string; approvalId: string; autoApproved: boolean }>>;
   saveGoal: (input: z.infer<typeof goalInputSchema>) => Promise<DesktopResult<string>>;
   saveProject: (input: z.infer<typeof projectInputSchema>) => Promise<DesktopResult<string>>;
-  saveTask: (input: z.infer<typeof taskInputSchema>) => Promise<DesktopResult<string>>;
+  saveTask: (input: z.infer<typeof taskInputSchema>) => Promise<DesktopResult<SaveTaskResult>>;
   requestApproval: (input: z.infer<typeof approvalInputSchema>) => Promise<DesktopResult<string>>;
   decideApproval: (input: z.infer<typeof approvalDecisionSchema>) => Promise<DesktopResult<boolean>>;
   saveSecret: (input: z.infer<typeof secretInputSchema>) => Promise<DesktopResult<string>>;