fix(collaboration): harden delegated task isolation (#1486)

* feat(collaboration): isolate delegated artifacts and child runs

Isolate delegated inputs and outputs behind secure artifact exchange lifecycles. Scope Agent Link tasks by tenant and root agent, and enforce delegation spawn-tree boundaries. Add process-wide child-run admission and preserve logical media paths across native, MCP, and sandbox execution.

* fix(collaboration): harden delegated task isolation

Enforce tenant and root-agent task scope across migrations and stores. Add exactly-once async completion delivery, delegated sandbox boundaries, and confined artifact and media recovery across runtime surfaces.

* fix(collaboration): recover interrupted async tasks

* fix(collaboration): normalize persisted child-run status

---------

Co-authored-by: ntduc <ntduc@cpp.ai.vn>
This commit is contained in:
Duc Nguyenandntduc authored and GitHub committed 2026-07-30 14:17:40 +07:00
1 parent 496b7ffce6
commit bb7712a9ff
186 files changed
+18858 -1233

No files matched your search

@@ -0,0 +1,9 @@
DROP INDEX IF EXISTS idx_subagent_tasks_root_archive;
DROP INDEX IF EXISTS idx_subagent_tasks_root_session;
DROP INDEX IF EXISTS idx_subagent_tasks_root_status;
ALTER TABLE subagent_tasks
DROP CONSTRAINT IF EXISTS fk_subagent_tasks_root_agent;
ALTER TABLE subagent_tasks
DROP COLUMN IF EXISTS root_agent_id;