feat(automation): add isolated job delivery mode

src/automation/cron.test.ts

@@ -78,6 +78,21 @@ describe('CronScheduler', () => {
     expect(messages[0].text).toBe('Hello from cron');
   });
 
+  it('uses isolated sender IDs when delivery mode is isolated_job', async () => {
+    const jobs = [makeCronJob()];
+    scheduler = new CronScheduler(jobs, mockChannelRegistry as any, 'isolated_job');
+
+    const messages: InboundMessage[] = [];
+    scheduler.onMessage((msg: InboundMessage) => messages.push(msg));
+    await scheduler.connect();
+    scheduler.triggerJob('test-job');
+
+    expect(messages).toHaveLength(1);
+    expect(messages[0].senderId).toMatch(/^test-job:run-/);
+    expect(messages[0].metadata?.replyPeerId).toBe('test-job');
+    expect(messages[0].metadata?.deliveryMode).toBe('isolated_job');
+  });
+
   it('forwards response to output channel on send()', async () => {
     const mockOutputAdapter = {
       send: vi.fn().mockResolvedValue(undefined),

src/automation/cron.ts

@@ -2,12 +2,15 @@ import { Cron } from 'croner';
 import type { CronJobConfig } from '../config/schema.js';
 import type { ChannelAdapter, ChannelStatus, InboundMessage, OutboundMessage } from '../channels/types.js';
 import { auditLogger } from '../audit/index.js';
+import { randomUUID } from 'crypto';
 
 /** Minimal interface for the parts of ChannelRegistry we need. */
 interface ChannelLookup {
   get(name: string): { send(peerId: string, message: OutboundMessage): Promise<void> } | undefined;
 }
 
+type DeliveryMode = 'shared_session' | 'isolated_job';
+
 export class CronScheduler implements ChannelAdapter {
   readonly name = 'cron';
   private _status: ChannelStatus = 'disconnected';
@@ -18,6 +21,7 @@ export class CronScheduler implements ChannelAdapter {
   constructor(
     private readonly jobConfigs: CronJobConfig[],
     private readonly channelLookup: ChannelLookup,
+    private readonly deliveryMode: DeliveryMode = 'shared_session',
   ) {
     for (const job of jobConfigs) {
       this.jobs.set(job.name, job);
@@ -85,15 +89,24 @@ export class CronScheduler implements ChannelAdapter {
   triggerJob(jobName: string): void {
     const job = this.jobs.get(jobName);
     if (!job) {return;}
+    const runId = `run-${randomUUID()}`;
+    const senderId = this.deliveryMode === 'isolated_job' ? `${jobName}:${runId}` : jobName;
 
     const msg: InboundMessage = {
       id: `cron-${jobName}-${Date.now()}`,
       channel: 'cron',
-      senderId: jobName,
+      senderId,
       senderName: `cron:${jobName}`,
       text: job.message,
       timestamp: Date.now(),
-      metadata: { cronJob: jobName, scheduled: true, modelTier: job.model_tier },
+      metadata: {
+        cronJob: jobName,
+        scheduled: true,
+        modelTier: job.model_tier,
+        deliveryMode: this.deliveryMode,
+        runId,
+        replyPeerId: jobName,
+      },
     };
 
     auditLogger?.cronTrigger({

src/automation/webhooks.test.ts

@@ -114,6 +114,25 @@ describe('WebhookHandler', () => {
     expect(messages[0].text).toBe('hello world');
   });
 
+  it('handleRequest uses isolated sender IDs when delivery mode is isolated_job', async () => {
+    const webhooks = [makeWebhook()];
+    handler = new WebhookHandler(webhooks, mockChannelRegistry as any, 'isolated_job');
+
+    const messages: InboundMessage[] = [];
+    handler.onMessage((msg: InboundMessage) => messages.push(msg));
+    await handler.connect();
+
+    const req = mockRequest('hello world');
+    const res = mockResponse();
+    const result = await handler.handleRequest('test-hook', req, res);
+
+    expect(result).toBe(true);
+    expect(messages).toHaveLength(1);
+    expect(messages[0].senderId).toMatch(/^test-hook:run-/);
+    expect(messages[0].metadata?.replyPeerId).toBe('test-hook');
+    expect(messages[0].metadata?.deliveryMode).toBe('isolated_job');
+  });
+
   it('returns false for unknown webhook', async () => {
     handler = new WebhookHandler([], mockChannelRegistry as any);
     await handler.connect();

src/automation/webhooks.ts

@@ -1,4 +1,4 @@
-import { createHmac, timingSafeEqual } from 'crypto';
+import { createHmac, randomUUID, timingSafeEqual } from 'crypto';
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { WebhookConfig } from '../config/schema.js';
 import type { ChannelAdapter, ChannelStatus, InboundMessage, OutboundMessage } from '../channels/types.js';
@@ -9,6 +9,8 @@ interface ChannelLookup {
   get(name: string): { send(peerId: string, message: OutboundMessage): Promise<void> } | undefined;
 }
 
+type DeliveryMode = 'shared_session' | 'isolated_job';
+
 /** Read the full request body as a string. */
 function readBody(req: IncomingMessage): Promise<string> {
   return new Promise((resolve, reject) => {
@@ -68,6 +70,7 @@ export class WebhookHandler implements ChannelAdapter {
   constructor(
     private readonly webhookConfigs: WebhookConfig[],
     private readonly channelLookup: ChannelLookup,
+    private readonly deliveryMode: DeliveryMode = 'shared_session',
   ) {
     for (const webhook of webhookConfigs) {
       this.webhooks.set(webhook.name, webhook);
@@ -151,15 +154,23 @@ export class WebhookHandler implements ChannelAdapter {
 
     // Render message template
     const text = renderTemplate(webhook.message, body);
+    const runId = `run-${randomUUID()}`;
+    const senderId = this.deliveryMode === 'isolated_job' ? `${webhookName}:${runId}` : webhookName;
 
     const msg: InboundMessage = {
       id: `webhook-${webhookName}-${Date.now()}`,
       channel: 'webhook',
-      senderId: webhookName,
+      senderId,
       senderName: `webhook:${webhookName}`,
       text,
       timestamp: Date.now(),
-      metadata: { webhookName, body },
+      metadata: {
+        webhookName,
+        body,
+        deliveryMode: this.deliveryMode,
+        runId,
+        replyPeerId: webhookName,
+      },
     };
 
     auditLogger?.webhookReceive({