fix(a2a): scope tasks and context sessions by bearer principal - #1012

Both findings addressed in 9ac6e4f8, and the branch is now merged with current main so it is MERGEABLE rather than CONFLICTING. Re-review requested.

P1 — ownership was filtered after the page was cut

Your example was right, and the fix is where you suggested: the principal filter now lives in listTasks, applied before sorting and truncation, so a caller cannot be paginated out by tasks they cannot see.

listTasks also returns the scoped total, counted before the page is cut. totalSize previously described the current page rather than the caller's matching set, so a short page and a filtered one were indistinguishable. Both tasks/list and the ListTasks path go through this one handler, as you noted.

Content loss — residue removed

Restored README to its merge-base content and removed SKILL.md, skill.json, history.env, config.txt, assets/payload.txt, and the fixture directories under skills/. None of those paths exist on main.

On the cause — corrected: this was not a separate test-hygiene problem. It is this repo's own #1020, reproduced.

Running the suite with GIT_DIR inherited, exactly as git push from a worktree exports it, makes the git-spawning tests (skills.zig's installSkillFromGit, workspace_audit.zig) operate on this repository instead of their fixture repos. They then run git init/git add/commit and write their fixtures into the working tree:

error: 'skills.test.installSkillFromGit installs from local git repository' failed:  (and 2 more)
$ git log --oneline -3
d2e298e0 init
bf747d23 init
072f4ad5 init
$ git show d2e298e0:README.md
# Not a skill

That commit adds skills/unsafe/SKILL.md and carries the stub README — byte-identical to the residue that was on this branch. A squashed git add -A commit then captures it, which is why only branches committed that way were affected.

The fix is #1021 (the unset of the inherited git environment at the top of the pre-push hook), verified against that exact condition: same worktree, same inherited GIT_DIR, suite green with HEAD unchanged and a clean git status. #1021 is the remedy for this; it was open and unreviewed when this branch was cleaned.

To be clear about an earlier mistake of mine: I previously said the writer was "a different test" that I could not identify, and pointed at #1029/#1038. That was wrong. #1038 is unrelated — it touches only src/config_paths.zig and fixes the cron/session leak into the real $HOME/.nullclaw.

Tests

• A caller's own task survives a pageSize: 1 request even when another principal owns a more recent task — your exact scenario
• The scoped total reports the whole matching set, not the page length
• A foreign caller's cancel of a working task returns not-found and never requests an interruption

On the cancellation check you asked for: the existing test used a submitted task, which never enters the interruption branch at all, so it could not have caught this. MockSessionManager now counts interrupt calls, and the new test puts the task in working first so the branch is genuinely reached.

One gap, stated plainly: I did not add the foreign-owner resubscribe regression. The principal check for resubscribe already exists in the code (src/a2a.zig, same not-found as an unknown id), but handleResubscribeStreaming takes a live *net.Stream and there is no in-memory seam, so an end-to-end test needs a real socket. Given #1012's HTTP-adjacent tests already showed how a port-binding test can go flaky, I did not want to add another. If you want it, a socketpair-backed seam is the clean way and I would rather add it as a follow-up than smuggle a flaky test in here.

Validation

• Branch: zig fmt --check src/ exit 0 · ReleaseSmall exit 0 · zig build test --summary all 13/13 steps, 7404/7413 passed, 9 skipped, 0 failures, 0 leaks
• Merge result with current main: clean, 13/13 steps, 7498/7507 passed, 9 skipped, 0 failures, 0 leaks
• The branch now contains main, so the PR diff is exactly 4 files, +456/−92, with no residue and no README churn

Follow-up in 7597bdb4: the foreign-owner resubscribe regression is now covered, closing the gap I flagged.

handleResubscribeStreaming takes a live *net.Stream while the other handlers take a JSON body, so there was no in-memory seam. Rather than bind a real port — which is exactly what made gateway.test.run returns AddressInUse when port is already bound unreliable — this uses the existing createTestSocketPair helper in src/websocket.zig, the same approach the websocket tests already use. No port, no flake surface.

It asserts the response is the not-found error (-32001) and that no trace of Alice's task id or text appears in the output. The guard is correct today; this pins it.

One thing I got wrong while writing it, worth recording so nobody re-adds it: I first asserted the response would not contain 200 OK, and it failed. writeSseError sends 200 OK headers and then delivers the error as an SSE event, which is correct SSE behaviour — an error inside a live stream is an event, not a status change. The test asserts on the event payload instead.

Validation: zig build test --summary all 13/13 steps, 7499/7508 passed, 9 skipped, 0 failures, 0 leaks. zig fmt --check src/ and zig build -Doptimize=ReleaseSmall clean.