1.9 KiB
R4.2 P0-B — Durable Message / Handoff Fabric
Status: candidate implementation; not evidence of protected-main merge or Production deployment.
MessageEnvelope is the single durable handoff identity and carries source/target/type, tenant/user/
project/conversation/task/run scope, causation, sequence, capability scope, confidentiality scope,
idempotency key, expiry and delivery state.
Identity includes target + scope + sequence + idempotency key + payload hash, fixing the existing AgentEventBus target collision. Server ActorContext is authoritative; caller scope may narrow but may not widen/forge trusted tenant/user/project/conversation/run fields.
DurableHandoffStore provides SQLite durability in the current runtime. Each logical stream has
unique (stream_key, idempotency_key) and (stream_key, sequence). Exact retry returns REPLAY;
changed payload under the same key is rejected; sequence gaps are rejected; expired messages are not
delivered.
Confidentiality scopes:
- public: no tenant requirement
- tenant: same tenant
- project: same tenant + project
- private: same tenant + project + user
- run: same tenant + project + user + run
Required capability_scope must be present on the authenticated delivery actor unless the actor is
explicitly administrative.
Compatibility adapters convert AgentEventBus events, TaskPlane CloudEvents and legacy Agent OS MessageBus messages into the durable envelope. Existing message_outbox remains intact as a migration source; P0-B does not delete or silently rewrite it.
Required gates:
MESSAGE_SCOPE_MISMATCH_DENY, MESSAGE_TARGET_COLLISION_DENY, MESSAGE_IDEMPOTENCY_REPLAY,
MESSAGE_SEQUENCE_GAP_DETECT, MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE,
HANDOFF_CROSS_TENANT_DENY, plus existing P0-A TaskPlane scope/security regressions.
SQLite remains current runtime persistence. PostgreSQL remains a separate migration gate.