DO NOT MERGE: Resource override audit snapshots

[simple-agent-manager]

Summary

DO NOT MERGE TO PROD. Draft/audit-only slice for task/session/trigger resource override data contracts and audit trails.

• Adds shared resource requirement validation, field-level provenance, and concrete resolved reservation snapshots.
• Adds additive D1 audit/default columns for project/profile/trigger resource JSON and requested provider/location/workspace/task-mode snapshots.
• Wires the shared resolver through task submit, trigger submit, SAM dispatch, MCP dispatch, retry/fork, and task run paths.
• Persists resolved task/workspace audit snapshots and passes resolved reservations to TaskRunner without changing placement behavior.
• Adds tests for precedence, validation, persisted snapshots, MCP taskMode default, and unchanged node selection behavior.

Deferred intentionally:

• Reservation tables
• Atomic node reservation claiming
• Reservation-aware placement or packing enforcement
• Admin placement explanation UI

• Preflight completed before code changes
• cross-component-change
• business-logic-change
• public-surface-change
• infra-change

External References

N/A: implementation used in-repo task context, SAM instructions, existing source, migrations, and postmortems; no external API or third-party contract changed.

Codebase Impact Analysis

Touched packages/shared resource/task/profile/trigger/project contracts, apps/api task start routes/services/MCP/SAM dispatch paths, D1 schema/migrations, and TaskRunner DO workspace audit persistence. Placement logic remains unchanged and is covered by apps/api/tests/unit/durable-objects/task-runner-node-selection.test.ts.

Documentation & Specs

Updated tasks/active/2026-05-31-resource-override-audit-slice.md with implementation status. Public-surface changes are additive request/response/schema fields for resource requirement audit data; broader user documentation is deferred because UI exposure and reservation-aware enforcement are intentionally out of this PR.

Constitution & Risk Check

Checked Principle XI for resource constants: platform defaults and validation limits are centralized in packages/shared/src/constants/resource-defaults.ts with tests, and no new deployment-specific URLs, credentials, or hidden scheduler behavior changes were introduced. D1 migration is additive-only.

Validation

Passed:

• pnpm --filter @simple-agent-manager/shared test -- resource-defaults.test.ts
• pnpm --filter @simple-agent-manager/api test -- task-start-audit.test.ts task-runner-node-selection.test.ts trigger-submit.test.ts mcp.test.ts sam-dispatch-task-mode-visibility.test.ts triggers.test.ts cron-sweep.test.ts github-trigger-handler.test.ts mcp-orchestration-tools.test.ts
• pnpm --filter @simple-agent-manager/api test:coverage -- agent-profiles.test.ts
• pnpm quality:migration-safety
• pnpm lint (passes with existing warnings)
• pnpm typecheck
• pnpm build
• git diff --check

Known unrelated local validation failure:

• pnpm test fails in @simple-agent-manager/ui DropdownMenu.test.tsx on two existing assertions around danger/disabled item attributes. Reproduced in isolation with pnpm --filter @simple-agent-manager/ui test -- DropdownMenu.test.tsx. No UI package files are changed in this PR.

Specialist Review Notes

• Cloudflare/D1/DO: migration 0058_resource_override_defaults.sql is additive-only; no table recreation/drop; TaskRunner DO receives audit data and workspace creation persists snapshots.
• Constitution: resource defaults/limits are centralized named constants in shared code with validation tests; no new deployment-specific URLs, timeouts, or credential identifiers introduced.
• Test engineering: focused tests cover shared validation/resolution, trigger persistence to D1 payload and TaskRunner payload, MCP default policy, and no scheduler placement behavior change.
• Task completion: checklist and acceptance criteria are covered; the PR is draft/do-not-merge.

Do Not Merge

This PR must remain draft/do-not-merge until Raphael explicitly authorizes readiness or merge.

[sonarqubecloud]

Quality Gate failed

Failed conditions
10.9% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud