kairos-chain 3.96.0 → 3.97.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d9378e59ddbeb6127f907b009d5c74f362932d3ded7669e75975d9e4e000285b
-  data.tar.gz: f5153b3a2034f5ad9f68d1ee5d31f4a7295e8b4e1cdf48cf90283744886d0355
+  metadata.gz: 7c9e86d08fcaeb0acb8208d11bc05a5b2aea3e93b1c5ce0e51ea582e728c5b97
+  data.tar.gz: c9e04ca2f728363fe2111a04431e7615e84a8c8a4d3b4a4e2f12f6fbe92ed246
 SHA512:
-  metadata.gz: 2a9ca012c529a7523e68bb0dde4fd08b20bda1e08a540d98714ae169efc1268946faeb6d16ad1a0926382a480177c60c736a383f8747b2dbcf0225bac5ad522a
-  data.tar.gz: 9e39c4801fef0169431db7c23e6f1e45099b11b0a482b12254fef0a90cf7de7787f6d3b6414824fddb86c0f04c246a2b488cda4741e450366841ee7d2f706b52
+  metadata.gz: a20c6536c9cae019fde8d6ae21b4c6c0a9a180e544d91186e24d1a58843a64bafcc63b030067ba5eb658ddf80a4d69a00f5bfb2f93d03e34796c3497b8497326
+  data.tar.gz: ce03eccb65d5d09c907b489e3ac153f1c83c9d3f13033a08324d2dad0412fe453b5fcd885ee8b243200ff67f021ec88568ff6d6222333ea2d52b94c8d1571501

data/CHANGELOG.md

@@ -6,6 +6,80 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.97.0] - 2026-10-23
+
+### Security — Meeting Place agent ids can no longer be taken over (hestia 0.3.0, mmp 1.2.0, skillset_exchange 0.2.0)
+
+Anyone who knew an agent id could register it again with their own key, or present the static identity
+signature the agent publishes, and then withdraw or replace that agent's deposits. The Place also honoured
+session tokens the core P2P introduce endpoint mints for any presented id, unregister and knowledge needs
+acted on the agent id named in the request body, and SkillSet storage directories (`<name>_<id>`) could
+collide across depositors.
+
+- **Key binding.** An agent id is bound to the first key that registers it, in `agent_bindings.json` under
+  the storage directory. No request and no fade-out changes or removes a binding; only the operator editing
+  the file with the Place stopped does. New bindings are limited to `binding_rate_per_hour` (default 60).
+  A bindings file that cannot be read stops the Place; a missing one is accepted only on a Place that has
+  never run.
+- **Registration proof** (`MMP::RegistrationProof`). Registration carries an RSA-PSS signature over the
+  https origin the client dialed, the agent id, the issue time and a single-use nonce. The Place accepts only
+  its own origin (`meeting_place.web_ui.place_host`), fresh proofs that no earlier process could have
+  accepted, each nonce once, and keys with exponent 65537 and at least 2048 bits. Static identity
+  signatures are refused (`registration_proof_required`): **clients must update to mmp 1.2.0**.
+- **Sessions.** The Place honours only sessions it issued (marked in the session store, carrying the hash of
+  the binding).
+- **Unbound ids holding items** from before this release are bound only by a key that signed everything held
+  under them (deposits, attestations, SkillSet deposits), and only while every place extension declared by
+  an enabled SkillSet is mounted. Place extensions must implement `holdings_evidence(agent_id)`.
+- **Writes act on the session id.** Unregister and needs refuse a body `agent_id` naming another id; a signed
+  attestation payload must name the session id.
+- **Storage.** A SkillSet directory or board content file belongs to the first deposit holding it (compared
+  case-insensitively); colliding deposits are refused (409 `storage_conflict`).
+- **Client.** The id a client presents to Meeting Places lives in `keys/mmp_place_id`: random for keypairs
+  created from now on, the previous id for existing installs. `meeting_connect` takes `fresh_id: true` to
+  take a new id after `key_mismatch`. `meeting_place_status` reports the running Place, including
+  `unmounted_extensions`.
+- **Upgrading a Place that has run before:** create `<storage>/agent_bindings.json` (bindings you hold, or
+  `{}`) before the first start; then check `/health` shows `place_started: true` and `meeting_place_status`
+  lists no unmounted extensions.
+
+## [3.96.1] - 2026-10-22
+
+### Fixed — agent runs convene the persona seat their reviews declared none for (agent 1.0.2)
+
+A run review dispatched multi_llm_review with `persona_count_declared: 0` and collected with no persona reviews,
+so every round counted four seats where the operator's roster has five, and the report said so in one line.
+
+- Each review round declares three personas (design: architect, security, operability; implementation:
+  correctness, performance, api-design; document: ontologist, skeptic, integration) and stores their prompts —
+  multi_llm_review's own canonical prompt for the same bundle, under a persona header — in run storage.
+- The actor launches each seat with a one-line marker that the PreToolUse hook replaces with the seat's prompt.
+  From then on the subagent is a seat for its whole life, recognised by the host's meta file naming that launch;
+  it may read only its prompt file and hand back. Messages and stops aimed at a seat are refused.
+- Each seat is settled at its SubagentStop from the hand-back the hooks kept, before the hazard and question
+  readers; agent_advance settles launches the host never started or never stopped. A seat whose transcript
+  shows another prompt is not submitted.
+- agent_advance waits about 540 s per call for running seats, submits each settled reply with the verdict and
+  findings multi_llm_review's own parser reads from it, one per line the seat wrote, so a finding's severity
+  and consequence come from the same line, and gives the stand-in each persona's own reply. A finding whose
+  consequence clause (or location) lies past the point where multi_llm_review cuts a persona finding is
+  rebuilt with the clause and its location after a shortened body, so the cut does not record a P0 as one
+  that stated no consequence. A seat never launched holds the round only until the first reminder; missing
+  seats become a shortfall named in the report, and seats launched late or never are named on the review's
+  closure item. Until the round collects or its token expires the Stop hook sends the actor back to
+  agent_advance (three times without an advance between, and once more after a turn in which a seat started or
+  ended, then the run rests), so the round collects before its token expires. From ten minutes before the
+  token's end no seat is launched or asked for. Collect closes the round's seats under the lock that admits
+  launches and settles its remaining launches, so no launch outlives the round and the seat refusals end with
+  it; agent_stop closes the seats of a round that never collected. A close that fails because the seat lock
+  cannot be taken is journaled as such (`seats_close_failed`) and the settled replies are still submitted. A settled seat may be stopped; it is
+  never messaged.
+- The seats run on the session's own plan; no policy spend counter counts them.
+- `depends_on` pins multi_llm_review >= 0.12.0. L1 multi_llm_review_workflow 3.17.1.
+- Design: `log/agent_persona_seats_design_v0.3_20261022.md` (two design review rounds, four implementation
+  review rounds and one falsification check; the P1s of each fixed). Probed live on one host: three seats
+  launched through the rewrite, all three submitted, five seats counted.
+
 ## [3.96.0] - 2026-10-21
 
 ### Changed — multi_llm_review says what the roster was when a result is read (multi_llm_review 0.12.0, llm_client 0.4.0)

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.96.0"
+  VERSION = "3.97.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/hestiachain_meeting_place/hestiachain_meeting_place.md

@@ -1,7 +1,7 @@
 ---
 name: hestiachain_meeting_place
 description: "HestiaChain Meeting Place — user guide for agent discovery, skill exchange, and trust anchoring"
-version: 2.1
+version: 2.2
 layer: L1
 tags: [documentation, readme, hestia, meeting-place, p2p, deployment, trust-anchor]
 readme_order: 4.5
@@ -66,10 +66,10 @@ kairos-chain --http --port 8080
 # Place info (no auth required)
 curl -s http://localhost:8080/place/v1/info | python3 -m json.tool
 
-# Register an agent
-curl -s -X POST http://localhost:8080/place/v1/register \
-  -H 'Content-Type: application/json' \
-  -d '{"id":"agent-alpha","name":"Agent Alpha","capabilities":{"supported_actions":["test"]}}'
+# Register an agent: registration carries a signed, single-use proof
+# (hestia >= 0.3.0), so register from KairosChain with the
+# meeting_connect tool (url: http://localhost:8080) rather than curl.
+# The session token is in its result.
 
 # Browse the skill board (Bearer token required)
 curl -s -H "Authorization: Bearer $TOKEN" \
@@ -81,8 +81,8 @@ curl -s -H "Authorization: Bearer $TOKEN" \
 | Method | Path | Auth | Description |
 |--------|------|------|-------------|
 | GET | `/place/v1/info` | None | Place metadata and identity |
-| POST | `/place/v1/register` | RSA signature (optional) | Register an agent |
-| POST | `/place/v1/unregister` | Bearer | Unregister an agent |
+| POST | `/place/v1/register` | Registration proof (required, mmp >= 1.2.0) | Register an agent; the id is bound to its key |
+| POST | `/place/v1/unregister` | Bearer | Unregister the session's own agent |
 | GET | `/place/v1/agents` | Bearer | List registered agents |
 | GET | `/place/v1/board/browse` | Bearer | Browse skill board (random order) |
 | POST | `/place/v1/board/needs` | Bearer | Publish knowledge needs to board |
@@ -166,6 +166,16 @@ kairos.example.com {
 }
 ```
 
+Set the public host name in the hestia config so the Place accepts registrations addressed to it (without it, only `localhost` registrations are accepted):
+
+```yaml
+meeting_place:
+  web_ui:
+    place_host: kairos.example.com
+```
+
+Upgrading a Place that has run before to hestia 0.3.0: the first start refuses until `agent_bindings.json` exists under the storage directory (`<data_dir>/storage/`). Create it with the bindings you hold, or as `{}`. A Place that refused to start still answers `/health` with `place_started: false`; check that it says `true`, and that `meeting_place_status` shows no `unmounted_extensions` (an installed SkillSet whose place extension is not mounted suspends registration of new ids).
+
 For detailed DEE protocol internals, install the hestia SkillSet and refer to its bundled knowledge (`hestia_meeting_place`).
 
 ### Interaction Policy (instance discipline)

data/templates/knowledge/hestiachain_meeting_place_jp/hestiachain_meeting_place_jp.md

@@ -1,7 +1,7 @@
 ---
 name: hestiachain_meeting_place_jp
 description: "HestiaChain Meeting Place — エージェント探索・スキル交換・信頼アンカーのユーザーガイド"
-version: 2.1
+version: 2.2
 layer: L1
 tags: [documentation, readme, hestia, meeting-place, p2p, deployment, trust-anchor]
 readme_order: 4.5
@@ -66,10 +66,9 @@ kairos-chain --http --port 8080
 # Place 情報（認証不要）
 curl -s http://localhost:8080/place/v1/info | python3 -m json.tool
 
-# エージェント登録
-curl -s -X POST http://localhost:8080/place/v1/register \
-  -H 'Content-Type: application/json' \
-  -d '{"id":"agent-alpha","name":"Agent Alpha","capabilities":{"supported_actions":["test"]}}'
+# エージェント登録：登録には署名つきの使い捨ての証明が要る（hestia 0.3.0 以降）。
+# curl ではなく、KairosChain から meeting_connect ツール（url: http://localhost:8080）で登録する。
+# 通行証（session token）はその結果に入っている。
 
 # スキルボード閲覧（Bearer トークン必須）
 curl -s -H "Authorization: Bearer $TOKEN" \
@@ -81,8 +80,8 @@ curl -s -H "Authorization: Bearer $TOKEN" \
 | メソッド | パス | 認証 | 説明 |
 |---------|------|------|------|
 | GET | `/place/v1/info` | なし | Place メタデータと身元情報 |
-| POST | `/place/v1/register` | RSA 署名（任意） | エージェント登録 |
-| POST | `/place/v1/unregister` | Bearer | エージェント登録解除 |
+| POST | `/place/v1/register` | 登録の証明（必須、mmp 1.2.0 以降） | エージェント登録。ID はその鍵に結びつく |
+| POST | `/place/v1/unregister` | Bearer | 通行証の持ち主自身の登録解除 |
 | GET | `/place/v1/agents` | Bearer | 登録エージェント一覧 |
 | GET | `/place/v1/board/browse` | Bearer | スキルボード閲覧（ランダム順） |
 | POST | `/place/v1/board/needs` | Bearer | 知識ニーズをボードに公開 |
@@ -166,4 +165,14 @@ kairos.example.com {
 }
 ```
 
+hestia の設定に公開ホスト名を書いてください。書かないと、localhost 宛ての登録しか受け付けません。
+
+```yaml
+meeting_place:
+  web_ui:
+    place_host: kairos.example.com
+```
+
+一度でも動かしたことのある Meeting Place を hestia 0.3.0 に上げる場合：保存ディレクトリ（`<data_dir>/storage/`）に `agent_bindings.json` ができるまで、最初の起動は止まります。手元にある結びつきを書いて作るか、`{}` で作ってください。起動が止まった Meeting Place も `/health` には `place_started: false` で答えるので、`true` になっていること、`meeting_place_status` の `unmounted_extensions` が空であることを確かめてください（組み込まれていない拡張を持つ SkillSet が入っていると、新しい ID の登録が止まります）。
+
 DEE プロトコルの内部詳細については、hestia SkillSet をインストールし、同梱の knowledge（`hestia_meeting_place`）を参照してください。

data/templates/knowledge/multi_llm_review_workflow/multi_llm_review_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: multi_llm_review_workflow
 description: "Multi-LLM review methodology and execution — workflow pattern, CLI tooling, consensus analysis, Persona Assembly. Applicable to design, implementation, documentation, or any artifact."
-version: "3.17.0"
+version: "3.17.1"
 tags:
   - workflow
   - review
@@ -896,9 +896,11 @@ A counted seat's maker is observed (the seat reported its model), configured (th
 roster pins the model and the seat ran on its own provider — this holds while the
 CLI's own configuration does not route that name to another maker), or
 caller-declared (a persona seat that was not observed). Only the first two
-establish diversity. Two kinds of round always carry the line: an `exclude` round
-whose caller names a slot (that slot does not count), and an agent SkillSet round
-(it submits no personas). None of this changes the verdict or the quorum
+establish diversity. One kind of round always carries the line: an `exclude` round
+whose caller names a slot (that slot does not count). An agent SkillSet round no
+longer always carries it: agent 1.0.2 convenes three personas on the host and
+submits the replies the host handed back, where 1.0.1 submitted none, so its line
+follows the same rule as any other round. None of this changes the verdict or the quorum
 (`min_quorum`, 2 shipped). An INSUFFICIENT result also says how many seats counted
 and how many were needed, that a seat can be added in config, and the restoring
 action for each reason in the table above.
@@ -2117,6 +2119,13 @@ Compression ratio: parallel agent raw → Assembly ≈ 2:1
   multi_llm_review 0.12.0 and llm_client 0.4.0. Design
   `log/mlr_non_claude_host_design_v0.3.3_20261021.md`, frozen after four rounds.
 
+- Agent runs convene persona seats (v3.17.1, 2026-10-22, operator request:
+  「Agent SkillSet1.0.1でreview時にpersona数が0に決め打ちされてるそうですが、MLRの設定と異なるので
+  修正して下さい」). § Reduced rosters no longer says an agent SkillSet round always
+  carries the roster line: agent 1.0.2 declares and convenes three personas, launched
+  by the run's actor through a marker the SkillSet's hook rewrites, and submits the
+  replies the host handed back. Design `log/agent_persona_seats_design_v0.3_20261022.md`.
+
 **Key insight**: Design reviews and implementation reviews find
 **categorically different bugs**. Both phases are necessary. The corollary that
 cost eight rounds to learn: **which of the two you are in is readable from the

data/templates/skillsets/agent/lib/agent/hooks.rb

@@ -10,6 +10,7 @@ require_relative 'stand_in'
 require_relative 'precedents'
 require_relative 'policies'
 require_relative 'transcript'
+require_relative 'seats'
 
 module KairosMcp
   module SkillSets
@@ -32,6 +33,13 @@ module KairosMcp
               "(#{run.target_repo}) as a new file — each version is a new file. Then call " \
               "agent_advance(run_id: '#{id}', phase: '#{phase.name}')."
           when :review
+            seats = Seats.instruction(run, phase.name.to_s)
+            return seats if seats
+            if run.in_flight_review
+              return "Phase #{phase.name}: a review round is running. Call agent_advance(run_id: '#{id}', " \
+                     "phase: '#{phase.name}') to collect it."
+            end
+
             answer = plan.phase(phase.args[:of])&.kind == :produce ? 'writing the next version as a new file' : 'new commits on the run branch'
             "Phase #{phase.name}: call agent_advance(run_id: '#{id}', phase: '#{phase.name}'). It dispatches the next " \
               "review round of the latest #{phase.args[:of]} artifact and, on the next call, returns the seats' findings " \
@@ -136,6 +144,11 @@ module KairosMcp
           sid = input['session_id']
           touch_guard_seen(sid)
           tool = input['tool_name'].to_s
+          # A review seat's own calls are placed before anything else, the
+          # agent-tool shortcut included (design v0.3 §3.5).
+          if input['agent_id'] && (out = seat_tool_gate(input, tool))
+            return out
+          end
           if Hooks.agent_tool?(tool)
             # The operator's words after an ending release the guard before the
             # agent tool runs (agent_start right after them is not refused).
@@ -150,6 +163,9 @@ module KairosMcp
           return nil unless run
           return nil if release_if_typed(run, sid)
 
+          seat = seat_launch_gate(run, input, tool)
+          return seat if seat
+
           policy = policy_for(run)
           unless policy
             return deny("the policy pinned by run #{run.id} changed or is missing; the guard cannot decide. " \
@@ -379,6 +395,9 @@ module KairosMcp
         def stop(input, subagent:)
           run = Run.bound_to(@paths, input['session_id'])
           return nil unless run
+          # A review seat's end settles it, before any other Stop-hook path:
+          # its reply is a review, not a hazard report or a question.
+          return nil if subagent && seat_stop(run, input) == :seat
           return nil if release_if_typed(run, input['session_id'])
           return nil if run.status == 'finished'
 
@@ -401,7 +420,10 @@ module KairosMcp
             end
             return out if out
           end
-          return nil if !subagent && Array(input['background_tasks']).any?
+          # Background tasks let the actor rest, except while persona seats of
+          # a dispatch are out: then the round must reach agent_advance before
+          # its token expires.
+          return nil if !subagent && Array(input['background_tasks']).any? && !Seats.holding_dispatch(run.journal.entries)
           if live && QUESTION_END.match?(tail.strip)
             answer = prose_question(run, policy, tail)
             return block("Stand-in answer (provisional, journaled): #{answer}. Continue the run.") if answer
@@ -430,11 +452,28 @@ module KairosMcp
           progressed = run.last_block_seq.nil? || run.last_progress_seq.to_i > run.last_block_seq.to_i ||
                        (last_block && last_block['fingerprint'] && last_block['fingerprint'] != fingerprint)
           if run.in_flight_review
+            # While persona seats are out, each agent_advance call (which waits
+            # for them) earns one more block, until the round collects.
+            entries = run.journal.entries
+            if Seats.holding_dispatch(entries)
+              # Blocked every time until the round collects, so the call that
+              # collects comes before the token expires; three blocks with no
+              # agent_advance between them is an actor not following, and the
+              # run rests rather than spin. Only what an agent_advance call
+              # journals counts as one between them: a seat launching or
+              # settling is not the actor calling it.
+              last_wait = entries.reverse.find { |e| %w[seats_prompted seats_waited review_dispatched].include?(e['kind']) }
+              since = entries.count { |e| e['kind'] == 'stop_blocked' && e['for'] == 'persona_seats' && e['seq'] > last_wait.to_h['seq'].to_i }
+              if since < Seats::HOLD_BLOCKS
+                run.append(:stop_blocked, for: 'persona_seats', fingerprint: fingerprint)
+                return block("Run #{run.id}: #{Guidance.next_step(run)}")
+              end
+            end
             # Once per progress: a round that never comes back rests the run.
-            last = run.journal.entries.reverse.find { |e| e['kind'] == 'stop_blocked' }
-            unless last && last['for'] == 'review_in_flight' && !progressed
+            last = entries.reverse.find { |e| e['kind'] == 'stop_blocked' }
+            unless last && %w[review_in_flight persona_seats].include?(last['for']) && !progressed
               run.append(:stop_blocked, for: 'review_in_flight', fingerprint: fingerprint)
-              return block("Run #{run.id}: a review round is running. Call agent_advance(run_id: '#{run.id}') to collect it.")
+              return block("Run #{run.id}: #{Guidance.next_step(run)}")
             end
           end
           if progressed
@@ -523,6 +562,141 @@ module KairosMcp
           File.exist?(f) && (Time.now - File.mtime(f)) <= within
         end
 
+        # --- persona seats (design log/agent_persona_seats_design_v0.3) ------------
+
+        # A subagent's own tool call while the run has seat launches: a seat
+        # may hand back and read its own prompt file, nothing else, and a
+        # subagent whose launch cannot be read is held to that while a seat is
+        # out. nil when the call is not a seat's.
+        def seat_tool_gate(input, tool)
+          run = Run.bound_to(@paths, input['session_id'])
+          return nil unless run
+
+          entries = run.journal.entries
+          return nil unless Seats.any_launch?(entries)
+
+          kind, launch = Seats.identify(entries, input)
+          return nil if kind == :other
+          return nil if kind == :unknown && Seats.unsettled_launches(entries).empty?
+
+          if tool == Seats::HANDBACK
+            Seats.keep_handback(run, input['agent_id'], input.dig('tool_input', 'message')) if kind == :seat
+            return allow
+          end
+          return allow if kind == :seat && tool == 'Read' && seat_reads_own_prompt?(run, launch, input['tool_input'], input['cwd'] || Dir.pwd)
+
+          if kind == :seat
+            deny("A review seat reads only its prompt file and answers with its hand-back; #{tool} is refused to it " \
+                 '(INV-2). Answer from the prompt.')
+          else
+            deny('The run cannot tell whether this subagent is a review seat (its host meta file names no launch) while ' \
+                 "a seat is out, so it is held to a seat's tools (INV-2).")
+          end
+        rescue StandardError, ScriptError => e
+          deny("agent seat gate error (#{e.class}): #{e.message[0, 200]}")
+        end
+
+        def seat_reads_own_prompt?(run, launch, tool_input, cwd = Dir.pwd)
+          given = tool_input.is_a?(Hash) ? tool_input['file_path'].to_s : ''
+          !given.empty? && File.expand_path(given, cwd) == File.expand_path(Seats.prompt_path(run, launch['full_sha256'].to_s))
+        end
+
+        # A launch of a seat by its marker, from any caller, and messages or
+        # stops aimed at a seat. nil when neither applies.
+        def seat_launch_gate(run, input, tool)
+          if Seats::LAUNCH_TOOLS.include?(tool)
+            prompt = input.dig('tool_input', 'prompt').to_s.strip
+            return nil unless prompt.start_with?(Seats::MARKER_PREFIX)
+
+            return Seats.locked(run) { launch_seat(run, input, prompt) }
+          end
+          return nil unless Seats::TARGET_TOOLS.include?(tool)
+
+          entries = run.journal.entries
+          return nil unless Seats.any_launch?(entries)
+
+          ti = input['tool_input'].is_a?(Hash) ? input['tool_input'] : {}
+          targets = Seats::TARGET_KEYS.map { |k| ti[k] }.select { |v| v.is_a?(String) && !v.empty? }
+          out = Seats.unsettled_launches(entries).any?
+          targets.each do |t|
+            kind, launch = Seats.identify(entries, input, t)
+            if kind == :seat
+              # A settled seat's reply is frozen, so stopping it changes no
+              # record; a message still could reach a reply, so it stays refused.
+              next if tool == 'TaskStop' && Seats.settlement_for(entries, launch)
+
+              return deny("#{tool} to a review seat is refused: a seat is neither messaged nor stopped by the run (INV-3).")
+            end
+            if kind == :unknown && out
+              return deny("#{tool} to #{t} is refused while a review seat is out: the run cannot tell whether it is a seat (INV-3).")
+            end
+          end
+          nil
+        end
+
+        # Admits one launch of a seat (under the run's seat lock) and replaces
+        # the marker with the seat's short prompt; every other key the caller
+        # gave is dropped.
+        def launch_seat(run, input, prompt)
+          if input['tool_use_id'].to_s.empty?
+            return deny('A review seat cannot be launched from a call the host gave no tool_use_id: the seat could not be bound to its launch.')
+          end
+
+          entries = run.journal.entries
+          live = Seats.live_markers(run.id, entries)
+          seat = live[prompt]
+          listing = live.empty? ? 'There is no seat to launch now.' : "Live markers:\n#{live.keys.join("\n")}"
+          unless seat
+            spent = Seats.spent_reason(run.id, entries, prompt)
+            return deny("This seat is no longer launched: #{spent}. #{listing}") if spent
+
+            return deny("Not a live review-seat marker. #{listing}")
+          end
+
+          why = Seats.launch_refusal(entries, seat)
+          return deny("Refused: #{why}. #{listing}") if why
+
+          path = Seats.prompt_path(run, seat['sha256'])
+          unless File.file?(path) && Digest::SHA256.file(path).hexdigest == seat['sha256']
+            return deny("The stored prompt of seat #{seat['persona']} no longer matches its dispatch; the seat cannot be launched.")
+          end
+
+          short = Seats.short_prompt(run, seat, Seats.dispatch_for(entries, seat['token']))
+          run.append(:seat_launched, token: seat['token'], persona: seat['persona'], phase: seat['phase'], round: seat['round'],
+                                     tool_use_id: input['tool_use_id'], full_sha256: seat['sha256'],
+                                     prompt_sha256: Digest::SHA256.hexdigest(short), session_id: input['session_id'],
+                                     subagents_dir: Seats.subagents_dir(input))
+          updated = { 'description' => "review seat #{seat['persona']}", 'prompt' => short, 'subagent_type' => 'general-purpose' }
+          effort = input['effort'].is_a?(Hash) ? input['effort']['level'] : input['effort']
+          updated['effort'] = effort if Seats::EFFORTS.include?(effort)
+          allow(updated_input: updated)
+        end
+
+        # Settles a seat at its first stop, and journals a subagent the run
+        # cannot place while a seat is out. :seat when the stop was a seat's.
+        def seat_stop(run, input)
+          entries = run.journal.entries
+          return nil unless Seats.any_launch?(entries)
+
+          kind, launch = Seats.identify(entries, input)
+          if kind == :seat
+            begin
+              reply = Seats.kept_handback(run, input['agent_id']) || input['last_assistant_message']
+              cause = Seats.first_prompt_sha256(Seats.host_files(input)) == launch['prompt_sha256'] ? nil : 'prompt_mismatch'
+              Seats.settle(run, launch, agent_id: input['agent_id'], reply: reply, cause: cause)
+            rescue StandardError, ScriptError => e
+              run.append(:seat_settle_failed, token: launch['token'], persona: launch['persona'], tool_use_id: launch['tool_use_id'],
+                                              reason: "#{e.class}: #{e.message[0, 200]}")
+            end
+            return :seat
+          end
+          if kind == :unknown && Seats.unsettled_launches(entries).any?
+            run.append(:subagent_unidentified, agent_id: input['agent_id'], agent_type: input['agent_type'],
+                                               cause: 'its host meta file names no launch')
+          end
+          nil
+        end
+
         # A session whose run another session took over: its guard refuses
         # what would act, until the operator speaks here again or the session
         # ends, so its turn does not continue unguarded.