| name | task-workstream-sessions |
| description | Guard Team tasks in the owner's selected runtime and isolate assigned owner tasks into durable provider sessions. This runtime skill is adapter-invoked; Guest keeps its established read-only Codex path and ungrouped owner tasks keep the selected core's legacy session. |
| user-invocable | false |
Task workstream sessions
This runtime skill intercepts Team tasks before they can reach the unrestricted
live core only when the AG2 Space broker also attests the target agent's explicit
Agent Native collaborator: true setting. The remote gateway turns that signed
combination into one pre-body collaborator: true execution stamp. Missing,
malformed, duplicate, locally forged, or body-positioned stamps fail closed to
the established restricted path; a local owner-to-Team cap is not treated as
room consent. This makes the opt-in per room and per agent, with no host-wide
environment toggle. When opted in, the worker launches a fresh instance of the
owner's configured runtime with the normal configured workspace, tools,
integrations, network, and provider settings. A Team-specific prompt
identifies the sender as a trusted collaborator rather than the owner and
requires cautious, scoped work without disclosing credentials or unrelated owner
context. Before delivery, the handler scans the final response with Sutando's
maintained secret scanner, rejects bridge delivery-control markers, and withholds
any result containing a likely credential. Scanner/runtime failures publish a
safe terminal result and never fall through to the owner core.
This is deliberately a behavioral guardrail, not adversarial isolation. Team
can perform ordinary development and operational work that needs the owner's
installed toolchain and configured integrations. The owner accepts that trust
tradeoff. The outbound scanner checks only the final response: it cannot observe
or prevent a malicious or successfully prompt-injected task from reading a
credential, sending it over the network, mutating the host, invoking a webhook,
or causing another side effect before returning scanner-clean text. Guest
remains on the pre-existing read-only Codex delegation path carried in the
task's in-band instructions.
Future defense in depth can add AG2 Space security monitoring around this
trusted tier: centralized action telemetry, prompt-injection and anomalous-tool
signals, cross-agent incident correlation, owner alerts, and rapid credential or
agent-session revocation. Those controls would improve detection and response;
they are not implemented here and must not be treated as current guarantees.
For owner tasks, the skill reads existing assignments from
<workspace>/data/task-workstreams.json; it never classifies tasks or changes
the grouping sidecar. For each assigned owner task it resumes a headless Claude
or Codex provider session dedicated to that workstream and atomically publishes
the final result body. Session IDs live in
<workspace>/state/task-workstream-sessions.json, so provider context remains
separate and resumable across core restarts.
Ungrouped, invalid, or unavailable owner assignments fail open to the selected
core's unchanged legacy task path. If an isolated owner provider fails, the
watcher also falls back to the live core rather than stranding the durable task;
the log explicitly records the possible at-least-once retry. This owner-only
fallback never applies to Team tasks.
Tradeoff: isolated workstream transcripts are headless and do not render in the
canonical Core CLI pane. Remove this skill to disable isolation without
disabling task grouping.
