collavre 0.24.0 → 0.25.0

data/app/models/collavre/task.rb

@@ -4,8 +4,6 @@ module Collavre
 
     belongs_to :agent, class_name: "Collavre::User"
     has_many :task_actions, class_name: "Collavre::TaskAction", dependent: :destroy
-    belongs_to :parent_task, class_name: "Collavre::Task", optional: true
-    has_many :sub_tasks, class_name: "Collavre::Task", foreign_key: :parent_task_id, dependent: :destroy
     belongs_to :creative, class_name: "Collavre::Creative", optional: true
     has_one :reply_comment, class_name: "Collavre::Comment", foreign_key: :task_id, dependent: :nullify
 
@@ -25,6 +23,7 @@ module Collavre
 
     after_update_commit :check_trigger_loop_completion, if: :trigger_loop_candidate?
     after_update_commit :broadcast_stop_button_removal, if: :became_terminal?
+    after_update_commit :restore_undelivered_dispatches, if: :ended_without_delivering?
 
     scope :running_for_topic, ->(topic_id, creative_id = nil) {
       rel = where(topic_id: topic_id, status: %w[running delegated])
@@ -52,6 +51,36 @@ module Collavre
       rel
     }
 
+    # Of the slot-occupying statuses, these have no live worker to run
+    # AiAgentJob's ensure-block drain, so whoever cancels one must release the
+    # slot itself.
+    HELD_SLOT_WITHOUT_WORKER = %w[pending delegated pending_approval].freeze
+
+    # Work still worth a typing indicator — and the Stop button that only exists
+    # inside it: everything occupying_topic_slot counts, plus queued, a waiter
+    # not yet promoted. delegated and pending_approval look idle but are not, the
+    # job returned holding the slot while it awaits an MCP /reply or a tool
+    # approval, and #cancel still accepts both. Kept here rather than in the
+    # client so one list decides it.
+    ACTIVE_STATUSES = %w[running delegated pending pending_approval queued].freeze
+
+    def active?
+      ACTIVE_STATUSES.include?(status)
+    end
+
+    # Cancellation callers often select an active row before waiting on another
+    # request's task lock. Reload under that lock so a completed reply cannot be
+    # overwritten by a stale running/delegated instance.
+    def cancel_if_active!(statuses: ACTIVE_STATUSES, **attributes)
+      with_lock do
+        next unless status.in?(statuses)
+
+        previous_status = status
+        update!(attributes.merge(status: "cancelled"))
+        previous_status
+      end
+    end
+
     # Check if agent already has an in-flight task triggered by the same comment.
     # Treats "delegated" as in-flight: a Claude Channel task that is waiting on
     # an external MCP reply is still active work — re-dispatching the same
@@ -77,6 +106,33 @@ module Collavre
       broadcast_stop_button_removal if terminal_status?
     end
 
+    # What a persisted row says about whether this turn ever handed anything
+    # over — ended_without_delivering? without the transition.
+    #
+    # Asked twice: by the callback of a status change, and by
+    # RestoreDroppedDispatchesJob of a row it finds afterwards. Written once,
+    # because a sweep deciding "terminal" where the callback decides this is how
+    # a backstop comes to re-answer comments the turn had already answered.
+    def ended_undelivered?
+      payload = trigger_event_payload
+      # Asked first, so that a row carrying both records is read as undelivered.
+      # A resumed turn can legitimately carry both: an earlier attempt handed
+      # off, while a later one failed before doing so. DeliveryRecord restores
+      # that row but subtracts the comment ids the successful attempts carried,
+      # leaving only the later attempt's undelivered comments.
+      return true if status == "done" && Orchestration::DeliveryRecord.handoff_failed?(payload)
+
+      # An ending is undelivered because the payload never reached the provider,
+      # not because of the name of the ending. A turn stopped — or broken — after
+      # the handoff has been read by the agent along with everything it
+      # swallowed, and the product already shows that turn with its partial
+      # reply. Only a turn that got far enough to record the handoff is exempt;
+      # everything quieter than that still owes its dispatches back.
+      return false if Orchestration::DeliveryRecord.handed_off?(payload)
+
+      status.in?(Orchestration::DeliveryRecord::UNDELIVERED_TERMINAL_STATUSES)
+    end
+
     private
 
     def trigger_loop_candidate?
@@ -106,6 +162,69 @@ module Collavre
       saved_change_to_attribute?("status") && terminal_status?
     end
 
+    # This turn refused other dispatches on the strength of having read their
+    # comments, and then died without answering anything. Those dispatches have
+    # to come back — see Orchestration::DeliveryRecord.restore!.
+    #
+    # Only the status transition is decided here. Whether anything was actually
+    # refused is asked inside restore!, off the persisted row: the drop record
+    # is written by the refused dispatch in another process, so this object's
+    # payload predates it and a check here would read `none` on every turn that
+    # dropped something.
+    #
+    # A status callback rather than a call site: AiAgentJob's rescue and
+    # StuckDetector both end a turn this way, and only one of them runs for a
+    # process that was killed outright.
+    #
+    # `done` is an undelivered ending too when the turn recorded that its
+    # request never reached the provider: AiClient#chat catches the error and
+    # AiAgentJob finishes the task normally, so the status alone cannot say it.
+    # Read off this object rather than the row because the flag is written by
+    # this turn's own service, in this process, immediately before the status
+    # update that fires this callback — unlike DROPPED_KEY, which the refused
+    # dispatch writes from another process and restore! therefore re-reads.
+    def ended_without_delivering?
+      return false unless saved_change_to_attribute?("status")
+      return false if ended_while_worker_settles?
+
+      ended_undelivered?
+    end
+
+    # A turn ended from another process while its worker is still inside the
+    # provider call, whose own account of the handoff does not exist yet.
+    #
+    # Stop is committed from a web request, and StuckDetector can fail a running
+    # row from its recurring job. Both can beat AiAgentService's ensure, which
+    # writes whether the payload reached the provider only after the call exits.
+    # This callback fires before that evidence exists.
+    #
+    # So it declines, and the question is asked where the turn settles —
+    # AiAgentJob's teardown, once the record is written. Behind that,
+    # DeliveryRecord.restore_missed! covers an ending with no live worker to
+    # settle anything.
+    def ended_while_worker_settles?
+      return false unless status_before_last_save == "running"
+      return true if status == "cancelled"
+
+      status == "failed" &&
+        Orchestration::DeliveryRecord.worker_settling?(trigger_event_payload)
+    end
+
+    # Best effort, deliberately: this runs after the turn's own status is
+    # committed, so an exception here propagates back into the update! that
+    # ended the turn — and AiAgentJob's rescue answers that by writing `failed`
+    # over a turn that had in fact finished and answered. The restore is
+    # reconstructible from the row it was given, and
+    # DeliveryRecord.restore_missed! is what asks again.
+    def restore_undelivered_dispatches
+      Orchestration::DeliveryRecord.restore!(self)
+    rescue StandardError => e
+      Rails.logger.error(
+        "[Task] Restore failed for task #{id}: #{e.class}: #{e.message} — " \
+        "leaving it to the restore sweep"
+      )
+    end
+
     def terminal_status?
       status.in?(%w[done cancelled failed])
     end

data/app/models/collavre/topic.rb

@@ -18,6 +18,11 @@ module Collavre
     has_many :user_creative_preferences_as_last_topic, class_name: "Collavre::UserCreativePreference",
              foreign_key: :last_topic_id, dependent: :nullify, inverse_of: :last_topic
 
+    # The dependent nullify below clears a user's selected topic without going
+    # through the preference controller. Advance the ordering token first so a
+    # client can distinguish that deletion from an older empty preference.
+    before_destroy :advance_last_topic_preference_revisions, prepend: true
+
     # --- Archive scopes ---
     scope :active, -> { where(archived_at: nil) }
     scope :archived, -> { where.not(archived_at: nil) }
@@ -33,6 +38,48 @@ module Collavre
       update!(primary_agent: agent)
     end
 
+    # A primary agent is an exclusive assignment: Matcher#match_by_primary_agent
+    # routes ambient events to it alone and returns [] — silence, not a fallback
+    # — when it cannot respond. Routing also requires :feedback on the creative,
+    # so pinning an agent that lacks it would disable the topic outright: the
+    # pinned agent is not permitted to answer, and every other agent is excluded
+    # by the assignment. User.mentionable_for and the agent palette both surface
+    # searchable agents regardless of creative access, so this is reachable from
+    # plain drag-and-drop or `/topic "name" @agent:`, not just a crafted request.
+    #
+    # This deliberately mirrors BOTH predicates Matcher applies before it will
+    # route to a primary agent — #has_creative_permission? and
+    # #eligible_in_inbox? — so "assignable" and "can respond" cannot drift
+    # apart. Checking only the permission is not enough: registration grants a
+    # Claude Channel agent inbox-wide :feedback, so it passes that check on
+    # every inbox topic while Matcher confines it to its own session topic.
+    # Pinning one on an ordinary inbox topic would therefore silence the topic
+    # for everyone, and it is reachable by plain drag-and-drop (the agent is
+    # created_by the user, so the palette lists it) or by `/topic "Main" @agent:`
+    # (the inbox share puts it in User.mentionable_for regardless of searchable).
+    #
+    # Returns nil when assignable, otherwise a symbol naming the reason, so
+    # callers can render a message that says which rule was hit.
+    #
+    # Deliberately NOT enforced inside #set_primary_agent!: SessionProvisioner
+    # and Api::V1::AgentsController#register write the pin as session identity
+    # before the inbox share exists, and must not be gated on it.
+    def self.primary_agent_rejection(creative, agent, topic: nil)
+      return :not_an_agent unless agent&.ai_user?
+      return :no_creative_access unless creative&.has_permission?(agent, :feedback)
+
+      # Mirror Matcher#eligible_in_inbox?
+      return nil unless creative.inbox?
+      return nil unless agent.claude_channel_agent?
+      return nil if topic&.session_id.present? && topic.primary_agent_id == agent.id
+
+      :session_agent_outside_session_topic
+    end
+
+    def self.primary_agent_assignable?(creative, agent, topic: nil)
+      primary_agent_rejection(creative, agent, topic: topic).nil?
+    end
+
     def archived?
       archived_at.present?
     end
@@ -47,6 +94,10 @@ module Collavre
 
     private
 
+    def advance_last_topic_preference_revisions
+      user_creative_preferences_as_last_topic.update_all("last_topic_revision = last_topic_revision + 1")
+    end
+
     def set_default_position
       return if position_changed? && position != 0
 

data/app/models/collavre/user.rb

@@ -29,7 +29,6 @@ module Collavre
     has_many :creative_shares_caches, class_name: "Collavre::CreativeSharesCache", dependent: :delete_all
     has_many :shared_creative_shares, class_name: "Collavre::CreativeShare", foreign_key: :shared_by_id,
                                       dependent: :nullify, inverse_of: :shared_by
-    has_many :inbox_items, class_name: "Collavre::InboxItem", foreign_key: :owner_id, dependent: :destroy, inverse_of: :owner
     has_many :invitations, class_name: "Collavre::Invitation", foreign_key: :inviter_id, dependent: :destroy, inverse_of: :inviter
     has_many :activity_logs, class_name: "Collavre::ActivityLog", dependent: :destroy
     has_many :labels, class_name: "Collavre::Label", foreign_key: :owner_id, dependent: :destroy
@@ -42,6 +41,7 @@ module Collavre
 
     # Leaf-first destroy to avoid closure_tree find(parent_id) errors
     has_many :creatives, class_name: "Collavre::Creative", dependent: nil
+    belongs_to :last_visited_creative, class_name: "Collavre::Creative", optional: true
     before_destroy :destroy_creatives_leaf_first
 
     # /compress and /merge summaries are durable recovery artifacts: they replace
@@ -55,6 +55,16 @@ module Collavre
 
     belongs_to :creator, class_name: "Collavre::User", foreign_key: "created_by_id", optional: true
     has_many :created_ai_users, class_name: "Collavre::User", foreign_key: "created_by_id", dependent: :destroy
+    has_many :created_llm_models,
+             class_name: "Collavre::LlmModel",
+             foreign_key: :created_by_id,
+             dependent: :nullify,
+             inverse_of: :creator
+    belongs_to :agent_gateway, class_name: "Collavre::AgentGateway", optional: true
+    has_many :owned_agent_gateways, class_name: "Collavre::AgentGateway", foreign_key: :owner_id, dependent: :destroy
+    has_many :agent_workspaces, class_name: "Collavre::AgentWorkspace", foreign_key: :agent_id, dependent: :destroy
+    has_many :personal_agent_workspaces, class_name: "Collavre::AgentWorkspace", foreign_key: :user_id, dependent: :destroy
+    after_update :revoke_old_gateway_workspaces, if: :saved_change_to_agent_gateway_id?
 
     has_one_attached :avatar
 
@@ -66,15 +76,7 @@ module Collavre
     attribute :locale, :string
     attribute :system_admin, :boolean, default: false
     attribute :searchable, :boolean, default: false
-
-    # Typo correction (2D gating: typing-device AND input-location must both be on).
-    attribute :typo_correction_enabled, :boolean, default: true
-    attribute :typo_correction_threshold, :integer, default: 80
-    attribute :typo_correction_on_soft_keyboard, :boolean, default: true
-    attribute :typo_correction_on_voice, :boolean, default: true
-    attribute :typo_correction_on_physical_keyboard, :boolean, default: false
-    attribute :typo_correction_in_chat, :boolean, default: true
-    attribute :typo_correction_in_editor, :boolean, default: false
+    attribute :creative_workspace_enabled, :boolean, default: true
 
     attribute :google_uid, :string
     attribute :google_access_token, :string
@@ -88,6 +90,7 @@ module Collavre
     attribute :gateway_url, :string
     attribute :tools, :json, default: -> { [] }
     attribute :agent_conf, :string
+    attribute :dismissed_notices, :json, default: -> { [] }
 
     # Default context settings for AI agents
     AGENT_CONF_DEFAULTS = {
@@ -160,31 +163,6 @@ module Collavre
       end
     end
 
-    TYPO_CORRECTION_DEVICES = %w[voice soft_keyboard physical_keyboard].freeze
-    TYPO_CORRECTION_LOCATIONS = %w[chat editor].freeze
-
-    # 2D gating: typo correction runs only when the master switch is on AND the
-    # originating typing device AND the input location are both enabled. Unknown
-    # device/location values are treated as disabled (fail closed).
-    def typo_correction_active_for?(device:, location:)
-      return false unless typo_correction_enabled
-
-      device_on = case device.to_s
-      when "voice" then typo_correction_on_voice
-      when "soft_keyboard" then typo_correction_on_soft_keyboard
-      when "physical_keyboard" then typo_correction_on_physical_keyboard
-      else false
-      end
-
-      location_on = case location.to_s
-      when "chat" then typo_correction_in_chat
-      when "editor" then typo_correction_in_editor
-      else false
-      end
-
-      device_on && location_on
-    end
-
     # LLM_VENDOR_OPTIONS is resolved dynamically from the AiClient vendor-option
     # registry so core lists only its built-in providers while vendor engines
     # (e.g. OpenClaw) contribute their own. Resolved lazily via const_missing so
@@ -200,17 +178,50 @@ module Collavre
     SUPPORTED_LLM_MODELS = [
       "gemini-3.1-flash-lite",
       "gemini-1.5-flash",
-      "gemini-1.5-pro"
+      "gemini-1.5-pro",
+      "paperclip/claude_local",
+      "paperclip/codex_local"
     ].freeze
 
     def ai_user?
       llm_vendor.present?
     end
 
+    def cli_proxy_agent?
+      llm_vendor == "cli_proxy" && agent_gateway.present?
+    end
+
+    def gateway_accessible_to?(user)
+      return false unless user
+      return true if user.system_admin? || created_by_id == user.id
+      return true if user.contact_users.where(id: id).exists?
+
+      agent_creative_ids = Collavre::Creative.where(user_id: id).pluck(:id)
+      agent_creative_ids.concat(
+        Collavre::CreativeSharesCache.where(user_id: [ id, nil ]).distinct.pluck(:creative_id)
+      )
+      agent_permissions = Collavre::Creatives::PermissionFilter.new(user: self)
+      agent_creative_ids = agent_permissions.readable_ids(agent_creative_ids, min_permission: :feedback)
+      Collavre::Creatives::PermissionFilter.new(user: user)
+                                           .readable_ids(agent_creative_ids)
+                                           .any?
+    end
+
+    def revoke_old_gateway_workspaces
+      old_gateway_id = agent_gateway_id_before_last_save
+      return unless old_gateway_id
+
+      agent_workspaces.where(agent_gateway_id: old_gateway_id).destroy_all
+    end
+
     def claude_channel_agent?
       llm_model == "claude-code"
     end
 
+    def claude_channel_online?
+      claude_channel_agent? && AgentSubscription.live.where(agent_id: id).exists?
+    end
+
     scope :ai_agents, -> { where.not(llm_vendor: [ nil, "" ]) }
 
     def self.accessible_ai_agents_for(user)
@@ -239,16 +250,65 @@ module Collavre
     validates :email, presence: true, uniqueness: true,
                       format: { with: URI::MailTo::EMAIL_REGEXP }
     validates :name, presence: true
+    validates :llm_vendor,
+              length: { maximum: Collavre::LlmModel::MAX_VENDOR_LENGTH },
+              if: :will_save_change_to_llm_vendor?
+    validates :llm_model,
+              length: { maximum: Collavre::LlmModel::MAX_NAME_LENGTH },
+              if: :will_save_change_to_llm_model?
+    validate :cli_proxy_gateway_belongs_to_creator
+    around_save :serialize_cli_proxy_gateway_assignment
+    before_save :validate_cli_proxy_gateway_assignment_under_lock
     validate :theme_accessibility
     validate :password_meets_minimum_length
     validates :timezone,
               inclusion: { in: ActiveSupport::TimeZone.all.map { |z| z.tzinfo.identifier } },
               allow_nil: true
-    # Column is NOT NULL; clearing the profile field (or a crafted PATCH) casts to
-    # nil and would raise a DB error on save. Validate so the form re-renders.
-    validates :typo_correction_threshold,
-              presence: true,
-              numericality: { only_integer: true, greater_than_or_equal_to: 0, less_than_or_equal_to: 100 }
+    def cli_proxy_gateway_belongs_to_creator
+      return unless llm_vendor == "cli_proxy"
+
+      validate_cli_proxy_gateway(agent_gateway)
+    end
+
+    # See AgentGateway#serialize_completion_key_removal. This repeats the
+    # gateway checks immediately before writing the agent while holding the
+    # same row lock used by a completion-key removal.
+    def serialize_cli_proxy_gateway_assignment
+      return yield unless llm_vendor == "cli_proxy" && agent_gateway_id.present?
+
+      gateway = AgentGateway.find_by(id: agent_gateway_id)
+      return yield unless gateway
+
+      gateway.with_lock do
+        begin
+          @cli_proxy_gateway_assignment_lock = gateway
+          yield
+        ensure
+          @cli_proxy_gateway_assignment_lock = nil
+        end
+      end
+    end
+
+    def validate_cli_proxy_gateway_assignment_under_lock
+      gateway = @cli_proxy_gateway_assignment_lock
+      return unless gateway
+
+      error_count = errors.count
+      validate_cli_proxy_gateway(gateway)
+      throw :abort if errors.count > error_count
+    end
+
+    def validate_cli_proxy_gateway(gateway)
+      if gateway.nil?
+        errors.add(:agent_gateway, :blank)
+      elsif gateway.owner_id != created_by_id
+        errors.add(:agent_gateway, :invalid)
+      elsif !gateway.chat_capable?
+        errors.add(:agent_gateway, :completion_key_required)
+      elsif gateway.identity_secret.blank? && (gateway.per_user? || gateway.agents.where.not(id: id).exists?)
+        errors.add(:agent_gateway, :identity_required)
+      end
+    end
 
     generates_token_for :email_verification, expires_in: 1.day do
       email

data/app/models/collavre/user_creative_preference.rb

@@ -6,7 +6,9 @@ module Collavre
     belongs_to :user, class_name: Collavre.configuration.user_class_name
     belongs_to :last_topic, class_name: "Collavre::Topic", optional: true
 
-    validates :expanded_status, presence: true, unless: :last_topic_id?
+    validates :expanded_status, presence: true, unless: -> {
+      last_topic_id? || last_topic_revision.to_i.positive? || last_topic_save_fence_issued.to_i.positive?
+    }
     validates :creative_id, uniqueness: { scope: :user_id }, allow_nil: true
   end
 end

data/app/services/collavre/agent_provisioning/archive.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "stringio"
+require "zlib"
+
+module Collavre
+  module AgentProvisioning
+    class Archive
+      BLOCK_SIZE = 512
+      MAX_FILE_SIZE = 1.megabyte
+      MAX_ARCHIVE_SIZE = 10.megabytes
+
+      class << self
+        def collavre_skill
+          @collavre_skill ||= build_from_directory(Collavre::Engine.root.join("skills/collavre"))
+        end
+
+        def workspace_config(workspace, base_url:)
+          json = JSON.pretty_generate(workspace.config_payload(base_url: base_url)) << "\n"
+          build({ "config.json" => { content: json, mode: 0o600 } })
+        end
+
+        def sha256(bytes)
+          Digest::SHA256.hexdigest(bytes)
+        end
+
+        private
+
+        def build_from_directory(root)
+          raise ArgumentError, "Provisioning source directory does not exist: #{root}" unless root.directory?
+
+          files = Dir.glob(root.join("**/*"), File::FNM_DOTMATCH).filter_map do |path|
+            next unless File.file?(path)
+
+            relative = Pathname(path).relative_path_from(root).to_s
+            mode = File.executable?(path) ? 0o755 : 0o644
+            [ relative, { content: File.binread(path), mode: mode } ]
+          end.to_h
+          raise ArgumentError, "Provisioning source directory is empty: #{root}" if files.empty?
+
+          build(files)
+        end
+
+        def build(files)
+          tar = +"".b
+          total_size = 0
+          files.sort.each do |name, entry|
+            content = entry.fetch(:content).to_s.b
+            raise ArgumentError, "Provisioning file is too large: #{name}" if content.bytesize > MAX_FILE_SIZE
+            raise ArgumentError, "Provisioning file is binary: #{name}" if content.include?("\0")
+
+            total_size += content.bytesize
+            raise ArgumentError, "Provisioning archive expands beyond the limit" if total_size > MAX_ARCHIVE_SIZE
+
+            tar << tar_header(name, mode: entry.fetch(:mode), size: content.bytesize)
+            tar << content
+            tar << "\0" * ((BLOCK_SIZE - (content.bytesize % BLOCK_SIZE)) % BLOCK_SIZE)
+          end
+          tar << "\0" * (BLOCK_SIZE * 2)
+
+          io = StringIO.new(+"".b)
+          gzip = Zlib::GzipWriter.new(io, Zlib::BEST_COMPRESSION)
+          gzip.mtime = 0
+          gzip.write(tar)
+          gzip.close
+          bytes = io.string
+          raise ArgumentError, "Provisioning archive is too large" if bytes.bytesize > MAX_ARCHIVE_SIZE
+
+          bytes.freeze
+        end
+
+        def tar_header(name, mode:, size:)
+          raise ArgumentError, "Provisioning path is too long: #{name}" if name.bytesize > 100
+
+          header = +"\0" * BLOCK_SIZE
+          write_field(header, 0, 100, name)
+          write_octal(header, 100, 8, mode)
+          write_octal(header, 108, 8, 0)
+          write_octal(header, 116, 8, 0)
+          write_octal(header, 124, 12, size)
+          write_octal(header, 136, 12, 0)
+          write_field(header, 148, 8, " " * 8)
+          write_field(header, 156, 1, "0")
+          write_field(header, 257, 6, "ustar\0")
+          write_field(header, 263, 2, "00")
+          write_field(header, 265, 32, "root")
+          write_field(header, 297, 32, "root")
+          checksum = header.bytes.sum
+          write_field(header, 148, 8, format("%06o\0 ", checksum))
+          header
+        end
+
+        def write_octal(buffer, offset, length, value)
+          write_field(buffer, offset, length, format("%0#{length - 1}o\0", value))
+        end
+
+        def write_field(buffer, offset, length, value)
+          value = value.to_s.b
+          raise ArgumentError, "Tar field overflow" if value.bytesize > length
+
+          buffer[offset, length] = value.ljust(length, "\0")
+        end
+      end
+    end
+  end
+end

data/app/services/collavre/ai_agent/a2a_dispatcher.rb

@@ -6,10 +6,11 @@ module Collavre
     # Detects mentioned agents, records interactions for loop prevention,
     # and dispatches system events for downstream processing.
     class A2aDispatcher
-      def initialize(agent:, reply_comment:, context:)
+      def initialize(agent:, reply_comment:, context:, workspace_user: nil)
         @agent = agent
         @reply_comment = reply_comment
         @context = context
+        @workspace_user = workspace_user
       end
 
       # Dispatch A2A events if the response mentions any AI agents
@@ -53,7 +54,7 @@ module Collavre
       end
 
       def dispatch_event(creative)
-        SystemEvents::Dispatcher.dispatch("comment_created", {
+        payload = {
           comment: {
             id: @reply_comment.id,
             content: @reply_comment.content,
@@ -65,7 +66,19 @@ module Collavre
           },
           topic: { id: @reply_comment.topic_id },
           chat: { content: @reply_comment.content }
-        })
+        }
+        # Always carry the resolved principal, including an explicit nil. Nil
+        # means the current anchor could not prove a human identity; omitting the
+        # key would let a downstream per-user CLI Proxy agent fall back to its
+        # creator and execute with that person's workspace credentials.
+        payload[:workspace_user_id] = @workspace_user&.id
+
+        SystemEvents::Dispatcher.dispatch(
+          "comment_created",
+          payload,
+          source: "a2a",
+          parent: SystemEvents::Envelope.in(@context)
+        )
       end
     end
   end