feat(runtime-host): bind ScheduledTasks to immutable Connection identity

[me2seeks]

Parent tracker

• [Tracking] Explicit multi-account provider connections across Runtime Host surfaces #3852
• Depends on the Session exact-target contract

Problem

ScheduledTask agent-run effects currently persist a model slug and model without immutable Connection identity. If account A is deleted and account B later reuses A's slug, a durable task can silently execute with B.

ScheduledTask is a separate durable aggregate and should not expand the Session identity PR.

Desired outcome

Persist and execute every new or replaced ScheduledTask agent-run target as exact connectionId + connectionSlug + model.

Acceptance criteria

• New and replaced agent-run effects freeze the exact Connection ID, slug, and model.
• Task idempotency fingerprints include Connection ID.
• Execution revalidates ID+slug+model before allocating a Session, AgentRun, or provider effect.
• Task-created Sessions receive the exact target.
• Delete A/reuse slug B never dispatches B credentials or creates execution state for an A-bound task.
• Legacy slug-only tasks remain readable and non-effect editable but fail closed before execution until explicitly recreated/reselected.
• Core codec, workflow persistence, Runtime Host coordinator/protocol, idempotency, corruption, and real two-client race tests cover the invariant.
• The closed ScheduledTask wire shape advances the compatibility epoch once from the then-current main value.

Non-goals

• Session legacy adoption
• CLI/Desktop account pickers
• Onboarding or OAuth
• Automatic account fallback

Generated-by: Codex

[testikun]

This was generated by AI during triage.

Hi, I would like to work on this issue.

I checked the current `apache/main@28bdbc6` and the connection-identity work that has already landed. PR #3864 now fails closed for legacy slug-only ScheduledTask agent runs, but the durable `ScheduledTaskExecutionTemplate` still persists only `llmConnectionSlug + model`. The exact Connection-ID persistence and execution contract described here remains open.

Proposed implementation

I will keep this as a separate ScheduledTask vertical slice under the #3852 identity work:

1. Extend `ScheduledTaskExecutionTemplate` with the immutable `connectionId`, while retaining the slug and model as a consistency check.
2. Update the Core normalizer/codec and Storage mutation path so every new or replaced `agent_run` freezes `connectionId + connectionSlug + model` atomically.
3. Include the Connection ID in task idempotency fingerprints and preserve it through `trigger_now`, scheduled fires, recovery, and persisted task reloads.
4. Extend the Runtime Host ScheduledTask protocol and advance the compatibility epoch once for the closed wire-shape change.
5. Resolve execution by Connection ID, then verify the stored slug and model. Missing IDs, ID/slug drift, deleted Connections, and model mismatches fail closed before credential resolution, Session creation, or AgentRun admission. There will be no fallback to a same-named slug.
6. Revalidate the frozen target inside the existing fire/admission lease so deleting Connection A and creating Connection B with the same slug cannot race into B.
7. Keep legacy slug-only records readable for inspection and non-effect edits, but block them before execution until the task is explicitly recreated or reselected with an exact Connection target. `session_resume` and notification effects remain unchanged.

The design follows the general safety properties used by mature agents such as Codex and Claude — stable entity identity, explicit execution targets, snapshotting at creation time, fail-closed stale references, and explicit user re-selection for legacy state — without copying provider-specific UI or routing behavior.

Verification

I will add focused regression coverage for:

• Core and protocol encode/decode;
• new, replaced, legacy, and corrupted ScheduledTask records;
• idempotency fingerprints;
• scheduled fire, `trigger_now`, and restart recovery;
• delete Connection A / recreate slug on Connection B;
• ID/slug/model mismatch;
• a two-client admission race proving no Session, AgentRun, or provider effect is allocated for a stale target.

The implementation will not change Session identity migration, account pickers, OAuth enrollment, automatic fallback, or unrelated notification/session-resume behavior.

中文摘要：我希望认领这个 issue。#3864 已经让旧的 slug-only ScheduledTask 在执行前失败，但新任务仍只保存 slug，#3927 需要补上不可变的 Connection ID。方案是保存并校验 `connectionId + slug + model`，把 ID 纳入幂等指纹，覆盖定时触发、手动触发和重启恢复；旧记录可以读取但不能执行，删除账号 A 后复用 slug 创建账号 B 时必须失败，不能静默使用 B。实现会沿用 Codex/Claude 等成熟 Agent 的稳定身份、显式目标和 fail-closed 原则，不改变 OAuth、Session 迁移或通知行为。