feat(tasks): rebind sandbox GitHub identity on actor transitions

[VojtechBartos]

Problem

Completes per-message identity for multiplayer Slack threads. #70454 makes the sandbox's MCP session follow the current speaker; this PR does the same for GitHub, and unifies both behind one gate so identity switching always happens in the same place.

Two GitHub-specific gaps today:

1. No per-message switching. GitHub credentials (token, git author) are injected at boot and re-applied by the background credential-refresh loop on token-TTL cadence. When a different user takes over a thread, commits, pushes, and PRs keep running as the previous actor.
2. The refresh loop reads a stale actor. refresh_sandbox_credentials receives the TaskProcessingContext captured at workflow start, whose state is a boot-time snapshot, so even its cadence refreshes resolve the boot-time actor forever. The actor-aware resolution added in feat(slack): add approval recovery flow #66212 never sees mid-run actor changes.

Changes

One reconciliation gate, ensure_sandbox_identity (new sandbox_identity.py module), called from the follow-up delivery activity right before the turn runs. It compares the run's current actor against the identity last pushed to this sandbox, per surface:

flowchart TD
    M[Follow-up message arrives] --> A{{Resolve actor from run state}}
    A --> MCP{MCP: transition or freshness window expired?}
    A --> GH{GitHub: transition?}
    MCP -- yes --> RM[Mint OAuth token, push refresh_session]
    GH -- yes --> RG[Re-inject GitHub token + git author, notify authorship]
    RM --> K[(Sandbox-scoped identity + freshness marks)]
    RG --> K

    classDef phBlue fill:#1d4aff,stroke:#1d4aff,color:#fff;
    classDef phYellow fill:#f9bd2b,stroke:#f9bd2b,color:#000;
    classDef phGray fill:#e5e7eb,stroke:#c7ccd1,color:#000;
    class A,RM,RG phBlue;
    class M phYellow;
    class K phGray;

Loading

• MCP surface: moved from send_followup_to_sandbox.py unchanged in behavior (transition bypasses the freshness window; same-actor repeats within the window skip).
• GitHub surface (new): transition-only, since token TTL between messages stays owned by the credential-refresh loop. On a speaker change it reuses GitHubSandboxCredential.refresh with the live run state (actor-aware token via feat(slack): add approval recovery flow #66212's resolution), rewrites the git author env (get_git_identity_env_vars), and notifies the agent-server with refreshed_credentials=["github"] and the effective PR authorship. A failed rebind leaves the mark untouched, so the next message retries.
• Actor fallback policy: a speaker without a usable GitHub connection falls through the existing resolution chain to the installation token, i.e. bot-authored work. Bot attribution beats wrong-person attribution.
• Staleness fix: refresh_sandbox_credentials re-reads the run state live before building credentials, so cadence refreshes also follow the current actor.
• The delivery activity input gains an optional context (the run's TaskProcessingContext, passed by both workflows); activities scheduled by pre-rollout histories deserialize without it and simply skip the GitHub surface.
• Boot records the GitHub session identity alongside the MCP one, keyed by sandbox id so replacement sandboxes start unmarked.

Note

Stacked on #70454 (the diff base). The gate stays best-effort: a failed rebind never blocks follow-up delivery.

How did you test this code?

327 passed, 4 skipped across process_task + execute_sandbox suites locally. New coverage in test_sandbox_identity.py:

• TestGithubIdentityTransitionGate (new): a speaker change re-injects credentials with the live run state, rewrites the git author, notifies with authorship, and records the identity; same actor doesn't touch the sandbox; missing context / no GitHub credentials / missing sandbox id skip safely; a failed rebind leaves the mark unset so the next message retries; an unrefreshable credential (caller-token run) marks without notifying.
• MCP gate tests moved from test_send_followup_to_sandbox.py and retargeted to the shared gate, asserting identical behavior through ensure_sandbox_identity.

Not manually tested end to end; the log trail (refresh_github_identity_transition, refresh_github_delivered, refresh_github_identity_failed) mirrors the MCP one for rollout verification.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

Docs update

Internal behavior only, no docs affected.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Claude Code (Claude Fable 5). Replaces closed #70024, rebuilt on master's run-state actor design. The gate extraction (rather than a second standalone refresh function) was an explicit ask: MCP and GitHub identity switching happen in the same place with the same transition semantics.

[trunk-io]

     

View Full Report ↗︎ ⋅ Docs

[VojtechBartos]

Superseded by #71941, which does rebind or log out on failure (a superset of the rebind-only behavior here) and is built on the current, rebased PR3. Closing this stale branch.