fix(ai): ai-spawned sub-runners persist their own runner doc, linked by session_id

[ocervell]

What / why (PR 2 of the runner-parenting design — core foundation)

AI-task-spawned sub-runners (nmap, httpx, subagents, …) run and their findings persist, but the sub-runner itself never created its own runner doc — so it never appeared in runner history. Root cause: the child inherited the parent ai task's context.task_id, so update_runner/runner_id targeted the parent's doc instead of minting a new one.

Fix

_get_result_context now builds a clean child context: strips the parent's runner-identity keys (task_id/workflow_id/scan_id/task_chunk_id), keeps session_id/drivers/workspace_*. Each child now takes update_runner's insert branch → mints its own doc, linked to the conversation by context.session_id.

Verified (empirical)

Probe (secator x ai -p "Run nmap … on scanme.nmap.org" --dangerous -driver mongodb -ws …):

• Before: 0 non-ai task docs under the session.
• After: the nmap child persists with its own _id (≠ parent), context.task_id = its own, context.session_id = the conversation, status=SUCCESS.

Tests

TestChildContextParenting (child context keeps session/drivers/workspace, sets has_parent, strips the four identity keys). test_ai_actions.py 85/85; no new failures vs branch baseline.

Not in this PR (design's later phases, go through the user)

• secator-api: a GET /ai/conversations/{session_id}/runners list resolver (unions tasks/workflows/scans by context.session_id).
• secator-ui: group a conversation's runners under it.
• Open decision (API/UI phase): whether ai children should also carry the behavioral top-level has_parent (controls whether they show as top-level in the general runner history vs nested). The persisted has_parent is currently false; parenting-by-session_id works regardless.

Part of the AI-task reliability series → ai-resiliency (#1241).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8b4b6f5d-3306-4f09-803a-352ae7fc4108

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ai-runner-parenting

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}