Execute native agent tasks in the reusable workflow (#1751)

* Execute native agent tasks in reusable workflow

* Enforce native agent task workflow contract

* Expose native task output projections

* Harden native agent task execution

* Add reusable workflow interface contract

* Harden native task artifact uploads

* Remove stale bridge migration guidance

Author: chubes4

.github/scripts/run-agent-task/build-codebox-task-request.mjs

@@ -20,11 +20,6 @@ function requiredString(name) {
   return value
 }
 
-function optionalString(name) {
-  const value = process.env[name]?.trim() ?? ""
-  return value || undefined
-}
-
 function booleanEnv(name) {
   return process.env[name] === "true"
 }
@@ -37,22 +32,39 @@ function numberEnv(name) {
   return value
 }
 
+const MAX_OUTPUT_CHARS = 8192
+
 function output(name, value) {
-  appendFileSync(process.env.GITHUB_OUTPUT, `${name}<<__WP_CODEBOX_OUTPUT__\n${String(value)}\n__WP_CODEBOX_OUTPUT__\n`)
+  const rendered = String(value)
+  if (rendered.length > MAX_OUTPUT_CHARS) throw new Error(`${name} exceeds the ${MAX_OUTPUT_CHARS}-character workflow output limit.`)
+  appendFileSync(process.env.GITHUB_OUTPUT, `${name}<<__WP_CODEBOX_OUTPUT__\n${rendered}\n__WP_CODEBOX_OUTPUT__\n`)
 }
 
-const artifactDeclarations = parseJson("ARTIFACT_DECLARATIONS", [], "array")
-const runnerRecipe = optionalString("RUNNER_RECIPE")
-const runAgent = booleanEnv("RUN_AGENT")
-const dryRun = booleanEnv("DRY_RUN")
+function repositoryList(name) {
+  const repositories = (process.env[name] || "").split(",").map((value) => value.trim()).filter(Boolean)
+  if (repositories.some((repository) => !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository))) {
+    throw new Error(`${name} must contain comma-separated OWNER/REPO values.`)
+  }
+  return repositories
+}
 
-if (!runnerRecipe && runAgent && !dryRun) {
-  throw new Error("RUNNER_RECIPE may be omitted only when RUN_AGENT=false or DRY_RUN=true. The executable workflow in wp-codebox PR #1751 must land before a live agent run can omit it.")
+function commandList(name) {
+  const value = parseJson(name, [], "array")
+  return value.map((entry, index) => {
+    if (typeof entry === "string" && entry.trim()) return { command: entry.trim(), description: entry.trim() }
+    if (!entry || typeof entry !== "object" || Array.isArray(entry) || typeof entry.command !== "string" || !entry.command.trim()) {
+      throw new Error(`${name}[${index}] must be a non-empty command string or an object with a non-empty command.`)
+    }
+    if (entry.description !== undefined && (typeof entry.description !== "string" || !entry.description.trim())) {
+      throw new Error(`${name}[${index}].description must be a non-empty string when provided.`)
+    }
+    return { command: entry.command.trim(), description: typeof entry.description === "string" ? entry.description.trim() : entry.command.trim() }
+  })
 }
 
+const artifactDeclarations = parseJson("ARTIFACT_DECLARATIONS", [], "array")
 const request = {
   schema: "wp-codebox/agent-task-workflow-request/v1",
-  ...(runnerRecipe ? { runner_recipe: runnerRecipe } : {}),
   agent_bundle: requiredString("AGENT_BUNDLE"),
   workload: {
     id: process.env.WORKLOAD_ID || "agent-task",
@@ -68,23 +80,18 @@ const request = {
   },
   runner_workspace: parseJson("RUNNER_WORKSPACE_CONFIG", {}, "object"),
   validation_dependencies: process.env.VALIDATION_DEPENDENCIES || "",
-  context_repositories: parseJson("CONTEXT_REPOSITORIES", [], "array"),
-  verification_commands: parseJson("VERIFICATION_COMMANDS", [], "array"),
-  drift_checks: parseJson("DRIFT_CHECKS", [], "array"),
-  workspace_contract_checks: parseJson("WORKSPACE_CONTRACT_CHECKS", {}, "object"),
-  actions_artifact_downloads: parseJson("ACTIONS_ARTIFACT_DOWNLOADS", [], "array"),
+  verification_commands: commandList("VERIFICATION_COMMANDS"),
+  drift_checks: commandList("DRIFT_CHECKS"),
   success: {
     requires_pr: booleanEnv("SUCCESS_REQUIRES_PR"),
-    completion_outcomes: parseJson("SUCCESS_COMPLETION_OUTCOMES", [], "array"),
   },
   access: {
-    access_token_repos: process.env.ACCESS_TOKEN_REPOS || process.env.TARGET_REPO || "",
+    access_token_repos: repositoryList("ACCESS_TOKEN_REPOS"),
     require_access_token: booleanEnv("REQUIRE_ACCESS_TOKEN"),
     allowed_repos: parseJson("ALLOWED_REPOS", [], "array"),
   },
   limits: {
     max_turns: numberEnv("MAX_TURNS"),
-    step_budget: numberEnv("STEP_BUDGET"),
     time_budget_ms: numberEnv("TIME_BUDGET_MS"),
   },
   artifacts: {
@@ -94,48 +101,29 @@ const request = {
     replay_bundle_name: process.env.REPLAY_BUNDLE_ARTIFACT_NAME || "",
   },
   outputs: {
-    tool_results_key: process.env.TOOL_RESULTS_KEY || "tool_results",
     projections: parseJson("OUTPUT_PROJECTIONS", {}, "object"),
   },
   callback_data: parseJson("CALLBACK_DATA", {}, "object"),
-  run_agent: runAgent,
-  dry_run: dryRun,
+  run_agent: booleanEnv("RUN_AGENT"),
+  dry_run: booleanEnv("DRY_RUN"),
 }
 
-const runId = `${request.workload.id}-${process.env.GITHUB_RUN_ID || "local"}`.replace(/[^A-Za-z0-9._-]+/g, "-")
-const status = !request.run_agent ? "skipped" : request.dry_run ? "dry-run" : "planned"
-const result = {
-  schema: "wp-codebox/agent-task-workflow-result/v1",
-  run_id: runId,
-  status,
-  request_path: ".codebox/agent-task-request.json",
-  transcript: {
-    artifact_name: request.artifacts.transcript_name,
-  },
-  artifacts: {
-    declarations: artifactDeclarations,
-    expected: request.artifacts.expected,
-    replay_bundle_name: request.artifacts.replay_bundle_name,
-  },
-  outputs: {
-    engine_data: {},
-    projections: request.outputs.projections,
-  },
-  access: {
-    credential_mode: request.access.require_access_token ? "app-token" : "default",
-  },
+if (request.access.allowed_repos.some((repository) => typeof repository !== "string" || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository))) {
+  throw new Error("ALLOWED_REPOS must be a JSON array of OWNER/REPO values.")
+}
+request.access.allowed_repos = [...new Set(request.access.allowed_repos.map((repository) => repository.toLowerCase()))]
+request.access.access_token_repos = [...new Set(request.access.access_token_repos.map((repository) => repository.toLowerCase()))]
+request.target_repo = request.target_repo.toLowerCase()
+if (!request.access.allowed_repos.includes(request.target_repo)) {
+  throw new Error("ALLOWED_REPOS must explicitly include TARGET_REPO.")
+}
+if (!request.access.access_token_repos.includes(request.target_repo)) {
+  throw new Error("ACCESS_TOKEN_REPOS must explicitly include TARGET_REPO.")
 }
 
+const runId = `${request.workload.id}-${process.env.GITHUB_RUN_ID || "local"}`.replace(/[^A-Za-z0-9._-]+/g, "-")
 mkdirSync(".codebox", { recursive: true })
 writeFileSync(".codebox/agent-task-request.json", `${JSON.stringify(request, null, 2)}\n`)
-writeFileSync(".codebox/agent-task-workflow-result.json", `${JSON.stringify(result, null, 2)}\n`)
 
-output("job_status", status)
-output("transcript_json", request.artifacts.transcript_name)
-output("transcript_summary", `${request.workload.label}: ${status}`)
-output("engine_data_json", JSON.stringify(result.outputs.engine_data))
-output("credential_mode", result.access.credential_mode)
-output("declared_artifacts_json", JSON.stringify(artifactDeclarations))
-output("request_path", result.request_path)
-output("result_path", ".codebox/agent-task-workflow-result.json")
+output("request_path", ".codebox/agent-task-request.json")
 output("run_id", runId)