Build a stable, collision-resistant task scope from the canonical endpoint
scope supplied by serve() and the authenticated principal. The tuple is
hashed to keep the value fixed-length before it reaches an indexed database
column and to avoid persisting raw authentication principal material.
Built-in bearer authentication uses "unknown" when a valid token has no
client_id or sub. Reject that sentinel so identity-less tokens cannot
collapse into one shared task namespace. Custom authenticators must likewise
assign a stable, collision-free principal for every caller allowed to use
persisted tasks. Including the endpoint scope keeps the same principal
isolated when one process and TaskStore serve multiple agents.
Build a stable, collision-resistant task scope from the canonical endpoint scope supplied by
serve()and the authenticated principal. The tuple is hashed to keep the value fixed-length before it reaches an indexed database column and to avoid persisting raw authentication principal material.Built-in bearer authentication uses
"unknown"when a valid token has noclient_idorsub. Reject that sentinel so identity-less tokens cannot collapse into one shared task namespace. Custom authenticators must likewise assign a stable, collision-free principal for every caller allowed to use persisted tasks. Including the endpoint scope keeps the same principal isolated when one process and TaskStore serve multiple agents.