diff --git a/.specify/feature.json b/.specify/feature.json
index 9305fb44e..fa81f8e0a 100644
--- a/.specify/feature.json
+++ b/.specify/feature.json
@@ -1,3 +1,3 @@
{
- "feature_directory": "specs/012-output-converters"
+ "feature_directory": "specs/013-user-tasks"
}
diff --git a/AGENTS.md b/AGENTS.md
index 0a1a9fbc1..5dca79ebb 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -83,7 +83,7 @@ Before handing off changes, verify the following when applicable:
For additional context about technologies to be used, project structure,
-shell commands, and other important information, read `specs/012-weaver-grounding-tools/plan.md`.
+shell commands, and other important information, read `specs/013-user-tasks/plan.md`.
## Active Technologies
diff --git a/CONTEXT.md b/CONTEXT.md
index 8e19b678c..c449ddc6c 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -43,3 +43,129 @@ _Avoid_: Assignment error, converter log message
**Bound Value**:
The value delivered only to the destination of an Output Binding after any configured Output Converter has run. It may be null only when the destination permits null.
_Avoid_: Activity output
+
+**External Identity**:
+A protocol-neutral identity asserted by an Identity Provider and identified within that provider's namespace.
+_Avoid_: Elsa User, external user
+
+**External Identity Key**:
+The immutable combination of target Elsa tenant, Connection Key, validated issuer namespace, and stable subject used to distinguish an External Identity. Host-wide connection deployment does not collapse Elsa User tenancy.
+_Avoid_: Email address, user name
+
+**External Identity Link**:
+The association between an External Identity and the Elsa User that receives Elsa-specific roles, permissions, and tenant access.
+_Avoid_: External user, federated user
+
+**Local Credential**:
+Optional Elsa-managed authentication material, such as a password, associated with an Elsa User independently of External Identity Links.
+_Avoid_: Elsa User, External Identity
+
+**Unlinked Identity Policy**:
+The selected rule that decides what Elsa may do when an authenticated External Identity has no External Identity Link.
+_Avoid_: Provisioning mode, authorization policy
+
+**Elsa Permission**:
+A string-named capability required by Elsa functionality and carried by an authenticated principal.
+_Avoid_: External claim, role
+
+**Permission Grant Source**:
+A deferred extension concept for contributing Elsa Permissions. It is not a v1 External Authentication Studio configuration surface.
+_Avoid_: Role mapping, raw claim pass-through
+
+**External User Matcher**:
+A trusted deployed extension selected by the matcher-based Unlinked Identity Policy to propose an existing Elsa User from bounded, ephemeral external claims. Ambiguous results and matcher errors reject authentication.
+_Avoid_: Role matcher, permission mapper, automatic email linking
+
+**Permission Descriptor**:
+Optional module-provided metadata that describes an Elsa Permission without determining validity. External Authentication v1 does not use it for claim-permission mapping.
+_Avoid_: Permission catalog, permission registry
+
+**External Authentication Session**:
+The bounded Elsa sign-in session established from one successful external authentication and its resulting claim snapshot.
+_Avoid_: Identity-provider session, Elsa access token
+
+**Upstream Logout**:
+An optional logout operation that also asks the Identity Provider to end its session, when supported by the connection's Protocol Adapter.
+_Avoid_: Elsa logout, session revocation
+
+**Break-glass Authentication**:
+A deployment-controlled recovery method kept independent of ordinary external sign-in so administrators can repair authentication after lockout.
+_Avoid_: Backup provider, normal login method
+
+**Elsa User**:
+An account governed by Elsa's authorization model. An Elsa User may be associated with multiple External Identities.
+_Avoid_: External Identity, identity-provider user
+
+**Adapter Descriptor**:
+The protocol-neutral description of a Protocol Adapter's connection settings, validation, presentation, and capabilities.
+_Avoid_: Connection settings, custom form
+
+**Secret Binding**:
+A non-secret reference that tells Elsa how to resolve a sensitive connection value without storing or disclosing that value as connection data.
+_Avoid_: Client secret, secret value
+
+**Managed Secret**:
+A Secret Binding whose lifecycle is managed through an Elsa-integrated secret store. Studio may replace or remove it but never reveal it.
+_Avoid_: Inline secret, connection field
+
+**External Secret**:
+A read-only Secret Binding resolved from deployment configuration or another externally operated resolver. Studio may show its configured/resolvable state but does not own its value or lifecycle.
+_Avoid_: Managed Secret, plaintext setting
+
+**Preferred Login Method**:
+The enabled Login Method emphasized and ordered first by the chooser. Preference never causes an automatic redirect; the chooser remains visible.
+_Avoid_: Automatic login, forced provider
+
+**Connection Health**:
+The observed operational condition of an Identity Provider Connection, independent of whether administrators intend it to be enabled.
+_Avoid_: Enabled state, validity
+
+**Connection Validity**:
+Whether an Identity Provider Connection has structurally acceptable settings and resolvable required secrets.
+_Avoid_: Connection Health, enabled state
+
+**Provider Trust Setting**:
+A connection-controlled rule for locating and validating the Identity Provider and its assertions.
+_Avoid_: Broker security invariant
+
+**Broker Security Invariant**:
+An Elsa-owned protection for the broker and its clients that connection administrators cannot weaken through Studio.
+_Avoid_: Provider Trust Setting
+
+## User Tasks
+
+**User Task Definition**:
+The design-time configuration of human work in a workflow. It is evaluated and materialized when the activity executes.
+_Avoid_: User Task Instance, standalone task
+
+**User Task Instance**:
+A durable runtime work item created by a committed User Task bookmark and completed by one accountable participant or a configured terminal outcome.
+_Avoid_: User Task Definition, generic RunTask
+
+**Participant Reference**:
+An opaque, tenant-scoped `{ provider, type, id }` reference to a host-owned user or group. It never implies an Elsa Identity record.
+_Avoid_: Elsa User ID, username
+
+**Candidate**:
+A participant eligible to claim an Available User Task. Candidacy grants safe-summary visibility, not protected task content.
+_Avoid_: Assignee, requester
+
+**Assignee**:
+The single participant accountable for an Assigned User Task and permitted to access its protected response surface.
+_Avoid_: Candidate, manager
+
+**Requester**:
+An optional informational participant shown for context and search. Requester status grants no task access.
+_Avoid_: Assignee, task owner
+
+**Task Action**:
+A stable literal outcome key and its materialized display label. `Timeout` and `Cancelled` are reserved actions.
+_Avoid_: Button text, arbitrary workflow command
+
+**Task Health**:
+An operational warning or blocking resolution problem independent of User Task lifecycle status.
+_Avoid_: Task status, workflow incident
+
+**Guest Invitation**:
+A bounded, one-time candidacy for an external participant that becomes a task-scoped guest session only after configured verification.
+_Avoid_: Elsa user invitation, bearer account
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 24137c54f..d23afa120 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -200,6 +200,7 @@
+
diff --git a/Elsa.sln b/Elsa.sln
index 0936205ac..309b50448 100644
--- a/Elsa.sln
+++ b/Elsa.sln
@@ -489,6 +489,30 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.ExternalAuthentication
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.Api.Common.UnitTests", "test\unit\Elsa.Api.Common.UnitTests\Elsa.Api.Common.UnitTests.csproj", "{D81CC1F3-6312-4E77-BA16-8044F2553F3C}"
EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "modules", "modules", "{CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks", "src\modules\Elsa.UserTasks\Elsa.UserTasks.csproj", "{2FF198D8-FE05-4893-92C8-A373C82C8DEF}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.Persistence.EFCore", "src\modules\Elsa.UserTasks.Persistence.EFCore\Elsa.UserTasks.Persistence.EFCore.csproj", "{3A89A26D-E9AF-4A75-B9F0-C93018727869}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.Persistence.EFCore.Sqlite", "src\modules\Elsa.UserTasks.Persistence.EFCore.Sqlite\Elsa.UserTasks.Persistence.EFCore.Sqlite.csproj", "{4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.Persistence.EFCore.SqlServer", "src\modules\Elsa.UserTasks.Persistence.EFCore.SqlServer\Elsa.UserTasks.Persistence.EFCore.SqlServer.csproj", "{C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.Persistence.EFCore.PostgreSql", "src\modules\Elsa.UserTasks.Persistence.EFCore.PostgreSql\Elsa.UserTasks.Persistence.EFCore.PostgreSql.csproj", "{408BBF9A-6CF2-4241-A20B-0190B03D48B1}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.Persistence.EFCore.MySql", "src\modules\Elsa.UserTasks.Persistence.EFCore.MySql\Elsa.UserTasks.Persistence.EFCore.MySql.csproj", "{BB2982B8-708B-422E-B1B3-541240F01A49}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.Persistence.EFCore.Oracle", "src\modules\Elsa.UserTasks.Persistence.EFCore.Oracle\Elsa.UserTasks.Persistence.EFCore.Oracle.csproj", "{F2714082-9CE1-4DAE-9421-AE59477F950A}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.Persistence.VNext", "src\modules\Elsa.UserTasks.Persistence.VNext\Elsa.UserTasks.Persistence.VNext.csproj", "{385BB2E8-33F3-4127-BBD6-33F06938EE1C}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "unit", "unit", "{AB07AAEB-2C7A-1088-880A-08DB82DA218D}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.UnitTests", "test\unit\Elsa.UserTasks.UnitTests\Elsa.UserTasks.UnitTests.csproj", "{FB045674-6D63-4B49-A060-73D580E0FAC0}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.UserTasks.Persistence.EFCore.UnitTests", "test\unit\Elsa.UserTasks.Persistence.EFCore.UnitTests\Elsa.UserTasks.Persistence.EFCore.UnitTests.csproj", "{A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}"
+EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
@@ -2297,6 +2321,126 @@ Global
{D81CC1F3-6312-4E77-BA16-8044F2553F3C}.Release|x64.Build.0 = Release|Any CPU
{D81CC1F3-6312-4E77-BA16-8044F2553F3C}.Release|x86.ActiveCfg = Release|Any CPU
{D81CC1F3-6312-4E77-BA16-8044F2553F3C}.Release|x86.Build.0 = Release|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Debug|x64.Build.0 = Debug|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Debug|x86.Build.0 = Debug|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Release|Any CPU.Build.0 = Release|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Release|x64.ActiveCfg = Release|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Release|x64.Build.0 = Release|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Release|x86.ActiveCfg = Release|Any CPU
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF}.Release|x86.Build.0 = Release|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Debug|x64.Build.0 = Debug|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Debug|x86.Build.0 = Debug|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Release|Any CPU.Build.0 = Release|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Release|x64.ActiveCfg = Release|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Release|x64.Build.0 = Release|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Release|x86.ActiveCfg = Release|Any CPU
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869}.Release|x86.Build.0 = Release|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Debug|x64.Build.0 = Debug|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Debug|x86.Build.0 = Debug|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Release|Any CPU.Build.0 = Release|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Release|x64.ActiveCfg = Release|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Release|x64.Build.0 = Release|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Release|x86.ActiveCfg = Release|Any CPU
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1}.Release|x86.Build.0 = Release|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Debug|x64.Build.0 = Debug|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Debug|x86.Build.0 = Debug|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Release|Any CPU.Build.0 = Release|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Release|x64.ActiveCfg = Release|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Release|x64.Build.0 = Release|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Release|x86.ActiveCfg = Release|Any CPU
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B}.Release|x86.Build.0 = Release|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Debug|x64.Build.0 = Debug|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Debug|x86.Build.0 = Debug|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Release|Any CPU.Build.0 = Release|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Release|x64.ActiveCfg = Release|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Release|x64.Build.0 = Release|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Release|x86.ActiveCfg = Release|Any CPU
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1}.Release|x86.Build.0 = Release|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Debug|x64.Build.0 = Debug|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Debug|x86.Build.0 = Debug|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Release|Any CPU.Build.0 = Release|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Release|x64.ActiveCfg = Release|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Release|x64.Build.0 = Release|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Release|x86.ActiveCfg = Release|Any CPU
+ {BB2982B8-708B-422E-B1B3-541240F01A49}.Release|x86.Build.0 = Release|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Debug|x64.Build.0 = Debug|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Debug|x86.Build.0 = Debug|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Release|Any CPU.Build.0 = Release|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Release|x64.ActiveCfg = Release|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Release|x64.Build.0 = Release|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Release|x86.ActiveCfg = Release|Any CPU
+ {F2714082-9CE1-4DAE-9421-AE59477F950A}.Release|x86.Build.0 = Release|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Debug|x64.Build.0 = Debug|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Debug|x86.Build.0 = Debug|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Release|Any CPU.Build.0 = Release|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Release|x64.ActiveCfg = Release|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Release|x64.Build.0 = Release|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Release|x86.ActiveCfg = Release|Any CPU
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C}.Release|x86.Build.0 = Release|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Debug|x64.Build.0 = Debug|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Debug|x86.Build.0 = Debug|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Release|Any CPU.Build.0 = Release|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Release|x64.ActiveCfg = Release|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Release|x64.Build.0 = Release|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Release|x86.ActiveCfg = Release|Any CPU
+ {FB045674-6D63-4B49-A060-73D580E0FAC0}.Release|x86.Build.0 = Release|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Debug|x64.ActiveCfg = Debug|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Debug|x64.Build.0 = Debug|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Debug|x86.Build.0 = Debug|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Release|Any CPU.Build.0 = Release|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Release|x64.ActiveCfg = Release|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Release|x64.Build.0 = Release|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Release|x86.ActiveCfg = Release|Any CPU
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E}.Release|x86.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
@@ -2490,6 +2634,16 @@ Global
{DCFAE70F-67B8-4F84-A28D-55E1FF6F92DC} = {18453B51-25EB-4317-A4B3-B10518252E92}
{F94712B2-9237-403F-B8F4-C6F73D1DFED9} = {1B8D5897-902E-4632-8698-E89CAF3DDF54}
{D81CC1F3-6312-4E77-BA16-8044F2553F3C} = {18453B51-25EB-4317-A4B3-B10518252E92}
+ {2FF198D8-FE05-4893-92C8-A373C82C8DEF} = {CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}
+ {3A89A26D-E9AF-4A75-B9F0-C93018727869} = {CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}
+ {4A494EBB-702E-4FC7-AFCB-02ECD2613AA1} = {CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}
+ {C298ED71-A1AA-4DB0-B4F8-B2F19133EC0B} = {CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}
+ {408BBF9A-6CF2-4241-A20B-0190B03D48B1} = {CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}
+ {BB2982B8-708B-422E-B1B3-541240F01A49} = {CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}
+ {F2714082-9CE1-4DAE-9421-AE59477F950A} = {CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}
+ {385BB2E8-33F3-4127-BBD6-33F06938EE1C} = {CA253913-39DE-BFD0-C9A3-4B7EC6FBDF17}
+ {FB045674-6D63-4B49-A060-73D580E0FAC0} = {AB07AAEB-2C7A-1088-880A-08DB82DA218D}
+ {A4F3CB08-759D-4FE6-B715-E8D91E3E3F3E} = {AB07AAEB-2C7A-1088-880A-08DB82DA218D}
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {D4B5CEAA-7D70-4FCB-A68E-B03FBE5E0E5E}
diff --git a/doc/adr/0026-identity-neutral-user-task-participants.md b/doc/adr/0026-identity-neutral-user-task-participants.md
new file mode 100644
index 000000000..07be44ddc
--- /dev/null
+++ b/doc/adr/0026-identity-neutral-user-task-participants.md
@@ -0,0 +1,21 @@
+# 26. Use identity-neutral participant references for User Tasks
+
+Date: 2026-08-17
+
+## Status
+
+Accepted
+
+## Context
+
+Elsa Core does not own a universal user model. `Elsa.Identity` is one optional host feature, while embedded deployments may use an application database, Entra ID, LDAP, or another identity platform. Coupling task assignment to one user table would make the User Tasks module unusable or duplicative for those hosts.
+
+## Decision
+
+User Tasks store opaque participant references composed of tenant, provider namespace, participant type, and external ID, with an optional non-authoritative display snapshot. The module has no required `Elsa.Identity` dependency or foreign key.
+
+Authentication mapping, live group membership, directory lookup, and task authorization are replaceable host contracts. The built-in adapter maps namespaced claims. Directory resolution failure does not invalidate an exact live participant claim or fault task activation.
+
+## Consequences
+
+Hosts can integrate their existing identities without synchronization into Elsa. Every authorization and query path must remain tenant- and namespace-aware, and participant display may degrade to an opaque ID when no directory is available. Database constraints cannot enforce existence in an external identity system; policy and integration tests enforce relationships instead.
diff --git a/doc/adr/0027-project-user-tasks-from-committed-bookmarks.md b/doc/adr/0027-project-user-tasks-from-committed-bookmarks.md
new file mode 100644
index 000000000..f6a008652
--- /dev/null
+++ b/doc/adr/0027-project-user-tasks-from-committed-bookmarks.md
@@ -0,0 +1,21 @@
+# 27. Project User Tasks from committed workflow bookmarks
+
+Date: 2026-08-17
+
+## Status
+
+Accepted
+
+## Context
+
+A User Task must both suspend workflow execution durably and support efficient task-inbox queries. Writing a bookmark and a separate task store as an uncoordinated dual write can leave an invisible suspended workflow or an orphan task. Making the task table the workflow source of truth would bypass Elsa's established bookmark execution semantics.
+
+## Decision
+
+The User Task activity creates a dedicated bookmark whose payload contains the materialized task definition. After the workflow commit succeeds, a projector idempotently creates the task record from the committed bookmark. Terminal task operations persist an idempotent transitional operation and asynchronously resume the bookmark with a dedicated stimulus. Bookmark removal finalizes the task.
+
+A bounded, multi-node-safe reconciler scans committed User Task bookmarks and task operations to recreate missed projections, retry stale terminal delivery, and diagnose or finalize orphan records. Materialization key, bookmark ID, expected revision, and operation ID provide uniqueness and race control.
+
+## Consequences
+
+Workflow state remains authoritative for suspension and resumption, while the task store can be indexed independently for secure queues. Task availability may be briefly eventually consistent after workflow commit, and the module must operate a projector, operation outbox, and reconciler. Every provider must preserve the same idempotency and compare-and-swap guarantees.
diff --git a/doc/adr/toc.md b/doc/adr/toc.md
index 9d089bb04..1e7f596e8 100644
--- a/doc/adr/toc.md
+++ b/doc/adr/toc.md
@@ -25,3 +25,5 @@
* [23. Separate authentication UI composition from security administration](0023-separate-authentication-ui-composition-from-security-administration.md)
* [24. Use exact OIDC discovery and deployment-derived callbacks](0024-use-exact-oidc-discovery-and-deployment-derived-callbacks.md)
* [25. Two-axis authorization model with open resources and open verbs](0025-two-axis-authorization-model.md)
+* [26. Use Identity-Neutral Participant References for User Tasks](0026-identity-neutral-user-task-participants.md)
+* [27. Project User Tasks from Committed Workflow Bookmarks](0027-project-user-tasks-from-committed-bookmarks.md)
diff --git a/doc/user-tasks.md b/doc/user-tasks.md
new file mode 100644
index 000000000..8db70d9c9
--- /dev/null
+++ b/doc/user-tasks.md
@@ -0,0 +1,60 @@
+# User Tasks
+
+User Tasks add durable, workflow-bound human work to Elsa. A workflow suspends at the `UserTask` activity, authorized workers discover and act on the task through `/user-tasks`, and the workflow resumes with a typed action and validated form result.
+
+## Identity integration
+
+The module does not require `Elsa.Identity`. It stores opaque, tenant-scoped participant references:
+
+```json
+{
+ "tenantId": "acme",
+ "provider": "entra",
+ "type": "User",
+ "id": "external-subject-id"
+}
+```
+
+The default adapter maps namespaced claims from `ClaimsPrincipal`. Embedded hosts can replace `IUserTaskIdentityResolver`, `IUserTaskAccessPolicy`, and `IUserTaskParticipantDirectory` to integrate their own authentication, authorization, users, and groups. Directory lookup enriches display and snapshot groups; it is never required for an exact live claim match.
+
+Every operation requires both its module permission and a relationship to the task. Candidate workers can read safe queue metadata and claim. Only the assignee and tenant-scoped managers can read protected instructions, task data, and form content. Releasing a task revokes that access immediately.
+
+## Lifecycle
+
+Direct assignments start as `Assigned`; candidate or invitation work starts as `Available`; a task with no route to a worker starts as manager-only `Unassigned`. Completion, timeout, and cancellation first enter a transitional state while the workflow bookmark is resumed, then finalize as `Completed`, `TimedOut`, or `Cancelled`.
+
+Claims and terminal actions use optimistic concurrency. Completion and cancellation require a client operation ID, making same-payload retries idempotent while rejecting divergent reuse. A post-commit bookmark projector and paged reconciler repair interrupted projection and resume delivery without duplicating tasks.
+
+## Forms and actions
+
+Action keys are stable literals; their labels may be expressions. `Timeout` and `Cancelled` are reserved. An optional `IUserTaskFormProvider` resolves and pins a provider-neutral form reference when the task activates, then validates and normalizes the completion payload. An unresolved form creates a blocking manager health issue. Tasks without a form accept an action only.
+
+Protected task, form, and completion payloads are limited to 256 KiB by default. Put files in an external object/document provider and submit references rather than file bytes.
+
+## Persistence
+
+The Core feature includes an in-memory repository for development and tests. Production hosts can select the EF Core User Tasks package for SQLite, SQL Server, PostgreSQL, MySQL, or Oracle, or use the VNext persistence adapter. The provider-neutral API and activity contract do not change with the store.
+
+Terminal tasks are retained indefinitely by default. Configurable cleanup may purge terminal aggregates and their protected data, but never open tasks. Audit events remain append-only and contain safe metadata only.
+
+## HTTP surface
+
+Clients read `GET /user-tasks/capabilities` before rendering navigation, then work through `/user-tasks` for the queue and `/user-tasks/{id}` for a single task. Every command carries an `operationId` that the client mints once per submission and reuses on retry, so a double click or a network retry is recognised as the same command rather than accepted as a second one.
+
+Terminal commands (complete, cancel, retry resolution) answer `202`: the workflow resumes out of band and the client observes the final state by requery or invalidation. Conflicts answer `409`, semantic input errors `422`, and anonymous invitation traffic is throttled with `429`. Every failure body is `{ code, message }` with display-safe copy — never exception text or payload fragments.
+
+Masked form fields never travel with the task detail. A client that needs one calls `POST /user-tasks/{id}/reveal`, which requires protected access, requires the form provider to have marked the field revealable, and writes the disclosure to the audit trail.
+
+## Guest invitations
+
+Guest invitations are task-scoped and do not create Elsa users. Core hashes the one-time token, retains retry material only in a Data Protection-encrypted transient outbox, and delegates delivery and challenge verification to host services. The first successful verification claims the task, revokes sibling invitations, and issues a bounded guest session. Anonymous errors are generic and rate-limited; guests cannot release or reassign work.
+
+The transient delivery outbox encrypts pending secrets with ASP.NET Core Data Protection, so the module needs an `IDataProtectionProvider`. Web hosts register one by default; a non-web host that enables invitations must call `AddDataProtection()` itself.
+
+A guest presents its session as `Authorization: UserTaskSession ` against `/user-task-sessions/current` and `/user-task-sessions/current/complete`. The session identifies the task, so no task ID appears in the route and a guest can never address a task other than the one its invitation was issued for. Completion is intersected with the action allowlist pinned at issuance, and every session for a task is revoked as soon as that task closes.
+
+## Studio and custom applications
+
+Elsa Studio provides Workflows → User Tasks with Assigned to me, Available, History, and manager-only All and Needs Attention views. Studio is a reference workbench, not a required runtime dependency. Custom applications use the same REST APIs and server-computed capability projections. Realtime messages are invalidations only; clients always requery authorized data.
+
+See [the feature specification](../specs/013-user-tasks/spec.md), [REST contract](../specs/013-user-tasks/contracts/rest-api.md), and [quickstart](../specs/013-user-tasks/quickstart.md) for the complete design and examples.
diff --git a/specs/013-user-tasks/checklists/accessibility.md b/specs/013-user-tasks/checklists/accessibility.md
new file mode 100644
index 000000000..6ad4f80e0
--- /dev/null
+++ b/specs/013-user-tasks/checklists/accessibility.md
@@ -0,0 +1,10 @@
+# Accessibility Checklist
+
+- [x] A11Y001 Queue and detail actions are keyboard operable.
+- [x] A11Y002 Status, health, priority, and overdue state do not rely on color alone.
+- [x] A11Y003 Desktop split view has a route-equivalent narrow/mobile detail experience.
+- [x] A11Y004 Loading, empty, error, conflict, and asynchronous accepted states have announced text.
+- [x] A11Y005 Forms preserve provider labels, descriptions, validation messages, and focus management.
+- [x] A11Y006 Claim/release/complete/reassign controls expose names and disabled reasons.
+- [x] A11Y007 Realtime invalidations do not unexpectedly move focus or replace in-progress input.
+- [x] A11Y008 Guest verification reveals generic but actionable accessible feedback.
diff --git a/specs/013-user-tasks/checklists/requirements.md b/specs/013-user-tasks/checklists/requirements.md
new file mode 100644
index 000000000..bb98182b4
--- /dev/null
+++ b/specs/013-user-tasks/checklists/requirements.md
@@ -0,0 +1,12 @@
+# Requirements Quality Checklist
+
+- [x] CHK001 Product outcome and actors are explicit.
+- [x] CHK002 User stories are prioritized and independently testable.
+- [x] CHK003 Functional requirements use stable identifiers and testable MUST language.
+- [x] CHK004 Identity neutrality and host integration seams are explicit.
+- [x] CHK005 Lifecycle, race, idempotency, and reconciliation behavior are explicit.
+- [x] CHK006 Safe versus protected disclosure is explicit.
+- [x] CHK007 REST, persistence, Studio, invitation, forms, retention, and scale boundaries are covered.
+- [x] CHK008 V1 exclusions and existing RunTask compatibility are explicit.
+- [x] CHK009 No unresolved `[NEEDS CLARIFICATION]` markers remain after the product interview.
+- [x] CHK010 Success criteria are measurable and implementation-neutral.
diff --git a/specs/013-user-tasks/checklists/security.md b/specs/013-user-tasks/checklists/security.md
new file mode 100644
index 000000000..c8c0eca3a
--- /dev/null
+++ b/specs/013-user-tasks/checklists/security.md
@@ -0,0 +1,12 @@
+# Security Checklist
+
+- [x] SEC001 Authentication is host-owned and identity storage is decoupled.
+- [x] SEC002 Permission and task-relationship checks are both required.
+- [x] SEC003 Tenant scope is part of participant identity and every query boundary.
+- [x] SEC004 Candidate, released-user, terminal-history, and manager disclosure rules are specified.
+- [x] SEC005 Exclusions and manager override reason/audit behavior are specified.
+- [x] SEC006 Protected payloads are bounded, excluded from search/audit, and purged consistently.
+- [x] SEC007 Invitation secrets are hashed, delivery retry material is encrypted and transient, and anonymous errors are generic/rate-limited.
+- [x] SEC008 Guest sessions are task-scoped, revocable, capability-limited, and bounded.
+- [x] SEC009 Mutation concurrency, operation idempotency, and terminal races are specified.
+- [x] SEC010 List authorization prevents row and count leakage.
diff --git a/specs/013-user-tasks/contracts/forms-contract.md b/specs/013-user-tasks/contracts/forms-contract.md
new file mode 100644
index 000000000..0f77564ac
--- /dev/null
+++ b/specs/013-user-tasks/contracts/forms-contract.md
@@ -0,0 +1,12 @@
+# Forms Contract
+
+`FormReference` contains `provider`, `id`, and an optional version selector. The replaceable `IUserTaskFormProvider` resolves a reference during activation, returns a version-pinned render descriptor, and validates/normalizes completion data.
+
+- A selector such as `latest` is resolved once and stored as a concrete version on the task.
+- Resolution failure creates a blocking manager-only health issue; it never silently substitutes a different form.
+- Repair retries the original reference. V1 provides no live editing or repinning of an open task.
+- Workers receive only the provider-neutral render descriptor after assignment. Studio delegates rendering to a registered renderer and shows an unsupported-provider state otherwise.
+- Submitted data is bounded to 256 KiB by default, validated by the same provider and pinned version, normalized, then stored and supplied to the workflow result.
+- A task without a form accepts no arbitrary data; completion consists only of a configured action.
+- Form data is protected, excluded from search and audit payloads, and retained/purged with the task.
+- V1 has no native form builder or draft protocol.
diff --git a/specs/013-user-tasks/contracts/identity-contract.md b/specs/013-user-tasks/contracts/identity-contract.md
new file mode 100644
index 000000000..ae60a3f34
--- /dev/null
+++ b/specs/013-user-tasks/contracts/identity-contract.md
@@ -0,0 +1,32 @@
+# Identity and Authorization Contract
+
+## Participant value
+
+`ParticipantReference` is an opaque value with required `tenantId`, `provider`, `type` (`User` or `Group`), and `id`; `displayName` is an optional non-authoritative snapshot. Equality uses the four required fields with host-configurable normalization. A configured default provider may expand a designer-entered bare ID. Core never verifies existence during task activation and never persists an Elsa Identity foreign key.
+
+## Host interfaces
+
+- `IUserTaskIdentityResolver`: maps the current authenticated principal to one or more exact participant references and tenant context.
+- `IUserTaskAccessPolicy`: evaluates an operation against module permission, task relationship, exclusions, management scope, and optional guest capabilities.
+- `IUserTaskParticipantDirectory`: searches display entries, resolves display snapshots, and optionally enumerates group membership for snapshot mode.
+
+The built-in identity resolver maps namespaced `ClaimsPrincipal` claims. All interfaces are replaceable. Directory failure affects display or task health; it does not make participant values invalid.
+
+## Assignment membership
+
+- `Live` (default): candidate group checks use current principal references/claims. An exact reference match remains authoritative even if the directory cannot resolve it.
+- `Snapshot`: groups are expanded at activation and stored as snapshot members. Failure to enumerate creates a blocking manager-only health issue.
+- Explicit user exclusions deny assignment and protected access. Manager override is disabled by default; when enabled it requires `manage:user-tasks` and a reason.
+- `Requester` is context only and grants no capability.
+
+## Operation permissions
+
+`read:user-tasks`, `claim:user-tasks`, `complete:user-tasks`, `assign:user-tasks`, `update:user-tasks`, `cancel:user-tasks`, `invite:user-tasks`, `manage:user-tasks`, and `lookup:user-task-participants` are independent permissions. Permission alone is insufficient: ordinary callers also need the corresponding task relationship. Managers are tenant-scoped. Guest sessions carry an allowlist of capabilities for one task.
+
+## Disclosure
+
+Safe summary: title, summary, reference, tags, task type, workflow context, status/health, assignee display, priority, due/created times, and caller capabilities. Protected detail: instructions, task data, pinned form, and completion data. Candidates receive summary before claim; assignees receive protected detail; release revokes it immediately. After termination, only the completer and managers retain protected detail. Prior assignees see safe summary and audit history.
+
+## Default-deny rules
+
+Cross-tenant references never match. Unknown relationship, missing tenant, malformed reference, failed policy integration, revoked guest session, and stale capability decisions deny access. List authorization must be applied in the query path so unauthorized rows and totals cannot leak.
diff --git a/specs/013-user-tasks/contracts/invitations-contract.md b/specs/013-user-tasks/contracts/invitations-contract.md
new file mode 100644
index 000000000..e52620ac8
--- /dev/null
+++ b/specs/013-user-tasks/contracts/invitations-contract.md
@@ -0,0 +1,17 @@
+# Guest Invitation Contract
+
+## Issuance and delivery
+
+Activity definitions and authorized managers may create multiple invitations. Each invitation has a challenge provider/configuration, allowed actions, and bounded expiry (default: earlier of seven days or `DueAt`). Core creates an unguessable one-time secret, stores only its hash, and gives raw material once to `IUserTaskInvitationDispatcher`. Retry uses a protected transient outbox encrypted through ASP.NET Core Data Protection; successful or expired delivery removes the entry.
+
+## Verification
+
+Anonymous endpoints disclose only generic invitation copy before verification, use rate limiting, and return indistinguishable failures for missing, expired, consumed, or invalid invitations. `IUserTaskInvitationVerifier` performs the configured challenge. Bearer-only verification is permitted only when explicitly enabled by the activity.
+
+The first successful verification atomically:
+
+1. claims the still-open task for a generated guest participant;
+2. consumes the winning invitation and revokes its siblings;
+3. issues a revocable, task-scoped session through `IUserTaskGuestSessionIssuer`.
+
+The guest session expires at task close or its own host-bounded TTL and grants only configured read/complete capabilities. Guests cannot release, reassign, invite, update, cancel, or manage. A manager recovers abandoned guest work by reassignment or reissue. No raw challenge response, invitation secret, or protected task data is written to audit events.
diff --git a/specs/013-user-tasks/contracts/persistence-contract.md b/specs/013-user-tasks/contracts/persistence-contract.md
new file mode 100644
index 000000000..9e1b99f6e
--- /dev/null
+++ b/specs/013-user-tasks/contracts/persistence-contract.md
@@ -0,0 +1,266 @@
+# User Tasks Persistence Contract
+
+**Feature**: `013-user-tasks`
+**Status**: Approved for implementation
+**Persistence precedent**: `Elsa.Secrets` module and its EF Core provider packages
+
+This contract defines the storage boundary and provider-parity requirements. It describes logical storage units rather than prescribing one physical database design, but every provider must preserve the same behavior and invariants.
+
+## Package and registration boundary
+
+The module is split as follows:
+
+```text
+Elsa.UserTasks
+├── contracts, models, activity, manager, in-memory repository
+├── claims resolver, access policy seam, projection/reconciliation
+├── endpoints, permissions, notifications, invitation orchestration
+└── no EF Core or Elsa.Identity dependency
+
+Elsa.UserTasks.Persistence.EFCore
+├── UserTasksElsaDbContext
+├── entity configurations and repository
+└── EFCoreUserTasksPersistenceFeature
+
+Elsa.UserTasks.Persistence.EFCore.Sqlite
+Elsa.UserTasks.Persistence.EFCore.SqlServer
+Elsa.UserTasks.Persistence.EFCore.PostgreSql
+Elsa.UserTasks.Persistence.EFCore.MySql
+Elsa.UserTasks.Persistence.EFCore.Oracle
+├── provider configuration and design-time factory
+├── provider-specific migration assembly
+└── provider shell feature
+
+Elsa.UserTasks.Persistence.VNext
+├── IPersistenceSchemaProvider descriptor
+└── document-store adapter with equivalent semantics
+```
+
+The Core feature registers an in-memory repository for development/tests. EF Core and VNext packages replace the repository through feature composition, following the `Elsa.Secrets` pattern. Providers must not add a dependency on `Elsa.Identity`.
+
+## Logical storage units
+
+All units are tenant-scoped. `TenantId` is either an explicit host tenant value or the configured default tenant; it is never taken from an untrusted arbitrary query string.
+
+### `UserTasks`
+
+One row/document per User Task instance.
+
+Required identity and workflow fields:
+
+- `Id`, `TenantId`.
+- `WorkflowDefinitionId`, `WorkflowInstanceId`, `ActivityInstanceId`, `BookmarkId`.
+- `MaterializationKey`, the normalized tenant/workflow-instance/activity-instance tuple.
+
+Safe query and presentation fields:
+
+- `Title`, `Summary`, `Reference`, `TaskType`, `Tags` (bounded safe JSON or normalized tag representation).
+- Requester provider/type/ID and optional display snapshot.
+- `Priority`, `DueAt`, `CreatedAt`, `UpdatedAt`, `AssignedAt`, `CompletedAt`.
+- `Status`, `IsOverdue` (computed or persisted consistently), and health summary.
+
+Assignment fields:
+
+- Assignee provider/type/ID and optional display snapshot.
+- `MembershipResolutionMode`.
+- Safe configuration flags such as exclusion-override enabled and timeout/cancellation enabled.
+
+Protected and operational fields:
+
+- `InstructionsJson`/`TaskDataJson`, encrypted or provider-protected bounded JSON.
+- Requested and pinned form reference metadata, protected where provider-private.
+- Terminal action key, protected normalized completion data, and completion actor reference.
+- `Revision`, an integer optimistic-concurrency token.
+- `CreatedFromBookmarkRevision` or equivalent workflow marker when needed for reconciliation.
+
+Protected fields are never part of search indexes, list projections, events, notifications, or authorization scopes.
+
+### `UserTaskCandidates`
+
+Materialized candidate relationships used for authorized list and claim queries:
+
+- `Id`, `TenantId`, `TaskId`.
+- Participant `Provider`, `Type`, and `ParticipantId`.
+- Optional display snapshot.
+- Source (`DirectUser`, `DirectGroup`, `SnapshotMember`, or `Invitation`) and source group reference where relevant.
+- Created/updated timestamps.
+
+The canonical uniqueness key is tenant, task, provider, participant type, participant ID, and source identity. Duplicate bookmark notifications must not duplicate candidate rows.
+
+For live groups, the group candidate is retained and evaluated against current actor claims. For snapshot groups, the expanded user rows are retained with the original group reference for audit. Exclusions are stored separately or with an unambiguous relationship marker and are checked before candidate eligibility.
+
+### `UserTaskSnapshotMembers` and `UserTaskExclusions`
+
+These optional normalized units make snapshot membership and exclusion checks queryable without deserializing protected task data:
+
+- Tenant/task identifiers.
+- Provider, participant type, participant ID, and optional source group.
+- Creation timestamp and safe source metadata.
+
+An implementation may combine these with `UserTaskCandidates` when it preserves the same uniqueness and authorization semantics.
+
+### `UserTaskEvents`
+
+Append-only audit timeline:
+
+- `Id`, `TenantId`, `TaskId`, and monotonically increasing task `Revision`.
+- `EventType`, `OccurredAt`, operation ID, actor provider/type/ID.
+- Safe reason and bounded safe metadata JSON. V1 has no generic completion comment.
+
+Events never contain instructions, task data, forms, completion data, invitation secrets, guest session tokens, or provider-private payloads. Event writes occur in the same transaction as the state transition.
+
+### `UserTaskOperations`
+
+Idempotency and asynchronous transition state:
+
+- `Id`, `TenantId`, `TaskId`, and client `OperationId`.
+- Operation kind (`Claim`, `Release`, `Assign`, `ScheduleUpdate`, `Complete`, `Timeout`, `Cancel`, `RetryResolution`, or invitation verification).
+- Expected revision, canonical request hash, state, attempts, and created/updated/completed timestamps.
+- Safe outcome/status metadata and a protected completion payload when the operation is a completion request.
+
+Unique key: `(TenantId, TaskId, OperationId)`. A repeated operation with the same request hash returns the existing state. A different request hash is a conflict.
+
+### `UserTaskInvitations`
+
+One-time guest invitation state:
+
+- `Id`, `TenantId`, `TaskId`, and optional sibling/replacement group ID.
+- Recipient reference or opaque destination metadata, never an Elsa.Identity foreign key.
+- Cryptographically strong token hash and challenge/verifier provider name/configuration.
+- `Status` (`Pending`, `Dispatched`, `Verified`, `Consumed`, `Revoked`, or `Expired`).
+- `ExpiresAt`, `IssuedAt`, `VerifiedAt`, `ConsumedAt`, and `RevokedAt`.
+
+Only the token hash is retained in the aggregate. A raw token must not be recoverable from ordinary reads or logs.
+
+### `UserTaskInvitationDeliveries`
+
+Encrypted transient delivery outbox:
+
+- `Id`, `TenantId`, `TaskId`, `InvitationId`, and dispatcher/provider name.
+- Encrypted token payload, delivery metadata, attempt count, state, `AvailableAt`, expiry, and last error code.
+- Idempotency key and timestamps.
+
+The encrypted payload is decrypted only for a dispatch attempt and returned once to the dispatcher boundary. Delivery failures are represented by safe error codes. Cleanup is independent of terminal task retention and must respect in-flight retries.
+
+### `UserTaskGuestSessions`
+
+Task-scoped guest capability:
+
+- `Id`, `TenantId`, `TaskId`, `InvitationId`.
+- Hashed session token, guest participant reference, granted capability set, issued/expiry timestamps, and revocation timestamp.
+
+The raw session token is returned only at issuance. The hash is unique and all queries are task- and tenant-scoped. A guest session cannot release, reassign, or access another task.
+
+## Required indexes and constraints
+
+Names may vary by provider, but the following logical constraints are mandatory:
+
+- Primary key for every unit on its opaque `Id`.
+- Unique `(TenantId, MaterializationKey)` on `UserTasks`.
+- Unique `(TenantId, BookmarkId)` on `UserTasks`.
+- Indexes for tenant/status; tenant/assignee provider/type/ID; tenant/priority; tenant/due time; workflow definition; workflow instance; activity instance; created/completed time; and revision/health where used by reconciliation.
+- Candidate lookup index on tenant/provider/type/participant ID/task status.
+- Unique event ordering `(TaskId, Revision)` or an equivalent monotonic event sequence.
+- Unique operation key `(TenantId, TaskId, OperationId)` and an index for stale pending operations.
+- Unique invitation token hash and indexes for task/status/expiry.
+- Unique guest session token hash and indexes for task/expiry/revocation.
+
+Safe search may use normalized columns or a bounded safe search projection. It must cover title, summary, reference, tags, task type, workflow/correlation fields, and safe requester fields without inspecting protected JSON. Cursor pagination uses a stable `(sortValue, Id)` key; counts are optional.
+
+## Repository contracts and transaction behavior
+
+```csharp
+public interface IUserTaskRepository
+{
+ Task GetAsync(string tenantId, string taskId, CancellationToken cancellationToken = default);
+ Task QueryAsync(UserTaskQuery query, CancellationToken cancellationToken = default);
+ Task FindByMaterializationKeyAsync(string tenantId, string key, CancellationToken cancellationToken = default);
+ Task FindByBookmarkIdAsync(string tenantId, string bookmarkId, CancellationToken cancellationToken = default);
+ Task SaveAsync(UserTask task, int expectedRevision, CancellationToken cancellationToken = default);
+ Task AddProjectionAsync(UserTaskProjection projection, CancellationToken cancellationToken = default);
+}
+```
+
+The concrete repository may expose child-unit operations through a unit-of-work abstraction. It must support:
+
+1. Authorized, store-translatable list scopes that do not load protected payloads.
+2. Atomic compare-and-swap by task ID and expected revision.
+3. Atomic candidate/snapshot/exclusion updates.
+4. Atomic append of the lifecycle event and operation record with the state transition.
+5. Atomic insertion of a workflow-resumption outbox marker for asynchronous completion, timeout, and cancellation.
+6. At-least-once delivery with idempotent operation and bookmark keys.
+
+If a database transaction is unavailable, the provider must provide equivalent compare-and-swap and durable ordering guarantees and document the recovery behavior. A mutation must never report success while dropping its event, operation, or required outbox marker.
+
+## Projection and reconciliation storage behavior
+
+The workflow runtime is the source of truth for bookmark existence and workflow resumption. User Tasks is a durable projection with recovery responsibilities.
+
+- `WorkflowBookmarksPersisted` projects committed materializations after the workflow transaction commits.
+- Projection is idempotent by `(TenantId, MaterializationKey)` and `BookmarkId`.
+- A missing projection is recreated from the committed bookmark payload in bounded pages.
+- A stale `Completing`, `TimingOut`, or `Cancelling` operation is requeued or finalized from its durable operation marker.
+- A task whose bookmark no longer exists is finalized as `Completed` only when a matching pending operation marker proves the intended resumption; otherwise it is finalized as `Cancelled`.
+- Ambiguous, cross-tenant, or malformed records are retained for manager diagnostics and reported as health issues.
+- Reconciliation is safe to run on multiple nodes. A distributed lock or compare-and-swap lease prevents duplicate work, while duplicate delivery remains harmless.
+
+## EF Core provider contract
+
+`Elsa.UserTasks.Persistence.EFCore` provides a dedicated `UserTasksElsaDbContext : ElsaDbContextBase`, entity configurations, repository, and `EFCoreUserTasksPersistenceFeature` depending on `UserTasksFeature`. Configuration must:
+
+- Use the Elsa schema abstraction (`IElsaDbContextSchema`) and provider-appropriate migration assembly.
+- Configure bounded string lengths, UTC `DateTimeOffset` values, string enum storage, JSON/protected payload columns, and the required keys/indexes.
+- Mark `Revision` as an optimistic concurrency token. An update with zero rows affected is a revision conflict, not a successful no-op.
+- Keep protected payload properties out of safe projections and indexes.
+- Use one transaction for state, candidates, events, operations, and outbox markers whenever the provider supports it.
+
+Provider packages must provide:
+
+- `Elsa.UserTasks.Persistence.EFCore.Sqlite` with SQLite configuration, design-time context factory, migrations, and shell feature.
+- `Elsa.UserTasks.Persistence.EFCore.SqlServer` with SQL Server configuration, design-time context factory, migrations, and shell feature.
+- `Elsa.UserTasks.Persistence.EFCore.PostgreSql` with PostgreSQL configuration, design-time context factory, migrations, and shell feature.
+- `Elsa.UserTasks.Persistence.EFCore.MySql` with MySQL configuration, design-time context factory, migrations, and shell feature.
+- `Elsa.UserTasks.Persistence.EFCore.Oracle` with Oracle configuration, design-time context factory, migrations, and shell feature.
+
+The provider differences are dialect and column-type details only. All providers must expose the same lifecycle transitions, revision conflicts, idempotency behavior, visibility scope, retention behavior, and projection/reconciliation semantics. SQLite stores UTC timestamps in its provider-compatible ISO-8601 representation; other providers use their native UTC-capable representation. JSON may use provider-native JSON types or text, but round-trip semantics and payload limits are identical.
+
+Each provider migration must create its complete User Tasks schema, including child units, constraints, indexes, and any required schema marker. Migration tests must apply from an empty database and verify restart durability and indexed query behavior.
+
+## VNext provider parity
+
+`Elsa.UserTasks.Persistence.VNext` registers an `IPersistenceSchemaProvider` describing the same logical storage units, fields, indexes, JSON payload limits, and uniqueness constraints under the `Elsa.UserTasks` schema namespace. Its document-store adapter uses compare-and-swap document versions for `Revision` and supports equivalent indexed queries for safe fields.
+
+The VNext adapter must preserve:
+
+- tenant/materialization/bookmark uniqueness;
+- candidate, exclusion, and snapshot membership semantics;
+- append-only events;
+- operation idempotency and stale-operation scans;
+- encrypted invitation delivery outbox and hashed invitation/session tokens;
+- terminal-only retention purge; and
+- the same protected-data and authorization boundaries.
+
+No provider may make Elsa.Identity a prerequisite or silently weaken tenant isolation.
+
+## Retention and cleanup
+
+- Terminal task and event retention is indefinite by default.
+- An opt-in purge job deletes only terminal tasks and their associated terminal events after the configured age.
+- Open tasks (`Unassigned`, `Available`, `Assigned`, and transitional states) are never purged.
+- Expired/revoked invitations, guest sessions, and delivered invitation outbox entries may be purged under separate bounded policies.
+- Purge is tenant-scoped, paged, observable, and safe to retry. It must not remove a task with a pending operation, unresolved health issue requiring recovery, or open workflow bookmark.
+- Purge never writes raw payloads to logs or audit records.
+
+## Verification obligations
+
+The provider test suite must cover:
+
+- empty-database migration and restart/reload round trips;
+- indexed tenant/status/assignment/due/workflow/cursor queries without protected payload loading;
+- unique materialization and bookmark projection under duplicate delivery;
+- concurrent claim, completion, timeout, cancellation, and revision conflicts;
+- repeated and divergent operation IDs;
+- event ordering and append-only behavior;
+- invitation token hash, sibling revocation, delivery retry, guest-session expiry, and no raw-token persistence;
+- reconciliation of missing projections, stale operations, and orphaned bookmarks; and
+- terminal-only retention cleanup.
diff --git a/specs/013-user-tasks/contracts/rest-api.md b/specs/013-user-tasks/contracts/rest-api.md
new file mode 100644
index 000000000..91d2cf81a
--- /dev/null
+++ b/specs/013-user-tasks/contracts/rest-api.md
@@ -0,0 +1,77 @@
+# REST API Contract
+
+Base path: `/user-tasks`. Authenticated endpoints use Elsa endpoint permission metadata plus `IUserTaskAccessPolicy`. JSON uses camel case. IDs and cursors are opaque. Enum-valued fields (`status`, `healthSeverity`) are emitted as strings so a client never depends on ordinal values.
+
+## Capabilities
+
+`GET /user-tasks/capabilities` returns the tenant- and actor-scoped feature descriptor:
+
+```json
+{
+ "enabled": true, "canList": true, "canRead": true, "canReadAll": false,
+ "canClaim": true, "canComplete": true, "canRelease": true, "canAssign": false,
+ "canUpdate": false, "canCancel": false, "canCreateGuestLinks": false,
+ "canViewProtected": true, "participantPicker": false,
+ "realtime": true, "pollingIntervalSeconds": 30
+}
+```
+
+The descriptor is advisory: it decides what a client renders, never what the server allows. It is gated on `read:user-tasks`, so an actor without read access receives `403` and clients treat that as "hide the feature".
+
+`GET /user-tasks/{id}/capabilities` returns the per-task projection: `taskId`, `revision`, `allowedActions`, `canReadProtected`, and `canManage`.
+
+## Query
+
+`GET /user-tasks?scope=assigned|available|history|all|needsAttention&cursor=&limit=&sort=&direction=&status=&priorityFrom=&priorityTo=&due=&from=&to=&workflowDefinitionId=&workflowInstanceId=&reference=&taskType=&search=&includeTotalCount=`
+
+Returns `{ items, nextCursor, totalCount? }`. Default/max limit: 50/200. Stable sorts: created, due, priority, title, updated, each with an ID tiebreaker.
+
+- `scope` is part of the authorization predicate, not a display filter. `all` and `needsAttention` require manager scope and answer `403` — not an empty page — for anyone else.
+- `status` is repeatable. Unknown values are dropped rather than rejected, so a stale bookmark still loads.
+- `due` is a derived filter (`overdue`, `today`, `thisWeek`, `noDueDate`); `from`/`to` carry an explicit range.
+
+Items contain only the safe summary and the caller's capabilities: id, title, summary, reference, tags, task type, status, priority, assignee display, a count-only `candidateSummary`, due/overdue, created/updated/assigned/completed times, workflow definition name and version, a safe workflow instance reference, health (managers only), `allowedActions`, and `revision`.
+
+`GET /user-tasks/{id}` returns the flat summary plus protected fields and a `disclosure` block when authorized. `GET /user-tasks/{id}/events?cursor=&limit=` returns safe append-only audit entries (`id`, `kind`, `summary`, `occurredAt`, `actorDisplayName`); it returns an empty page for callers without protected access rather than revealing who acted.
+
+`POST /user-tasks/{id}/reveal` with `{ fieldKey }` discloses one masked form field. The field must be marked `masked` and `canReveal` by its form provider, the caller must hold protected access, and the reveal is written to the audit trail. Masked values are never included in the ordinary detail response.
+
+`GET /user-task-participants?search=&type=&cursor=&limit=` requires `lookup:user-task-participants`; absence of a directory returns an empty page, never an identity-module error.
+
+## Commands
+
+Every command accepts an `operationId`. Clients mint one per user submission and reuse it across retries, so a retry is recognised as the same command instead of accepted as a second one.
+
+- `POST /user-tasks/{id}/claim`: `{ expectedRevision, operationId? }` → `200` `{ operationId, status, revision, task }`.
+- `POST /user-tasks/{id}/release`: `{ expectedRevision, operationId?, reason? }` → `200`.
+- `POST /user-tasks/{id}/assign`: `{ expectedRevision, assignee, operationId?, reason? }` → `200`; managers may assign a non-candidate and it is audited. The assignee's tenant is taken from the caller's own scope and never from the body, so a cross-tenant reference cannot be constructed over the wire.
+- `PATCH /user-tasks/{id}`: `{ expectedRevision, priority?, dueAt?, operationId? }` → `200`; no other materialized fields are mutable.
+- `POST /user-tasks/{id}/complete`: `{ expectedRevision, operationId, actionKey, data? }` → `202`.
+- `POST /user-tasks/{id}/cancel`: `{ expectedRevision, operationId, reason }` → `202` only when enabled.
+- `POST /user-tasks/{id}/retry-resolution`: `{ expectedRevision, operationId? }` → `202`; retries the original form or snapshot input.
+- `POST /user-tasks/{id}/invitations`: invitation definition → `201` metadata; the secret is delivered through the dispatcher, never returned to API clients.
+- `GET /user-tasks/{id}/invitations` → `{ items }` and `DELETE /user-tasks/{id}/invitations/{invitationId}` → `204` require the invite relationship.
+
+## Guest API
+
+- `GET /user-task-invitations/{token}` → a generic challenge descriptor `{ challengeType, prompt, requiresCode }`.
+- `POST /user-task-invitations/{token}/verify` → a generic failure or `{ sessionCredential, taskId, expiresAt }`.
+- `GET /user-task-sessions/current` → the guest-visible task projection.
+- `POST /user-task-sessions/current/complete` → `202`, with the same operation and idempotency semantics as the authenticated command.
+
+The session credential is presented as `Authorization: UserTaskSession `.
+
+**Documented adjustment.** An earlier draft had guests read and complete through the ordinary `/user-tasks/{id}` resource. The shipped contract addresses the guest surface through the session instead, for two reasons. First, Elsa's endpoint security applies permission metadata at the transport layer through `ConfigurePermissions`; mixing an anonymous session scheme into those routes would have required weakening the gate on the two most sensitive endpoints. Second, the session already identifies exactly one task, so keeping the task ID out of the route removes a task-existence oracle instead of relying on `404` concealment. The guest's authorization semantics are unchanged: `IUserTaskAccessPolicy` still scopes the actor to its own task and intersects completion with the invitation's action allowlist.
+
+## Errors and idempotency
+
+Failures return `{ code, message }` with a stable code and display-safe copy. Messages never carry exception text, payload fragments, or infrastructure detail.
+
+- `401`: no valid authenticated or guest principal.
+- `403`: the module permission itself is missing, including a list scope the actor may not use. This is decided at the transport layer before any task is loaded, so it discloses nothing about a specific task.
+- `404`: task absent, or present but denied by the relationship check. Both answer with the same status and the same copy, so an ID-guessing caller cannot use a command to prove that a task exists.
+- `409`: revision race (`revision-conflict`), invalid lifecycle transition (`terminal`, `transition-in-progress`, `not-claimable`), or an operation ID reused with a different canonical payload (`idempotency-conflict`).
+- `422`: invalid action, form validation, payload size, cancellation configuration, or other semantic input.
+- `429`: anonymous invitation traffic throttled, partitioned by caller rather than by token.
+
+Repeated terminal commands with the same task, operation ID, and canonical payload return the existing operation response. Accepted terminal operations always return `202`; clients observe the final state by requery or invalidation.
diff --git a/specs/013-user-tasks/contracts/runtime-contract.md b/specs/013-user-tasks/contracts/runtime-contract.md
new file mode 100644
index 000000000..29e8504ab
--- /dev/null
+++ b/specs/013-user-tasks/contracts/runtime-contract.md
@@ -0,0 +1,327 @@
+# User Tasks Runtime Contract
+
+**Feature**: `013-user-tasks`
+**Status**: Approved for implementation
+**Audience**: Elsa Core module and host integrations
+
+This contract defines the provider-neutral runtime seams. Names are normative unless explicitly marked as an implementation detail. All asynchronous methods accept cancellation and all identity values are external opaque references.
+
+## Runtime principles
+
+- User Tasks are workflow-bound. The activity suspends on a dedicated User Task bookmark and resumes only through `UserTaskStimulus`.
+- The existing generic `RunTask` activity and `/tasks/{id}/complete` endpoint are not changed.
+- Core owns task state, optimistic concurrency, operation idempotency, protected-data disclosure, projection, reconciliation, and audit events.
+- Hosts own authentication, participant identity, group membership, directory display data, policy, form implementations, invitation delivery, invitation verification, and guest session infrastructure.
+- Elsa.Identity is optional. No contract accepts an Elsa.Identity user or group entity.
+
+## Identity-neutral contracts
+
+### ParticipantReference
+
+```csharp
+public enum UserTaskParticipantType
+{
+ User,
+ Group
+}
+
+public sealed record ParticipantReference(
+ string TenantId,
+ string Provider,
+ UserTaskParticipantType Type,
+ string Id,
+ string? DisplayName = null);
+```
+
+`TenantId`, `Provider`, `Type`, and `Id` are required and form the canonical identity. `DisplayName` is a non-authoritative presentation snapshot. Implementations must normalize and compare the canonical fields consistently, but must not rewrite the external ID.
+
+### Principal mapping
+
+```csharp
+public sealed record UserTaskActor(
+ ParticipantReference Subject,
+ IReadOnlyCollection Groups,
+ string? DisplayName = null);
+
+public interface IUserTaskIdentityResolver
+{
+ ValueTask ResolveAsync(
+ ClaimsPrincipal principal,
+ CancellationToken cancellationToken = default);
+}
+```
+
+The default implementation is claims-based. Subject, provider/issuer, display-name, and group claim names are configurable. The default subject lookup prefers `NameIdentifier`, then `sub`; the provider falls back to the configured namespace when no issuer is present. Hosts may replace the resolver entirely.
+
+### Task authorization
+
+Authorization has two independent gates: the module permission and a task relationship/policy scope. The policy must be usable before protected task data is loaded so list queries cannot leak invisible tasks.
+
+```csharp
+public enum UserTaskAccessOperation
+{
+ ReadSummary,
+ ReadProtected,
+ Claim,
+ Release,
+ Assign,
+ UpdateScheduling,
+ Complete,
+ Cancel,
+ Manage,
+ IssueInvitation,
+ RetryResolution
+}
+
+public interface IUserTaskAccessPolicy
+{
+ Task CreateScopeAsync(
+ UserTaskActor actor,
+ UserTaskAccessOperation operation,
+ CancellationToken cancellationToken = default);
+
+ Task AuthorizeAsync(
+ UserTask task,
+ UserTaskActor actor,
+ UserTaskAccessOperation operation,
+ CancellationToken cancellationToken = default);
+}
+```
+
+`CreateScopeAsync` must produce a store-translatable tenant/relationship scope. `AuthorizeAsync` is the final check after a task has been loaded. Managers remain tenant-scoped. An inaccessible task is reported as not found at the API boundary.
+
+### Participant directory
+
+Directory lookup is optional and never authoritative for authorization.
+
+```csharp
+public interface IUserTaskParticipantDirectory
+{
+ Task SearchAsync(
+ UserTaskParticipantQuery query,
+ CancellationToken cancellationToken = default);
+
+ Task> ResolveDisplayNamesAsync(
+ IReadOnlyCollection participants,
+ CancellationToken cancellationToken = default);
+
+ Task> EnumerateGroupMembersAsync(
+ ParticipantReference group,
+ CancellationToken cancellationToken = default);
+}
+```
+
+If a directory is not registered, capability discovery reports it as unavailable and Studio falls back to raw namespaced references or expressions. Live group authorization still uses the actor's exact namespaced claims. Snapshot enumeration failure creates a durable manager-only health issue.
+
+## Form provider contract
+
+```csharp
+public sealed record UserTaskFormReference(
+ string ProviderName,
+ string Key,
+ string? Binding = null,
+ string? Version = null);
+
+public sealed record ResolvedUserTaskForm(
+ UserTaskFormReference Requested,
+ string PinnedVersion,
+ IReadOnlyDictionary Metadata);
+
+public interface IUserTaskFormProvider
+{
+ string Name { get; }
+
+ Task ResolveAsync(
+ UserTaskFormReference reference,
+ CancellationToken cancellationToken = default);
+
+ Task ValidateAndNormalizeAsync(
+ ResolvedUserTaskForm form,
+ string actionKey,
+ JsonElement data,
+ CancellationToken cancellationToken = default);
+}
+```
+
+The provider resolves and pins the form at task activation. Completion always validates against that pinned version. A missing provider or failed resolution blocks worker completion and is repairable only by retrying the original reference. Server-supplied HTML is not a Core contract and must not be rendered by Studio without a trusted installed renderer.
+
+Tasks without a form must reject arbitrary completion JSON. A form provider returns normalized data; Core stores it as protected completion data and exposes it only according to task visibility rules.
+
+## Task manager contract
+
+The public manager is the only lifecycle orchestration entry point. Repositories and projection stores are not exposed to workflow activities or API endpoints directly.
+
+```csharp
+public interface IUserTaskManager
+{
+ Task ProjectAsync(
+ UserTaskMaterialization materialization,
+ CancellationToken cancellationToken = default);
+
+ Task QueryAsync(
+ UserTaskQuery query,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+
+ Task GetAsync(
+ string tenantId,
+ string taskId,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+
+ Task ClaimAsync(
+ string tenantId,
+ string taskId,
+ UserTaskMutationRequest request,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+
+ Task ReleaseAsync(
+ string tenantId,
+ string taskId,
+ UserTaskMutationRequest request,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+
+ Task AssignAsync(
+ string tenantId,
+ string taskId,
+ UserTaskAssignRequest request,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+
+ Task UpdateSchedulingAsync(
+ string tenantId,
+ string taskId,
+ UserTaskSchedulingUpdate request,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+
+ Task CompleteAsync(
+ string tenantId,
+ string taskId,
+ UserTaskCompletionRequest request,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+
+ Task CancelAsync(
+ string tenantId,
+ string taskId,
+ UserTaskCancelRequest request,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+
+ Task RetryResolutionAsync(
+ string tenantId,
+ string taskId,
+ UserTaskMutationRequest request,
+ UserTaskActor actor,
+ CancellationToken cancellationToken = default);
+}
+```
+
+The concrete DTO names may follow repository conventions, but the following fields and semantics are required:
+
+- `UserTaskMutationRequest`: `ExpectedRevision`, and `OperationId` for retried/asynchronous operations.
+- `UserTaskAssignRequest`: target canonical participant, optional reason, `ExpectedRevision`, and `OperationId`.
+- `UserTaskSchedulingUpdate`: optional `Priority` and `DueAt`; no other task definition fields may be changed.
+- `UserTaskCompletionRequest`: `ExpectedRevision`, `OperationId`, configured `ActionKey`, and optional JSON `Data` only when a form is installed. V1 has no generic completion comment; explanation fields belong to the pinned form.
+- `UserTaskCancelRequest`: `ExpectedRevision`, `OperationId`, and mandatory safe `Reason`.
+
+Claim, release, assignment, and scheduling updates are synchronous state transitions. Completion and manager cancellation persist a transitional operation, enqueue workflow resumption, and return an accepted result while the task is `Completing` or `Cancelling`. Timeout uses the same operation path with `TimingOut` and reserved action `Timeout`.
+
+## Workflow bookmark and projection contracts
+
+The activity materializes its evaluated definition into a dedicated bookmark. The bookmark payload is safe to retry and contains no host-only identity object.
+
+```csharp
+public sealed record UserTaskMaterialization(
+ string TenantId,
+ string WorkflowDefinitionId,
+ string WorkflowInstanceId,
+ string ActivityInstanceId,
+ string BookmarkId,
+ UserTaskDefinitionSnapshot Definition,
+ IReadOnlyCollection SnapshotMembers,
+ IReadOnlyCollection SnapshotGroups,
+ DateTimeOffset CreatedAt);
+
+public sealed record UserTaskStimulus(
+ string TenantId,
+ string TaskId,
+ string OperationId,
+ string ActionKey,
+ JsonElement? CompletionData);
+```
+
+`UserTaskStimulus` is the only completion stimulus for this module. The activity binds the resulting `UserTaskResult` and selected action to its outputs and emits the configured workflow outcome.
+
+```csharp
+public interface IUserTaskProjectionService
+{
+ Task ProjectCommittedBookmarksAsync(
+ IReadOnlyCollection materializations,
+ CancellationToken cancellationToken = default);
+
+ Task FinalizeBookmarkRemovalAsync(
+ UserTaskBookmarkRemoval removal,
+ CancellationToken cancellationToken = default);
+}
+
+public interface IUserTaskReconciler
+{
+ Task ReconcileAsync(
+ UserTaskReconciliationRequest request,
+ CancellationToken cancellationToken = default);
+}
+```
+
+The `WorkflowBookmarksPersisted` path calls the projection service only after the workflow commit. Projection is idempotent by the materialization key and bookmark ID. Bookmark removal finalizes a pending matching completion as `Completed`; removal without a pending completion finalizes the task as `Cancelled` and never independently resumes the workflow.
+
+The bounded reconciler must:
+
+1. Recreate a missing task projection for every committed User Task bookmark.
+2. Requeue stale `Completing`, `TimingOut`, or `Cancelling` operations whose workflow stimulus was not delivered.
+3. Finalize task records whose bookmark was removed, subject to the matching operation marker.
+4. Report, but not silently delete, ambiguous or cross-tenant records.
+
+Task creation, operation state, lifecycle event, and transactional outbox marker must commit together where the provider supports a transaction. Delivery is at least once; consumers are idempotent by task and operation ID.
+
+## Invitation, delivery, and guest-session contracts
+
+```csharp
+public interface IUserTaskInvitationDispatcher
+{
+ Task DispatchAsync(
+ UserTaskInvitationDelivery delivery,
+ CancellationToken cancellationToken = default);
+}
+
+public interface IUserTaskInvitationVerifier
+{
+ Task VerifyAsync(
+ UserTaskInvitationChallenge challenge,
+ CancellationToken cancellationToken = default);
+}
+
+public interface IUserTaskGuestSessionIssuer
+{
+ Task IssueAsync(
+ UserTaskInvitation invitation,
+ CancellationToken cancellationToken = default);
+}
+```
+
+Invitation issuance stores only a hash of the redemption token in the task aggregate. The raw token is returned once to the delivery outbox/dispatcher boundary and is never included in logs, events, API responses, or ordinary persistence reads. The transient delivery outbox stores the encrypted token for retry and decrypts it only for a dispatch attempt. Delivery implementations must use the delivery ID as an idempotency key.
+
+Verification must use generic failure responses and rate limits. The first valid verification atomically claims the task for the guest, revokes all sibling invitations, and issues a task-scoped guest session with an explicit expiry. A guest session cannot release or reassign the task and cannot be used for another task.
+
+Invitation expiry defaults to the earlier of seven days or the task due time, when due time exists. Expired, consumed, revoked, and invalid invitations must be indistinguishable at the anonymous API boundary.
+
+## Notifications and audit
+
+Core publishes mediator notifications only after the lifecycle transaction commits. Notifications and realtime invalidations contain metadata such as tenant, task ID, status, revision, and changed safe fields; they never contain protected task/form/completion data, invitation tokens, or provider-private metadata.
+
+Minimum lifecycle notifications are `UserTaskCreated`, `UserTaskChanged`, `UserTaskCompletionAccepted`, `UserTaskCompleted`, `UserTaskTimedOut`, `UserTaskCancelled`, `UserTaskOverdue`, `UserTaskInvitationChanged`, and `UserTaskHealthChanged`.
+
+`UserTaskEvent` is the durable audit record. Hosts may subscribe to mediator notifications for email, webhooks, or escalations; notification delivery is not a required v1 Core feature.
diff --git a/specs/013-user-tasks/contracts/studio-contract.md b/specs/013-user-tasks/contracts/studio-contract.md
new file mode 100644
index 000000000..4ea58bf00
--- /dev/null
+++ b/specs/013-user-tasks/contracts/studio-contract.md
@@ -0,0 +1,254 @@
+# Studio Contract: User Tasks
+
+The Core/server User Tasks feature is paired with an optional `elsa-studio` module. Studio owns the authenticated task workspace, workflow-designer activity editing, and the guest completion page. The server remains authoritative for task visibility, participant identity, disclosure, capabilities, validation, claims, and completion.
+
+Studio must not reference `Elsa.Identity` user entities. Participant identifiers are opaque, tenant-scoped references supplied by the host application. A host may provide a participant picker, but the task module remains fully usable when no picker is installed.
+
+## Information Architecture
+
+The authenticated module contributes a **User Tasks** entry under **Workflows**:
+
+```text
+Workflows
+├── Definitions
+├── Instances
+└── User Tasks
+```
+
+Routes:
+
+- `/workflows/user-tasks` — task workspace and queue.
+- `/workflows/user-tasks/{taskId}` — authenticated task detail and response page.
+- `/tasks/guest?t={opaqueTaskToken}` — guest task page; it is not linked from the authenticated menu.
+
+The task list must not offer a generic **Create task** action. Runtime tasks are created by executing a published workflow containing the User Task activity. Designers create task definitions from the workflow designer.
+
+The menu is displayed only when the remote User Tasks feature is enabled and the current actor has list/read capability. The menu never grants authorization.
+
+## Task Workspace
+
+The default route opens the **Assigned to me** tab. Tabs are represented in the URL and preserve browser back/forward behavior:
+
+| Tab | Query value | Purpose | Required capability |
+| --- | --- | --- | --- |
+| Assigned to me | `tab=assigned` | Tasks assigned to the current actor, including claimed tasks | `read:user-tasks` |
+| Available | `tab=available` | Unassigned tasks for which the actor is an eligible candidate | `read:user-tasks` |
+| History | `tab=history` | Terminal tasks completed by the actor and safe history for tasks they acted on | `read:user-tasks` |
+| All | `tab=all` | Tenant-visible tasks for operations and support | `manage:user-tasks` |
+| Needs Attention | `tab=needs-attention` | Unassigned, blocked-health, overdue, and stale-operation tasks | `manage:user-tasks` |
+
+Tabs that are not allowed by the capability response are hidden. A deep link to a hidden tab displays the permitted default tab rather than an authorization error from the UI. The API remains authoritative.
+
+### Queue/list behavior
+
+The list is server-paged and server-filtered. It follows the existing Studio `MudTable.ServerData` pattern used by Secrets and Workflow Definitions.
+
+The table displays safe summary fields only:
+
+- task title and task type/key;
+- status and priority;
+- assignee or candidate summary, subject to disclosure policy;
+- due date and overdue indicator;
+- workflow definition name/version and a safe workflow instance reference;
+- created/updated timestamps;
+- an action menu derived from the row's `allowedActions`.
+
+The row action menu may contain **Open**, **Claim**, **Release**, **Assign**, **Complete**, **Cancel**, and **Copy link**, but only when both the server capability response and the row's `allowedActions` allow the action. A row click opens the detail route. The list never performs a client-only mutation or assumes that a visible button is authorized.
+
+The toolbar provides:
+
+- Search over the server-approved task title, task key/type, and workflow summary fields.
+- Status filter using the canonical lifecycle states; overdue is a derived filter.
+- Priority filter.
+- Due-date filter (`overdue`, `today`, `thisWeek`, `noDueDate`, or explicit range).
+- Workflow definition/instance filters when the actor has the corresponding workflow visibility.
+- A reset-filters action.
+
+Search and filters are debounced, cancellable, and applied before paging. Empty states distinguish **No tasks**, **No tasks match these filters**, and **Tasks are unavailable**. Errors preserve the current filters and offer retry.
+
+### URL state
+
+The list serializes only non-sensitive view state:
+
+```text
+/workflows/user-tasks?tab=assigned&status=Assigned&priorityFrom=75&due=overdue&search=approval&cursor=opaque&pageSize=25&sort=due&direction=asc
+```
+
+Supported query keys are `tab`, repeated `status`, `priorityFrom`, `priorityTo`, `due`, `from`, `to`, `search`, `workflowDefinitionId`, `workflowInstanceId`, `cursor`, `pageSize`, `sort`, and `direction`. Unknown or invalid values are ignored and replaced by safe defaults. Tenant, actor identity, form data, access tokens, task payloads, and protected fields must never appear in the URL.
+
+Changing a filter resets the page to the first page. Reloading or sharing a URL restores the same safe list state, subject to the current actor's capabilities. The server's canonical sort and page-size limits win over client values.
+
+## Task Detail
+
+The detail page is a responsive, single-task workspace. It loads a safe task projection and a server-provided capability/action projection; it does not load the raw workflow instance state.
+
+The desktop layout contains a task header, primary response surface, and contextual summary. On narrow screens it becomes a single column with a sticky bottom action bar. All actions remain keyboard accessible and have accessible names that include the task title where useful.
+
+Detail tabs are:
+
+1. **Task** — title, description, due/priority/status, participant summary, and the form or outcome controls.
+2. **Workflow** — safe definition and instance context, shown only when the response authorizes it.
+3. **History** — claims, assignments, releases, and completion audit entries, shown only when the response authorizes it.
+
+The Task tab is always the landing tab. Tabs that are not disclosed are omitted rather than rendered disabled. A task that has become completed, cancelled, expired, or stale is rendered read-only with its final status and outcome where disclosure permits.
+
+### Claim and completion
+
+- **Claim** is an atomic server operation. On success Studio refreshes the task projection and opens the response surface.
+- **Release** returns a claimed task to its eligible queue when allowed.
+- **Complete** validates the response both client-side and server-side. The server may require a current claim, an expected task revision, or a participant authorization check.
+- Stale task responses produce a conflict state with **Reload task** and a clear explanation; Studio must not overwrite another actor's claim or completion.
+- Completion success shows the outcome and workflow continuation state when safe, then returns to the originating list while preserving its URL filters.
+- Repeated completion of the same task is treated as an idempotent success only when the submitted response matches the already recorded completion; otherwise Studio displays the server conflict.
+
+## Protected Disclosure
+
+User Tasks can contain business data and workflow-derived values. The Studio task module must treat all task projections and form responses as protected data.
+
+- Render only fields explicitly returned by the server's disclosure projection.
+- Never expose bookmark IDs/hashes, workflow input dictionaries, variables, activity execution state, bearer/SAS tokens, internal storage payloads, or provider credentials.
+- Do not put form data, participant claims, or protected description text in URLs, browser titles, telemetry, exception messages, clipboard content, or client-side logs.
+- Sensitive form fields are masked by default and are not copied into diagnostics or analytics. A server-provided `canReveal`/`disclosure` decision is required before any reveal control is rendered.
+- Workflow and history tabs use safe summaries and server-rendered audit values only; Studio must not reconstruct them from generic workflow APIs.
+- If the server marks a task or field as `guestVisible: false`, it is absent from the guest page even if it is visible to an authenticated operator.
+
+## Guest Task Page
+
+The guest page is a narrow completion surface for a signed, expiring, single-purpose task token. It is not a task inbox and must not require or create an Elsa Identity account.
+
+The token is supplied as an opaque query value (`t`). Studio passes it to the guest-task API without decoding, persisting, logging, or displaying it. The server resolves tenant, task, actor constraints, expiry, disclosure, and allowed operations.
+
+Guest behavior:
+
+- Show only the task title, explicitly guest-visible description/form fields, due/status information, and server-approved outcomes.
+- Do not show workflow definition/instance identifiers, participant IDs, claims, internal links, task history, or protected fields.
+- Do not provide list navigation, menu navigation, claim/reassign/cancel actions, or arbitrary workflow links.
+- Require explicit submit confirmation when completion is irreversible.
+- On success, show a confirmation/status page and invalidate or consume the token according to the server response.
+- On expired, revoked, already completed, or invalid token, show a generic safe error with no task existence oracle.
+- Do not silently retry a state-changing request. Retry is allowed only for an idempotent read.
+
+## Capabilities and Action Projection
+
+Studio obtains a User Tasks capability descriptor before displaying navigation or choosing controls. The descriptor is server-generated for the current actor and tenant and may include:
+
+```json
+{
+ "enabled": true,
+ "canList": true,
+ "canRead": true,
+ "canReadAll": false,
+ "canClaim": true,
+ "canComplete": true,
+ "canRelease": true,
+ "canAssign": false,
+ "canCancel": false,
+ "canCreateGuestLinks": false,
+ "canViewProtected": false,
+ "participantPicker": false,
+ "realtime": true,
+ "pollingIntervalSeconds": 30
+}
+```
+
+The exact capability transport may be part of the User Tasks REST capability endpoint, but the Studio client must not infer permissions from the presence of an endpoint or an Elsa Identity role. Each task row/detail response also supplies `allowedActions`, `disclosure`, and `revision` so that per-task authorization and concurrency are explicit.
+
+When capabilities are unavailable, Studio fails closed for mutations and hides the User Tasks menu unless the remote feature's safe default explicitly permits read-only discovery. A `403` from any API remains an authorization result, not a client error to suppress.
+
+## Realtime Invalidation and Polling
+
+The module may subscribe to a User Tasks SignalR hub when the capability descriptor advertises `realtime`. The hub sends tenant- and actor-authorized invalidation envelopes, not task data:
+
+```json
+{
+ "kind": "task.updated",
+ "taskId": "task-123",
+ "revision": 7,
+ "occurredAt": "2026-01-01T12:00:00Z"
+}
+```
+
+Supported invalidation kinds are `task.created`, `task.updated`, `task.claimed`, `task.released`, `task.assigned`, `task.completed`, `task.cancelled`, and `task.expired`. The server enforces tenant and actor visibility before publishing an envelope. The envelope must not contain title, description, participant IDs, form values, workflow input, or protected audit data.
+
+Studio behavior:
+
+- Debounce bursts of invalidations into one list reload.
+- Reload the visible list when an invalidation can affect its filters; preserve the selected page where possible and reset only when the server indicates that the current page is no longer valid.
+- Reload the open detail when its `taskId` is invalidated. Do not apply partial event data to local state.
+- If SignalR is unavailable or disconnected, fall back to visibility-aware polling at the server-advertised interval (30 seconds by default), stopping while the document is hidden and when the component is disposed.
+- Reconnect with bounded backoff, then perform a full list/detail reload after reconnect to close gaps.
+- Guest pages do not subscribe to a task inbox or realtime stream.
+
+## Workflow Designer Activity
+
+The User Task activity is contributed to the activity catalog under a human-task category and uses the normal activity descriptor/input/output editor. The activity is blocking: execution creates a task and suspends until an authorized completion resumes it.
+
+Required designer inputs:
+
+| Field | Behavior |
+| --- | --- |
+| Title | Required, expression-capable string; safe display text for the task list/detail. |
+| Summary and instructions | Optional expression-capable safe summary and separately protected instructions. |
+| Reference, tags, and task type | Optional safe values used for filtering, reporting, and host form/participant policies. |
+| Requester | Optional informational participant reference that grants no access. |
+| Assignee | Optional expression-capable opaque participant reference. It is not an Elsa Identity user ID. |
+| Candidate users and groups | Optional collections of opaque participant references using the canonical user/group kinds. |
+| Membership and exclusions | Live or snapshot membership, excluded users, and optional reason-required manager override. |
+| Due date | Optional expression-capable UTC timestamp; Studio displays the configured timezone explicitly. |
+| Priority | Numeric value from 0 through 100 with default 50. |
+| Form/actions | Optional provider-neutral form reference and literal immutable action keys with expression-capable labels. |
+| Timeout/cancellation | Explicit enablement for the reserved `Timeout` and `Cancelled` outcomes. |
+| Invitations | Optional guest definitions including challenge provider, bounded expiry, allowed actions, and explicit bearer-only opt-in. |
+
+Outputs:
+
+- `TaskId` — the durable task identifier.
+- `Outcome` — the selected completion outcome.
+- `Response` or `FormData` — the validated completion payload according to the activity contract.
+- `CompletedBy` and `CompletedAt` — safe completion metadata when configured by the activity.
+
+All inputs remain expression-capable unless the activity descriptor marks a field as non-expression metadata. The generic Studio editor must preserve expressions and bindings when a participant picker or form editor is not installed. The editor must not fetch or persist resolved participant names as workflow definition values.
+
+The activity editor should show a clear note that a task is created only when the workflow runs, and that changing the definition does not mutate already-created tasks.
+
+## Optional Participant Picker
+
+The User Tasks Studio module may consume a host-provided participant picker. The picker is an optional contribution, not a dependency on Elsa Identity.
+
+Suggested contribution shape:
+
+```csharp
+public interface IUserTaskParticipantPicker
+{
+ ValueTask PickAsync(
+ ParticipantPickerContext context,
+ CancellationToken cancellationToken = default);
+}
+```
+
+The context includes the current opaque values, allowed participant kinds, task key, tenant scope, and whether multiple selection is allowed. Results contain opaque `kind`/`id` references and optional display labels. Labels are presentation-only; the workflow definition persists the references. If no picker is registered, Studio renders a safe text/reference editor and preserves unknown participant kinds.
+
+The picker must obey the server's participant lookup authorization, avoid returning hidden users/groups, and never be used to authorize claim or completion actions.
+
+## Client Contracts and Verification
+
+The paired Studio module should provide a Refit client whose DTOs mirror the User Tasks REST contract, plus:
+
+- menu/feature registration following the existing Secrets module pattern;
+- list/detail/guest routes above;
+- server-paged list loading with cancellation and URL-state restoration;
+- task-form validation and conflict handling;
+- capability/action/disclosure rendering;
+- optional participant-picker registration;
+- SignalR invalidation subscription with polling fallback.
+
+Studio verification must cover:
+
+- menu gating and hidden tabs for missing capabilities;
+- every URL filter, invalid-value normalization, page reset, and browser navigation;
+- safe row/detail rendering and absence of protected data in URLs/logs/telemetry;
+- claim, release, complete, conflict, already-completed, and server-error states;
+- responsive detail and guest-page behavior;
+- fallback text participant editing with no picker;
+- SignalR debounce/reconnect, polling start/stop, and post-reconnect reload;
+- preservation of expressions/bindings and disclosure defaults in the designer.
diff --git a/specs/013-user-tasks/data-model.md b/specs/013-user-tasks/data-model.md
new file mode 100644
index 000000000..d13c83706
--- /dev/null
+++ b/specs/013-user-tasks/data-model.md
@@ -0,0 +1,180 @@
+# User Tasks Data Model
+
+**Feature**: `013-user-tasks`
+**Status**: Approved for implementation
+**Source of truth**: [`spec.md`](./spec.md)
+
+This document fixes the vocabulary, aggregate boundaries, lifecycle invariants, and persistence-safe representation for User Tasks. A User Task is always created by a workflow activity; v1 does not support standalone tasks.
+
+## Domain vocabulary
+
+| Term | Meaning |
+| --- | --- |
+| User Task Definition | Configuration stored in a workflow definition. It is evaluated when the activity executes. |
+| User Task Instance | Durable runtime work item created from a committed User Task bookmark. |
+| Participant Reference | An identity-neutral `{ tenant, provider, type, id }` value. `type` is `user` or `group` for authenticated participants. |
+| Candidate | A participant eligible to claim an available task. |
+| Assignee | The single participant currently accountable for the task. The assignee is normally a user; an invitation may establish a task-scoped guest assignee. |
+| Requester | Optional informational participant. Requester status never grants task access. |
+| Action | A stable workflow outcome key and its materialized display label. |
+| Form Reference | A provider-neutral reference to a form definition. The concrete version is pinned when the task activates. |
+| Task Health | Operational resolution or delivery state independent of lifecycle status. |
+| Operation | An idempotent command record used for asynchronous completion, timeout, cancellation, or another retried mutation. |
+| Invitation | A single-task guest candidacy secured by a one-time token and a pluggable verification challenge. |
+| Guest Session | A bounded, revocable, task-scoped capability issued after invitation verification. |
+| Invitation Delivery | An encrypted, transient outbox entry used to deliver a one-time invitation secret. |
+
+## User Task instance
+
+The instance is the durable projection of one committed bookmark. It has one workflow owner and one terminal result.
+
+### Identity and workflow linkage
+
+- `Id` is a stable opaque task identifier.
+- `TenantId` is required for every task and every child record. A host may use a single default tenant, but the storage contract remains tenant-scoped.
+- `WorkflowDefinitionId`, `WorkflowInstanceId`, and `ActivityInstanceId` identify the workflow execution that owns the task.
+- `BookmarkId` identifies the dedicated User Task bookmark.
+- `MaterializationKey` is the normalized tuple `(TenantId, WorkflowInstanceId, ActivityInstanceId)`. It is unique and prevents retries or duplicate bookmark notifications from creating two task instances.
+- The existing generic `RunTask` activity and `/tasks/{id}/complete` contract are unrelated and remain unchanged.
+
+### Safe task fields
+
+These fields may be returned to a candidate before claim and may be used for authorized search:
+
+- `Title` (required), `Summary`, `Reference`, `Tags`, and `TaskType`.
+- Materialized requester reference and workflow labels/identifiers.
+- `Priority`, an integer from 0 through 100; the default is 50.
+- `DueAt` in UTC and computed `IsOverdue`.
+- `Status`, `CreatedAt`, `AssignedAt`, `CompletedAt`, and `UpdatedAt`.
+- Materialized assignee display information when the caller is authorized to see it.
+
+Protected fields are never searched or returned to an unassigned candidate:
+
+- `Instructions`.
+- `TaskData`.
+- The pinned form reference and provider-private form metadata.
+- Completion data and other provider-private payloads.
+
+The default maximum serialized size for each protected task/form/completion payload is 256 KiB. External files are represented by a provider URI or ID; they are not embedded in task JSON.
+
+### Assignment fields
+
+- A direct `Assignee` may be materialized at activation.
+- `CandidateUsers` and `CandidateGroups` are stored as namespaced participant references.
+- `MembershipResolutionMode` is `Live` or `Snapshot`; `Live` is the default.
+- `ExcludedUsers` are canonical participant references and are hard exclusions by default.
+- `AllowManagerExclusionOverride` is materialized from the activity. If true, a manager may bypass an exclusion only with a mandatory audit reason.
+- Invitations are separate child records and do not turn an external recipient into a global Elsa user.
+
+Display names are optional snapshots used only for presentation. Authorization and uniqueness always use the provider namespace, participant type, and external ID.
+
+## Participant references and membership
+
+```text
+ParticipantReference
+├── TenantId required, storage scope
+├── Provider required namespace/issuer
+├── Type user | group
+├── Id required external identifier
+└── DisplayName optional non-authoritative snapshot
+```
+
+The default claims adapter maps the authenticated principal to a user reference and group references. Hosts may replace that adapter and may use any external directory or authorization policy. Elsa.Identity is not required and no User Tasks table has a foreign key to an Elsa.Identity table.
+
+### Live membership
+
+Live tasks persist group references and evaluate the caller's current namespaced claims at list/action time. Directory lookup may enrich names or report health, but an unavailable directory does not invalidate an exact authoritative claim match.
+
+### Snapshot membership
+
+At activation, the participant directory enumerates each configured group and persists the resulting user references together with the original group reference. Later organization changes do not alter eligibility. If enumeration is unavailable or fails, the task is still durable but becomes manager-only with a blocking health issue.
+
+### Exclusions
+
+Exclusions are checked against canonical references for claiming, assignment, and guest verification. An excluded participant cannot claim or receive the task unless the activity allows manager override and the manager supplies a reason that is written to the audit event.
+
+## Actions and forms
+
+### Actions
+
+Each action has:
+
+- `Key`: a literal, immutable workflow outcome key.
+- `Label`: a materialized display value; the source may be expression-capable.
+- Optional safe presentation metadata.
+
+Action keys are unique within a task. `Timeout` and `Cancelled` are reserved keys and cannot be configured by a designer. A task without an enabled form accepts only the selected configured action and no arbitrary completion JSON.
+
+### Forms
+
+A form reference contains `ProviderName`, `Key`, and the requested binding/version information. Activation resolves and pins a concrete provider version. Open tasks never follow a later “latest” form version.
+
+The installed provider validates and normalizes submission data for the pinned version and selected action. If resolution or pinning fails, the task remains durable but is manager-only with a blocking health issue. Repair retries the original reference; managers cannot replace the live form reference ad hoc.
+
+## Lifecycle
+
+### States
+
+| State | Meaning | Worker visibility |
+| --- | --- | --- |
+| `Unassigned` | No direct assignee, candidate, or invitation is available. | Manager-only; never an open “everyone” queue. |
+| `Available` | At least one candidate or invitation may claim the task. | Eligible candidates see safe summary. |
+| `Assigned` | One participant is accountable. | Assignee sees protected content; managers see it within tenant scope. |
+| `Completing` | A valid completion operation won the race and bookmark resumption is pending. | No second terminal action is accepted. |
+| `TimingOut` | A timeout operation won the race and reserved `Timeout` resumption is pending. | No worker action is accepted. |
+| `Cancelling` | A manager cancellation operation won the race and reserved `Cancelled` resumption is pending. | No worker action is accepted. |
+| `Completed` | Bookmark resumption committed with a configured action. | Terminal. |
+| `TimedOut` | Bookmark resumption committed with reserved `Timeout`. | Terminal. |
+| `Cancelled` | The task was cancelled by its workflow/activity or by an enabled manager operation. | Terminal. |
+
+### Transitions
+
+| Trigger | Transition and rule |
+| --- | --- |
+| Activity activation with direct assignee | Create `Assigned`. |
+| Activity activation with candidates/invitations | Create `Available`. |
+| Activation without any assignment | Create `Unassigned` and a warning/health issue. |
+| Eligible claim | Atomically `Available → Assigned`; one winner only. |
+| Release | `Assigned → Available`, or `Unassigned` when no eligible candidates/invitations remain. Protected access ends immediately. |
+| Manager assign/reassign | Any open task becomes `Assigned`; manager completion still requires assignment to the accountable participant. |
+| Authenticated completion | `Assigned → Completing`; enqueue the dedicated User Task bookmark resumption. |
+| Due processing with timeout enabled | Open state `→ TimingOut`; resume through reserved `Timeout`; finalize `TimedOut`. |
+| Due processing without timeout | Keep the task open, set `IsOverdue`, and publish one idempotent overdue notification. |
+| Enabled manager cancellation | Open state `→ Cancelling`; resume through reserved `Cancelled`; finalize `Cancelled`. A reason is required. |
+| Workflow/activity bookmark removal | Finalize `Completed` when a matching pending completion exists; otherwise finalize `Cancelled`. It never independently resumes the workflow. |
+
+Completion, timeout, and cancellation use one optimistic transition path. The first committed transition wins; later requests receive a conflict. Guest verification is a special claim operation: the first valid invitation atomically claims the task and revokes sibling invitations. Guests cannot release tasks.
+
+### Mutable after activation
+
+Only priority and due date may be changed through the governed runtime update path. Assignment changes use dedicated claim/release/assign operations. Title, summary, instructions, protected task data, actions, exclusions, membership mode, and the pinned form are immutable for the live task.
+
+## Operations and idempotency
+
+An operation is scoped by `(TenantId, TaskId, OperationId)` and stores the canonical request hash, expected revision, operation kind, status, and timestamps.
+
+- Every mutation requiring a race-safe result supplies `ExpectedRevision`.
+- A matching repeated operation ID and request hash returns the existing result/state without performing the command twice.
+- Reusing an operation ID with different content is a conflict.
+- A completion operation stores normalized completion data only in protected task/operation storage, never in an event or notification payload.
+- A stale `Completing`, `TimingOut`, or `Cancelling` operation is retried or completed by reconciliation according to its durable state; it is never silently discarded.
+
+## Events and health
+
+`UserTaskEvent` is append-only, tenant-scoped, and ordered by task revision. Events include the event kind, actor participant reference when known, timestamp, operation ID, safe reason, and safe metadata. They never include protected instructions, task data, form data, completion data, invitation secrets, or provider-private payloads.
+
+At minimum, record `Created`, `Claimed`, `Released`, `Assigned`, `Reassigned`, `CompletionRequested`, `Completed`, `TimedOut`, `Cancelled`, `OverdueNotified`, `InvitationIssued`, `InvitationVerified`, `InvitationRevoked`, and failed privileged operations.
+
+Health issues are separate from lifecycle status. They identify blocking or advisory problems such as form resolution failure, snapshot enumeration failure, unknown participant display data, or invitation delivery failure. Health data is safe for managers and diagnostics; it cannot disclose tokens or protected payloads.
+
+## Visibility and retention invariants
+
+- A candidate receives safe summary only. Protected content is disclosed only to the assignee or a manager.
+- Releasing a task revokes protected access immediately.
+- A completed task's protected data is visible to the completer and managers; prior assignees retain only summary and safe audit visibility.
+- A requester receives no access merely by being the requester.
+- Inaccessible task IDs are indistinguishable from missing IDs (`404` at the API boundary).
+- All reads and writes are tenant-scoped and must pass both module permission and task relationship/policy checks.
+- Terminal retention is indefinite by default. An opt-in purge removes only terminal tasks and their events. Open tasks and their operational records are never purged.
+- Expired invitations, revoked guest sessions, and delivered invitation outbox entries may use separate short retention settings, but cleanup must not affect the task aggregate or audit history.
+
diff --git a/specs/013-user-tasks/plan.md b/specs/013-user-tasks/plan.md
new file mode 100644
index 000000000..7a8a815fe
--- /dev/null
+++ b/specs/013-user-tasks/plan.md
@@ -0,0 +1,104 @@
+# Implementation Plan: User Tasks
+
+**Feature**: `013-user-tasks` | **Date**: 2026-08-17 | **Specification**: [spec.md](spec.md)
+
+## Summary
+
+Deliver an identity-neutral human-task bounded context in Elsa Core and a reference task workbench in Elsa Studio. A blocking activity creates a materialized bookmark payload; post-commit projection creates a durable task record. Authorized REST commands atomically mutate task state and terminal commands asynchronously resume the bookmark. Reconciliation closes commit gaps. The core package defaults to in-memory persistence and optional provider packages mirror Elsa.Secrets.
+
+## Technical Context
+
+**Language/Version**: C# latest; nullable and implicit usings enabled; Blazor/Razor in Studio
+**Primary Dependencies**: Elsa feature/module and workflow runtime infrastructure, FastEndpoints via Elsa endpoint base types, mediator notifications, SignalR, Microsoft.Extensions.Options/Logging, ASP.NET Core Data Protection/rate limiting, EF Core provider packages
+**Storage**: In-memory development/test repository; module-specific EF Core context and SQLite, SQL Server, PostgreSQL, MySQL, Oracle packages; VNext document-store adapter
+**Testing**: xUnit, existing Elsa testing helpers, SQLite integration fixtures, Studio component/client tests where available
+**Targets**: Core `net8.0;net9.0;net10.0`; existing Studio targets
+**Performance Envelope**: approximately 100,000 open and millions of terminal tasks per tenant; cursor queries avoid protected JSON and page-number offsets
+**Constraints**: no Elsa.Identity dependency; no change to generic RunTask; task/bookmark consistency across failure and cluster races; protected data never disclosed through summary/search/realtime
+**Repositories**: Core worktree plus adjacent Elsa Studio repository; local-only delivery gates while GitHub is unavailable
+
+## Constitution Check
+
+### Pre-design
+
+- Separate Core module, EF persistence, provider packages, and Studio module: PASS.
+- Provider-neutral contracts and optional host integrations: PASS.
+- Activity uses standard attributes and input/output wrappers: PASS.
+- Endpoints remain one class per route and asynchronous: PASS.
+- Public behavior and architecture are documented before code: PASS.
+- Minimum scoped product: PASS; excluded capabilities are explicit.
+
+### Post-design
+
+- No persistence or identity infrastructure leaks into domain/API contracts: PASS.
+- Every durable race has a revision/idempotency rule and test task: PASS.
+- Every protected-data path has an authorization/disclosure rule: PASS.
+- Multi-provider persistence follows established Elsa.Secrets boundaries: PASS.
+- Local build/test/review gates replace only the explicitly skipped GitHub gates: PASS.
+
+## Architecture
+
+```mermaid
+flowchart LR
+ A["UserTask activity"] -->|"bookmark payload"| B["Workflow commit"]
+ B --> C["Post-commit projector"]
+ C --> D["IUserTaskRepository"]
+ D --> E["In-memory / EF Core / VNext"]
+ F["Studio or host app"] --> G["Authorized REST endpoints"]
+ G --> H["IUserTaskManager"]
+ H --> D
+ H --> I["Identity and policy adapters"]
+ H --> J["Form and invitation adapters"]
+ H -->|"terminal operation"| K["Bookmark resumer"]
+ K --> A
+ L["Paged reconciler and due scanner"] --> D
+ L --> K
+ H --> M["Mediator lifecycle events"]
+ M --> N["Metadata-free SignalR invalidation"]
+```
+
+## Package and File Shape
+
+### Elsa Core repository
+
+- `src/modules/Elsa.UserTasks`: activity, domain models, contracts, default services, in-memory repository, projection/reconciliation/due workers, permissions, notifications, SignalR hub, endpoints, feature and shell feature.
+- `src/modules/Elsa.UserTasks.Persistence.EFCore`: context, configurations, repository, feature.
+- `src/modules/Elsa.UserTasks.Persistence.EFCore.{Sqlite,SqlServer,PostgreSql,MySql,Oracle}`: provider configuration, migrations, shell features.
+- `src/modules/Elsa.UserTasks.Persistence.VNext`: document-store-backed repository/feature.
+- `test/unit/Elsa.UserTasks.UnitTests`: lifecycle, identity, disclosure, form, invitation, idempotency, projection, due, API model tests.
+- `test/integration/Elsa.UserTasks.IntegrationTests` where an existing test project pattern supports endpoint/runtime integration.
+
+### Elsa Studio repository
+
+- `src/modules/Elsa.Studio.UserTasks`: remote feature, menu, Refit client, models, queue/detail pages and components, optional extension interfaces, guest page, realtime/polling coordinator.
+- Existing workflow designer renders the activity through metadata; custom inputs are added only where generic editing is insufficient.
+
+## Delivery Sequence
+
+1. Land the approved dossier, contracts, terminology, and traceable task ledger.
+2. Implement the domain, state machine, activity/bookmark contract, repository, and focused unit tests.
+3. Add post-commit projection, asynchronous completion, reconciliation, due processing, and lifecycle notifications.
+4. Add authorized REST query/commands and safe DTO mapping.
+5. Add invitations, guest sessions, delivery outbox, anonymous defenses, and tests.
+6. Add EF Core/VNext persistence and provider migrations/configuration.
+7. Add Studio queue/detail/designer/guest integrations.
+8. Run targeted then broad local verification, traceability analysis, and up to five self-review passes.
+
+## Verification Strategy
+
+- Unit-test legal and illegal state transitions, exact revision increments, canonical idempotency payloads, claim and terminal races.
+- Contract-test query authorization and safe/protected DTO mapping for every relationship.
+- Runtime-test task projection after workflow commit, bookmark resume, finalization, and each reconciliation gap.
+- SQLite-test durable restart, indexes, tenant isolation, cursor stability, and cleanup.
+- Schema-review every provider migration and compile all provider projects.
+- Studio-test tab queries, URL state, responsive route behavior, capability actions, conflict refresh, disclosure, realtime fallback, and accessibility semantics.
+- Build affected projects first, then both repositories broadly without GitHub-dependent checks.
+
+## Risk Controls
+
+- **Dual-write inconsistency**: bookmark is source evidence; projection happens post-commit and a paged reconciler repairs both directions.
+- **Authorization leakage**: repository query accepts an authorization scope compiled by policy; summary DTOs cannot carry protected fields.
+- **Terminal duplicate resume**: transitional states, expected revision, canonical operation record, and bookmark-removal finalization.
+- **Provider schema drift**: one EF model plus provider-specific migrations and a shared conformance suite.
+- **Guest secret exposure**: hash at rest, encrypted transient outbox, generic anonymous surface, short bounded sessions.
+- **Scope pressure**: v1 exclusions remain acceptance constraints; standalone tasks, drafts, attachments, comments, bulk actions, and native forms are not implementation tasks.
diff --git a/specs/013-user-tasks/quickstart.md b/specs/013-user-tasks/quickstart.md
new file mode 100644
index 000000000..4ce8df66b
--- /dev/null
+++ b/specs/013-user-tasks/quickstart.md
@@ -0,0 +1,270 @@
+# Quickstart: Elsa User Tasks
+
+**Status**: Approved
+**Last reviewed**: 2026-08-17
+
+This walkthrough creates a workflow-bound invoice approval, executes it, lists the candidate task, claims it as an external user, and completes it with a typed action and form payload. The examples use the planned `Elsa.UserTasks` REST contract and do not require `Elsa.Identity`.
+
+## Prerequisites
+
+- An Elsa Server with workflow management, workflow runtime, and the User Tasks module enabled.
+- A host identity provider that issues a bearer token with a stable subject and optional group claims.
+- The `read:user-tasks`, `claim:user-tasks`, and `complete:user-tasks` permissions for the worker token. A manager token additionally needs `assign:user-tasks` and `manage:user-tasks`.
+- An installed form provider if the task uses `formReference`.
+
+The Core module defaults to an in-memory repository for development and tests. A durable host adds the User Tasks EF Core persistence package and its provider-specific shell feature, following the same package split used by `Elsa.Secrets`:
+
+```csharp
+services.AddElsa(elsa =>
+{
+ elsa.UseUserTasks();
+});
+
+// Enable the provider-specific User Tasks persistence feature in the host.
+// The feature registers the User Task repository, DbContext, mappings, and migrations.
+// Use the SQLite, SQL Server, PostgreSQL, MySQL, or Oracle package selected by the host.
+```
+
+Do not add an `Elsa.Identity` reference merely to run this walkthrough. The default claims resolver reads the configured subject/provider/group claims; a host may replace it with `IUserTaskIdentityResolver` and `IUserTaskAccessPolicy`.
+
+## Create the workflow
+
+In Elsa Studio, create a workflow definition named `invoice-review` with a sequence containing one `UserTask` activity:
+
+```csharp
+new UserTask
+{
+ Id = "ReviewInvoice",
+ Title = "Review invoice",
+ Summary = "Approve or reject invoice INV-1042.",
+ Instructions = "Check the supplier, amount, and purchase order before deciding.",
+ Reference = "INV-1042",
+ TaskType = "invoice-approval",
+ CandidateGroups =
+ [
+ new ParticipantReference(
+ TenantId: "acme",
+ Provider: "acme-directory",
+ Type: UserTaskParticipantType.Group,
+ Id: "accounts-payable")
+ ],
+ Priority = 75,
+ DueAt = "= now() + duration(\"P2D\")",
+ FormReference = new UserTaskFormReference
+ {
+ ProviderName = "acme-forms",
+ Key = "invoice-review",
+ Binding = "version:3"
+ },
+ Actions =
+ [
+ new UserTaskActionDefinition { Key = "approved", Label = "Approve" },
+ new UserTaskActionDefinition { Key = "rejected", Label = "Reject" }
+ ],
+ TaskData = new
+ {
+ invoiceNumber = "INV-1042",
+ amount = 1250.00,
+ currency = "EUR",
+ supplier = "Northwind Supplies"
+ }
+};
+```
+
+The C# above describes the activity shape used by the workflow builder. Studio serializes the same values into the workflow definition. `CandidateGroups` stores an opaque external reference; the string `accounts-payable` is not an Elsa group ID. The activity blocks on its User Task bookmark and exposes the selected action as the workflow outcome after completion.
+
+If a form provider is not installed, omit `FormReference` and complete with an action only. Without a form, arbitrary business data is not accepted by the Core completion endpoint.
+
+## Execute the workflow
+
+After publishing the definition, execute it through the existing workflow runtime endpoint. Set `DEFINITION_ID` to the published definition ID returned by the workflow-definition API:
+
+```bash
+export ELSA_BASE_URL="https://localhost:5001"
+export DEFINITION_ID="invoice-review"
+export WORKER_TOKEN=""
+
+curl --fail-with-body -i \
+ -X POST "$ELSA_BASE_URL/workflow-definitions/$DEFINITION_ID/execute" \
+ -H "Authorization: Bearer $WORKER_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "correlationId": "order-1042",
+ "input": {
+ "invoiceNumber": "INV-1042"
+ }
+ }'
+```
+
+The response includes the normal workflow state and the `x-elsa-workflow-instance-id` response header. Save that value for the task detail and workflow deep link.
+
+## List the candidate queue
+
+The accounts-payable worker supplies a token whose external group claims include `acme-directory/accounts-payable`. The User Tasks API evaluates the host identity policy and returns summary-safe rows:
+
+```bash
+curl --fail-with-body \
+ "$ELSA_BASE_URL/user-tasks?scope=available&taskType=invoice-approval&limit=20&includeTotalCount=true" \
+ -H "Authorization: Bearer $WORKER_TOKEN" \
+ -H "Accept: application/json"
+```
+
+An available row has this shape (the exact response may include links and tenant metadata):
+
+```json
+{
+ "items": [
+ {
+ "id": "01JUSER-TASK-1042",
+ "title": "Review invoice",
+ "summary": "Approve or reject invoice INV-1042.",
+ "reference": "INV-1042",
+ "taskType": "invoice-approval",
+ "status": "Available",
+ "assignee": null,
+ "priority": 75,
+ "dueAt": "2026-08-19T10:30:00Z",
+ "isOverdue": false,
+ "allowedActions": ["claim"],
+ "dataAccess": "summary",
+ "revision": 1
+ }
+ ],
+ "totalCount": 1
+}
+```
+
+The row does not expose `Instructions`, `TaskData`, or the form payload. A worker can search by reference, status, priority, due-date range, workflow definition/instance, and stable cursor/sort parameters. Studio uses the same endpoint for its **Available** tab.
+
+## Claim the task
+
+Claiming is a separate, concurrency-safe operation. The `expectedRevision` prevents a stale list row from claiming a task that another worker already took:
+
+```bash
+export TASK_ID="01JUSER-TASK-1042"
+
+curl --fail-with-body \
+ -X POST "$ELSA_BASE_URL/user-tasks/$TASK_ID/claim" \
+ -H "Authorization: Bearer $WORKER_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{"expectedRevision":1}'
+```
+
+A successful claim changes the task to `Assigned`, sets the assignee to the external subject from the token, increments `revision`, and returns `allowedActions` containing `release` and `complete`.
+
+## Read protected details
+
+After claiming, the worker can fetch the full detail. The same request made with a different candidate token returns only the safe projection or `404`, depending on the host access policy:
+
+```bash
+curl --fail-with-body \
+ "$ELSA_BASE_URL/user-tasks/$TASK_ID" \
+ -H "Authorization: Bearer $WORKER_TOKEN" \
+ -H "Accept: application/json"
+```
+
+The assigned response includes the pinned form reference, protected instructions, task data, workflow definition/instance links, action definitions, revision, and a safe lifecycle timeline. It still omits secrets that the host form provider does not authorize.
+
+## Complete with a form action
+
+The form provider validates and normalizes `data`. The `actionKey` must match a configured action; it is also emitted as the User Task activity outcome. The `operationId` makes a network retry idempotent:
+
+```bash
+export OPERATION_ID="6d1cf9d1-22e4-4f4d-a13e-0f9a50b754d8"
+
+curl --fail-with-body -i \
+ -X POST "$ELSA_BASE_URL/user-tasks/$TASK_ID/complete" \
+ -H "Authorization: Bearer $WORKER_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "expectedRevision": 2,
+ "operationId": "'"$OPERATION_ID"'",
+ "actionKey": "approved",
+ "data": {
+ "purchaseOrder": "PO-1042",
+ "approvedAmount": 1250.00
+ }
+ }'
+```
+
+The endpoint returns `202 Accepted` while the task is `Completing`. Poll the task resource until `Completed`:
+
+```bash
+until curl --fail-with-body -s \
+ "$ELSA_BASE_URL/user-tasks/$TASK_ID" \
+ -H "Authorization: Bearer $WORKER_TOKEN" \
+ | rg -q '"status"[[:space:]]*:[[:space:]]*"Completed"'; do
+ sleep 1
+done
+```
+
+When the bookmark resumes, the workflow receives `UserTaskResult` with `actionKey = "approved"`, the provider-normalized data, the external completing participant, and the completion timestamp. A workflow branch can use the `approved` or `rejected` outcome to continue execution.
+
+Submitting the same `operationId` and payload again returns the original completion result or an equivalent idempotent response. Reusing it with a different action or data returns `409 Conflict`.
+
+## Release or reassign
+
+If the worker cannot finish, release clears the assignee and returns the task to the candidate queue:
+
+```bash
+curl --fail-with-body \
+ -X POST "$ELSA_BASE_URL/user-tasks/$TASK_ID/release" \
+ -H "Authorization: Bearer $WORKER_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{"expectedRevision":2}'
+```
+
+A manager can assign the task to a specific external user. Managers cannot complete on another user's behalf; they must assign it to an accountable user first:
+
+```bash
+export MANAGER_TOKEN=""
+
+curl --fail-with-body \
+ -X POST "$ELSA_BASE_URL/user-tasks/$TASK_ID/assign" \
+ -H "Authorization: Bearer $MANAGER_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "expectedRevision": 3,
+ "assignee": {
+ "provider": "acme-directory",
+ "type": "user",
+ "id": "u-2048"
+ },
+ "reason": "Accounts-payable coverage for the month-end queue."
+ }'
+```
+
+## Inspect the manager queue and audit history
+
+Managers with `manage:user-tasks` can query all task scopes and see the safe event timeline:
+
+```bash
+curl --fail-with-body \
+ "$ELSA_BASE_URL/user-tasks?scope=all&status=Assigned&priorityFrom=50&limit=50" \
+ -H "Authorization: Bearer $MANAGER_TOKEN" \
+ -H "Accept: application/json"
+
+curl --fail-with-body \
+ "$ELSA_BASE_URL/user-tasks/$TASK_ID/events" \
+ -H "Authorization: Bearer $MANAGER_TOKEN" \
+ -H "Accept: application/json"
+```
+
+Events include created, claimed, released, assigned, reassigned, completion requested, completed, and canceled transitions with timestamps, external participant references, revisions, and safe reasons. They do not include protected task or form payloads.
+
+## Validate the integration
+
+Run these scenarios against an in-memory host first, then repeat with the selected EF Core provider:
+
+1. Two candidate workers claim the same task; one succeeds and the other receives `409`.
+2. A candidate can list a summary but cannot fetch protected data before claiming.
+3. A claimed worker can release and another candidate can claim the task.
+4. A completion retry with the same `operationId` does not resume the bookmark twice.
+5. A stale `expectedRevision` cannot complete or reassign a task.
+6. A task with no assignment is manager-only and produces a design/runtime warning.
+7. A missing form provider produces a blocking health issue and never renders arbitrary HTML.
+8. The workflow receives the configured action outcome and typed result after `Completing` reaches `Completed`.
+9. A canceled workflow removes the bookmark and records the User Task as canceled.
+10. No request or persistence path requires an `Elsa.Identity` user or group.
+
+The implementation should turn each scenario into a Core integration or component test and keep this document synchronized with the REST and runtime contracts.
diff --git a/specs/013-user-tasks/research.md b/specs/013-user-tasks/research.md
new file mode 100644
index 000000000..f280a4092
--- /dev/null
+++ b/specs/013-user-tasks/research.md
@@ -0,0 +1,131 @@
+# Research: User Tasks
+
+**Status**: Approved
+**Last reviewed**: 2026-08-17
+
+This research captures the product and integration decisions behind `Elsa.UserTasks`. The feature is deliberately identity-neutral: Elsa stores references to participants supplied by the host application, but does not create or require Elsa users.
+
+## Decision: Make User Tasks a workflow-bound inbox projection
+
+**Rationale**: A User Task must block workflow execution and must also be queryable as durable work from Elsa Studio or a custom application. The activity therefore creates a bookmark, while the User Tasks module projects the committed bookmark into a task record. Completion records the requested result and resumes the bookmark asynchronously. This gives workflow execution and inbox queries separate persistence boundaries without allowing a task row to become an independent workflow execution primitive.
+
+**Alternatives considered**:
+
+- Reuse the existing generic `RunTask` activity and `/tasks/{id}/complete`: rejected because it has a different contract and does not provide assignment, participant, form, audit, or queue semantics.
+- Create standalone tasks in v1: rejected because the first release must have an unambiguous workflow resume target; standalone work can follow once its lifecycle and retention rules are separately designed.
+- Make the task table the source of workflow state: rejected because a database write could claim or complete a task without atomically coordinating the workflow bookmark.
+
+## Decision: Store opaque, tenant-scoped participant references
+
+**Rationale**: Camunda models `assignee`, `candidateUsers`, and `candidateGroups` as identifiers resolved by its surrounding identity system. Its current documentation also notes that identifiers are case-sensitive and that group IDs are preferred. Flowable is even more explicit: its runtime does not verify that an assigned user exists, which allows an embedded engine to use an existing identity service. Elsa should adopt this integration boundary directly.
+
+Elsa persists a participant as `{ provider, type, id }`, where `type` is `user` or `group`. The value is an external reference, not an `Elsa.Identity` foreign key. Claims, directory lookups, display names, and group membership are replaceable host integrations. A display name is a convenience snapshot and never participates in authorization.
+
+**Sources**: [Camunda user task assignments](https://docs.camunda.io/docs/components/modeler/bpmn/user-tasks/), [Flowable Task API](https://www.flowable.com/open-source/docs/bpmn/ch04-API/), [Flowable user-task assignment](https://www.flowable.com/open-source/docs/userguide-5/).
+
+**Alternatives considered**:
+
+- Foreign keys to `Elsa.Identity` users or groups: rejected because integrations may use Entra ID, LDAP, an application database, a SaaS identity provider, or no Elsa user store at all.
+- Free-form strings without a provider namespace: rejected because the same subject identifier can exist in multiple issuers or tenants.
+- A mandatory directory provider: rejected because authorization must work with claims alone and directory services are often unavailable or eventually consistent.
+
+## Decision: Separate assignment from task state
+
+**Rationale**: Camunda Tasklist treats assignment as a distinct concern: a task can be available to candidates, claimed by one worker, released, reassigned, and then completed. Flowable uses the same model: claiming makes one user the assignee and removes the task from the other candidates' personal queues. Elsa therefore exposes dedicated claim, release, assign, and complete operations, rather than treating an assignee field update as completion or as a generic patch.
+
+The public lifecycle is `Unassigned`, `Available`, `Assigned`, transitional `Completing`, `TimingOut`, and `Cancelling`, and terminal `Completed`, `TimedOut`, and `Cancelled`. A task with no usable assignment is manager-only and raises a designer/runtime warning; it never becomes visible to every authenticated user merely because no candidate was configured.
+
+**Sources**: [Camunda Tasklist overview](https://docs.camunda.io/docs/components/tasklist/userguide/using-tasklist/), [Camunda user-task lifecycle](https://docs.camunda.io/docs/apis-tools/frontend-development/task-applications/user-task-lifecycle/), [Flowable task lists and claiming](https://www.flowable.com/open-source/docs/bpmn/ch07a-BPMN-Introduction/).
+
+**Alternatives considered**:
+
+- Let every candidate complete directly: rejected because it creates race conditions and makes accountability unclear.
+- Treat `InProgress` as a required engine state: rejected for v1; hosts can add application-level progress outside the workflow lifecycle. `Assigned` is the accountable state.
+- Automatically reassign when a worker disconnects: rejected because leases and absence detection are host-specific and can surprise users.
+
+## Decision: Give candidates a safe queue projection and protect task content
+
+**Rationale**: Camunda's Tasklist combines a queue with a selected-task detail view and shows task name, process, assignee, priority, creation date, due date, and follow-up date. Elsa keeps the useful queue/detail pattern but makes the security boundary explicit: an available candidate receives only summary-safe fields and can claim the task; protected instructions, task data, and form metadata are returned only after claim or to an authorized manager. This is a deliberate Elsa security improvement, not a claim that all Camunda deployments behave this way.
+
+The API returns `dataAccess` and server-computed `allowedActions` so Studio does not infer authorization from the current user interface state. An inaccessible task returns `404`, avoiding existence leaks.
+
+**Source**: [Camunda Tasklist queue and task details](https://docs.camunda.io/docs/components/tasklist/userguide/using-tasklist/).
+
+## Decision: Keep priority and due dates with an explicit timeout outcome
+
+**Rationale**: Camunda supports expression-capable due dates, follow-up dates, and a 0–100 priority with a default of 50; Tasklist can sort by those fields. Elsa keeps an expression-capable `DueAt` and priority because approvals, exception queues, and SLA work need these signals. Every overdue task publishes one idempotent notification. By default it remains actionable; when the designer explicitly enables timeout, a cluster-safe due operation races through `TimingOut` and resumes the workflow with reserved action `Timeout`. Follow-up dates and first-party escalation delivery remain deferred.
+
+**Sources**: [Camunda user-task scheduling and priority](https://docs.camunda.io/docs/components/modeler/bpmn/user-tasks/), [Camunda priority labels](https://docs.camunda.io/docs/components/tasklist/userguide/defining-task-priorities/).
+
+**Alternatives considered**:
+
+- Automatically cancel at the due date: rejected because business processes differ on whether a missed deadline should escalate, remain actionable, or take a rejection path.
+- Use an unbounded numeric priority: rejected because a bounded range is easier to validate, render, and sort consistently.
+- Include follow-up or first-party escalation delivery in the first domain contract: rejected because it couples task persistence to a delivery system that Elsa does not otherwise provide. The module publishes lifecycle notifications for host subscribers.
+
+## Decision: Use provider-neutral, version-pinned forms
+
+**Rationale**: Camunda links forms to user tasks as separately deployed, versioned resources. It supports binding to the latest, a deployment, or a version tag so a running process can pin the form version it expects. Elsa has no first-party form builder to assume, so `FormReference` contains a provider name, key, and version/binding. On activation, the module resolves and pins the concrete version. The provider validates and normalizes submitted data; Core does not merge arbitrary fields into workflow variables. Studio renders only an installed trusted provider renderer and never arbitrary server-provided HTML.
+
+If the form cannot be resolved or validated, the task records a blocking health issue and is manager-only until configuration is repaired. A manager may retry the original reference; they cannot silently replace the live form on an active task.
+
+**Sources**: [Camunda form linking](https://docs.camunda.io/docs/components/modeler/forms/utilizing-forms/), [Camunda resource binding](https://docs.camunda.io/docs/components/best-practices/modeling/choosing-the-resource-binding-type/), [Camunda Tasklist form behavior](https://docs.camunda.io/docs/components/tasklist/userguide/using-tasklist/).
+
+**Alternatives considered**:
+
+- Build a form designer into Core: rejected because it would make Elsa responsible for a large UI and schema ecosystem before the provider contract is proven.
+- Store only an unversioned form key: rejected because a form change could invalidate an active task.
+- Render arbitrary HTML returned by a provider: rejected because it creates an unnecessary XSS and trust-boundary risk.
+- Persist completion data as arbitrary workflow variables: rejected because user-submitted data needs provider validation and an explicit typed `UserTaskResult` boundary.
+
+## Decision: Make completion optimistic-concurrency-safe and idempotent
+
+**Rationale**: A queue is inherently concurrent: two workers may select the same candidate task, or a client may retry after a network timeout. Claim, release, assign, and complete requests require `expectedRevision`. Completion additionally requires a client-generated `operationId`; repeating the same operation is safe, while reusing it with a different payload returns `409`. Completion returns `202 Accepted` while the workflow resume is pending and transitions the task through `Completing`.
+
+This combines Camunda's explicit assignment/completion operations with Elsa's bookmark-resume boundary. The first committed terminal transition wins; later completion, cancellation, or workflow-cancel attempts receive a conflict or are recorded as an already-finalized no-op according to the operation contract.
+
+**Sources**: [Camunda lifecycle operations and events](https://docs.camunda.io/docs/apis-tools/frontend-development/task-applications/user-task-lifecycle/), [Camunda task API](https://docs.camunda.io/docs/apis-tools/tasklist-api-rest/controllers/tasklist-api-rest-task-controller/).
+
+## Decision: Use a rich, authorized queue API and a capability-driven Studio
+
+**Rationale**: Camunda's task search API supports status, assignment, candidate users/groups, process references, date ranges, priority, variable predicates, include-variable selection, sorting, and cursor pagination. Elsa adopts those high-value query dimensions with opaque cursor pagination and a stable ID tie-breaker. List rows contain bounded metadata; details load protected content only when authorized.
+
+Studio adds **Assigned to me**, **Available**, **History**, and manager-only **All** and **Needs Attention** views at `/workflows/user-tasks`. The list uses server-side filtering, URL-persisted filters, sorting, and cursor paging. The detail view shows workflow context, protected form/data when allowed, action buttons from `allowedActions`, and a safe audit timeline. A participant picker is optional and capability-driven; raw opaque IDs and expressions remain available when no directory exists.
+
+**Sources**: [Camunda task search](https://docs.camunda.io/docs/apis-tools/tasklist-api-rest/specifications/search-tasks/), [Camunda Tasklist overview](https://docs.camunda.io/docs/apis-tools/tasklist-api-rest/tasklist-api-rest-overview/).
+
+**Alternatives considered**:
+
+- A client-side list loaded from workflow instances: rejected because it cannot enforce task-level scope efficiently or support custom task stores.
+- A mandatory user/group picker: rejected because host identity systems may not expose a searchable directory.
+- A single page showing every task to every authenticated user: rejected because it leaks business data and makes a manager scope meaningless.
+
+## Decision: Mirror the Elsa.Secrets persistence shape
+
+**Rationale**: The module follows the repository's established split: a Core package owns contracts, services, default repository, activity, endpoints, permissions, and an in-memory implementation; persistence packages add provider-specific repositories, shell features, migrations, and mappings. This keeps the default useful for development and tests while allowing durable EF Core providers and future persistence-vNext adapters without changing the REST or activity contract.
+
+Persist `UserTasks`, normalized `UserTaskCandidates`, and append-only `UserTaskEvents`. Index tenant, status, assignee provider/ID, priority, due date, workflow definition/instance, activity instance, created/completed time, and revision. Store bounded protected task data, completion data, and form references as JSON. Unique keys cover task ID, bookmark ID, and the tenant/workflow-instance/activity-instance materialization key.
+
+The module has no secret-like cleartext protection requirement; protected task data is governed by task authorization and provider storage guarantees. Terminal retention is indefinite by default, with opt-in purge of terminal tasks and events only.
+
+## Decision: Keep guest invitations separate from ordinary identity
+
+**Rationale**: External customer or partner approvals are high-value, but a guest link must not become a general Elsa credential. Guest invitations use the same task aggregate and authorization model, with a single-task, scoped, one-time token and an optional bearer-only permission. The invitation token is hashed at rest; the host owns dispatch and verification. Authenticated workers never need to use invitation APIs.
+
+This is staged after the authenticated lifecycle so the core task contract can be validated first. It follows the same task queue and completion rules, including revision and operation-idempotency checks.
+
+**Alternatives considered**:
+
+- Treat every guest as an Elsa user: rejected because it recreates the identity coupling the module is intended to avoid.
+- Put all task data in a bearer URL: rejected because links are routinely copied, logged, or forwarded.
+- Make invitation delivery part of Core: rejected because email/SMS/portal delivery is host-specific.
+
+## What Elsa should and should not copy
+
+| Copy | Adapt | Do not copy as a v1 dependency |
+| --- | --- | --- |
+| Camunda's assignment vocabulary, queue/detail layout, priority/due fields, explicit actions, form references, and lifecycle events. | Camunda's candidate visibility: use Elsa's summary-safe projection and host authorization policy rather than coupling to Elsa.Identity. | Camunda Tasklist V1/V2 visibility behavior; its docs describe different candidate semantics across API versions. |
+| Flowable's standalone identity boundary and candidate-group claim semantics. | Flowable's rich query vocabulary, adding tenant and workflow bookmark constraints. | Flowable's assumption that the engine's identity component can resolve group membership; Elsa must support claims-only hosts. |
+| Temporal's durable human approval pattern and immutable execution history. | Expose mediator notifications and webhooks/events for host integrations. | A signal-only implementation with no durable inbox, task assignment, or Studio list. |
+
+The Camunda visibility split is documented in [Tasklist access restrictions](https://docs.camunda.io/docs/8.8/components/tasklist/user-task-access-restrictions/). The Temporal comparison comes from its official [human-in-the-loop reference architecture](https://go.temporal.io/platform-hub/ai-engineering/ai-reference-architecture/), which uses Signals/Updates and durable waits rather than a built-in task inbox.
diff --git a/specs/013-user-tasks/spec.md b/specs/013-user-tasks/spec.md
new file mode 100644
index 000000000..674d45bd8
--- /dev/null
+++ b/specs/013-user-tasks/spec.md
@@ -0,0 +1,173 @@
+# Feature Specification: User Tasks
+
+**Feature Branch**: `013-user-tasks`
+**Created**: 2026-08-17
+**Status**: Approved for implementation
+**Input**: Add an identity-neutral, durable human-task module to Elsa Core and a production-capable task workbench to Elsa Studio.
+
+## Product Intent
+
+User Tasks let a workflow pause for a human decision, expose the work through a secure queue, and resume with a typed outcome. Elsa owns task durability and workflow coordination, while the host owns people, groups, authentication, and policy. No required dependency or foreign key may couple the module to `Elsa.Identity`.
+
+## User Scenarios & Testing
+
+### User Story 1 - Model and execute a user task (Priority: P1)
+
+A workflow designer adds a User Task activity, configures visible context, assignment rules, completion actions, and an optional form. At runtime the workflow suspends until an authorized worker completes the task.
+
+**Why this priority**: Durable workflow suspension and typed human completion are the feature's core value.
+
+**Independent Test**: Publish and run a workflow containing one User Task, complete it through REST, and verify the selected action and normalized form data resume the correct activity exactly once.
+
+**Acceptance Scenarios**:
+
+1. **Given** a task with a direct assignee, **When** the activity executes, **Then** an `Assigned` task and matching bookmark are persisted and only the assignee or a manager can read protected content.
+2. **Given** a task with candidates, **When** an eligible worker claims it, **Then** the claim is atomic and competing claimants receive a conflict.
+3. **Given** a valid completion request, **When** it is accepted, **Then** the API returns `202`, transitions through `Completing`, resumes the workflow, and eventually records `Completed` once.
+
+---
+
+### User Story 2 - Work from a task inbox (Priority: P1)
+
+Workers use Elsa Studio to see work assigned to them, discover available work, inspect authorized details, claim or release it, and complete it. Managers monitor all work and repair or reassign tasks that need attention.
+
+**Why this priority**: A human task that cannot be found and acted upon is not operationally useful.
+
+**Independent Test**: Seed tasks in each lifecycle state and verify each Studio tab, filter, action, disclosure rule, and mobile detail route against the REST API.
+
+**Acceptance Scenarios**:
+
+1. **Given** an authenticated worker, **When** they open User Tasks, **Then** Assigned to me, Available, and History contain only relationship-authorized safe records.
+2. **Given** an unclaimed candidate task, **When** a candidate opens it, **Then** only its safe summary is visible until claim succeeds.
+3. **Given** a manager, **When** they open All or Needs Attention, **Then** they can diagnose, reassign, retry resolution, update due date or priority, and optionally cancel without completing on another person's behalf.
+
+---
+
+### User Story 3 - Integrate a host-owned identity system (Priority: P1)
+
+An Elsa integrator maps its authenticated principals and directory to opaque, tenant-scoped participant references and supplies task authorization without adopting Elsa Identity.
+
+**Why this priority**: Identity neutrality is a hard compatibility boundary for embedded Elsa deployments.
+
+**Independent Test**: Replace the default claims adapter and directory with test implementations and verify list visibility, live and snapshot groups, exclusions, management scope, and display resolution.
+
+**Acceptance Scenarios**:
+
+1. **Given** a namespaced participant reference unknown to the directory, **When** an exact authenticated claim matches it, **Then** live-mode authorization can succeed and activation does not fail.
+2. **Given** snapshot membership that cannot be enumerated, **When** the task activates, **Then** it is created with a manager-only blocking health issue.
+3. **Given** an excluded participant, **When** they otherwise match assignment, **Then** access is denied unless the activity permits a manager override and an audited reason is supplied.
+
+---
+
+### User Story 4 - Complete a task from an external portal (Priority: P2)
+
+A workflow invites an external person. The host delivers a one-time token, the guest completes a pluggable verification challenge, and a task-scoped guest session permits completion without creating an Elsa user.
+
+**Why this priority**: Customer approvals and document requests are high-value workflow scenarios.
+
+**Independent Test**: Issue multiple invitations, verify one, confirm it atomically claims the task and revokes its siblings, and complete through the guest page with no identity-module dependency.
+
+**Acceptance Scenarios**:
+
+1. **Given** an unverified invitation link, **When** it is opened, **Then** the response reveals generic content only.
+2. **Given** a valid challenge, **When** verification succeeds, **Then** a bounded task-scoped session is issued, the task is claimed, and competing invitations are revoked.
+3. **Given** an expired, consumed, or invalid token, **When** verification is attempted, **Then** the API returns a generic rate-limited failure without revealing task existence.
+
+---
+
+### User Story 5 - Meet deadlines and recover reliably (Priority: P2)
+
+Operators rely on due-date notifications, optional timeout outcomes, reconciliation, audit history, and provider-backed persistence across restarts and multiple nodes.
+
+**Why this priority**: Human work is asynchronous and must survive failures and races.
+
+**Independent Test**: Exercise completion-versus-timeout races on two nodes, restart between bookmark commit and projection, and verify first-writer-wins, idempotent notifications, and reconciliation.
+
+**Acceptance Scenarios**:
+
+1. **Given** an overdue task without timeout enabled, **When** the scanner processes it repeatedly, **Then** one overdue notification is published and the task remains open.
+2. **Given** timeout enabled, **When** due time wins the terminal transition, **Then** the workflow resumes with reserved action `Timeout` and the task becomes `TimedOut`.
+3. **Given** a committed bookmark lacking a task projection, **When** reconciliation runs, **Then** the missing task is recreated without duplication.
+
+## Edge Cases
+
+- A task with neither assignee, candidates, nor invitations becomes `Unassigned`, visible only to managers, and records a warning.
+- Release immediately revokes protected access and returns to `Available` or `Unassigned`.
+- Reuse of an operation ID with the same payload is idempotent; reuse with different content conflicts.
+- Completion, timeout, cancellation, and bookmark removal races use expected revision and a transitional state so exactly one terminal result wins.
+- A configured form that cannot be resolved blocks worker completion and creates a manager-only health issue; repair retries the original reference.
+- “Latest” form references are pinned at activation so later form changes cannot alter an open task.
+- Search never examines protected instructions, task data, form data, or completion data.
+- Terminal history grants protected data only to the completer and managers; prior assignees receive summary and audit only.
+- Unknown display names degrade to opaque participant IDs and a health indication, not workflow failure.
+- Invitations expire at the configured bound, defaulting to the earlier of seven days or task due time.
+
+## Requirements
+
+### Functional Requirements
+
+- **FR-001**: The system MUST provide a blocking `UserTask` workflow activity with expression-capable design inputs and typed result outputs.
+- **FR-002**: The activity MUST materialize title, summary, reference, tags, task type, requester, priority, due time, instructions, bounded task data, assignment rules, exclusions, actions, form reference, and invitation definitions at activation.
+- **FR-003**: Completion action keys MUST be immutable literals; `Timeout` and `Cancelled` are reserved; labels MAY be expressions.
+- **FR-004**: Task status MUST follow `Unassigned`, `Available`, `Assigned`, transitional `Completing`/`TimingOut`/`Cancelling`, and terminal `Completed`/`TimedOut`/`Cancelled` states.
+- **FR-005**: Claim, release, direct assign, reassign, due-date update, priority update, completion, timeout, and optional cancellation MUST be atomic, revision-checked, idempotent where applicable, and audited.
+- **FR-006**: Completion MUST be asynchronous: accept a command, persist operation state, enqueue bookmark resumption, and finalize from bookmark removal or reconciliation.
+- **FR-007**: The module MUST project committed User Task bookmarks and reconcile missing projections, stale operations, and orphan task records in bounded pages.
+- **FR-008**: The module MUST use opaque participant references composed of tenant, provider namespace, participant type, and external ID, with no required Elsa Identity dependency.
+- **FR-009**: The host MUST be able to replace principal mapping, identity resolution, participant lookup, task policy, form, invitation delivery, invitation verification, and guest session services.
+- **FR-010**: Authorization MUST require both operation permission and a task relationship; managers remain tenant-scoped and guest sessions remain task-scoped.
+- **FR-011**: Candidate users MUST see safe summary only; protected instructions, task data, and forms MUST be disclosed only after assignment and revoked on release.
+- **FR-012**: Live group membership MUST use current principal claims; snapshot membership MUST expand at activation and create a manager-only issue if enumeration fails.
+- **FR-013**: Explicit exclusions MUST override ordinary assignment; an optional manager override MUST require a reason and audit event.
+- **FR-014**: The requester MUST be searchable and visible but MUST confer no access.
+- **FR-015**: Forms MUST be provider-neutral, version-pinned at activation, validated and normalized by the provider, and repairable only by retrying the original reference.
+- **FR-016**: Tasks without a form MUST accept only a configured action and no arbitrary completion JSON.
+- **FR-017**: Due processing MUST publish one idempotent overdue notification; when timeout is enabled it MUST resume with `Timeout` and finalize as `TimedOut`.
+- **FR-018**: Manager cancellation MUST be activity-enabled, permission-protected, reason-required, and resume with `Cancelled`.
+- **FR-019**: REST APIs under `/user-tasks` MUST provide cursor-based authorized search, details, events, capabilities, claim/release/assign, priority/due update, complete/cancel, resolution retry, participant lookup, and invitation operations.
+- **FR-020**: Terminal mutation APIs MUST require `expectedRevision` and `operationId`, return `202` when accepted, `409` for races or divergent operation reuse, and `422` for domain validation.
+- **FR-021**: Anonymous invitation APIs MUST use generic errors and rate limiting; raw invitation secrets MUST never be stored outside an encrypted transient delivery outbox and MUST be returned only once to a dispatcher.
+- **FR-022**: The first successfully verified invitation MUST atomically claim the task, revoke sibling invitations, and issue a bounded guest session; guests MUST NOT release tasks.
+- **FR-023**: Persistence MUST offer an in-memory default plus EF Core packages for SQLite, SQL Server, PostgreSQL, MySQL, and Oracle, and a VNext provider abstraction with equivalent behavior.
+- **FR-024**: Storage MUST index normalized query fields and use bounded JSON only for protected task, form, and completion payloads; default payload limit is 256 KiB.
+- **FR-025**: Audit events MUST be append-only, tenant-scoped, and exclude raw protected payloads.
+- **FR-026**: Terminal retention MUST be indefinite by default with configurable purge that never deletes open tasks.
+- **FR-027**: Studio MUST add Workflows → User Tasks with Assigned to me, Available, History, and manager-only All and Needs Attention views.
+- **FR-028**: Studio MUST provide desktop queue/detail and mobile detail routes, URL-backed filters, workflow-instance deep links, capability-driven actions, safe disclosure, and no embedded diagram.
+- **FR-029**: Studio MUST consume metadata-free SignalR invalidations and requery, with polling fallback.
+- **FR-030**: Studio's generic activity editor MUST support all activity fields; participant lookup is optional with raw namespaced references and expressions as fallback.
+- **FR-031**: Studio MUST ship a replaceable guest task page that reveals no task-specific information before successful verification.
+- **FR-032**: Search MUST be limited to safe title, summary, reference, tags, task type, workflow, and correlation fields and MUST use opaque cursor pagination with stable sorting and optional totals.
+- **FR-033**: Existing generic `RunTask` behavior and `/tasks/{id}/complete` MUST remain unchanged.
+- **FR-034**: The system MUST publish mediator lifecycle notifications and metadata-free realtime invalidations for external integrations.
+
+### Key Entities
+
+- **UserTask**: Durable runtime projection linked to tenant, workflow, activity instance, and bookmark; owns lifecycle, safe/protected content, timing, assignment, form pin, health, revision, and terminal result.
+- **ParticipantReference**: Opaque tenant/provider/type/ID identity value with an optional display snapshot.
+- **Candidate / Exclusion / SnapshotMember**: Assignment relationships materialized for authorization and querying.
+- **UserTaskAction**: Stable completion key and materialized display label.
+- **UserTaskOperation**: Idempotency and asynchronous transition record keyed by task and operation ID.
+- **UserTaskEvent**: Append-only audit event with actor reference and safe metadata.
+- **UserTaskInvitation**: Hashed one-time invitation, challenge policy, expiry, state, and guest claim relationship.
+- **GuestSession**: Revocable, task-scoped capabilities and expiry.
+- **InvitationDelivery**: Encrypted transient outbox entry for retryable host delivery.
+
+## Success Criteria
+
+- **SC-001**: A published workflow can suspend at a User Task and resume exactly once with a typed result across restart and retry tests.
+- **SC-002**: Two concurrent claimants or terminal actors yield exactly one winner in all automated race tests.
+- **SC-003**: Authorization tests prove no candidate, released worker, unrelated user, cross-tenant manager, or unverified guest can read protected content.
+- **SC-004**: Authorized list queries remain cursor-stable at the target envelope of 100,000 open tasks and millions of terminal tasks per tenant without loading protected payloads.
+- **SC-005**: All supported persistence providers expose the same schema contract and the SQLite integration suite proves restart durability and indexed query behavior.
+- **SC-006**: A worker can locate, claim, and complete a seeded task from Studio on desktop and a narrow viewport without entering an Elsa Identity user ID.
+- **SC-007**: Reconciliation restores every intentionally interrupted bookmark/task/operation test fixture without duplicate tasks or workflow resumes.
+- **SC-008**: Requirements, contracts, implementation tasks, automated tests, and documentation retain stable traceability identifiers.
+
+## Assumptions and Scope
+
+- Hosts already provide authentication and a permission pipeline; the module provides replaceable adapters and safe defaults, not a user database.
+- Server time is UTC and persistence providers support optimistic concurrency.
+- External files are referenced by URI or provider ID; they are not embedded in task JSON.
+- V1 excludes standalone tasks, a native form builder, drafts, comments, attachments, formal delegation, bulk actions, named saved filters, and multi-response tasks.
+- GitHub issue, project, pull-request, and remote review gates are intentionally skipped for this delivery because of reported GitHub downtime; all local specification, test, build, and self-review gates remain in force.
diff --git a/specs/013-user-tasks/tasks.md b/specs/013-user-tasks/tasks.md
new file mode 100644
index 000000000..eeed3bfc8
--- /dev/null
+++ b/specs/013-user-tasks/tasks.md
@@ -0,0 +1,125 @@
+# Tasks: User Tasks
+
+Tasks use `[ID] [P?] [Story] Description with file path`. `[P]` tasks may run in parallel when their file ownership does not overlap.
+
+## Phase 1: Durable specification
+
+- [x] T001 Create the authoritative PRD in `specs/013-user-tasks/spec.md`.
+- [x] T002 [P] Capture official-source decisions in `specs/013-user-tasks/research.md`.
+- [x] T003 [P] Define the runtime data model in `specs/013-user-tasks/data-model.md`.
+- [x] T004 [P] Define REST, runtime, identity, forms, invitations, persistence, and Studio contracts in `specs/013-user-tasks/contracts/`.
+- [x] T005 Add requirements, security, and accessibility gates in `specs/013-user-tasks/checklists/`.
+- [x] T006 Record architecture, sequence, risks, and verification in `specs/013-user-tasks/plan.md`.
+- [x] T007 Reconcile dossier terminology and run cross-artifact analysis across `specs/013-user-tasks/`.
+- [x] T008 Add canonical User Tasks terminology to `CONTEXT.md` and update the active Spec Kit pointer in `AGENTS.md`.
+
+## Phase 2: Core domain and workflow slice
+
+- [x] T009 [US1] Scaffold `src/modules/Elsa.UserTasks/Elsa.UserTasks.csproj` and feature/shell registration.
+- [x] T010 [P] [US1] Add enums and value models for participants, lifecycle, health, actions, form pins, results, operations, and invitations under `src/modules/Elsa.UserTasks/Models/`.
+- [x] T011 [P] [US3] Add replaceable identity, access policy, directory, forms, invitations, manager, repository, clock, and scheduling contracts under `src/modules/Elsa.UserTasks/Contracts/`.
+- [x] T012 [US1] Implement the guarded state machine and aggregate invariants in `src/modules/Elsa.UserTasks/Services/DefaultUserTaskManager.cs`.
+- [x] T013 [P] [US1] Implement the in-memory repository with tenant-safe authorized cursor queries in `src/modules/Elsa.UserTasks/Repositories/`.
+- [x] T014 [P] [US3] Implement default claims resolver and default-deny access policy in `src/modules/Elsa.UserTasks/Services/`.
+- [x] T015 [US1] Implement the blocking `UserTask` activity, materialized bookmark payload, stimulus, and typed output under `src/modules/Elsa.UserTasks/Activities/`.
+- [x] T016 [US1] Project committed bookmarks and finalize removed bookmarks in `src/modules/Elsa.UserTasks/HostedServices/` and notification handlers.
+- [ ] T017 [US5] Add the bounded startup/recurring reconciler for missing projections, stale operations, and orphan records.
+- [x] T018 [P] [US5] Add cluster-safe due scanning, idempotent overdue notification, and optional timeout operation.
+- [x] T019 [P] Add append-only safe audit and mediator lifecycle notification models/dispatch.
+- [x] T020 [P] Add domain, race, disclosure, identity, projection, reconciliation, and due tests in `test/unit/Elsa.UserTasks.UnitTests/`.
+
+## Phase 3: REST and realtime slice
+
+- [x] T021 [US2] Add permissions, API DTOs, safe/protected mapping, and canonical API error mapping under `src/modules/Elsa.UserTasks/`.
+- [x] T022 [P] [US2] Implement authorized cursor search, detail, events, and capability endpoints under `Endpoints/UserTasks/`.
+- [x] T023 [P] [US2] Implement claim, release, assignment, and priority/due update endpoints.
+- [x] T024 [P] [US1] Implement asynchronous complete, cancel, and resolution-retry endpoints with operation idempotency.
+- [x] T025 [P] [US3] Implement optional participant lookup without Elsa Identity coupling.
+- [ ] T026 [US2] Add metadata-free SignalR invalidation and polling-compatible lifecycle notifications.
+- [ ] T027 [P] Add endpoint authorization, concealment, validation, cursor, idempotency, and conflict tests.
+
+## Phase 4: Guest invitations
+
+- [x] T028 [US4] Implement invitation issuance, token hashing, expiry, sibling revocation, and manager APIs.
+- [x] T029 [US4] Implement Data Protection-backed transient delivery outbox and dispatcher retries.
+- [x] T030 [US4] Implement generic rate-limited challenge and verification endpoints.
+- [x] T031 [US4] Implement atomic guest claim and revocable task-scoped session issuance/validation.
+- [x] T032 [P] Add invitation secrecy, expiry, replay, race, guest capability, and recovery tests.
+
+## Phase 5: Persistence providers
+
+- [x] T033 [US5] Scaffold `Elsa.UserTasks.Persistence.EFCore` with module DbContext, entity configurations, repository, and feature.
+- [x] T034 [P] [US5] Add normalized indexes and bounded JSON mappings for tasks, participants, audit, operations, invitations, guest sessions, and delivery outbox.
+- [x] T035 [P] [US5] Add SQLite provider configuration, migration, design-time factory, and shell feature.
+- [x] T036 [P] [US5] Add SQL Server provider configuration, migration, design-time factory, and shell feature.
+- [x] T037 [P] [US5] Add PostgreSQL provider configuration, migration, design-time factory, and shell feature.
+- [x] T038 [P] [US5] Add MySQL provider configuration, migration, design-time factory, and shell feature.
+- [x] T039 [P] [US5] Add Oracle provider configuration, migration, design-time factory, and shell feature.
+- [x] T040 [P] [US5] Add VNext document-store repository and feature.
+- [ ] T041 [US5] Add shared persistence conformance and SQLite restart/index/tenant/cursor tests.
+
+## Phase 6: Elsa Studio
+
+- [x] T042 [US2] Scaffold `Elsa.Studio.UserTasks` module, remote feature, service registration, and Workflows menu item.
+- [x] T043 [P] [US2] Add Refit client and safe/protected/capability/command models.
+- [x] T044 [US2] Implement URL-backed Assigned to me, Available, History, All, and Needs Attention queue views.
+- [x] T045 [US2] Implement desktop split detail and mobile detail route with workflow deep link, protected disclosure, timeline, health, and capability actions.
+- [x] T046 [P] [US2] Implement claim/release/assign/update/complete/cancel/retry interactions with asynchronous and conflict refresh states.
+- [ ] T047 [P] [US1] Add User Task activity editor support and optional replaceable participant lookup picker with raw/expression fallback.
+- [ ] T048 [US2] Add metadata-free SignalR requery coordinator and polling fallback without disrupting focus or form input.
+- [x] T049 [US4] Add replaceable anonymous guest verification and task completion page.
+- [ ] T050 [P] Add Studio client/component tests for tabs, URL filters, disclosure, actions, responsive routing, realtime fallback, and accessibility.
+
+## Phase 7: Documentation and local gates
+
+- [x] T051 Add module configuration, identity integration, forms, invitations, hosting, persistence, and upgrade documentation under `doc/`.
+- [ ] T052 Add runnable sample workflows and host adapter examples referenced by `specs/013-user-tasks/quickstart.md`.
+- [ ] T053 Run affected Core unit/integration tests and all User Tasks persistence conformance tests.
+- [x] T054 Run affected Studio tests and builds.
+- [ ] T055 Build both repositories broadly across configured target frameworks without GitHub-dependent gates.
+- [ ] T056 Re-run requirement-to-task-to-test traceability analysis and resolve every critical/high finding.
+- [ ] T057 Run up to five local self-review passes for correctness, security, API compatibility, accessibility, and maintainability.
+- [ ] T058 Confirm no unrelated files were changed and record local verification evidence.
+
+## Dependencies
+
+T001–T008 precede implementation. Domain T009–T015 precede runtime T016–T019 and REST commands. Auth contracts T011/T014 precede all public queries. Core REST T021–T027 precedes Studio T042–T050. Invitations depend on the core state machine and REST security. EF/VNext depend on repository contracts but can proceed alongside Studio after the Core slice stabilizes. Documentation and final gates follow all slices.
+
+## Requirement traceability
+
+| Requirements | Delivery tasks | Primary verification |
+| --- | --- | --- |
+| FR-001–FR-007, FR-033 | T009–T020 | Activity/runtime, transition-race, projection, bookmark, and reconciliation tests |
+| FR-008–FR-014 | T011, T014, T020–T027 | Identity replacement, authorized query, exclusion, disclosure, and tenant-isolation tests |
+| FR-015–FR-018 | T012, T015, T018, T020, T024 | Form pin/validation, no-form completion, overdue/timeout, and cancellation tests |
+| FR-019–FR-022 | T021–T032 | REST contract, idempotency, invitation secrecy/rate-limit, and guest-session tests |
+| FR-023–FR-026 | T033–T041 | Provider compile/migration review and shared persistence conformance suite |
+| FR-027–FR-031 | T042–T050 | Studio client/component, responsive, disclosure, guest, and accessibility tests |
+| FR-032, FR-034 | T013, T019, T022, T026, T027 | Cursor stability, search safety, notification, and invalidation tests |
+
+## Verification status
+
+Checked items were built and exercised by an automated test or a successful multi-target build in this
+worktree. The following remain open and are deliberately left unchecked:
+
+- **T017** — the reconciler's periodic worker is registered, but its repair logic has no test covering
+ interrupted projection or stale-operation recovery.
+- **T026, T048** — Core has no SignalR invalidation hub yet. Studio ships the client and a
+ visibility-aware polling fallback, so the feature degrades correctly, but the realtime path is not
+ end to end.
+- **T027** — authorization, concealment, idempotency, and conflict behavior are covered at the service
+ layer. There are no HTTP-level endpoint tests asserting the status-code mapping.
+- **T041** — persistence coverage is EF Core/SQLite only. The shared conformance suite across
+ in-memory, EF, and VNext is not written.
+- **T047** — the Studio activity editor contribution and participant-picker integration for the
+ designer are not implemented.
+- **T050** — Studio tests cover the wire contract, URL state, and error mapping. Component-level tests
+ for tabs, disclosure, responsive routing, realtime fallback, and accessibility are not written.
+- **T052** — no runnable sample workflows or host adapter examples yet.
+- **T053, T055** — targeted Core and Studio test suites and the affected module, provider, and host
+ builds pass. A full solution-wide build across every configured target framework has not been run.
+- **T056–T058** — final traceability, self-review, and evidence passes are outstanding.
+
+## Local-only gate note
+
+GitHub issue/project/branch/PR/review automation is intentionally omitted because the user reported GitHub downtime. This does not waive specification analysis, automated tests, builds, traceability, or self-review.
diff --git a/src/apps/Elsa.ModularServer.Web/Elsa.ModularServer.Web.csproj b/src/apps/Elsa.ModularServer.Web/Elsa.ModularServer.Web.csproj
index e6676c124..972ec240d 100644
--- a/src/apps/Elsa.ModularServer.Web/Elsa.ModularServer.Web.csproj
+++ b/src/apps/Elsa.ModularServer.Web/Elsa.ModularServer.Web.csproj
@@ -25,6 +25,7 @@
+
@@ -33,6 +34,8 @@
+
+
diff --git a/src/apps/Elsa.ModularServer.Web/Program.cs b/src/apps/Elsa.ModularServer.Web/Program.cs
index b44a3c436..0b1248f4f 100644
--- a/src/apps/Elsa.ModularServer.Web/Program.cs
+++ b/src/apps/Elsa.ModularServer.Web/Program.cs
@@ -7,6 +7,8 @@ using Elsa.Diagnostics.ConsoleLogs.Dashboard.ShellFeatures;
using Elsa.Diagnostics.StructuredLogs.Dashboard.ShellFeatures;
using Elsa.ExternalAuthentication.OpenIdConnect.ShellFeatures;
using Elsa.ExternalAuthentication.Secrets.ShellFeatures;
+using Elsa.UserTasks.Persistence.EFCore.Sqlite.ShellFeatures;
+using Elsa.UserTasks.ShellFeatures;
using Elsa.ModularServer.Web;
using Elsa.ModularServer.Web.Catalog;
using Elsa.Platform.Integration.ShellFeatures;
@@ -88,7 +90,9 @@ builder.AddShells(shells => shells
typeof(WorkflowRuntimeDashboardFeature),
typeof(ConsoleLogsDashboardFeature),
typeof(StructuredLogsDashboardFeature),
- typeof(WorkflowsApiFeature));
+ typeof(WorkflowsApiFeature),
+ typeof(UserTasksFeature),
+ typeof(SqliteUserTasksPersistenceShellFeature));
}));
services.AddSingleton();
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/DbContextFactories.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/DbContextFactories.cs
new file mode 100644
index 000000000..8e0571746
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/DbContextFactories.cs
@@ -0,0 +1,17 @@
+using Elsa.Persistence.EFCore.Abstractions;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Pomelo.EntityFrameworkCore.MySql.Infrastructure;
+
+namespace Elsa.UserTasks.Persistence.EFCore.MySql;
+
+[UsedImplicitly]
+public class UserTasksDbContextFactory : MySqlUserTasksDesignTimeDbContextFactory;
+public class MySqlUserTasksDesignTimeDbContextFactory : DesignTimeDbContextFactoryBase where TDbContext : DbContext
+{
+ protected override void ConfigureServices(IServiceCollection services) => services.AddMySqlEntityModelCreatingHandlers();
+ protected override void ConfigureBuilder(DbContextOptionsBuilder builder, string connectionString) => builder.UseElsaMySql(GetType().Assembly, connectionString, serverVersion: ServerVersion.Parse("9.0.0"));
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Elsa.UserTasks.Persistence.EFCore.MySql.csproj b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Elsa.UserTasks.Persistence.EFCore.MySql.csproj
new file mode 100644
index 000000000..2f1dcdc2e
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Elsa.UserTasks.Persistence.EFCore.MySql.csproj
@@ -0,0 +1,9 @@
+
+ net8.0;net9.0Provides MySQL EF Core persistence for Elsa user tasks.elsa module user tasks persistence efcore mysql
+
+
+
+
+
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Extensions/MySqlUserTasksPersistenceFeatureExtensions.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Extensions/MySqlUserTasksPersistenceFeatureExtensions.cs
new file mode 100644
index 000000000..2f9412323
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Extensions/MySqlUserTasksPersistenceFeatureExtensions.cs
@@ -0,0 +1,14 @@
+using System.Reflection;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore.Features;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+
+namespace Elsa.UserTasks.Persistence.EFCore.MySql.Extensions;
+
+public static class MySqlUserTasksPersistenceFeatureExtensions
+{
+ private static Assembly Assembly => typeof(MySqlUserTasksPersistenceFeatureExtensions).Assembly;
+ public static EFCoreUserTasksPersistenceFeature UseMySql(this EFCoreUserTasksPersistenceFeature feature, string connectionString, ElsaDbContextOptions? options = null, Action? configure = null) => feature.UseMySql(Assembly, connectionString, options, configure);
+ public static EFCoreUserTasksPersistenceFeature UseMySql(this EFCoreUserTasksPersistenceFeature feature, Func connectionStringFunc, ElsaDbContextOptions? options = null, Action? configure = null) => feature.UseMySql(Assembly, connectionStringFunc, options, configure);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/FodyWeavers.xml b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/FodyWeavers.xml
new file mode 100644
index 000000000..8304193f8
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/FodyWeavers.xml
@@ -0,0 +1,2 @@
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Migrations/UserTasks/20260817120000_Initial.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Migrations/UserTasks/20260817120000_Initial.cs
new file mode 100644
index 000000000..bd4ec2cd9
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/Migrations/UserTasks/20260817120000_Initial.cs
@@ -0,0 +1,17 @@
+using Elsa.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore.Migrations;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+namespace Elsa.UserTasks.Persistence.EFCore.MySql.Migrations.UserTasks;
+
+[DbContext(typeof(UserTasksElsaDbContext))]
+[Migration("20260817120000_Initial")]
+public partial class Initial : Migration
+{
+ private readonly IElsaDbContextSchema schema;
+ public Initial(IElsaDbContextSchema schema) => this.schema = schema ?? throw new ArgumentNullException(nameof(schema));
+ protected override void Up(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Up(migrationBuilder, schema.Schema);
+ protected override void Down(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Down(migrationBuilder, schema.Schema);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/ShellFeatures/MySqlUserTasksPersistenceShellFeature.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/ShellFeatures/MySqlUserTasksPersistenceShellFeature.cs
new file mode 100644
index 000000000..6f3cc0c6c
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.MySql/ShellFeatures/MySqlUserTasksPersistenceShellFeature.cs
@@ -0,0 +1,27 @@
+using System.Reflection;
+using CShells.Features;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.Platform.PackageManifest.Generator.Hints;
+using Elsa.UserTasks.Persistence.EFCore.ShellFeatures;
+using Elsa.UserTasks.ShellFeatures;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Elsa.UserTasks.Persistence.EFCore.MySql.ShellFeatures;
+
+[ManifestFeatureCategory("User Tasks")]
+[ManifestFeatureCategory("Persistence")]
+[ShellFeature(DisplayName = "MySQL User Tasks Persistence", Description = "Provides MySQL persistence for User Tasks", DependsOn = [typeof(UserTasksFeature)])]
+[UsedImplicitly]
+[ManifestInfrastructure("mysql-database", "database", Reason = "Stores User Tasks data in MySQL.", Providers = new[] { "MySQL" }, ConfigurationKeys = new[] { "ConnectionString" })]
+public sealed class MySqlUserTasksPersistenceShellFeature : EFCoreUserTasksPersistenceShellFeatureBase
+{
+ protected override void ConfigureProvider(DbContextOptionsBuilder builder, Assembly migrationsAssembly, string connectionString, ElsaDbContextOptions? options) => builder.UseElsaMySql(migrationsAssembly, connectionString, options);
+ protected override void OnConfiguring(IServiceCollection services)
+ {
+ services.AddMySqlEntityModelCreatingHandlers();
+ base.OnConfiguring(services);
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/DbContextFactories.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/DbContextFactories.cs
new file mode 100644
index 000000000..abaf63825
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/DbContextFactories.cs
@@ -0,0 +1,15 @@
+using Elsa.Persistence.EFCore.Abstractions;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Oracle;
+
+[UsedImplicitly]
+public class UserTasksDbContextFactory : OracleUserTasksDesignTimeDbContextFactory;
+public class OracleUserTasksDesignTimeDbContextFactory : DesignTimeDbContextFactoryBase where TDbContext : DbContext
+{
+ protected override void ConfigureBuilder(DbContextOptionsBuilder builder, string connectionString) => builder.UseElsaOracle(GetType().Assembly, connectionString, new ElsaDbContextOptions().ConfigureOracle());
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Elsa.UserTasks.Persistence.EFCore.Oracle.csproj b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Elsa.UserTasks.Persistence.EFCore.Oracle.csproj
new file mode 100644
index 000000000..f6481a8bf
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Elsa.UserTasks.Persistence.EFCore.Oracle.csproj
@@ -0,0 +1,9 @@
+
+ Provides Oracle EF Core persistence for Elsa user tasks.elsa module user tasks persistence efcore oracle
+
+
+
+
+
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Extensions/OracleUserTasksPersistenceFeatureExtensions.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Extensions/OracleUserTasksPersistenceFeatureExtensions.cs
new file mode 100644
index 000000000..39ac2edb0
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Extensions/OracleUserTasksPersistenceFeatureExtensions.cs
@@ -0,0 +1,14 @@
+using System.Reflection;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore.Features;
+using Oracle.EntityFrameworkCore.Infrastructure;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Oracle.Extensions;
+
+public static class OracleUserTasksPersistenceFeatureExtensions
+{
+ private static Assembly Assembly => typeof(OracleUserTasksPersistenceFeatureExtensions).Assembly;
+ public static EFCoreUserTasksPersistenceFeature UseOracle(this EFCoreUserTasksPersistenceFeature feature, string connectionString, ElsaDbContextOptions? options = null, Action? configure = null) => feature.UseOracle(Assembly, connectionString, options, configure);
+ public static EFCoreUserTasksPersistenceFeature UseOracle(this EFCoreUserTasksPersistenceFeature feature, Func connectionStringFunc, ElsaDbContextOptions? options = null, Action? configure = null) => feature.UseOracle(Assembly, connectionStringFunc, options, configure);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/FodyWeavers.xml b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/FodyWeavers.xml
new file mode 100644
index 000000000..8304193f8
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/FodyWeavers.xml
@@ -0,0 +1,2 @@
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Migrations/UserTasks/20260817120000_Initial.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Migrations/UserTasks/20260817120000_Initial.cs
new file mode 100644
index 000000000..b41b8611e
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/Migrations/UserTasks/20260817120000_Initial.cs
@@ -0,0 +1,17 @@
+using Elsa.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore.Migrations;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Oracle.Migrations.UserTasks;
+
+[DbContext(typeof(UserTasksElsaDbContext))]
+[Migration("20260817120000_Initial")]
+public partial class Initial : Migration
+{
+ private readonly IElsaDbContextSchema schema;
+ public Initial(IElsaDbContextSchema schema) => this.schema = schema ?? throw new ArgumentNullException(nameof(schema));
+ protected override void Up(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Up(migrationBuilder, schema.Schema);
+ protected override void Down(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Down(migrationBuilder, schema.Schema);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/ShellFeatures/OracleUserTasksPersistenceShellFeature.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/ShellFeatures/OracleUserTasksPersistenceShellFeature.cs
new file mode 100644
index 000000000..6145fe785
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Oracle/ShellFeatures/OracleUserTasksPersistenceShellFeature.cs
@@ -0,0 +1,21 @@
+using System.Reflection;
+using CShells.Features;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.Platform.PackageManifest.Generator.Hints;
+using Elsa.UserTasks.Persistence.EFCore.ShellFeatures;
+using Elsa.UserTasks.ShellFeatures;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Oracle.ShellFeatures;
+
+[ManifestFeatureCategory("User Tasks")]
+[ManifestFeatureCategory("Persistence")]
+[ShellFeature(DisplayName = "Oracle User Tasks Persistence", Description = "Provides Oracle persistence for User Tasks", DependsOn = [typeof(UserTasksFeature)])]
+[UsedImplicitly]
+[ManifestInfrastructure("oracle-database", "database", Reason = "Stores User Tasks data in Oracle.", Providers = new[] { "Oracle" }, ConfigurationKeys = new[] { "ConnectionString" })]
+public sealed class OracleUserTasksPersistenceShellFeature : EFCoreUserTasksPersistenceShellFeatureBase
+{
+ protected override void ConfigureProvider(DbContextOptionsBuilder builder, Assembly migrationsAssembly, string connectionString, ElsaDbContextOptions? options) => builder.UseElsaOracle(migrationsAssembly, connectionString, options.ConfigureOracle());
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/DbContextFactories.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/DbContextFactories.cs
new file mode 100644
index 000000000..30b1d5891
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/DbContextFactories.cs
@@ -0,0 +1,16 @@
+using Elsa.Persistence.EFCore.Abstractions;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Elsa.UserTasks.Persistence.EFCore.PostgreSql;
+
+[UsedImplicitly]
+public class UserTasksDbContextFactory : PostgreSqlUserTasksDesignTimeDbContextFactory;
+public class PostgreSqlUserTasksDesignTimeDbContextFactory : DesignTimeDbContextFactoryBase where TDbContext : DbContext
+{
+ protected override void ConfigureServices(IServiceCollection services) => services.AddPostgreSqlEntityModelCreatingHandlers();
+ protected override void ConfigureBuilder(DbContextOptionsBuilder builder, string connectionString) => builder.UseElsaPostgreSql(GetType().Assembly, connectionString);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Elsa.UserTasks.Persistence.EFCore.PostgreSql.csproj b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Elsa.UserTasks.Persistence.EFCore.PostgreSql.csproj
new file mode 100644
index 000000000..1b4b12738
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Elsa.UserTasks.Persistence.EFCore.PostgreSql.csproj
@@ -0,0 +1,8 @@
+
+ Provides PostgreSQL EF Core persistence for Elsa user tasks.elsa module user tasks persistence efcore postgresql
+
+
+
+
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Extensions/PostgreSqlUserTasksPersistenceFeatureExtensions.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Extensions/PostgreSqlUserTasksPersistenceFeatureExtensions.cs
new file mode 100644
index 000000000..b1fce544e
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Extensions/PostgreSqlUserTasksPersistenceFeatureExtensions.cs
@@ -0,0 +1,14 @@
+using System.Reflection;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore.Features;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Infrastructure;
+
+namespace Elsa.UserTasks.Persistence.EFCore.PostgreSql.Extensions;
+
+public static class PostgreSqlUserTasksPersistenceFeatureExtensions
+{
+ private static Assembly Assembly => typeof(PostgreSqlUserTasksPersistenceFeatureExtensions).Assembly;
+ public static EFCoreUserTasksPersistenceFeature UsePostgreSql(this EFCoreUserTasksPersistenceFeature feature, string connectionString, ElsaDbContextOptions? options = null, Action? configure = null) => feature.UsePostgreSql(Assembly, connectionString, options, configure);
+ public static EFCoreUserTasksPersistenceFeature UsePostgreSql(this EFCoreUserTasksPersistenceFeature feature, Func connectionStringFunc, ElsaDbContextOptions? options = null, Action? configure = null) => feature.UsePostgreSql(Assembly, connectionStringFunc, options, configure);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/FodyWeavers.xml b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/FodyWeavers.xml
new file mode 100644
index 000000000..8304193f8
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/FodyWeavers.xml
@@ -0,0 +1,2 @@
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Migrations/UserTasks/20260817120000_Initial.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Migrations/UserTasks/20260817120000_Initial.cs
new file mode 100644
index 000000000..e5f7e3320
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/Migrations/UserTasks/20260817120000_Initial.cs
@@ -0,0 +1,17 @@
+using Elsa.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore.Migrations;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+namespace Elsa.UserTasks.Persistence.EFCore.PostgreSql.Migrations.UserTasks;
+
+[DbContext(typeof(UserTasksElsaDbContext))]
+[Migration("20260817120000_Initial")]
+public partial class Initial : Migration
+{
+ private readonly IElsaDbContextSchema schema;
+ public Initial(IElsaDbContextSchema schema) => this.schema = schema ?? throw new ArgumentNullException(nameof(schema));
+ protected override void Up(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Up(migrationBuilder, schema.Schema);
+ protected override void Down(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Down(migrationBuilder, schema.Schema);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/ShellFeatures/PostgreSqlUserTasksPersistenceShellFeature.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/ShellFeatures/PostgreSqlUserTasksPersistenceShellFeature.cs
new file mode 100644
index 000000000..8e41bb22f
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.PostgreSql/ShellFeatures/PostgreSqlUserTasksPersistenceShellFeature.cs
@@ -0,0 +1,27 @@
+using System.Reflection;
+using CShells.Features;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.Platform.PackageManifest.Generator.Hints;
+using Elsa.UserTasks.Persistence.EFCore.ShellFeatures;
+using Elsa.UserTasks.ShellFeatures;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Elsa.UserTasks.Persistence.EFCore.PostgreSql.ShellFeatures;
+
+[ManifestFeatureCategory("User Tasks")]
+[ManifestFeatureCategory("Persistence")]
+[ShellFeature(DisplayName = "PostgreSQL User Tasks Persistence", Description = "Provides PostgreSQL persistence for User Tasks", DependsOn = [typeof(UserTasksFeature)])]
+[UsedImplicitly]
+[ManifestInfrastructure("postgresql-database", "database", Reason = "Stores User Tasks data in PostgreSQL.", Providers = new[] { "PostgreSQL" }, ConfigurationKeys = new[] { "ConnectionString" })]
+public sealed class PostgreSqlUserTasksPersistenceShellFeature : EFCoreUserTasksPersistenceShellFeatureBase
+{
+ protected override void ConfigureProvider(DbContextOptionsBuilder builder, Assembly migrationsAssembly, string connectionString, ElsaDbContextOptions? options) => builder.UseElsaPostgreSql(migrationsAssembly, connectionString, options);
+ protected override void OnConfiguring(IServiceCollection services)
+ {
+ services.AddPostgreSqlEntityModelCreatingHandlers();
+ base.OnConfiguring(services);
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/DbContextFactories.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/DbContextFactories.cs
new file mode 100644
index 000000000..9016dedbe
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/DbContextFactories.cs
@@ -0,0 +1,15 @@
+using Elsa.Persistence.EFCore.Abstractions;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+
+namespace Elsa.UserTasks.Persistence.EFCore.SqlServer;
+
+[UsedImplicitly]
+public class UserTasksDbContextFactory : SqlServerUserTasksDesignTimeDbContextFactory;
+
+public class SqlServerUserTasksDesignTimeDbContextFactory : DesignTimeDbContextFactoryBase where TDbContext : DbContext
+{
+ protected override void ConfigureBuilder(DbContextOptionsBuilder builder, string connectionString) => builder.UseElsaSqlServer(GetType().Assembly, connectionString);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Elsa.UserTasks.Persistence.EFCore.SqlServer.csproj b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Elsa.UserTasks.Persistence.EFCore.SqlServer.csproj
new file mode 100644
index 000000000..d85f42d51
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Elsa.UserTasks.Persistence.EFCore.SqlServer.csproj
@@ -0,0 +1,8 @@
+
+ Provides SQL Server EF Core persistence for Elsa user tasks.elsa module user tasks persistence efcore sqlserver
+
+
+
+
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Extensions/SqlServerUserTasksPersistenceFeatureExtensions.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Extensions/SqlServerUserTasksPersistenceFeatureExtensions.cs
new file mode 100644
index 000000000..6b1d5fb54
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Extensions/SqlServerUserTasksPersistenceFeatureExtensions.cs
@@ -0,0 +1,16 @@
+using System.Reflection;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore.Features;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+
+namespace Elsa.UserTasks.Persistence.EFCore.SqlServer.Extensions;
+
+public static class SqlServerUserTasksPersistenceFeatureExtensions
+{
+ private static Assembly Assembly => typeof(SqlServerUserTasksPersistenceFeatureExtensions).Assembly;
+
+ public static EFCoreUserTasksPersistenceFeature UseSqlServer(this EFCoreUserTasksPersistenceFeature feature, string connectionString, ElsaDbContextOptions? options = null, Action? configure = null) => feature.UseSqlServer(Assembly, connectionString, options, configure);
+
+ public static EFCoreUserTasksPersistenceFeature UseSqlServer(this EFCoreUserTasksPersistenceFeature feature, Func connectionStringFunc, ElsaDbContextOptions? options = null, Action? configure = null) => feature.UseSqlServer(Assembly, connectionStringFunc, options, configure);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/FodyWeavers.xml b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/FodyWeavers.xml
new file mode 100644
index 000000000..8304193f8
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/FodyWeavers.xml
@@ -0,0 +1,2 @@
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Migrations/UserTasks/20260817120000_Initial.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Migrations/UserTasks/20260817120000_Initial.cs
new file mode 100644
index 000000000..53ec19143
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/Migrations/UserTasks/20260817120000_Initial.cs
@@ -0,0 +1,17 @@
+using Elsa.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore.Migrations;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+namespace Elsa.UserTasks.Persistence.EFCore.SqlServer.Migrations.UserTasks;
+
+[DbContext(typeof(UserTasksElsaDbContext))]
+[Migration("20260817120000_Initial")]
+public partial class Initial : Migration
+{
+ private readonly IElsaDbContextSchema schema;
+ public Initial(IElsaDbContextSchema schema) => this.schema = schema ?? throw new ArgumentNullException(nameof(schema));
+ protected override void Up(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Up(migrationBuilder, schema.Schema);
+ protected override void Down(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Down(migrationBuilder, schema.Schema);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/ShellFeatures/SqlServerUserTasksPersistenceShellFeature.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/ShellFeatures/SqlServerUserTasksPersistenceShellFeature.cs
new file mode 100644
index 000000000..1d2785fb5
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.SqlServer/ShellFeatures/SqlServerUserTasksPersistenceShellFeature.cs
@@ -0,0 +1,21 @@
+using System.Reflection;
+using CShells.Features;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.Platform.PackageManifest.Generator.Hints;
+using Elsa.UserTasks.Persistence.EFCore.ShellFeatures;
+using Elsa.UserTasks.ShellFeatures;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+
+namespace Elsa.UserTasks.Persistence.EFCore.SqlServer.ShellFeatures;
+
+[ManifestFeatureCategory("User Tasks")]
+[ManifestFeatureCategory("Persistence")]
+[ShellFeature(DisplayName = "SQL Server User Tasks Persistence", Description = "Provides SQL Server persistence for User Tasks", DependsOn = [typeof(UserTasksFeature)])]
+[UsedImplicitly]
+[ManifestInfrastructure("sqlserver-database", "database", Reason = "Stores User Tasks data in SQL Server.", Providers = new[] { "SQL Server" }, ConfigurationKeys = new[] { "ConnectionString" })]
+public sealed class SqlServerUserTasksPersistenceShellFeature : EFCoreUserTasksPersistenceShellFeatureBase
+{
+ protected override void ConfigureProvider(DbContextOptionsBuilder builder, Assembly migrationsAssembly, string connectionString, ElsaDbContextOptions? options) => builder.UseElsaSqlServer(migrationsAssembly, connectionString, options);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/DbContextFactories.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/DbContextFactories.cs
new file mode 100644
index 000000000..a253f50f7
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/DbContextFactories.cs
@@ -0,0 +1,24 @@
+using Elsa.Persistence.EFCore.Abstractions;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Sqlite;
+
+[UsedImplicitly]
+public class UserTasksDbContextFactory : SqliteUserTasksDesignTimeDbContextFactory;
+
+public class SqliteUserTasksDesignTimeDbContextFactory : DesignTimeDbContextFactoryBase where TDbContext : DbContext
+{
+ protected override void ConfigureServices(IServiceCollection services)
+ {
+ services.AddSqliteEntityModelCreatingHandlers();
+ }
+
+ protected override void ConfigureBuilder(DbContextOptionsBuilder builder, string connectionString)
+ {
+ builder.UseElsaSqlite(GetType().Assembly, connectionString);
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Elsa.UserTasks.Persistence.EFCore.Sqlite.csproj b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Elsa.UserTasks.Persistence.EFCore.Sqlite.csproj
new file mode 100644
index 000000000..c9dab9158
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Elsa.UserTasks.Persistence.EFCore.Sqlite.csproj
@@ -0,0 +1,11 @@
+
+
+ Provides SQLite EF Core persistence for Elsa user tasks.
+ elsa module user tasks persistence efcore sqlite
+
+
+
+
+
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Extensions/SqliteUserTasksPersistenceFeatureExtensions.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Extensions/SqliteUserTasksPersistenceFeatureExtensions.cs
new file mode 100644
index 000000000..375a321d6
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Extensions/SqliteUserTasksPersistenceFeatureExtensions.cs
@@ -0,0 +1,31 @@
+using System.Reflection;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.UserTasks.Persistence.EFCore.Features;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Sqlite.Extensions;
+
+public static class SqliteUserTasksPersistenceFeatureExtensions
+{
+ private static Assembly Assembly => typeof(SqliteUserTasksPersistenceFeatureExtensions).Assembly;
+
+ public static EFCoreUserTasksPersistenceFeature UseSqlite(
+ this EFCoreUserTasksPersistenceFeature feature,
+ string? connectionString = null,
+ ElsaDbContextOptions? options = null,
+ Action? configure = null)
+ {
+ connectionString ??= "Data Source=elsa.sqlite.db;Cache=Shared;";
+ return feature.UseSqlite(_ => connectionString, options, configure);
+ }
+
+ public static EFCoreUserTasksPersistenceFeature UseSqlite(
+ this EFCoreUserTasksPersistenceFeature feature,
+ Func connectionStringFunc,
+ ElsaDbContextOptions? options = null,
+ Action? configure = null)
+ {
+ return feature.UseSqlite(Assembly, connectionStringFunc, options, configure);
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/FodyWeavers.xml b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/FodyWeavers.xml
new file mode 100644
index 000000000..bc5a74a23
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/FodyWeavers.xml
@@ -0,0 +1,3 @@
+
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Migrations/UserTasks/20260817120000_Initial.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Migrations/UserTasks/20260817120000_Initial.cs
new file mode 100644
index 000000000..1736b84e2
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/Migrations/UserTasks/20260817120000_Initial.cs
@@ -0,0 +1,23 @@
+using Elsa.Persistence.EFCore;
+using Elsa.UserTasks.Persistence.EFCore.Migrations;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Sqlite.Migrations.UserTasks;
+
+[DbContext(typeof(UserTasksElsaDbContext))]
+[Migration("20260817120000_Initial")]
+public partial class Initial : Migration
+{
+ private readonly IElsaDbContextSchema _schema;
+
+ public Initial(IElsaDbContextSchema schema)
+ {
+ _schema = schema ?? throw new ArgumentNullException(nameof(schema));
+ }
+
+ protected override void Up(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Up(migrationBuilder, _schema.Schema);
+
+ protected override void Down(MigrationBuilder migrationBuilder) => UserTasksSchemaMigration.Down(migrationBuilder, _schema.Schema);
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/ShellFeatures/SqliteUserTasksPersistenceShellFeature.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/ShellFeatures/SqliteUserTasksPersistenceShellFeature.cs
new file mode 100644
index 000000000..2753f0743
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore.Sqlite/ShellFeatures/SqliteUserTasksPersistenceShellFeature.cs
@@ -0,0 +1,34 @@
+using System.Reflection;
+using CShells.Features;
+using Elsa.Persistence.EFCore;
+using Elsa.Persistence.EFCore.Extensions;
+using Elsa.Platform.PackageManifest.Generator.Hints;
+using Elsa.UserTasks.Persistence.EFCore.ShellFeatures;
+using Elsa.UserTasks.ShellFeatures;
+using JetBrains.Annotations;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Sqlite.ShellFeatures;
+
+[ManifestFeatureCategory("User Tasks")]
+[ManifestFeatureCategory("Persistence")]
+[ShellFeature(
+ DisplayName = "SQLite User Tasks Persistence",
+ Description = "Provides SQLite persistence for User Tasks",
+ DependsOn = [typeof(UserTasksFeature)])]
+[UsedImplicitly]
+[ManifestInfrastructure("sqlite-database", "database", Reason = "Stores User Tasks data in SQLite.", Providers = new[] { "SQLite" }, ConfigurationKeys = new[] { "ConnectionString" })]
+public sealed class SqliteUserTasksPersistenceShellFeature : EFCoreUserTasksPersistenceShellFeatureBase
+{
+ protected override void ConfigureProvider(DbContextOptionsBuilder builder, Assembly migrationsAssembly, string connectionString, ElsaDbContextOptions? options)
+ {
+ builder.UseElsaSqlite(migrationsAssembly, connectionString, options);
+ }
+
+ protected override void OnConfiguring(IServiceCollection services)
+ {
+ services.AddSqliteEntityModelCreatingHandlers();
+ base.OnConfiguring(services);
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/Contracts/IUserTaskPersistenceAdapter.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore/Contracts/IUserTaskPersistenceAdapter.cs
new file mode 100644
index 000000000..91e9e10ba
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/Contracts/IUserTaskPersistenceAdapter.cs
@@ -0,0 +1,34 @@
+namespace Elsa.UserTasks.Persistence.EFCore.Contracts;
+
+///
+/// Low-level record adapter used by migration/reconciliation infrastructure. The public aggregate
+/// repository is implemented by the same EF repository below.
+///
+public interface IUserTaskPersistenceAdapter
+{
+ Task GetAsync(string tenantId, string taskId, CancellationToken cancellationToken = default);
+
+ Task> QueryAsync(
+ UserTaskPersistenceQuery query,
+ CancellationToken cancellationToken = default);
+
+ Task TryAddProjectionAsync(
+ UserTaskRecord task,
+ CancellationToken cancellationToken = default);
+
+ Task TrySaveAsync(
+ UserTaskRecord task,
+ int expectedRevision,
+ CancellationToken cancellationToken = default);
+}
+
+public sealed class UserTaskPersistenceQuery
+{
+ public string TenantId { get; init; } = default!;
+ public IReadOnlyCollection Statuses { get; init; } = [];
+ public string? AssigneeProvider { get; init; }
+ public string? AssigneeType { get; init; }
+ public string? AssigneeId { get; init; }
+ public string? Search { get; init; }
+ public int? Limit { get; init; }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/Elsa.UserTasks.Persistence.EFCore.csproj b/src/modules/Elsa.UserTasks.Persistence.EFCore/Elsa.UserTasks.Persistence.EFCore.csproj
new file mode 100644
index 000000000..5df5e6f2f
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/Elsa.UserTasks.Persistence.EFCore.csproj
@@ -0,0 +1,17 @@
+
+
+
+
+ Provides Entity Framework Core persistence for Elsa user tasks.
+
+ elsa module user tasks persistence efcore
+
+
+
+
+
+
+
+
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/Extensions/UserTasksPersistenceFeatureExtensions.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore/Extensions/UserTasksPersistenceFeatureExtensions.cs
new file mode 100644
index 000000000..ca1d74990
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/Extensions/UserTasksPersistenceFeatureExtensions.cs
@@ -0,0 +1,13 @@
+using Elsa.UserTasks.Features;
+using Elsa.UserTasks.Persistence.EFCore.Features;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Extensions;
+
+public static class UserTasksPersistenceFeatureExtensions
+{
+ public static UserTasksFeature UseEntityFrameworkCore(this UserTasksFeature feature, Action? configure = null)
+ {
+ feature.Module.Configure(configure);
+ return feature;
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/Features/EFCoreUserTasksPersistenceFeature.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore/Features/EFCoreUserTasksPersistenceFeature.cs
new file mode 100644
index 000000000..448464cfe
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/Features/EFCoreUserTasksPersistenceFeature.cs
@@ -0,0 +1,33 @@
+using Elsa.Features.Attributes;
+using Elsa.Features.Services;
+using Elsa.Persistence.EFCore;
+using Elsa.UserTasks.Contracts;
+using Elsa.UserTasks.Features;
+using Elsa.UserTasks.Persistence.EFCore.Contracts;
+using Elsa.UserTasks.Persistence.EFCore.Repositories;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Features;
+
+///
+/// Configures the identity-neutral User Tasks repository with EF Core persistence.
+///
+[DependsOn(typeof(UserTasksFeature))]
+public class EFCoreUserTasksPersistenceFeature(IModule module)
+ : PersistenceFeatureBase(module)
+{
+ public override void Apply()
+ {
+ base.Apply();
+ AddStore();
+ AddStore();
+ AddStore();
+ Services.AddScoped();
+ Services.AddScoped();
+
+ // Guest sessions and invitation deliveries carry secrets that must survive a restart and a
+ // failover, so the provider replaces the Core in-memory defaults registered by TryAdd.
+ Services.AddScoped();
+ Services.AddScoped();
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/FodyWeavers.xml b/src/modules/Elsa.UserTasks.Persistence.EFCore/FodyWeavers.xml
new file mode 100644
index 000000000..bc5a74a23
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/FodyWeavers.xml
@@ -0,0 +1,3 @@
+
+
+
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/Migrations/UserTasksSchemaMigration.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore/Migrations/UserTasksSchemaMigration.cs
new file mode 100644
index 000000000..dfdaaa967
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/Migrations/UserTasksSchemaMigration.cs
@@ -0,0 +1,264 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Migrations;
+
+///
+/// Provider-neutral initial schema operations. Provider migration assemblies call this helper so their
+/// generated migration shape stays functionally identical while EF chooses provider column types.
+///
+public static class UserTasksSchemaMigration
+{
+ public static void Up(MigrationBuilder migrationBuilder, string schema)
+ {
+ migrationBuilder.EnsureSchema(schema);
+
+ migrationBuilder.CreateTable(name: "UserTasks", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ WorkflowDefinitionId = table.Column(maxLength: 450, nullable: false),
+ WorkflowDefinitionName = table.Column(maxLength: 500, nullable: true),
+ WorkflowDefinitionVersion = table.Column(nullable: true),
+ WorkflowInstanceId = table.Column(maxLength: 450, nullable: false),
+ WorkflowInstanceReference = table.Column(maxLength: 500, nullable: true),
+ ActivityInstanceId = table.Column(maxLength: 450, nullable: false),
+ BookmarkId = table.Column(maxLength: 450, nullable: false),
+ MaterializationKey = table.Column(maxLength: 900, nullable: false),
+ Title = table.Column(maxLength: 500, nullable: false),
+ Summary = table.Column(maxLength: 4000, nullable: true),
+ Reference = table.Column(maxLength: 500, nullable: true),
+ TaskType = table.Column(maxLength: 200, nullable: true),
+ TagsJson = table.Column(nullable: false),
+ RequesterProvider = table.Column(maxLength: 200, nullable: true),
+ RequesterType = table.Column(maxLength: 64, nullable: true),
+ RequesterId = table.Column(maxLength: 450, nullable: true),
+ RequesterDisplayName = table.Column(maxLength: 500, nullable: true),
+ Priority = table.Column(nullable: false),
+ DueAt = table.Column(nullable: true),
+ IsOverdue = table.Column(nullable: false),
+ Status = table.Column(maxLength: 32, nullable: false),
+ TimeoutEnabled = table.Column(nullable: false),
+ CancellationEnabled = table.Column(nullable: false),
+ AllowManagerExclusionOverride = table.Column(nullable: false),
+ MembershipResolutionMode = table.Column(maxLength: 32, nullable: true),
+ AssigneeProvider = table.Column(maxLength: 200, nullable: true),
+ AssigneeType = table.Column(maxLength: 64, nullable: true),
+ AssigneeId = table.Column(maxLength: 450, nullable: true),
+ AssigneeDisplayName = table.Column(maxLength: 500, nullable: true),
+ InstructionsJson = table.Column(nullable: false),
+ TaskDataJson = table.Column(nullable: false),
+ FormReferenceJson = table.Column(nullable: true),
+ PinnedFormJson = table.Column(nullable: true),
+ ActionsJson = table.Column(nullable: true),
+ InvitationDefinitionsJson = table.Column(nullable: false),
+ HealthIssuesJson = table.Column(nullable: false),
+ HealthSeverity = table.Column(maxLength: 32, nullable: true),
+ HealthCode = table.Column(maxLength: 200, nullable: true),
+ HealthMessage = table.Column(maxLength: 4000, nullable: true),
+ CompletionActionKey = table.Column(maxLength: 200, nullable: true),
+ CompletionDataJson = table.Column(nullable: true),
+ CompletionActorJson = table.Column(nullable: true),
+ CreatedAt = table.Column(nullable: false),
+ UpdatedAt = table.Column(nullable: false),
+ AssignedAt = table.Column(nullable: true),
+ CompletedAt = table.Column(nullable: true),
+ Revision = table.Column(nullable: false),
+ CreatedFromBookmarkRevision = table.Column(nullable: true)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTasks", x => x.Id));
+
+ migrationBuilder.CreateTable(name: "UserTaskCandidates", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ TaskId = table.Column(maxLength: 450, nullable: false),
+ Provider = table.Column(maxLength: 200, nullable: false),
+ ParticipantKey = table.Column(maxLength: 800, nullable: false),
+ ParticipantType = table.Column(maxLength: 32, nullable: false),
+ ParticipantId = table.Column(maxLength: 450, nullable: false),
+ DisplayName = table.Column(maxLength: 500, nullable: true),
+ Source = table.Column(maxLength: 32, nullable: false),
+ SourceGroupProvider = table.Column(maxLength: 200, nullable: true),
+ SourceGroupId = table.Column(maxLength: 450, nullable: true),
+ CreatedAt = table.Column(nullable: false),
+ UpdatedAt = table.Column(nullable: false)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTaskCandidates", x => x.Id));
+
+ migrationBuilder.CreateTable(name: "UserTaskSnapshotMembers", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ TaskId = table.Column(maxLength: 450, nullable: false),
+ Provider = table.Column(maxLength: 200, nullable: false),
+ ParticipantKey = table.Column(maxLength: 800, nullable: false),
+ ParticipantType = table.Column(maxLength: 32, nullable: false),
+ ParticipantId = table.Column(maxLength: 450, nullable: false),
+ SourceGroupProvider = table.Column(maxLength: 200, nullable: true),
+ SourceGroupId = table.Column(maxLength: 450, nullable: true),
+ CreatedAt = table.Column(nullable: false)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTaskSnapshotMembers", x => x.Id));
+
+ migrationBuilder.CreateTable(name: "UserTaskExclusions", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ TaskId = table.Column(maxLength: 450, nullable: false),
+ Provider = table.Column(maxLength: 200, nullable: false),
+ ParticipantKey = table.Column(maxLength: 800, nullable: false),
+ ParticipantType = table.Column(maxLength: 32, nullable: false),
+ ParticipantId = table.Column(maxLength: 450, nullable: false),
+ CreatedAt = table.Column(nullable: false)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTaskExclusions", x => x.Id));
+
+ migrationBuilder.CreateTable(name: "UserTaskEvents", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ TaskId = table.Column(maxLength: 450, nullable: false),
+ Revision = table.Column(nullable: false),
+ EventType = table.Column(maxLength: 64, nullable: false),
+ OccurredAt = table.Column(nullable: false),
+ OperationId = table.Column(maxLength: 450, nullable: true),
+ ActorProvider = table.Column(maxLength: 200, nullable: true),
+ ActorType = table.Column(maxLength: 64, nullable: true),
+ ActorId = table.Column(maxLength: 450, nullable: true),
+ ActorJson = table.Column(nullable: true),
+ Reason = table.Column(maxLength: 4000, nullable: true),
+ MetadataJson = table.Column(nullable: false)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTaskEvents", x => x.Id));
+
+ migrationBuilder.CreateTable(name: "UserTaskOperations", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ TaskId = table.Column(maxLength: 450, nullable: false),
+ OperationId = table.Column(maxLength: 450, nullable: false),
+ Kind = table.Column(maxLength: 64, nullable: false),
+ ExpectedRevision = table.Column(nullable: false),
+ RequestHash = table.Column(maxLength: 128, nullable: false),
+ Status = table.Column(maxLength: 32, nullable: false),
+ Attempts = table.Column(nullable: false),
+ SafeResultJson = table.Column(nullable: true),
+ ProtectedPayloadJson = table.Column(nullable: true),
+ ActionKey = table.Column(maxLength: 200, nullable: true),
+ ErrorCode = table.Column(maxLength: 200, nullable: true),
+ CreatedAt = table.Column(nullable: false),
+ UpdatedAt = table.Column(nullable: false),
+ CompletedAt = table.Column(nullable: true)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTaskOperations", x => x.Id));
+
+ migrationBuilder.CreateTable(name: "UserTaskInvitations", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ TaskId = table.Column(maxLength: 450, nullable: false),
+ SiblingGroupId = table.Column(maxLength: 450, nullable: true),
+ RecipientJson = table.Column(nullable: true),
+ TokenHash = table.Column(maxLength: 256, nullable: false),
+ VerifierProvider = table.Column(maxLength: 200, nullable: false),
+ AllowedActionsJson = table.Column(nullable: false),
+ ChallengeJson = table.Column(nullable: true),
+ Status = table.Column(maxLength: 32, nullable: false),
+ IssuedAt = table.Column(nullable: false),
+ ExpiresAt = table.Column(nullable: false),
+ VerifiedAt = table.Column(nullable: true),
+ ConsumedAt = table.Column(nullable: true),
+ RevokedAt = table.Column(nullable: true)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTaskInvitations", x => x.Id));
+
+ migrationBuilder.CreateTable(name: "UserTaskInvitationDeliveries", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ TaskId = table.Column(maxLength: 450, nullable: false),
+ InvitationId = table.Column(maxLength: 450, nullable: false),
+ DispatcherProvider = table.Column(maxLength: 200, nullable: false),
+ EncryptedToken = table.Column(nullable: false),
+ DeliveryMetadataJson = table.Column(nullable: true),
+ Status = table.Column(maxLength: 32, nullable: false),
+ Attempts = table.Column(nullable: false),
+ AvailableAt = table.Column(nullable: false),
+ ExpiresAt = table.Column(nullable: false),
+ LastErrorCode = table.Column(maxLength: 128, nullable: true),
+ CreatedAt = table.Column(nullable: false),
+ DeliveredAt = table.Column(nullable: true)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTaskInvitationDeliveries", x => x.Id));
+
+ migrationBuilder.CreateTable(name: "UserTaskGuestSessions", schema: schema,
+ columns: table => new
+ {
+ Id = table.Column(maxLength: 450, nullable: false),
+ TenantId = table.Column(maxLength: 450, nullable: false),
+ TaskId = table.Column(maxLength: 450, nullable: false),
+ InvitationId = table.Column(maxLength: 450, nullable: false),
+ SessionTokenHash = table.Column(maxLength: 256, nullable: false),
+ GuestParticipantJson = table.Column(nullable: false),
+ CapabilitiesJson = table.Column(nullable: false),
+ IssuedAt = table.Column(nullable: false),
+ ExpiresAt = table.Column(nullable: false),
+ RevokedAt = table.Column(nullable: true)
+ },
+ constraints: table => table.PrimaryKey("PK_UserTaskGuestSessions", x => x.Id));
+
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_MaterializationKey", table: "UserTasks", columns: ["TenantId", "MaterializationKey"], schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_BookmarkId", table: "UserTasks", columns: ["TenantId", "BookmarkId"], schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_Status", table: "UserTasks", columns: ["TenantId", "Status"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_Assignee", table: "UserTasks", columns: ["TenantId", "AssigneeProvider", "AssigneeType", "AssigneeId"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_Priority", table: "UserTasks", columns: ["TenantId", "Priority"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_DueAt", table: "UserTasks", columns: ["TenantId", "DueAt"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_WorkflowDefinition", table: "UserTasks", columns: ["TenantId", "WorkflowDefinitionId"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_WorkflowInstance", table: "UserTasks", columns: ["TenantId", "WorkflowInstanceId"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_ActivityInstance", table: "UserTasks", columns: ["TenantId", "ActivityInstanceId"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_CreatedAt", table: "UserTasks", columns: ["TenantId", "CreatedAt"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTasks_Tenant_CompletedAt", table: "UserTasks", columns: ["TenantId", "CompletedAt"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskCandidates_Tenant_Task_Participant", table: "UserTaskCandidates", columns: ["TenantId", "TaskId", "Provider", "ParticipantType", "ParticipantId", "Source"], schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskCandidates_Tenant_Participant", table: "UserTaskCandidates", columns: ["TenantId", "Provider", "ParticipantType", "ParticipantId"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskCandidates_Tenant_Task", table: "UserTaskCandidates", columns: ["TenantId", "TaskId"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskCandidates_Tenant_Task_ParticipantKey", table: "UserTaskCandidates", columns: ["TenantId", "TaskId", "ParticipantKey"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskSnapshotMembers_Tenant_Task_Participant", table: "UserTaskSnapshotMembers", columns: ["TenantId", "TaskId", "Provider", "ParticipantType", "ParticipantId"], schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskSnapshotMembers_Tenant_Task_ParticipantKey", table: "UserTaskSnapshotMembers", columns: ["TenantId", "TaskId", "ParticipantKey"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskExclusions_Tenant_Task_Participant", table: "UserTaskExclusions", columns: ["TenantId", "TaskId", "Provider", "ParticipantType", "ParticipantId"], schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskExclusions_Tenant_Task_ParticipantKey", table: "UserTaskExclusions", columns: ["TenantId", "TaskId", "ParticipantKey"], schema: schema);
+ // Not unique: audit is append-only and several entries may share a revision, because an audited read
+ // (a masked-field reveal) records without consuming the aggregate's concurrency token.
+ migrationBuilder.CreateIndex(name: "IX_UserTaskEvents_Task_Revision", table: "UserTaskEvents", columns: ["TaskId", "Revision"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskEvents_Tenant_Task_OccurredAt", table: "UserTaskEvents", columns: ["TenantId", "TaskId", "OccurredAt"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskOperations_Tenant_Task_Operation", table: "UserTaskOperations", columns: ["TenantId", "TaskId", "OperationId"], schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskOperations_Tenant_Status_UpdatedAt", table: "UserTaskOperations", columns: ["TenantId", "Status", "UpdatedAt"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskInvitations_TokenHash", table: "UserTaskInvitations", column: "TokenHash", schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskInvitations_Tenant_Task_Status", table: "UserTaskInvitations", columns: ["TenantId", "TaskId", "Status"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskInvitations_Tenant_Status_ExpiresAt", table: "UserTaskInvitations", columns: ["TenantId", "Status", "ExpiresAt"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskInvitationDeliveries_Tenant_Status_AvailableAt", table: "UserTaskInvitationDeliveries", columns: ["TenantId", "Status", "AvailableAt"], schema: schema);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskInvitationDeliveries_Tenant_Invitation", table: "UserTaskInvitationDeliveries", columns: ["TenantId", "InvitationId"], schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskGuestSessions_SessionTokenHash", table: "UserTaskGuestSessions", column: "SessionTokenHash", schema: schema, unique: true);
+ migrationBuilder.CreateIndex(name: "IX_UserTaskGuestSessions_Tenant_Task_ExpiresAt", table: "UserTaskGuestSessions", columns: ["TenantId", "TaskId", "ExpiresAt"], schema: schema);
+ }
+
+ public static void Down(MigrationBuilder migrationBuilder, string schema)
+ {
+ migrationBuilder.DropTable("UserTaskGuestSessions", schema);
+ migrationBuilder.DropTable("UserTaskInvitationDeliveries", schema);
+ migrationBuilder.DropTable("UserTaskInvitations", schema);
+ migrationBuilder.DropTable("UserTaskOperations", schema);
+ migrationBuilder.DropTable("UserTaskEvents", schema);
+ migrationBuilder.DropTable("UserTaskExclusions", schema);
+ migrationBuilder.DropTable("UserTaskSnapshotMembers", schema);
+ migrationBuilder.DropTable("UserTaskCandidates", schema);
+ migrationBuilder.DropTable("UserTasks", schema);
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/PersistenceModels.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore/PersistenceModels.cs
new file mode 100644
index 000000000..f68bc7864
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/PersistenceModels.cs
@@ -0,0 +1,218 @@
+using Elsa.UserTasks.Models;
+
+namespace Elsa.UserTasks.Persistence.EFCore;
+
+///
+/// EF records intentionally keep JSON payloads and participant references flattened so every relational
+/// provider has the same schema. The public User Tasks aggregate is materialized by the repository.
+///
+public enum UserTaskPersistenceCandidateSource
+{
+ DirectUser,
+ DirectGroup,
+ SnapshotMember,
+ Invitation
+}
+
+public sealed class UserTaskRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string WorkflowDefinitionId { get; set; } = default!;
+ public string? WorkflowDefinitionName { get; set; }
+ public int? WorkflowDefinitionVersion { get; set; }
+ public string WorkflowInstanceId { get; set; } = default!;
+ public string? WorkflowInstanceReference { get; set; }
+ public string ActivityInstanceId { get; set; } = default!;
+ public string BookmarkId { get; set; } = default!;
+ public string MaterializationKey { get; set; } = default!;
+ public string Title { get; set; } = default!;
+ public string? Summary { get; set; }
+ public string? Reference { get; set; }
+ public string? TaskType { get; set; }
+ public string TagsJson { get; set; } = "[]";
+ public string? RequesterProvider { get; set; }
+ public string? RequesterType { get; set; }
+ public string? RequesterId { get; set; }
+ public string? RequesterDisplayName { get; set; }
+ public int Priority { get; set; } = 50;
+ public DateTimeOffset? DueAt { get; set; }
+ public bool IsOverdue { get; set; }
+ public UserTaskStatus Status { get; set; }
+ public bool TimeoutEnabled { get; set; }
+ public bool CancellationEnabled { get; set; }
+ public bool AllowManagerExclusionOverride { get; set; }
+ public UserTaskMembershipResolutionMode? MembershipResolutionMode { get; set; }
+ public string? AssigneeProvider { get; set; }
+ public string? AssigneeType { get; set; }
+ public string? AssigneeId { get; set; }
+ public string? AssigneeDisplayName { get; set; }
+ public string InstructionsJson { get; set; } = "null";
+ public string TaskDataJson { get; set; } = "null";
+ public string? FormReferenceJson { get; set; }
+ public string? PinnedFormJson { get; set; }
+ public string? ActionsJson { get; set; }
+ public string InvitationDefinitionsJson { get; set; } = "[]";
+ public string HealthIssuesJson { get; set; } = "[]";
+ public UserTaskHealthSeverity? HealthSeverity { get; set; }
+ public string? HealthCode { get; set; }
+ public string? HealthMessage { get; set; }
+ public string? CompletionActionKey { get; set; }
+ public string? CompletionDataJson { get; set; }
+ public string? CompletionActorJson { get; set; }
+ public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset UpdatedAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset? AssignedAt { get; set; }
+ public DateTimeOffset? CompletedAt { get; set; }
+ public int Revision { get; set; }
+ public long? CreatedFromBookmarkRevision { get; set; }
+}
+
+public sealed class UserTaskCandidateRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string TaskId { get; set; } = default!;
+ public string Provider { get; set; } = default!;
+ public string ParticipantKey { get; set; } = default!;
+ public UserTaskParticipantType ParticipantType { get; set; }
+ public string ParticipantId { get; set; } = default!;
+ public string? DisplayName { get; set; }
+ public UserTaskPersistenceCandidateSource Source { get; set; }
+ public string? SourceGroupProvider { get; set; }
+ public string? SourceGroupId { get; set; }
+ public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset UpdatedAt { get; set; } = DateTimeOffset.UtcNow;
+}
+
+public sealed class UserTaskSnapshotMemberRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string TaskId { get; set; } = default!;
+ public string Provider { get; set; } = default!;
+ public string ParticipantKey { get; set; } = default!;
+ public UserTaskParticipantType ParticipantType { get; set; } = UserTaskParticipantType.User;
+ public string ParticipantId { get; set; } = default!;
+ public string? SourceGroupProvider { get; set; }
+ public string? SourceGroupId { get; set; }
+ public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
+}
+
+public sealed class UserTaskExclusionRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string TaskId { get; set; } = default!;
+ public string Provider { get; set; } = default!;
+ public string ParticipantKey { get; set; } = default!;
+ public UserTaskParticipantType ParticipantType { get; set; } = UserTaskParticipantType.User;
+ public string ParticipantId { get; set; } = default!;
+ public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
+}
+
+public sealed class UserTaskEventRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string TaskId { get; set; } = default!;
+ public int Revision { get; set; }
+ public string EventType { get; set; } = default!;
+ public DateTimeOffset OccurredAt { get; set; } = DateTimeOffset.UtcNow;
+ public string? OperationId { get; set; }
+ public string? ActorProvider { get; set; }
+ public string? ActorType { get; set; }
+ public string? ActorId { get; set; }
+ public string? ActorJson { get; set; }
+ public string? Reason { get; set; }
+ public string MetadataJson { get; set; } = "{}";
+}
+
+public enum UserTaskPersistenceOperationStatus
+{
+ Pending,
+ Enqueued,
+ Completed,
+ Failed,
+ Abandoned
+}
+
+public sealed class UserTaskOperationRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string TaskId { get; set; } = default!;
+ public string OperationId { get; set; } = default!;
+ public string Kind { get; set; } = default!;
+ public int ExpectedRevision { get; set; }
+ public string RequestHash { get; set; } = default!;
+ public UserTaskPersistenceOperationStatus Status { get; set; }
+ public int Attempts { get; set; }
+ public string? SafeResultJson { get; set; }
+ public string? ProtectedPayloadJson { get; set; }
+ public string? ActionKey { get; set; }
+ public string? ErrorCode { get; set; }
+ public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset UpdatedAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset? CompletedAt { get; set; }
+}
+
+public sealed class UserTaskInvitationRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string TaskId { get; set; } = default!;
+ public string? SiblingGroupId { get; set; }
+ public string? RecipientJson { get; set; }
+ public string TokenHash { get; set; } = default!;
+ public string VerifierProvider { get; set; } = default!;
+ public string AllowedActionsJson { get; set; } = "[]";
+ public string? ChallengeJson { get; set; }
+ public UserTaskInvitationStatus Status { get; set; }
+ public DateTimeOffset IssuedAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset ExpiresAt { get; set; }
+ public DateTimeOffset? VerifiedAt { get; set; }
+ public DateTimeOffset? ConsumedAt { get; set; }
+ public DateTimeOffset? RevokedAt { get; set; }
+}
+
+public enum UserTaskPersistenceDeliveryStatus
+{
+ Pending,
+ Processing,
+ Delivered,
+ Failed,
+ Expired
+}
+
+public sealed class UserTaskInvitationDeliveryRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string TaskId { get; set; } = default!;
+ public string InvitationId { get; set; } = default!;
+ public string DispatcherProvider { get; set; } = default!;
+ public string EncryptedToken { get; set; } = default!;
+ public string? DeliveryMetadataJson { get; set; }
+ public UserTaskPersistenceDeliveryStatus Status { get; set; }
+ public int Attempts { get; set; }
+ public DateTimeOffset AvailableAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset ExpiresAt { get; set; }
+ public string? LastErrorCode { get; set; }
+ public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset? DeliveredAt { get; set; }
+}
+
+public sealed class UserTaskGuestSessionRecord
+{
+ public string Id { get; set; } = Guid.NewGuid().ToString("N");
+ public string TenantId { get; set; } = default!;
+ public string TaskId { get; set; } = default!;
+ public string InvitationId { get; set; } = default!;
+ public string SessionTokenHash { get; set; } = default!;
+ public string GuestParticipantJson { get; set; } = default!;
+ public string CapabilitiesJson { get; set; } = "[]";
+ public DateTimeOffset IssuedAt { get; set; } = DateTimeOffset.UtcNow;
+ public DateTimeOffset ExpiresAt { get; set; }
+ public DateTimeOffset? RevokedAt { get; set; }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/Repositories/EFCoreUserTaskGuestStores.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore/Repositories/EFCoreUserTaskGuestStores.cs
new file mode 100644
index 000000000..4ea91eb98
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/Repositories/EFCoreUserTaskGuestStores.cs
@@ -0,0 +1,184 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Elsa.Common;
+using Elsa.Persistence.EFCore;
+using Elsa.UserTasks.Contracts;
+using Elsa.UserTasks.Models;
+using Elsa.UserTasks.Options;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Repositories;
+
+internal static class UserTaskSecretHashing
+{
+ public static string Hash(string token) => Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(token)));
+
+ public static string CreateToken() => Convert.ToBase64String(RandomNumberGenerator.GetBytes(32)).TrimEnd('=').Replace('+', '-').Replace('/', '_');
+}
+
+///
+/// Durable guest session store. Only the credential hash is written, and every read re-checks expiry and
+/// revocation so a session cannot outlive its task across a restart or a failover.
+///
+public sealed class EFCoreUserTaskGuestSessionIssuer(
+ Store store,
+ ISystemClock clock,
+ IOptions options) : IUserTaskGuestSessionIssuer
+{
+ private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web) { Converters = { new JsonStringEnumConverter() } };
+
+ public async Task IssueAsync(UserTaskInvitation invitation, ParticipantReference subject, CancellationToken cancellationToken = default)
+ {
+ var now = clock.UtcNow;
+ var expiresAt = invitation.ExpiresAt <= now.Add(options.Value.GuestSessionLifetime) ? invitation.ExpiresAt : now.Add(options.Value.GuestSessionLifetime);
+ if (expiresAt <= now)
+ return new(false, FailureCode: "session-unavailable");
+
+ var token = UserTaskSecretHashing.CreateToken();
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ dbContext.UserTaskGuestSessions.Add(new()
+ {
+ TenantId = invitation.TenantId,
+ TaskId = invitation.TaskId,
+ InvitationId = invitation.Id,
+ SessionTokenHash = UserTaskSecretHashing.Hash(token),
+ GuestParticipantJson = JsonSerializer.Serialize(subject, JsonOptions),
+ CapabilitiesJson = JsonSerializer.Serialize(invitation.AllowedActions, JsonOptions),
+ IssuedAt = now,
+ ExpiresAt = expiresAt
+ });
+ await dbContext.SaveChangesAsync(cancellationToken);
+ return new(true, token, expiresAt, TaskId: invitation.TaskId);
+ }
+
+ public async Task ResolveAsync(string credential, CancellationToken cancellationToken = default)
+ {
+ if (string.IsNullOrWhiteSpace(credential))
+ return null;
+
+ var hash = UserTaskSecretHashing.Hash(credential);
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ var now = clock.UtcNow;
+ var row = await dbContext.UserTaskGuestSessions.AsNoTracking()
+ .FirstOrDefaultAsync(x => x.SessionTokenHash == hash && x.RevokedAt == null && x.ExpiresAt > now, cancellationToken);
+ if (row is null)
+ return null;
+
+ var subject = JsonSerializer.Deserialize(row.GuestParticipantJson, JsonOptions);
+ if (subject is null)
+ return null;
+
+ var actions = JsonSerializer.Deserialize>(row.CapabilitiesJson, JsonOptions) ?? [];
+ return new(row.TenantId, row.TaskId, subject, actions, row.ExpiresAt);
+ }
+
+ public async Task RevokeForTaskAsync(string tenantId, string taskId, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ await dbContext.UserTaskGuestSessions
+ .Where(x => x.TenantId == tenantId && x.TaskId == taskId && x.RevokedAt == null)
+ .ExecuteUpdateAsync(x => x.SetProperty(p => p.RevokedAt, clock.UtcNow), cancellationToken);
+ }
+}
+
+///
+/// Durable invitation-delivery outbox. Tokens are encrypted with ASP.NET Core Data Protection before they
+/// reach the database, so a table dump never yields a usable invitation link.
+///
+public sealed class EFCoreUserTaskInvitationOutbox(
+ Store store,
+ IDataProtectionProvider dataProtectionProvider,
+ ISystemClock clock,
+ IOptions options) : IUserTaskInvitationOutbox
+{
+ private readonly IDataProtector _protector = dataProtectionProvider.CreateProtector("Elsa.UserTasks.InvitationDelivery.v1");
+
+ public async Task EnqueueAsync(UserTaskInvitationDelivery delivery, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ dbContext.UserTaskInvitationDeliveries.Add(new()
+ {
+ Id = delivery.Id,
+ TenantId = delivery.TenantId,
+ TaskId = delivery.TaskId,
+ InvitationId = delivery.InvitationId,
+ DispatcherProvider = delivery.DispatcherName,
+ EncryptedToken = _protector.Protect(delivery.Token),
+ DeliveryMetadataJson = delivery.Recipient == null ? null : JsonSerializer.Serialize(new { delivery.Recipient }),
+ Status = UserTaskPersistenceDeliveryStatus.Pending,
+ AvailableAt = delivery.NotBefore ?? clock.UtcNow,
+ ExpiresAt = delivery.ExpiresAt,
+ CreatedAt = clock.UtcNow
+ });
+ await dbContext.SaveChangesAsync(cancellationToken);
+ }
+
+ public async Task> DequeueDueAsync(int maxCount, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ var now = clock.UtcNow;
+ // Expired secrets are dropped, never delivered late.
+ await dbContext.UserTaskInvitationDeliveries.Where(x => x.ExpiresAt <= now).ExecuteDeleteAsync(cancellationToken);
+
+ var rows = await dbContext.UserTaskInvitationDeliveries.AsNoTracking()
+ .Where(x => x.Status == UserTaskPersistenceDeliveryStatus.Pending && x.AvailableAt <= now)
+ .OrderBy(x => x.AvailableAt)
+ .Take(Math.Max(1, maxCount))
+ .ToListAsync(cancellationToken);
+
+ var deliveries = new List(rows.Count);
+ foreach (var row in rows)
+ {
+ string token;
+ try
+ {
+ token = _protector.Unprotect(row.EncryptedToken);
+ }
+ catch (CryptographicException)
+ {
+ // A rotated or unavailable key makes the secret unrecoverable; drop it so a manager reissues.
+ await dbContext.UserTaskInvitationDeliveries.Where(x => x.Id == row.Id).ExecuteDeleteAsync(cancellationToken);
+ continue;
+ }
+
+ deliveries.Add(new(row.Id, row.TenantId, row.TaskId, row.InvitationId, row.DispatcherProvider, token, row.ExpiresAt)
+ {
+ Attempt = row.Attempts,
+ NotBefore = row.AvailableAt
+ });
+ }
+
+ return deliveries;
+ }
+
+ public async Task CompleteAsync(string deliveryId, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ // Delivery succeeded, so the encrypted secret has no further purpose and is removed outright.
+ await dbContext.UserTaskInvitationDeliveries.Where(x => x.Id == deliveryId).ExecuteDeleteAsync(cancellationToken);
+ }
+
+ public async Task RescheduleAsync(string deliveryId, DateTimeOffset notBefore, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ var row = await dbContext.UserTaskInvitationDeliveries.FirstOrDefaultAsync(x => x.Id == deliveryId, cancellationToken);
+ if (row is null)
+ return;
+
+ row.Attempts += 1;
+ if (row.Attempts > options.Value.InvitationDeliveryRetryDelays.Count)
+ {
+ dbContext.UserTaskInvitationDeliveries.Remove(row);
+ }
+ else
+ {
+ row.AvailableAt = notBefore;
+ row.LastErrorCode = "dispatch-failed";
+ }
+ await dbContext.SaveChangesAsync(cancellationToken);
+ }
+}
diff --git a/src/modules/Elsa.UserTasks.Persistence.EFCore/Repositories/EFCoreUserTaskRepository.cs b/src/modules/Elsa.UserTasks.Persistence.EFCore/Repositories/EFCoreUserTaskRepository.cs
new file mode 100644
index 000000000..6e7707897
--- /dev/null
+++ b/src/modules/Elsa.UserTasks.Persistence.EFCore/Repositories/EFCoreUserTaskRepository.cs
@@ -0,0 +1,794 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Elsa.Persistence.EFCore;
+using Elsa.UserTasks.Contracts;
+using Elsa.UserTasks.Models;
+using Elsa.UserTasks.Persistence.EFCore.Contracts;
+using Microsoft.EntityFrameworkCore;
+
+namespace Elsa.UserTasks.Persistence.EFCore.Repositories;
+
+///
+/// EF Core implementation of the public User Tasks repository and the low-level projection adapter.
+/// Participant identities are flattened into provider/type/id columns; no identity or foreign-key
+/// dependency is introduced by this package.
+///
+public sealed class EFCoreUserTaskRepository(Store store)
+ : IUserTaskRepository, IUserTaskPersistenceAdapter
+{
+ private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
+ {
+ Converters = { new JsonStringEnumConverter() }
+ };
+
+ public async Task GetAsync(string tenantId, string taskId, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ var record = await dbContext.UserTasks.AsNoTracking().FirstOrDefaultAsync(x => x.TenantId == tenantId && x.Id == taskId, cancellationToken);
+ return record is null ? null : await LoadAggregateAsync(dbContext, record, cancellationToken);
+ }
+
+ public async Task QueryAsync(UserTaskQuery query, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ var records = BuildQuery(dbContext, query);
+ int? totalCount = query.IncludeTotalCount ? await records.CountAsync(cancellationToken) : null;
+ var limit = Math.Clamp(query.Limit <= 0 ? 50 : query.Limit, 1, 200);
+ var rows = await ApplyCursor(ApplyOrdering(records, query), query).Take(limit + 1).ToListAsync(cancellationToken);
+ var hasMore = rows.Count > limit;
+ var page = rows.Take(limit).ToList();
+
+ // The query predicate is intentionally SQL-side, but the policy layer still needs the
+ // normalized candidate/snapshot/exclusion/history relationships to calculate allowed actions.
+ // Hydrate those relationships in bounded batches after paging rather than issuing one query per
+ // task or allowing a summary projection with empty candidate collections.
+ var items = await LoadAggregatesAsync(dbContext, page, cancellationToken);
+ return new UserTaskQueryResult(items, hasMore ? CreateCursor(page[^1], query.Sort) : null, totalCount);
+ }
+
+ public async Task FindByMaterializationKeyAsync(string tenantId, string key, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ var record = await dbContext.UserTasks.AsNoTracking().FirstOrDefaultAsync(x => x.TenantId == tenantId && x.MaterializationKey == key, cancellationToken);
+ return record is null ? null : await LoadAggregateAsync(dbContext, record, cancellationToken);
+ }
+
+ public async Task FindByBookmarkIdAsync(string tenantId, string bookmarkId, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ var record = await dbContext.UserTasks.AsNoTracking().FirstOrDefaultAsync(x => x.TenantId == tenantId && x.BookmarkId == bookmarkId, cancellationToken);
+ return record is null ? null : await LoadAggregateAsync(dbContext, record, cancellationToken);
+ }
+
+ public async Task<(UserTask Task, UserTaskInvitation Invitation)?> FindByInvitationTokenHashAsync(string tokenHash, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ // The unique index on TokenHash makes this a single seek. Deliberately not tenant-filtered: an
+ // anonymous holder presents only a secret and must not be trusted to name its own tenant.
+ var row = await dbContext.UserTaskInvitations.AsNoTracking().FirstOrDefaultAsync(x => x.TokenHash == tokenHash, cancellationToken);
+ if (row is null)
+ return null;
+
+ var record = await dbContext.UserTasks.AsNoTracking().FirstOrDefaultAsync(x => x.TenantId == row.TenantId && x.Id == row.TaskId, cancellationToken);
+ if (record is null)
+ return null;
+
+ var task = await LoadAggregateAsync(dbContext, record, cancellationToken);
+ return (task, ToInvitation(row));
+ }
+
+ public async Task SaveAsync(UserTask task, int expectedRevision, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ await using var transaction = await dbContext.Database.BeginTransactionAsync(cancellationToken);
+ var existing = await dbContext.UserTasks.FirstOrDefaultAsync(x => x.TenantId == task.TenantId && x.Id == task.Id, cancellationToken);
+ EnsureExpectedRevision(existing, task.Id, expectedRevision);
+
+ Copy(task, existing!);
+ existing!.Revision = expectedRevision + 1;
+ existing.UpdatedAt = DateTimeOffset.UtcNow;
+ await ReplaceChildrenAsync(dbContext, task, cancellationToken);
+
+ try
+ {
+ await dbContext.SaveChangesAsync(cancellationToken);
+ await transaction.CommitAsync(cancellationToken);
+ task.Revision = existing.Revision;
+ task.UpdatedAt = existing.UpdatedAt;
+ }
+ catch (DbUpdateConcurrencyException exception)
+ {
+ await transaction.RollbackAsync(cancellationToken);
+ // Translated to the repository contract's exception so callers can distinguish a lost
+ // optimistic-concurrency race from a fault without depending on EF Core.
+ throw new UserTaskRevisionConflictException(task.Id, expectedRevision, exception);
+ }
+ }
+
+ public async Task AddProjectionAsync(UserTask task, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ if (await ExistsByMaterializationKeyAsync(dbContext, task.TenantId, task.MaterializationKey, cancellationToken))
+ return;
+
+ dbContext.UserTasks.Add(ToRecord(task));
+ dbContext.UserTaskCandidates.AddRange(task.CandidateUsers.Select(x => ToCandidate(task, x, UserTaskPersistenceCandidateSource.DirectUser)));
+ dbContext.UserTaskCandidates.AddRange(task.CandidateGroups.Select(x => ToCandidate(task, x, UserTaskPersistenceCandidateSource.DirectGroup)));
+ dbContext.UserTaskSnapshotMembers.AddRange(task.SnapshotMembers.Select(x => ToSnapshot(task, x)));
+ dbContext.UserTaskSnapshotMembers.AddRange(task.SnapshotGroups.Select(x => ToSnapshot(task, x)));
+ dbContext.UserTaskExclusions.AddRange(task.ExcludedUsers.Select(x => ToExclusion(task, x)));
+ dbContext.UserTaskEvents.AddRange(task.Events.Select(ToEventRecord));
+ dbContext.UserTaskOperations.AddRange(task.Operations.Select(ToOperationRecord));
+ dbContext.UserTaskInvitations.AddRange(task.Invitations.Select(ToInvitationRecord));
+ try
+ {
+ await dbContext.SaveChangesAsync(cancellationToken);
+ }
+ catch (DbUpdateException)
+ {
+ if (!await ExistsByMaterializationKeyAsync(dbContext, task.TenantId, task.MaterializationKey, cancellationToken))
+ throw;
+ // A concurrent projection won the unique materialization-key race. Projection is idempotent.
+ }
+ }
+
+ public async Task AppendEventAsync(string tenantId, string taskId, UserTaskEvent @event, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ if (!await dbContext.UserTasks.AsNoTracking().AnyAsync(x => x.TenantId == tenantId && x.Id == taskId, cancellationToken))
+ return;
+
+ // A plain insert: the aggregate row, and therefore its revision, is deliberately left untouched.
+ dbContext.UserTaskEvents.Add(ToEventRecord(@event));
+ await dbContext.SaveChangesAsync(cancellationToken);
+ }
+
+ public async Task TryMutateAsync(string tenantId, string taskId, int expectedRevision, Func mutation, CancellationToken cancellationToken = default)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ await using var transaction = await dbContext.Database.BeginTransactionAsync(cancellationToken);
+ var record = await dbContext.UserTasks.FirstOrDefaultAsync(x => x.TenantId == tenantId && x.Id == taskId, cancellationToken);
+ if (record is null || record.Revision != expectedRevision)
+ return false;
+
+ var task = await LoadAggregateAsync(dbContext, record, cancellationToken);
+ if (!mutation(task))
+ return false;
+
+ Copy(task, record);
+ record.Revision = expectedRevision + 1;
+ record.UpdatedAt = DateTimeOffset.UtcNow;
+ await ReplaceChildrenAsync(dbContext, task, cancellationToken);
+
+ try
+ {
+ await dbContext.SaveChangesAsync(cancellationToken);
+ await transaction.CommitAsync(cancellationToken);
+ return true;
+ }
+ catch (DbUpdateConcurrencyException)
+ {
+ await transaction.RollbackAsync(cancellationToken);
+ return false;
+ }
+ }
+
+ async Task IUserTaskPersistenceAdapter.GetAsync(string tenantId, string taskId, CancellationToken cancellationToken)
+ {
+ await using var dbContext = await store.CreateDbContextAsync(cancellationToken);
+ return await dbContext.UserTasks.AsNoTracking().FirstOrDefaultAsync(x => x.TenantId == tenantId && x.Id == taskId, cancellationToken);
+ }
+
+ public async Task