feat(orchestrator): tasks tab with register, inbox and queue

Add a Tasks tab that lists the kvb-org-rasci register next to the inbox
and the heavy-job queue, in list, board and RASCI matrix views, each
task with its roles, WSJF, open work and the merge flow of its worktree.

- Task priority pins and WSJF estimates are signed with the operator's
  passkey and applied by the runner through rasci.py; the hub verifies
  the signature itself before it queues a job or logs the change, the
  runner verifies it again and runs only the checked argv, from /, with
  a pinned PATH and a 30 s process-group limit.
- The runner refuses task changes into a council that is a symlink, not
  owned by its uid or given by a relative path, and while the installed
  council.py, nofollow.py or rasci.py differ from the tree.
- Only tasks the hub can sign whole are editable (task slug and length).
- Page lookups keyed by register text use Object.hasOwn, so a status or
  party named like an Object.prototype member cannot break the views.
- The inbox screen renders through the tasks screen, so its task filter
  shows with "Wartet auf Operator" pressed.

Tests: 604 unit tests OK, e2e 15/15 OK (Chromium and Firefox).

🎯 Fix: 93 %
💥 Break: 5 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orchestrator/kvb_orchestrator/tasking.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+import time
+
+from .errors import Conflict, Missing, ToolError
+from .fields import decode, expect
+from .jobs import TASK_JOB
+from .register import REGISTER, read_register, status_of
+from .signed import signing
+from .tasks import editable
+
+CHANGE_LIMIT = 10
+CHANGE_KEYS = ("kind", "id", "argv")
+
+
+def task_request(raw: object) -> bool:
+    return isinstance(raw, list) and bool(raw) and all(isinstance(entry, dict) and entry.get("kind") == TASK_JOB for entry in raw)
+
+
+def shown_command(argv: list[str]) -> str:
+    return " ".join(["rasci.py", *argv])
+
+
+class Tasking:
+    def task_changes(self, raw: object) -> list[dict]:
+        """Args:
+            raw: the page's items, each {"kind": "task", "id", "argv"} with
+                the rasci.py arguments of one priority pin or WSJF estimate.
+
+        Returns:
+            The signed items, each for an open register task outside
+            operator/ and hotfix/ whose argv signing.task_argv() accepts.
+        """
+        if not isinstance(raw, list) or not 1 <= len(raw) <= CHANGE_LIMIT:
+            raise ToolError(f"items must be a list of 1 to {CHANGE_LIMIT} task changes")
+        tasks = read_register(self.council / REGISTER)
+        signed: list[dict] = []
+        for entry in raw:
+            if not isinstance(entry, dict):
+                raise ToolError("every item must be an object with kind, id and argv")
+            expect(entry, CHANGE_KEYS)
+            try:
+                argv = signing.task_argv(entry["id"], entry["argv"])
+            except signing.Refused as error:
+                raise ToolError(f"{entry['id']!s:.200}: {error}") from None
+            row = tasks.get(entry["id"])
+            if row is None:
+                raise Missing(entry["id"])
+            if not editable(entry["id"], row):
+                raise Conflict({"id": entry["id"], "status": status_of(row)})
+            item = signing.task_item(entry["id"], argv)
+            if item in signed:
+                raise ToolError("items must be distinct")
+            signed.append(item)
+        return signed
+
+    def change_tasks(self, body: bytes) -> dict:
+        payload = decode(body)
+        expect(payload, ("items", "proof"))
+        items = self.task_changes(payload["items"])
+        proof = self.covered(payload["proof"], items, time.time())
+        for item in items:
+            self.still_signed(proof, item)
+        ids = []
+        for item in items:
+            fields = {"kind": TASK_JOB, "task": item["id"], "argv": item["argv"], "command": shown_command(item["argv"]), "directory": "", "sha256": "", "status": "queued", "proof": proof}
+            ids.append(self.jobs.add({**fields, "code": None, "output": "", "created_ts": time.time(), "started": None, "finished": None})["id"])
+        commands = [shown_command(item["argv"]) for item in items]
+        self.log.add({"kind": "run", "title": f"Aufgabe signiert geändert: {', '.join(item['id'] for item in items)}"[:200], "text": "\n".join(commands), "ref": {"jobs": ids, "status": "queued"}})
+        return {"jobs": ids, "status": "queued"}