aiworkhub_task_create

MANAGER WRITE: create one new canonical repo-local task card.

Creation choices (also exposed as field hints): difficulty: bounded, standard, complex (optional; never inferred). work_kind: generic, bugfix, refactor, performance, security, data_ml. validation_roles: generic, reproduction, regression, parity, baseline, delta, negative_fixture, schema, distribution; one per validation command. Required roles: bugfix=reproduction+regression; refactor=parity; performance=baseline+delta; security=negative_fixture; data_ml=schema+distribution. validation: shell-free executable commands; no environment assignments, pipes, redirects or chaining. Set environment outside validation argv. custom_template_escape: audited_custom_unclassified, explicitly audited unclassified cards only, not an automatic bypass; writable escaped cards require non-empty required_outputs covered by allowed_writes.

Replies with a creation receipt (aiworkhub.task_create_receipt.v1): task_id, created/reconciled/receipt_state, scope_warnings, the server-derived validation_roles, risk_tier/origin/signals, difficulty/origin, validation_exemption, template_provenance, the project_context Source Graph query, and card_sha256/card_bytes -- never the card the caller just typed. echo_card=True returns the full CLI envelope with the persisted card in stdout instead. A refusal names every violation at once (violations) with field, length and limit. The live manager session supplies callback provider/origin identity; callers cannot route a task into another chat, disable the mandatory review callback, or overwrite an existing id. depends_on (optional) names other task_ids in this repo that must finish before this card is Plan-DAG ready; omit it for the pre-DAG behavior. Tasks are uncapped by default. Never infer, estimate, or auto-assign max_live_tokens from task complexity, model, historical usage, or cost. Supply it only when the owner explicitly requests an exact cap or a repository policy pre-registers one. Process efficiency must come from focused context, bounded reads, minimal edits, fewer retries, and useful validation rather than from truncating work. An authorized cap is enforced only when the selected provider exposes structured usage while running; terminal-only usage remains posthoc evidence, never a false live- enforcement claim. A writable task's required_outputs may be empty ONLY when template classification matches a contract that declares that default itself (e.g. implementation_with_tests/cross_boundary_bugfix, whose combined production+test scope keeps a deliberate empty default per NF-2026-00456) or an explicit, in-scope mandatory list resolves that way. Every other writable outcome -- including the audited custom-escape path, which has no template contract of its own to fall back on -- requires a non-empty required_outputs (NF-2026-00772); it contains only repo-relative file paths or glob patterns covered by allowed_writes. Human-readable outcome descriptions belong in acceptance; mixing prose into required_outputs is rejected before a provider run is launched. allow_unchanged_required_outputs explicitly names required files that are evidence inputs/outputs permitted to remain byte-identical to both launch baselines; they are verified and hashed but never promoted. allow_empty_required_outputs is the equivalent explicit exception for deliberately zero-byte outputs. Neither exception is inferred. read_only=True is required for a task that intentionally declares both allowed_writes=[] and required_outputs=[]. Read-only intent is never inferred from missing output authority. runner is the worker execution identity returned by aiworkhub_manager_workforce_rank.launch_contract.runner. The exact value codex is reserved for the verified manager and is rejected for worker cards. work_kind is an explicit behavioral contract, never inferred from the title or worker prose. Specialized values require one validation_roles entry per validation command: bugfix=reproduction+regression, refactor=parity, performance=baseline+delta, security=negative_fixture, and data_ml=schema+distribution. Missing roles are rejected before launch. risk_tier is optional explicit routing/economic evidence. It is never inferred from priority or prose; omitted historical cards remain unknown. It is a FLOOR: the observed write scope may escalate it, never lower it. The skill_* fields are the card's skill selection vocabulary, drawn from closed sets (aiworkhub_manager_skill_mine and skill_registry.SELECTION_VOCABULARIES name them). An unknown token is refused at create rather than silently matching nothing. skill_task_family and skill_path_scope are derivable from the template and the write set and may be omitted; skill_stage, skill_triggers and skill_applicability are not derivable, and a card that omits them selects no skill at all. Default creation is template-first: generic Python production-plus-test cards classify against the frozen registry, and unclassified raw cards fail closed unless custom_template_escape is the audited token. wave_goal_binding (optional) is exactly {roadmap_id, goal_id, predecessor_task_id} and makes this card that active wave goal's current task in place of the predecessor. It is never inferred from a title, topic, version suffix or prose; the receipt names its state.