875 B
R4.2 P0-A TaskPlane Scope Isolation
Status: candidate implementation. This is not proof of protected-main promotion or production deployment.
Task scope is now represented by scope_type, tenant_id, user_id, project_id, conversation_id, and run_id in the model and SQLite persistence. Historical rows become legacy; their tenant is never guessed. Tenant tasks require tenant_id. System resources use scope_type=system without a fabricated tenant.
The HTTP adapter uses the authenticated identity. PolicyEngine resolves that identity through server-owned identity_actor_contexts; request payload fields do not grant scope. Public create binds the trusted scope, and public list/get apply parameterized scope predicates in TaskPlaneStore.
SQLite is the current runtime database. PostgreSQL remains a separate migration and runtime-acceptance gate.