The three independent outcomes recorded per run beside the derived
status rollup: did the turn itself complete (ok | error), what
happened to the configured delivery attempt
(not_required | delivered | failed | skipped), and did the
conversation-binding append land (not_bound | persisted | failed;
always not_bound until conversation binding exists).
The immutable provenance stamped on a run record, side by side, as
at-time-of-action facts: the initiating principal (serialized verbatim)
and the executing agent’s canonical alias. Later job renames or owner
changes never rewrite what a historical row reports.
Read a job only when agent_alias is its current owner. The ownership
predicate belongs to this SELECT so an operator rename that commits before
the read cannot leave the caller with a stale authorization.
Owner-scoped run-history read: the ownership predicate rides the SAME
query that returns the rows, so authorization and retrieval can never
straddle a concurrent rename or owner re-point — the row set is decided
atomically by one statement. A row belongs to the caller when its
durable cleanup owner matches; a legacy row recorded before ownership
existed belongs to whoever currently owns the live job.
Delete every cron job owned by agent_alias and its run history,
returning the job row count. A job whose owning agent is gone can never
run, so the agent deletion removes it.
Re-point every cron job owned by from to to, returning the row count.
Called by the agent-rename cascade the job keeps running, just
under the renamed owner. agent_alias is plain TEXT (not a UUID), so this
is a direct column update.
Patch a job only if agent_alias owns it, with the ownership test carried
into the UPDATE itself rather than performed as a separate read. See
remove_job_for_agent for why the separate read is not enough.
Update a job with security validation for shell-command patches.
Validates a new shell command against the named agent’s risk profile
before persisting. Agent jobs remap command onto prompt first.
Validate a shell command against an agent’s security policy
(allowlist + risk gate). agent_alias names the agent under whose
risk profile the command will run. Returns Ok(()) if the command
passes all checks, or an error describing why it was blocked.