fix: gate scheduler task concurrency

internal/runnerfacade/facade.go

@@ -57,6 +57,7 @@ type Facade struct {
 	Registry     *Registry
 	Capabilities Capabilities
 	Upstream     Upstream
+	OnTerminal   func(taskassignment.Assignment)
 }
 
 func (f *Facade) Handler() (string, http.Handler) {
@@ -98,7 +99,11 @@ func (f *Facade) UpdateTask(ctx context.Context, request *connect.Request[runner
 	if request.Msg.GetState().GetId() != assignment.Task.GetId() {
 		return nil, connect.NewError(connect.CodePermissionDenied, errors.New("task update does not match assignment"))
 	}
-	return f.Upstream.UpdateTask(ctx, connect.NewRequest(request.Msg))
+	response, err := f.Upstream.UpdateTask(ctx, connect.NewRequest(request.Msg))
+	if err == nil && request.Msg.GetState().GetResult() != runnerv1.Result_RESULT_UNSPECIFIED && f.OnTerminal != nil {
+		f.OnTerminal(assignment)
+	}
+	return response, err
 }
 
 func (f *Facade) UpdateLog(ctx context.Context, request *connect.Request[runnerv1.UpdateLogRequest]) (*connect.Response[runnerv1.UpdateLogResponse], error) {

internal/runnerfacade/facade_test.go

@@ -163,6 +163,29 @@ func TestFacadeForwardsOnlyMatchingTaskAndLogUpdates(t *testing.T) {
 	}
 }
 
+func TestFacadeSignalsTerminalTaskAfterUpstreamAcceptsIt(t *testing.T) {
+	facade, assignment, token := testFacade(t)
+	ctx := WithSPIFFEID(context.Background(), assignment.Identity.SPIFFEID)
+	if _, err := facade.FetchTask(ctx, authenticatedRequest(&runnerv1.FetchTaskRequest{}, assignment.ID, token)); err != nil {
+		t.Fatal(err)
+	}
+	completed := 0
+	facade.OnTerminal = func(got taskassignment.Assignment) {
+		if got.ID != assignment.ID {
+			t.Fatalf("terminal assignment = %s", got.ID)
+		}
+		completed++
+	}
+	if _, err := facade.UpdateTask(ctx, authenticatedRequest(&runnerv1.UpdateTaskRequest{
+		State: &runnerv1.TaskState{Id: 42, Result: runnerv1.Result_RESULT_SUCCESS},
+	}, assignment.ID, token)); err != nil {
+		t.Fatal(err)
+	}
+	if completed != 1 {
+		t.Fatalf("terminal notifications = %d", completed)
+	}
+}
+
 func TestCapabilitiesAreDeterministicAndAssignmentScoped(t *testing.T) {
 	capabilities, err := NewCapabilities([]byte("0123456789abcdef0123456789abcdef"))
 	if err != nil {