feat(rewrite): add Phase 3 task domain

[mira-2026]

Summary

• Add the first Phase 3 operator domain: normalized tasks, labels, automation profiles, progress history, append-only task events, realtime invalidation, and durable notification intents.
• Expose capability-scoped task contracts and tRPC procedures for list/get/create/update/assign/move/delete plus progress operations, with Valibot validation and typed Effect services.
• Add the lazy /tasks browser route using the shared accessible UI system, Headless UI, TanStack Form/Query, @dnd-kit/react, Lucide icons, and reusable Markdown/search/select/textarea/link primitives.
• Remove superseded @dnd-kit/core and @dnd-kit/sortable dependencies; the current React package owns drag-and-drop behavior.

Behavior and regression coverage

• Every task mutation runs in one admitted SQLite IMMEDIATE transaction with optimistic versions, validated persisted rows, atomic audit/realtime records, and no callback replay after transaction entry.
• List and progress reads are bounded and use deterministic keyset cursors; task read/write capabilities are enforced independently for browser sessions and scoped automation principals.
• Mira-relevant changes create one redacted notification-outbox record atomically, suppress the task-tracking automation's own changes, and preserve a stable Gateway idempotency key. Production sending remains explicitly gated on the Phase 4 persistent Gateway client.
• The browser board provides server-side filters, accessible dialogs/forms, realtime cache invalidation, and four-column movement while retaining the established Dashboard palette and layout.

Verification

• Frozen dependency install: bun install --frozen-lockfile
• Source boundaries: bun run check:boundaries
• Repository lint: bun run lint
• Browser and Bun type graphs: bun run typecheck
• Repository formatting: bun run format:check
• Full test suite: bun run test — 1,413 passed, 0 failed
• Coverage: bun run test:coverage — 91.81% (33,234 / 36,199 lines; threshold 85%)
• Browser/process builds: bun run build:browser and bun run build:processes
• Generated documentation: bun run docs:check
• Database schema/manifest: bun run db:check
• Patch hygiene: git diff --check

Risk checklist

• No secrets, tokens, .env files, database dumps, or runtime state committed
• New API procedures enforce exact authentication, capability, input/output, and expected-error policies
• Task schema changes are pinned by the reviewed migration manifest and validated migration snapshot
• Realtime and notification paths preserve transaction ordering, retry ownership, idempotency, and recovery semantics
• UI changes use shared components and package-owned accessibility/form/drag behavior rather than local replacements

Deployment / operations

• No production deploy or restart applies before the greenfield cutover.
• This PR is stacked directly on the locked Phase 2 PR feat(rewrite): complete Phase 2 security and browser surface #395.
• Persistent Gateway notification delivery remains a Phase 4 activation gate; this PR safely retains intents until that authenticated adapter exists.

Notes for reviewers

Please focus on optimistic transaction boundaries, cursor stability, capability separation, realtime invalidation, notification redaction/lease settlement, and browser mutation/cache behavior.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 138 files, which is 38 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d88f29b9-d6ae-4e45-814a-4ad44737ee49

📥 Commits

Reviewing files that changed from the base of the PR and between 5c05ff0 and 68aa852.

⛔ Files ignored due to path filters (34)

• greenfield/bun.lock is excluded by !**/*.lock and included by **/*
• greenfield/docs/generated/packages-and-runtime.md is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/procedures.md is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/automationSecurity.createPrincipal.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/automationSecurity.createPrincipal.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/automationSecurity.disablePrincipal.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/automationSecurity.listPrincipals.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/automationSecurity.replaceCapabilities.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/automationSecurity.replaceCapabilities.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/events.stream.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/events.stream.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/securityAudit.listEvents.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.addUpdate.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.addUpdate.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.assign.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.assign.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.create.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.create.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.delete.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.delete.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.deleteProgress.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.deleteProgress.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.get.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.get.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.list.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.list.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.listUpdates.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.listUpdates.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.move.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.move.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.update.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.update.output.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.updateProgress.input.schema.json is excluded by !**/generated/** and included by **/*
• greenfield/docs/generated/schemas/tasks.updateProgress.output.schema.json is excluded by !**/generated/** and included by **/*

📒 Files selected for processing (138)

• greenfield/docs/architecture/greenfield-rewrite/application-architecture.md
• greenfield/docs/architecture/greenfield-rewrite/progress.md
• greenfield/migrations/20260804022252_dashboard-foundation/migration.sql
• greenfield/migrations/20260804022252_dashboard-foundation/snapshot.json
• greenfield/package.json
• greenfield/scripts/documentation/artifacts.test.ts
• greenfield/scripts/documentation/jsonSchema.test.ts
• greenfield/scripts/documentation/jsonSchema.ts
• greenfield/src/app/dashboardServer.ts
• greenfield/src/app/server.ts
• greenfield/src/app/trpcHttpHandler.ts
• greenfield/src/app/trpcRequestPolicy.test.ts
• greenfield/src/app/trpcRequestPolicy.ts
• greenfield/src/browser/api/realtimeClient.test.ts
• greenfield/src/browser/api/realtimeClient.ts
• greenfield/src/browser/api/realtimeContext.tsx
• greenfield/src/browser/api/realtimeContextValue.ts
• greenfield/src/browser/api/realtimeHub.test.ts
• greenfield/src/browser/api/realtimeHub.ts
• greenfield/src/browser/api/trpcClient.ts
• greenfield/src/browser/application.test.tsx
• greenfield/src/browser/application.tsx
• greenfield/src/browser/auth/AuthenticationBoundary.test.tsx
• greenfield/src/browser/auth/LoginRoute.test.tsx
• greenfield/src/browser/layout/DashboardShell.tsx
• greenfield/src/browser/lib/dashboardRoutes.ts
• greenfield/src/browser/router.tsx
• greenfield/src/browser/routes/tasks.lazy.tsx
• greenfield/src/browser/security/AccountSecurityRoute.test.tsx
• greenfield/src/browser/tasks/NewTaskModal.tsx
• greenfield/src/browser/tasks/TaskAutomationFields.tsx
• greenfield/src/browser/tasks/TaskBoard.test.ts
• greenfield/src/browser/tasks/TaskBoard.tsx
• greenfield/src/browser/tasks/TaskBoardRoute.test.tsx
• greenfield/src/browser/tasks/TaskBoardRoute.tsx
• greenfield/src/browser/tasks/TaskBoardToolbar.tsx
• greenfield/src/browser/tasks/TaskCard.tsx
• greenfield/src/browser/tasks/TaskColumn.tsx
• greenfield/src/browser/tasks/TaskDetailModal.tsx
• greenfield/src/browser/tasks/TaskEditorFields.tsx
• greenfield/src/browser/tasks/TaskEditorForm.tsx
• greenfield/src/browser/tasks/TaskMetadataControls.tsx
• greenfield/src/browser/tasks/TaskProgressForm.tsx
• greenfield/src/browser/tasks/TaskProgressSection.tsx
• greenfield/src/browser/tasks/taskBoardDrop.ts
• greenfield/src/browser/tasks/taskEditorForm.test.ts
• greenfield/src/browser/tasks/taskEditorForm.ts
• greenfield/src/browser/tasks/taskMutations.ts
• greenfield/src/browser/tasks/taskPresentation.ts
• greenfield/src/browser/tasks/taskQueries.test.ts
• greenfield/src/browser/tasks/taskQueries.ts
• greenfield/src/browser/tasks/useTaskEditorController.ts
• greenfield/src/browser/tasks/useTaskRealtimeInvalidation.test.tsx
• greenfield/src/browser/tasks/useTaskRealtimeInvalidation.ts
• greenfield/src/browser/test/realtime.ts
• greenfield/src/browser/ui/ActionLink.tsx
• greenfield/src/browser/ui/ExternalLink.test.tsx
• greenfield/src/browser/ui/ExternalLink.tsx
• greenfield/src/browser/ui/Form.tsx
• greenfield/src/browser/ui/Markdown.tsx
• greenfield/src/browser/ui/NavigationLink.tsx
• greenfield/src/browser/ui/SearchInput.tsx
• greenfield/src/browser/ui/Select.test.tsx
• greenfield/src/browser/ui/Select.tsx
• greenfield/src/browser/ui/Textarea.tsx
• greenfield/src/contracts/contractRegistry.ts
• greenfield/src/contracts/events.test.ts
• greenfield/src/contracts/events.ts
• greenfield/src/contracts/registry.ts
• greenfield/src/contracts/security.ts
• greenfield/src/contracts/taskModel.test.ts
• greenfield/src/contracts/taskModel.ts
• greenfield/src/contracts/taskRealtime.ts
• greenfield/src/contracts/tasks.test.ts
• greenfield/src/contracts/tasks.ts
• greenfield/src/server/database/migrations/migrationGraph.test.ts
• greenfield/src/server/database/migrations/securityIdentitySchema.automation.test.ts
• greenfield/src/server/database/migrations/taskSchema.test.ts
• greenfield/src/server/database/schema/automationPrincipalCapabilities.ts
• greenfield/src/server/database/schema/drizzleSchema.ts
• greenfield/src/server/database/schema/taskAutomationProfiles.ts
• greenfield/src/server/database/schema/taskEvents.ts
• greenfield/src/server/database/schema/taskLabels.ts
• greenfield/src/server/database/schema/taskNotificationOutbox.ts
• greenfield/src/server/database/schema/taskUpdates.ts
• greenfield/src/server/database/schema/tasks.ts
• greenfield/src/server/database/validation/taskAutomationProfiles.ts
• greenfield/src/server/database/validation/taskEvents.ts
• greenfield/src/server/database/validation/taskLabels.ts
• greenfield/src/server/database/validation/taskNotificationOutbox.ts
• greenfield/src/server/database/validation/taskRows.test.ts
• greenfield/src/server/database/validation/taskUpdates.ts
• greenfield/src/server/database/validation/tasks.ts
• greenfield/src/server/domains/monitoring/service.ts
• greenfield/src/server/domains/realtime/retention.ts
• greenfield/src/server/domains/security/requestAuthenticationSession.test.ts
• greenfield/src/server/domains/tasks/errors.ts
• greenfield/src/server/domains/tasks/mutationSupport.ts
• greenfield/src/server/domains/tasks/procedures.test.ts
• greenfield/src/server/domains/tasks/procedures.ts
• greenfield/src/server/domains/tasks/queries.ts
• greenfield/src/server/domains/tasks/repository.ts
• greenfield/src/server/domains/tasks/repositoryReader.ts
• greenfield/src/server/domains/tasks/repositoryRecords.ts
• greenfield/src/server/domains/tasks/repositoryTypes.ts
• greenfield/src/server/domains/tasks/repositoryUnitOfWork.ts
• greenfield/src/server/domains/tasks/routes.ts
• greenfield/src/server/domains/tasks/service.test.ts
• greenfield/src/server/domains/tasks/service.ts
• greenfield/src/server/domains/tasks/serviceEvents.ts
• greenfield/src/server/domains/tasks/serviceRecords.ts
• greenfield/src/server/domains/tasks/taskMutations.ts
• greenfield/src/server/domains/tasks/taskNotification.test.ts
• greenfield/src/server/domains/tasks/taskNotification.ts
• greenfield/src/server/domains/tasks/taskNotificationQueue.test.ts
• greenfield/src/server/domains/tasks/taskNotificationQueue.ts
• greenfield/src/server/domains/tasks/taskProgressMutations.ts
• greenfield/src/server/domains/tasks/testSupport/service.ts
• greenfield/src/server/domains/tasks/testSupport/taskService.ts
• greenfield/src/server/platform/runtime/applicationRuntime.ts
• greenfield/src/server/test/support/requestContext.ts
• greenfield/src/server/test/system/serverAuthenticationTransport.test.ts
• greenfield/src/server/trpc/appRouter.ts
• greenfield/src/server/trpc/context.test.ts
• greenfield/src/server/trpc/context.ts
• greenfield/src/server/trpc/procedureErrorPolicy.ts
• greenfield/src/shared/databaseMigrationManifest.ts
• greenfield/src/shared/taskNotifications.ts
• greenfield/src/shared/validation.test.ts
• greenfield/src/shared/validation.ts
• greenfield/src/test/parity/fixtures/frontend-routes.json
• greenfield/src/test/parity/fixtures/greenfield-contracts.json
• greenfield/src/test/parity/fixtures/legacy-endpoints.json
• greenfield/src/test/parity/parityInventory.test.ts
• greenfield/src/test/parity/parityInventorySchemas.ts
• greenfield/src/test/parity/reviewedParityInventory.ts
• greenfield/src/worker/taskNotifications.test.ts
• greenfield/src/worker/taskNotifications.ts

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Review on demand using usage pricing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 90.52715% with 478 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...enfield/src/browser/tasks/TaskAutomationFields.tsx	27.63%	110 Missing ⚠️
greenfield/src/server/database/schema/tasks.ts	30.00%	42 Missing ⚠️
...c/server/database/schema/taskNotificationOutbox.ts	42.85%	32 Missing ⚠️
...c/server/database/schema/taskAutomationProfiles.ts	40.00%	30 Missing ⚠️
...eenfield/src/browser/tasks/TaskProgressSection.tsx	85.36%	24 Missing ⚠️
...reenfield/src/server/database/schema/taskEvents.ts	53.06%	23 Missing ⚠️
...eenfield/src/server/database/schema/taskUpdates.ts	46.51%	23 Missing ⚠️
greenfield/src/browser/tasks/TaskCard.tsx	73.80%	22 Missing ⚠️
greenfield/src/browser/tasks/TaskBoard.tsx	62.00%	19 Missing ⚠️
greenfield/src/browser/tasks/taskEditorForm.ts	90.55%	17 Missing ⚠️
... and 27 more

📢 Thoughts on this report? Let us know!

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 254c27a13b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[mira-2026]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 703ba464e6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".