test(runtime-b): prove provider-side cancellation

[XnLemon]

Summary

• keep a deterministic hold task addressable after its SSE connection closes so Router''s one bounded tasks/cancel request can reach the same A2A task
• bind task get/cancel and cancellation observations to authenticated workspaceId + agentId
• record every Provider-side cancellation request under a non-sensitive acceptance marker, including rejected duplicates
• add the cancel-observed sample fixture, which consumes the scoped marker and returns only canceled plus cancelCount
• prove disconnected-task cancellation, one-shot observation, marker secrecy, invalid marker handling, duplicate counting, and cross-Workspace isolation

Why

The existing Stack acceptance proves that caller cancellation becomes a canceled Ledger record, while Core unit tests prove that Router attempts tasks/cancel. Those independent assertions do not prove the live discovered Provider actually received cancellation. Runtime B also removed a hold task as soon as its stream context closed, racing the Router''s follow-up cancel request.

This stacked Samples slice supplies Provider-owned evidence for a follow-up Stack E2E without adding a direct Provider inspection endpoint or bypassing Gateway/Router.

Security boundary

• task ownership is derived only from verified Router credential claims and includes exact Release provenance, capability, and Invocation ID
• foreign Workspace/Agent/Invocation task reads and cancellation return TaskNotFound
• the observation is a deterministic Sample fixture, not a Core contract or management API
• observation reads are normal managed Agent invocations through Gateway and Router
• the marker is never returned; Agent payloads and credentials remain absent from Ledger and logs
• no retry, alternate endpoint, provider, Release, or stale-success behavior is added

Validation

• go build ./...
• go test ./...
• go test -race ./...
• go vet ./...
• git diff --check
• focused runtime-b coverage: 78.1%; cancellation scope/observation helpers: 100%

Dependency

Stacked on Samples #6 (codex/core-registration-lease). Stack #7 pins exact commit 9f26d5e674a79b2d89685b05ca4ed02a2c5ba37d.

Fallback delta: removed 0, retained 0, added 0, net +0.
Added fallback evidence: none.

[XnLemon]

Re-reviewed current HEAD 9f26d5e. I found no remaining required-closure issue. Runtime B now preserves a known hold task long enough for Router''s bounded tasks/cancel, binds task get/cancel to the authenticated Workspace, exact Release provenance, capability, and original Invocation, and scopes the later observation to the same trusted target without requiring the original Invocation ID. Foreign Workspace, Release, and Invocation task operations are covered as TaskNotFound; the marker is not returned. Full build/test/race/vet passed, focused Runtime B coverage is 78.1%, and all required Samples CI is green.

中文

已复审当前 HEAD 9f26d5e，未发现剩余的 required-closure 问题。Runtime B 现在会保留已知 hold task，使 Router 的有界 tasks/cancel 可以到达；task get/cancel 绑定认证的 Workspace、精确 Release provenance、capability 和原始 Invocation，后续 observation 绑定同一可信目标但不要求沿用原 Invocation ID。跨 Workspace、Release、Invocation 的 task 操作均以 TaskNotFound 覆盖，marker 不会返回。完整 build/test/race/vet 通过，Runtime B focused coverage 为 78.1%，Samples required CI 全绿。