[Change]: Show and control cron and callback lifecycle in the macOS app

[dennisonbertram]

Parent epic: #1000
Depends on: #1004, #1006, #1007, and #1008.

Work type

Shippable macOS GUI lifecycle and controls slice.

Problem

The existing tasks foundation can display coarse cron active/paused rows and pending callbacks, but it does not present the full execution lifecycle or consistently expose actions. TaskInfo.actions is decoded without a complete end-to-end control path, and refresh behavior is not enough to prove that a scheduled continuation advanced the chat.

Protected user path

A user schedules “every five minutes check whether the website is deployed” or “in two minutes say hello,” sees when it will run, watches it start and finish, sees the new chat messages, and can pause/resume/delete the cron or cancel the callback.

How to fix

1. Extend the additive /v1/tasks representation with next_run_at/fires_at, last_run_at, execution status, linked run ID, attempts, last safe error, updated_at, and server-authoritative allowed actions.
2. Add or finish scoped endpoints for cron pause/resume/delete and callback cancel. Validate action availability server-side, not only in Swift.
3. Model task kind/state/actions as typed Swift values with forward-compatible unknown handling.
4. Add row/detail controls with confirmation for destructive delete, disabled/loading/error states, keyboard access, VoiceOver labels, and visible next/last execution status.
5. Refresh task state from lifecycle events where available, with bounded polling fallback.
6. Add transcript system entries or equivalent UI treatment for scheduled, started, retrying/skipped, succeeded, failed, canceled, and deleted transitions. Do not fabricate an assistant message; actual assistant output must come from the run stream.
7. Link a task's active/last run into the existing conversation and run controls.

Acceptance criteria

• Cron rows show enabled/paused, next run, last result, and linked run.
• Callback rows show due time, attempts/state, last error when failed, and linked run.
• Pause/resume/delete/cancel work from the GUI and immediately reconcile to server state.
• A cron/callback-triggered run visibly advances the open chat.
• Failed/retrying/skipped states are distinguishable and accessible.
• Unauthorized or stale actions fail safely and refresh allowed actions.
• State remains correct after app restart and SSE reconnect.
• Existing task display behavior remains compatible with older additive payloads.

Test-first plan

Backend tests:

• task serialization for every lifecycle state;
• scope/auth and action availability;
• pause/resume/delete/cancel endpoint success, conflict, not found, and stale action.

Swift tests:

• decoder forward compatibility;
• row/detail rendering and accessible labels;
• each action's request and reconciliation;
• lifecycle event refresh and polling fallback;
• transcript entries versus actual assistant output;
• error/retry/skipped states.

Run:

• go test ./internal/server -run 'Test.*Tasks|Test.*Cron.*Action|Test.*Callback.*Cancel' -count=1
• go test ./internal/server -race -count=1
• swift test --package-path macapp --filter Task
• swift test --package-path macapp

Scope boundaries

In scope: additive task API/action endpoints, Mac models/views/actions, transcript lifecycle UX, tests, accessibility, docs.
Out of scope: scheduler/retry implementation itself, a generalized notification center, and iOS/web clients.

Rollout / rollback

Add fields and endpoints compatibly. Hide controls when the server omits an allowed action. Rollback the new controls while retaining read-only task display and additive server fields.

Definition of done

One PR closes this issue, includes backend and Swift regression coverage, demonstrates the real path in the installed Mac app, updates UX/API/engineering docs and indexes, and passes required verification.

[dennisonbertram]

Current native-app acceptance update — 2026-08-04

The installed /Users/dennison/Applications/GoCode.app is not a valid acceptance artifact for merged main. Its Info.plist reports GoCodeMainCommit=f942c1a5, while current main is bf99206fd1b0a2aa7fd9a440884688e3ee04d765; the installed commit predates the #982/#1001-era cron visibility fixes.

Live GUI callback behavior was positive in that stale build: a 15-second set_delayed_callback produced an actual later transcript message GUI_CALLBACK_MARKER, and a follow-up correctly cited that marker. This evidence is historical only and must not be used to close this issue or #1010.

The stale GUI cron test revealed a false-success UX: prompted to create gui-cron-marker every minute, the model claimed the job existed but did not provide an ID; the inspector recorded no cron_create call. The app instead wrote an untracked .github/workflows/gui-cron-marker.yml. This is consistent with the pre-fix binary and is not evidence of current-main behavior. Do not delete the generated workflow as part of this issue without an owner-directed cleanup decision.

Required additions to #1009 acceptance / #1010 evidence

• Rebuild and install a native GoCode artifact from the exact merged-main SHA under test; expose or record app, embedded harness, and source SHA provenance so the acceptance runner rejects stale artifacts.
• In that artifact, use the GUI inspector/API to prove the exact cron prompt calls cron_create, returns the server job ID, shows scheduled status, fires, and causes a later real assistant turn in the same transcript.
• Prove callback scheduling, firing, retries/failure, cancellation, and successful same-conversation transcript continuation in the same exact artifact.
• Preserve the existing requirement that lifecycle rows/actions reconcile to server-authoritative state. A model text claim is never proof of a tool call or created job.
• Attach redacted build SHA, inspector/API row/job ID, transcript, and current-main full-conversation evidence before marking native GUI acceptance complete.

This update narrows no product requirement: it adds the missing provenance gate necessary to distinguish a current GUI proof from a stale-app false positive. The separate default callback-admission, idle-TUI streaming, and cron execution-API defects are tracked in #1147, #1148, and #1149 respectively.