test(acceptance): add durable callback scheduled-conversation scenarios

[dennisonbertram]

Work type

Engineering change / feature slice

Change class

Infrastructure, CI, or process change

Why this matters

#1010 needs real proof that callbacks schedule/list/cancel/fire/recover/retry/idempotently continue the originating conversation visibly, not merely that a background timer fires.

Protected path

Agent callback tool call -> durable callback manager/store -> callback bridge/reserved child run -> conversation events/messages -> API/SSE/store and attached 100x30 TUI same-conversation transcript.

Acceptance contract

Given isolated lifecycle and attached PTY, prove: schedule/list/cancel; fire with callback.started/fired and one linked child; restart recovery fires once; deterministic first admission failure retries then starts one reserved run; repeated/recovered dispatch stays idempotent; two tenants/conversations remain isolated. Every case retains tool result, API/SSE/tasks/store evidence, >=2 manual messages and visible continuation.

Current architecture and search evidence

Agent tools internal/harness/tools/deferred/delayed_callback.go:14,79,119; durable manager internal/harness/tools/delayed_callback.go:279,355,429,605,1132; bridge internal/harness/callback_bridge.go:66; task observability internal/server/http_tasks.go:72,368; recovery cmd/harnessd/main.go:726-747,1137; #1285 is required for same-daemon PTY.

Cross-surface impact map

Acceptance driver only; existing callback tools/API/SSE/tasks/conversation DB/callbacks.db read as evidence. Concurrency/retry/idempotency and restart are explicitly exercised. Tenant isolation is required. TUI attached frames included; native GUI excluded. No production API/schema/deployment/provider change. Tests/docs/logs/indexes required.

Product and UX contract

None — acceptance-only seam validates existing user-visible callback intent.

In scope

K1-K6 embedded callback scenarios and deterministic test-only admission seam if necessary, on #1285.

Out of scope

Cron, remote cronsd, native GUI, altering production behavior without live-failure evidence.

Coordination and dependencies

Depends on #1285; child of #1279/#1010. Exact one issue/PR with Closes #N.

Test-first plan

Red identity/artifact tests for K1/K2, then recovery, deterministic retry/idempotency, isolation. Run focused/race/full regression and a retained real API+PTY suite.

Verification plan

Hash-bound source, tool calls, callbacks.db/task/API/SSE probes, same conversation/run ID evidence, immutable 100x30 frames, full regression/CI and independent review.

Rollout and rollback

Acceptance-only; revert isolated PR, no deployment/migration.

Documentation and handoff

Update plan/impact/logs/indexes and the #1279 runbook.

Definition of done

• K1-K6 artifact contracts pass
• API/SSE/store and same-conversation TUI proof retained
• Focused/race/full regression, review and CI green
• Docs/logs current

Process acknowledgement

• I completed the search and impact analysis before implementation and will update this issue if the design or scope changes.