docs(task): define cache trust requirements

[jdx]

Summary

• document remote cache namespaces, bearer-token handling, HTTPS, retention, and writer trust boundaries
• explain how cached logs and filesystem artifacts can retain sensitive task output
• define the determinism, complete-input, and complete-output requirements for correct cache hits
• update local-only guidance now that remote cache configuration exists

Tests

• markdownlint-cli2 docs/tasks/task-configuration.md TASK_CACHE_PARITY.md
• prettier --check docs/tasks/task-configuration.md TASK_CACHE_PARITY.md

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

---

Note

Low Risk
Documentation-only changes with no runtime or configuration behavior modifications.

Overview
Adds operator-facing guidance for the experimental task output cache in task-configuration.md, and marks the corresponding parity tracker items complete in TASK_CACHE_PARITY.md.

local-only is documented as bypassing any configured remote cache (replacing the prior “equivalent to read-write” note). New sections cover remote cache and sensitive data: namespace isolation, bearer tokens via MISE_TASK_CACHE_REMOTE_TOKEN, HTTPS expectations, what cache entries contain (logs and outputs), redaction limits, remote retention, and writer trust boundaries (checksums vs signatures, PR read-only / separate namespaces).

A cache correctness and deterministic tasks section states that enabling cache asserts identical key material yields equivalent results, lists what must be in the key, warns about pass-through env and undeclared side effects, and gives troubleshooting steps (--task-cache off, separate namespaces).

^{Reviewed by Cursor Bugbot for commit 7186d55. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 290a37c8-011f-4df6-adcd-1c82394d248c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Documents the trust and correctness requirements for the experimental remote task cache.

• Clarifies that local-only bypasses configured remote services.
• Documents remote namespaces, bearer-token handling, HTTPS requirements, sensitive cached data, retention, and writer trust boundaries.
• Defines deterministic-task, complete-input, and complete-output requirements for correct cache hits.
• Marks the corresponding documentation work complete in the parity tracker.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
docs/tasks/task-configuration.md	Adds remote-cache security guidance and deterministic-cache correctness requirements without changing runtime behavior.
TASK_CACHE_PARITY.md	Marks the secret-handling and cache-correctness documentation tasks complete.

_{Reviews (12): Last reviewed commit: "docs(task): define cache trust requireme..." | Re-trigger Greptile}

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▂▄▂▁▁▁▃▃▃█	80,074,952 → 80,209,136	+0.17%	17.64 → 17.39ms	-1.45%
hook-env	▅▄▁▃▂▂▃▃▄█	82,190,914 → 82,353,618	+0.20%	18.34 → 18.34ms	+0.00%
ls	▄▃▁▁▁▅▅▅▅█	73,127,800 → 73,235,463	+0.15%	15.71 → 15.84ms	+0.82%
registry	▁▁▂▂▃▆▆█▂▆	49,102,713 → 49,163,148	+0.12%	11.64 → 12.25ms	+5.18%
startup	▃▃▁▂▂▁▁▂▂█	15,784,751 → 15,850,302	+0.42%	9.04 → 9.43ms	+4.33%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{7186d55addb6 vs e5230aa14775 · measured on the runner, not pushed to the history.}

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.