[codex] Support task drafts and canonical relocation

[EgorPPS]

Summary

• add optional intakeStatus: draft | ready to the Task ontology
• allow external drafts without homeProjectId; empty assignees remains valid
• extend TaskReference with optional canonicalEnvelopeId, referenceType, and relocatedAt for canonical relocation

Interoperability semantics

• each MetaEnvelope still has exactly one ACL; no originAcl or secondary readable ACL is introduced
• a relocated former canonical envelope can remain as a content-free TaskReference under its existing envelope ACL
• consumers follow canonicalEnvelopeId to the current canonical Task and enforce that canonical envelope ACL independently
• all new fields are optional so legacy Tasks and TaskReferences remain valid

Validation

• JSON parsing and git diff --check pass
• AJV draft-07 validates an external draft without project/assignees
• AJV draft-07 validates a canonical-relocation TaskReference
• 80hours npm run check and npm run build pass

Summary by CodeRabbit

• New Features

  • Added task intake statuses: draft and ready.
  • Added metadata for relocated canonical task references, including relocation type, timestamp, and canonical envelope details.

• Bug Fixes

  • Tasks no longer require a home project identifier to be valid.

[coderabbitai]

📝 Walkthrough

Walkthrough

The ontology schemas now support task intake status, optional homeProjectId, and metadata describing canonical task relocation references.

Changes

Ontology schema updates

Layer / File(s)	Summary
Task schema contract services/ontology/schemas/task.json	Adds intakeStatus with draft and ready values, and removes homeProjectId from the required fields.
Task reference relocation metadata services/ontology/schemas/taskReference.json	Adds canonical envelope, relocation type, and relocation timestamp properties to TaskReference.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the change and testing, but it misses required template sections like Issue Number, Type of change, and checklist.	Reformat the PR body to match the template and add Issue Number, Type of change, How tested, and the full change checklist.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: task drafts and canonical relocation support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/task-draft-ontology-update

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

services/ontology/schemas/taskReference.json (1)

10-16: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consumer-side ACL enforcement for relocated references is a critical security contract.

The PR objectives state that consumers must follow canonicalEnvelopeId and independently enforce the canonical envelope ACL. Since the schema can only describe this contract but not enforce it, any consumer that reads a TaskReference with referenceType: "canonical-relocation" without following canonicalEnvelopeId could access task content under the former envelope's ACL rather than the canonical's — resulting in an ACL bypass.

Consider adding a stronger description on canonicalEnvelopeId or referenceType explicitly warning that consumers must resolve and enforce the canonical envelope ACL before granting access, to reduce the risk of consumer implementation gaps.

🔒 Suggested description strengthening

-    "canonicalEnvelopeId": { "type": "string", "description": "MetaEnvelope ID of the current canonical task" },
+    "canonicalEnvelopeId": { "type": "string", "description": "MetaEnvelope ID of the current canonical task. Consumers MUST resolve this ID and enforce the canonical envelope's ACL before granting access to task content." },

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/ontology/schemas/taskReference.json` around lines 10 - 16,
Strengthen the schema descriptions for canonicalEnvelopeId and/or referenceType
to explicitly require consumers to resolve the canonical envelope and enforce
its ACL before granting access to relocated task content. Update the
descriptions in taskReference.json while preserving the existing fields and
enum.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@services/ontology/schemas/taskReference.json`:
- Around line 10-16: Strengthen the schema descriptions for canonicalEnvelopeId
and/or referenceType to explicitly require consumers to resolve the canonical
envelope and enforce its ACL before granting access to relocated task content.
Update the descriptions in taskReference.json while preserving the existing
fields and enum.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a81e8b04-ed51-44d9-9764-0041a3fdd205

📥 Commits

Reviewing files that changed from the base of the PR and between 388ccb2 and c262d4d.

📒 Files selected for processing (2)

• services/ontology/schemas/task.json
• services/ontology/schemas/taskReference.json