git.stella-ops.org/src/TaskRunner/StellaOps.TaskRunner/TASKS.md

Task Runner Service Task Board — Epic 12: CLI Parity & Task Packs

Sprint 41 – Foundations

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
TASKRUN-41-001	DOING (2025-11-01)	Task Runner Guild	ORCH-SVC-41-101, AUTH-PACKS-41-001	Bootstrap service, define migrations for pack_runs, pack_run_logs, pack_artifacts, implement run API (create/get/log stream), local executor, approvals pause, artifact capture, and provenance manifest generation.	Service builds/tests; migrations scripted; run API functional with sample pack; logs/artefacts stored; manifest signed; compliance checklist recorded.

Sprint 42 – Advanced Execution

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
TASKRUN-42-001	DONE (2025-11-04)	Task Runner Guild	TASKRUN-41-001	Add loops, conditionals, maxParallel, outputs, simulation mode, policy gate integration, and failure recovery (retry/abort) with deterministic state.	Executor handles control flow; simulation returns plan; policy gates pause for approvals; tests cover restart/resume.

2025-10-29: Initiated manifest parsing + deterministic planning core to unblock approvals pipeline; building expression engine + plan hashing to support CLI parity. 2025-10-29: Landed manifest loader, planner, deterministic hash, outputs + approval/policy insights with unit tests; awaiting upstream APIs for execution-side wiring. 2025-11-04: Worker now builds execution graph, enforces parallelism/continue-on-error, persists retry windows, and WebService exposes simulation/run-state APIs. 2025-11-04: Resuming execution-engine enhancements (loops, conditionals, maxParallel) and simulation mode wiring; mapping failure recovery + policy gate enforcement plan. 2025-11-04: Continuing wiring — fixing file-backed state store, validating retry metadata, and preparing CLI surface for the simulation preview. 2025-11-04: Gate outcomes now reflect approval states; CLI task-runner simulate surfaces the new simulation API.

Sprint 43 – Approvals, Notifications, Hardening

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
TASKRUN-43-001	DOING (2025-10-29)	Task Runner Guild	TASKRUN-42-001, NOTIFY-SVC-40-001	Implement approvals workflow (resume after approval), notifications integration, remote artifact uploads, chaos resilience, secret injection, and audit logs.	Approvals/resume flow validated; notifications emitted; chaos tests documented; secrets redacted in logs; audit logs complete.

2025-10-29: Starting approvals orchestration — defining persistence/workflow scaffolding, integrating plan insights for notifications, and staging resume hooks. 2025-10-29: Added approval coordinator + policy notification bridge with unit tests; ready to wire into worker execution/resume path. 2025-11-06: Added approval decision API with resume requeue, persisted plan snapshots, and artifact uploader hook (logging backend pending).

Authority-Backed Scopes & Tenancy (Epic 14)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
TASKRUN-TEN-48-001	TODO	Task Runner Guild	ORCH-TEN-48-001	Require tenant/project context for every pack run, set DB/object-store prefixes, block egress when tenant restricted, and propagate context to steps/logs.	Pack runs fail without tenant context; artifacts stored under tenant prefix; tests verify enforcement.

Observability & Forensics (Epic 15)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
TASKRUN-OBS-50-001	TODO	Task Runner Guild	TELEMETRY-OBS-50-001, TELEMETRY-OBS-50-002	Adopt telemetry core in Task Runner host + worker executors, ensuring step execution spans/logs include trace_id, tenant_id, run_id, and scrubbed command transcripts.	Telemetry emitted for sample runs; integration test verifies context propagation across async steps; log schema validated.
TASKRUN-OBS-51-001	TODO	Task Runner Guild, DevOps Guild	TASKRUN-OBS-50-001, TELEMETRY-OBS-51-001	Emit metrics for step latency, retries, queue depth, sandbox resource usage; define SLOs for pack run completion and failure rate; surface burn-rate alerts to collector/Notifier.	Metrics appear in dashboards; burn-rate alert tested; docs capture thresholds and response playbook.
TASKRUN-OBS-52-001	TODO	Task Runner Guild	TASKRUN-OBS-50-001, TIMELINE-OBS-52-002	Produce timeline events for pack runs (pack.started, pack.step.completed, pack.failed) containing evidence pointers and policy gate context. Provide dedupe + retry logic.	Timeline events recorded for sample runs; duplicates suppressed; tests cover error/retry; docs updated.
TASKRUN-OBS-53-001	TODO	Task Runner Guild, Evidence Locker Guild	TASKRUN-OBS-52-001, EVID-OBS-53-002	Capture step transcripts, artifact manifests, environment digests, and policy approvals into evidence locker snapshots; ensure redaction + hash chain coverage.	Evidence bundle created for sample pack; redaction tests pass; manifest linked in timeline.
TASKRUN-OBS-54-001	TODO	Task Runner Guild, Provenance Guild	TASKRUN-OBS-53-001, PROV-OBS-53-002	Generate DSSE attestations for pack runs (subjects = produced artifacts) and expose verification API/CLI integration. Store references in timeline events.	Attestation generated + verified; timeline includes attestation ref; docs updated.
TASKRUN-OBS-55-001	TODO	Task Runner Guild, DevOps Guild	TASKRUN-OBS-51-001, TELEMETRY-OBS-55-001, DEVOPS-OBS-55-001	Implement incident mode escalations (extra telemetry, debug artifact capture, retention bump) and align on automatic activation via SLO breach webhooks.	Incident mode toggles validated; extra artefacts captured; notifier integration tested.

Air-Gapped Mode (Epic 16)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
TASKRUN-AIRGAP-56-001	DOING (2025-11-03)	Task Runner Guild, AirGap Policy Guild	AIRGAP-POL-56-001, TASKRUN-OBS-50-001	Enforce plan-time validation rejecting steps with non-allowlisted network calls in sealed mode and surface remediation errors.	Planner blocks disallowed steps; error contains remediation; tests cover sealed/unsealed behavior.
TASKRUN-AIRGAP-56-002	TODO	Task Runner Guild, AirGap Importer Guild	TASKRUN-AIRGAP-56-001, AIRGAP-IMP-57-002	Add helper steps for bundle ingestion (checksum verification, staging to object store) with deterministic outputs.	Helper steps succeed deterministically; integration tests import sample bundle.
TASKRUN-AIRGAP-57-001	TODO	Task Runner Guild, AirGap Controller Guild	TASKRUN-AIRGAP-56-001, AIRGAP-CTL-56-002	Refuse to execute plans when environment sealed=false but declared sealed install; emit advisory timeline events.	Mismatch detection works; timeline + telemetry record violation; docs updated.
TASKRUN-AIRGAP-58-001	TODO	Task Runner Guild, Evidence Locker Guild	TASKRUN-OBS-53-001, EVID-OBS-55-001	Capture bundle import job transcripts, hashed inputs, and outputs into portable evidence bundles.	Evidence recorded; manifests deterministic; timeline references created.

SDKs & OpenAPI (Epic 17)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
TASKRUN-OAS-61-001	TODO	Task Runner Guild, API Contracts Guild	OAS-61-001	Document Task Runner APIs (pack runs, logs, approvals) in service OAS, including streaming response schemas and examples.	OAS covers all Task Runner endpoints with examples; lint passes.
TASKRUN-OAS-61-002	TODO	Task Runner Guild	TASKRUN-OAS-61-001	Expose GET /.well-known/openapi returning signed spec metadata, build version, and ETag.	Discovery endpoint deployed; contract tests call endpoint; telemetry includes x-stella-service.
TASKRUN-OAS-62-001	TODO	Task Runner Guild, SDK Generator Guild	TASKRUN-OAS-61-001, SDKGEN-63-001	Provide SDK examples for pack run lifecycle; ensure SDKs offer streaming log helpers and paginator wrappers.	SDK smoke tests cover pack run flows; docs auto-embed snippets.
TASKRUN-OAS-63-001	TODO	Task Runner Guild, API Governance Guild	APIGOV-63-001	Implement deprecation header support and Sunset handling for legacy pack APIs; emit notifications metadata.	Deprecated endpoints emit headers; notifications pipeline validated; documentation updated.