@acnlabs/paperclip-plugin-acn 0.1.1 → 0.2.0

package/dist/worker.js

@@ -2,15 +2,18 @@
  * ACN Plugin Worker
  *
  * Responsibilities:
- *  P0-1  Startup  : register webhook URL as ACN subnet harness
- *  P0-2  Startup  : full sync — pull open ACN tasks → Paperclip issues
- *  P0-3  ACN→PC   : task.* webhook events → sync Paperclip issue status / comments
- *  P0-4  PC→ACN   : Paperclip issue done/cancelled → ACN review (approve / reject)
- *  P0-5  PC→ACN   : Paperclip issue created (not from ACN) → ACN task
+ *  P0-1  Startup  : resolve/create ACN Org; register subnet harness webhook
+ *  P0-2  Startup  : full sync — pull open ACN tasks → Paperclip issues (legacy)
+ *  P0-3  ACN→PC   : task.* webhook events → sync Paperclip issue status / comments (legacy)
+ *  P0-4  PC→ACN   : Paperclip issue done/cancelled → ACN task review (legacy)
+ *  P2c-C1 PC→ACN  : Paperclip issue created → Org work (NOT Task Pool)
+ *  P2c-C2 ACN→PC  : org.work_* / org.loop_tick → Issues (preferred inbound)
+ *  P2c-C3 PC→ACN  : Paperclip issue done/cancelled → PATCH Org work status
  */
 import { definePlugin, runWorker } from "@paperclipai/plugin-sdk";
 import { ACNClient } from "acn-client";
 import { PLUGIN_ID, STATE_KEYS, WEBHOOK_KEYS } from "./constants.js";
+import { AcnHttpError, AcnOrgApi, orgSubnetId } from "./lib/org-api.js";
 import { verifyAcnSignature } from "./lib/signature.js";
 import { shouldSkipPluginEcho } from "./lib/echo-guard.js";
 import { resolveSecretOrLiteral } from "./lib/secrets.js";
@@ -25,10 +28,63 @@ let _harnessSecret = null;
 /**
  * ACN agent_id of the API key the plugin is configured with. Used to detect
  * — and skip — webhook events fired for tasks the plugin itself just
- * created (PC issue → plugin createTask → ACN fires task.created → plugin
- * would otherwise mirror it back into a ghost duplicate issue).
+ * created (legacy Task path).
  */
 let _selfAgentId = null;
+/**
+ * work_ids successfully mapped after C1 outbound. Covers async/retry
+ * deliveries that arrive after `saveMap` (ACN may retry after sync POST fails).
+ */
+const _recentOutboundWorkIds = new Set();
+const RECENT_OUTBOUND_CAP = 200;
+const _pendingOutboundByCompany = new Map();
+/** Mark a work_id as outbound so late/retry org.work_created skips create. */
+export function noteRecentOutboundWork(workId) {
+    _recentOutboundWorkIds.add(workId);
+    if (_recentOutboundWorkIds.size > RECENT_OUTBOUND_CAP) {
+        const first = _recentOutboundWorkIds.values().next().value;
+        if (first !== undefined)
+            _recentOutboundWorkIds.delete(first);
+    }
+}
+/** Drop a work_id from the echo set (e.g. after saveMap failure). */
+export function forgetRecentOutboundWork(workId) {
+    _recentOutboundWorkIds.delete(workId);
+}
+/** Register an in-flight outbound create before awaiting createWork. */
+export function beginOutboundWorkCreate(companyId, issueId, title) {
+    const stack = _pendingOutboundByCompany.get(companyId) ?? [];
+    stack.push({ issueId, title });
+    _pendingOutboundByCompany.set(companyId, stack);
+}
+/** Clear in-flight entry after createWork settles (success or failure). */
+export function endOutboundWorkCreate(companyId, issueId) {
+    const stack = _pendingOutboundByCompany.get(companyId);
+    if (!stack?.length)
+        return;
+    const idx = stack.findIndex((p) => p.issueId === issueId);
+    if (idx >= 0)
+        stack.splice(idx, 1);
+    if (stack.length === 0)
+        _pendingOutboundByCompany.delete(companyId);
+    else
+        _pendingOutboundByCompany.set(companyId, stack);
+}
+function peekPendingOutbound(companyId) {
+    const stack = _pendingOutboundByCompany.get(companyId);
+    if (!stack?.length)
+        return undefined;
+    return stack[stack.length - 1];
+}
+/** Test helper — clear outbound echo + in-flight stacks. */
+export function clearRecentOutboundWorkForTests() {
+    _recentOutboundWorkIds.clear();
+    _pendingOutboundByCompany.clear();
+    _lastLoopTickCommentAt = 0;
+}
+/** Cooldown so loop_tick does not spam issue comments. */
+const LOOP_TICK_COMMENT_COOLDOWN_MS = 5 * 60 * 1000;
+let _lastLoopTickCommentAt = 0;
 async function loadMap(ctx, key, companyId) {
     // Paperclip's plugin_state.value_json is a jsonb column, so the host can
     // return either a parsed object or a JSON string depending on how the
@@ -48,10 +104,112 @@ async function loadMap(ctx, key, companyId) {
 async function saveMap(ctx, key, companyId, map) {
     await ctx.state.set({ scopeKind: "company", scopeId: companyId, stateKey: key }, JSON.stringify(map));
 }
+async function loadScalar(ctx, key, companyId) {
+    const raw = await ctx.state.get({ scopeKind: "company", scopeId: companyId, stateKey: key });
+    if (raw == null || raw === "")
+        return null;
+    if (typeof raw === "string") {
+        const s = raw.trim();
+        if (!s || s === "null")
+            return null;
+        // Historically some hosts JSON-encode scalars.
+        if (s.startsWith('"') && s.endsWith('"')) {
+            try {
+                const parsed = JSON.parse(s);
+                return typeof parsed === "string" && parsed ? parsed : null;
+            }
+            catch {
+                return s;
+            }
+        }
+        return s;
+    }
+    return null;
+}
+async function saveScalar(ctx, key, companyId, value) {
+    await ctx.state.set({ scopeKind: "company", scopeId: companyId, stateKey: key }, value);
+}
 /** Reverse-lookup: find the key whose value equals `val` */
 function reverseLookup(map, val) {
     return Object.entries(map).find(([, v]) => v === val)?.[0];
 }
+/**
+ * Resolve configured / persisted Org, or create one bound to ``acnSubnetId``.
+ * Mutates ``cfg.acnOrgId`` / ``cfg.acnSubnetId`` when filled from Org record.
+ *
+ * On ``subnet_already_bound`` (409): if the error body hints a ``org_…`` id,
+ * reuse it; otherwise fail with an operator-facing message to set ``acnOrgId``.
+ */
+export async function resolveAcnOrg(ctx, cfg, orgApi, companyId, companyName) {
+    let orgId = (cfg.acnOrgId ?? "").trim();
+    if (!orgId && companyId) {
+        orgId = (await loadScalar(ctx, STATE_KEYS.acnOrgId, companyId)) ?? "";
+    }
+    if (orgId) {
+        const org = await orgApi.getOrg(orgId);
+        const fence = orgSubnetId(org);
+        const configuredSubnet = (cfg.acnSubnetId ?? "").trim();
+        if (fence && configuredSubnet && fence !== configuredSubnet) {
+            ctx.logger.warn("acn-plugin: acnSubnetId does not match Org fence — using Org fence for harness", {
+                acnOrgId: org.org_id,
+                configured_subnet: configuredSubnet,
+                org_fence: fence,
+            });
+            cfg.acnSubnetId = fence;
+        }
+        else if (fence && !configuredSubnet) {
+            cfg.acnSubnetId = fence;
+        }
+        cfg.acnOrgId = org.org_id;
+        if (companyId) {
+            await saveScalar(ctx, STATE_KEYS.acnOrgId, companyId, org.org_id);
+        }
+        return org.org_id;
+    }
+    const subnet = (cfg.acnSubnetId ?? "").trim();
+    if (!subnet) {
+        throw new Error("acnOrgId or acnSubnetId required: set an existing Org, or a subnet to create one");
+    }
+    const displayName = (companyName && companyName.trim()) ||
+        (companyId ? `Paperclip ${companyId}` : "Paperclip Org");
+    try {
+        const created = await orgApi.createOrg({
+            display_name: displayName,
+            subnet_id: subnet,
+        });
+        cfg.acnOrgId = created.org_id;
+        if (companyId) {
+            await saveScalar(ctx, STATE_KEYS.acnOrgId, companyId, created.org_id);
+        }
+        ctx.logger.info("acn-plugin: created ACN Org for company", {
+            org_id: created.org_id,
+            subnet_id: subnet,
+            company_id: companyId,
+        });
+        return created.org_id;
+    }
+    catch (err) {
+        if (err instanceof AcnHttpError && err.status === 409) {
+            const hint = err.boundOrgIdHint;
+            if (hint) {
+                ctx.logger.warn("acn-plugin: subnet already bound — reusing bound Org from error hint", { subnet_id: subnet, org_id: hint, reason: err.reason });
+                const org = await orgApi.getOrg(hint);
+                cfg.acnOrgId = org.org_id;
+                const fence = orgSubnetId(org);
+                if (fence)
+                    cfg.acnSubnetId = fence;
+                if (companyId) {
+                    await saveScalar(ctx, STATE_KEYS.acnOrgId, companyId, org.org_id);
+                }
+                return org.org_id;
+            }
+            throw new Error(`Subnet '${subnet}' is already bound to an ACN Org (reason=${err.reason ?? "conflict"}). ` +
+                `Set instance config acnOrgId to that org_id and restart the plugin. ` +
+                `Original: ${err.message}`);
+        }
+        throw err;
+    }
+}
 // ── ACN client factory ────────────────────────────────────────────────────────
 function buildClient(cfg, apiKey) {
     return new ACNClient({
@@ -117,6 +275,167 @@ async function syncTasks(ctx, client, cfg, companyId, taskIssueMap) {
     }
     return updated;
 }
+// ── Org work inbound (P2c-C2) ─────────────────────────────────────────────────
+function workIssueDescription(data) {
+    const lines = [];
+    if (data.work_id)
+        lines.push(`**ACN Work ID:** \`${data.work_id}\``);
+    if (data.org_id)
+        lines.push(`**ACN Org ID:** \`${data.org_id}\``);
+    if (data.assignee_agent_id) {
+        lines.push(`**Assignee:** \`${data.assignee_agent_id}\``);
+    }
+    return lines.join("\n");
+}
+function configuredOrgId(cfg) {
+    return (cfg.acnOrgId ?? "").trim();
+}
+export async function handleOrgWorkCreated(ctx, cfg, companyId, data) {
+    const orgId = configuredOrgId(cfg);
+    const eventOrgId = (data.org_id ?? "").trim();
+    if (!orgId || !eventOrgId || eventOrgId !== orgId) {
+        ctx.logger.debug("acn-plugin: org.work_created skipped — org mismatch", {
+            event_org: eventOrgId || null,
+            configured_org: orgId || null,
+        });
+        return;
+    }
+    const workId = (data.work_id ?? "").trim();
+    if (!workId)
+        return;
+    if (_recentOutboundWorkIds.has(workId)) {
+        ctx.logger.info("acn-plugin: skipping org.work_created (outbound echo)", {
+            work_id: workId,
+        });
+        return;
+    }
+    const workMap = await loadMap(ctx, STATE_KEYS.issueWorkMap, companyId);
+    if (workMap[workId]) {
+        ctx.logger.info("acn-plugin: skipping org.work_created (already mapped)", {
+            work_id: workId,
+            issue_id: workMap[workId],
+        });
+        return;
+    }
+    // Sync harness: bind to the Paperclip issue currently inside createWork.
+    const pending = peekPendingOutbound(companyId);
+    if (pending) {
+        try {
+            const fresh = await loadMap(ctx, STATE_KEYS.issueWorkMap, companyId);
+            fresh[workId] = pending.issueId;
+            await saveMap(ctx, STATE_KEYS.issueWorkMap, companyId, fresh);
+            noteRecentOutboundWork(workId);
+            ctx.logger.info("acn-plugin: org.work_created → bound to in-flight issue", {
+                work_id: workId,
+                issue_id: pending.issueId,
+                org_id: orgId,
+            });
+        }
+        catch (err) {
+            forgetRecentOutboundWork(workId);
+            ctx.logger.error("acn-plugin: failed to bind org.work_created to in-flight issue", {
+                work_id: workId,
+                issue_id: pending.issueId,
+                error: String(err),
+            });
+        }
+        return;
+    }
+    if (!cfg.autoCreateIssues)
+        return;
+    const issue = await ctx.issues.create({
+        companyId,
+        title: `[ACN] ${data.title ?? workId}`,
+        description: workIssueDescription(data),
+        status: "todo",
+        originKind: `plugin:${PLUGIN_ID}:work`,
+        originId: workId,
+    });
+    try {
+        const fresh = await loadMap(ctx, STATE_KEYS.issueWorkMap, companyId);
+        fresh[workId] = issue.id;
+        await saveMap(ctx, STATE_KEYS.issueWorkMap, companyId, fresh);
+        noteRecentOutboundWork(workId);
+        ctx.logger.info("acn-plugin: org.work_created → issue created", {
+            work_id: workId,
+            issue_id: issue.id,
+            org_id: orgId,
+        });
+    }
+    catch (err) {
+        forgetRecentOutboundWork(workId);
+        ctx.logger.error("acn-plugin: org.work_created issue created but map persist failed", {
+            work_id: workId,
+            issue_id: issue.id,
+            error: String(err),
+        });
+    }
+}
+export async function handleOrgWorkUpdated(ctx, cfg, companyId, data) {
+    const orgId = configuredOrgId(cfg);
+    const eventOrgId = (data.org_id ?? "").trim();
+    if (!orgId || !eventOrgId || eventOrgId !== orgId)
+        return;
+    const workId = (data.work_id ?? "").trim();
+    if (!workId)
+        return;
+    const workMap = await loadMap(ctx, STATE_KEYS.issueWorkMap, companyId);
+    const issueId = workMap[workId];
+    if (!issueId)
+        return;
+    const status = data.status;
+    if (!status)
+        return;
+    // Same constraint as task.accepted: Paperclip in_progress needs an assignee
+    // in Paperclip's identity space — ACN agent ids are not assignable.
+    if (status === "in_progress") {
+        const who = data.assignee_agent_id ?? "unknown";
+        await ctx.issues.createComment(issueId, `Org work moved to \`in_progress\` on ACN (assignee \`${who}\`).`, companyId);
+        ctx.logger.info("acn-plugin: org.work_updated → comment (in_progress)", {
+            work_id: workId,
+            issue_id: issueId,
+        });
+        return;
+    }
+    if (status === "todo" || status === "done" || status === "cancelled") {
+        await ctx.issues.update(issueId, { status }, companyId);
+        await ctx.issues.createComment(issueId, `Org work status on ACN is now \`${status}\`.`, companyId);
+        ctx.logger.info("acn-plugin: org.work_updated → issue status", {
+            work_id: workId,
+            issue_id: issueId,
+            status,
+        });
+    }
+}
+export async function handleOrgLoopTick(ctx, cfg, companyId, data) {
+    const orgId = configuredOrgId(cfg);
+    const eventOrgId = (data.org_id ?? "").trim();
+    if (!orgId || !eventOrgId || eventOrgId !== orgId)
+        return;
+    const workIds = Array.isArray(data.work_ids) ? data.work_ids : [];
+    const openCount = data.open_count ?? workIds.length;
+    ctx.logger.info("acn-plugin: org.loop_tick", {
+        org_id: orgId,
+        open_count: openCount,
+        work_ids: workIds,
+    });
+    if (workIds.length === 0)
+        return;
+    const now = Date.now();
+    if (now - _lastLoopTickCommentAt < LOOP_TICK_COMMENT_COOLDOWN_MS) {
+        return;
+    }
+    const workMap = await loadMap(ctx, STATE_KEYS.issueWorkMap, companyId);
+    // One comment per tick (first mapped open work) to avoid comment spam.
+    for (const workId of workIds) {
+        const issueId = workMap[workId];
+        if (!issueId)
+            continue;
+        await ctx.issues.createComment(issueId, `Org loop tick — ${openCount} open work item(s) on ACN.`, companyId);
+        _lastLoopTickCommentAt = now;
+        break;
+    }
+}
 // ── ACN webhook event handler ─────────────────────────────────────────────────
 async function handleAcnWebhook(ctx, cfg, client, rawBody) {
     let payload;
@@ -134,8 +453,29 @@ async function handleAcnWebhook(ctx, cfg, client, rawBody) {
     const companyId = companies[0]?.id;
     if (!companyId)
         return;
+    const { data } = payload;
+    // Preferred Org Harness path (P2c-C2) — must run before task.* so we never
+    // treat the overloaded task_id (org_id) as a Task Pool id.
+    if (payload.event === "org.work_created") {
+        await handleOrgWorkCreated(ctx, cfg, companyId, data);
+        return;
+    }
+    if (payload.event === "org.work_updated") {
+        await handleOrgWorkUpdated(ctx, cfg, companyId, data);
+        return;
+    }
+    if (payload.event === "org.loop_tick") {
+        await handleOrgLoopTick(ctx, cfg, companyId, data);
+        return;
+    }
+    if (payload.event.startsWith("org.")) {
+        ctx.logger.debug("acn-plugin: unhandled org event", { event: payload.event });
+        return;
+    }
+    const task_id = payload.task_id ?? "";
+    if (!task_id)
+        return;
     const taskIssueMap = await loadMap(ctx, STATE_KEYS.issueTaskMap, companyId);
-    const { task_id, data } = payload;
     switch (payload.event) {
         case "task.created": {
             if (!cfg.autoCreateIssues)
@@ -143,7 +483,7 @@ async function handleAcnWebhook(ctx, cfg, client, rawBody) {
             if (taskIssueMap[task_id])
                 break;
             // Echo guard: skip tasks the bridge agent itself created. The plugin's
-            // `handleIssueCreated` path also calls ACN createTask synchronously,
+            // legacy outbound path also called ACN createTask synchronously,
             // which fires this very `task.created` webhook *before* `saveMap` has
             // had a chance to persist the mapping. The map check above will miss
             // and we'd ghost-mirror our own outbound task back into a second
@@ -243,7 +583,7 @@ async function handleAcnWebhook(ctx, cfg, client, rawBody) {
     }
 }
 // ── Paperclip issue event handlers ────────────────────────────────────────────
-export async function handleIssueUpdated(ctx, cfg, client, event) {
+export async function handleIssueUpdated(ctx, cfg, client, orgApi, event) {
     if (shouldSkipPluginEcho(event, PLUGIN_ID))
         return;
     // See handleIssueCreated: Paperclip carries the issue id on the event
@@ -256,13 +596,46 @@ export async function handleIssueUpdated(ctx, cfg, client, event) {
     const status = payload.status;
     if (!status)
         return;
+    if (status !== "done" && status !== "cancelled")
+        return;
     const companyId = event.companyId;
+    const orgId = (cfg.acnOrgId ?? "").trim();
+    // P2c-C3: Org-backed issues → PATCH work status (preferred path).
+    const workMap = await loadMap(ctx, STATE_KEYS.issueWorkMap, companyId);
+    const workId = reverseLookup(workMap, issueId);
+    if (workId && orgId) {
+        if (status === "done" && !cfg.autoApproveOnDone) {
+            ctx.logger.info("acn-plugin: skip Org work done — autoApproveOnDone=false", {
+                work_id: workId,
+                issue_id: issueId,
+            });
+            return;
+        }
+        try {
+            await orgApi.updateWorkStatus(orgId, workId, { status });
+            ctx.logger.info("acn-plugin: issue status → Org work PATCH", {
+                work_id: workId,
+                org_id: orgId,
+                issue_id: issueId,
+                status,
+            });
+        }
+        catch (err) {
+            ctx.logger.error("acn-plugin: Org work status PATCH failed", {
+                work_id: workId,
+                org_id: orgId,
+                issue_id: issueId,
+                status,
+                error: String(err),
+            });
+        }
+        return;
+    }
+    // Legacy Task Pool review path.
     const taskIssueMap = await loadMap(ctx, STATE_KEYS.issueTaskMap, companyId);
     const taskId = reverseLookup(taskIssueMap, issueId);
     if (!taskId)
         return;
-    if (status !== "done" && status !== "cancelled")
-        return;
     // Only call /review when ACN considers the task to be awaiting review
     // (`submitted`). For other statuses (open / in_progress / completed /...)
     // the review endpoint will 400.
@@ -288,7 +661,7 @@ export async function handleIssueUpdated(ctx, cfg, client, event) {
         }
     }
 }
-export async function handleIssueCreated(ctx, cfg, client, event) {
+export async function handleIssueCreated(ctx, cfg, orgApi, event) {
     if (shouldSkipPluginEcho(event, PLUGIN_ID))
         return;
     // Paperclip carries entity identity at the event envelope level
@@ -300,60 +673,68 @@ export async function handleIssueCreated(ctx, cfg, client, event) {
         return;
     const issueId = event.entityId;
     const companyId = event.companyId;
-    const taskIssueMap = await loadMap(ctx, STATE_KEYS.issueTaskMap, companyId);
-    if (reverseLookup(taskIssueMap, issueId))
-        return;
-    const payload = (event.payload ?? {});
-    let description = "";
-    try {
-        const full = (await ctx.issues.get(issueId, companyId));
-        description = full?.description?.trim() ?? "";
-    }
-    catch (err) {
-        ctx.logger.warn("acn-plugin: failed to fetch issue body, falling back to title", {
+    const orgId = (cfg.acnOrgId ?? "").trim();
+    if (!orgId) {
+        ctx.logger.error("acn-plugin: issue.created skipped — acnOrgId not resolved", {
             issue_id: issueId,
-            error: String(err),
         });
+        return;
     }
+    // Dedup against both Org work map and legacy Task map (inbound task.* may
+    // still create issues during the transition).
+    const [workMap, taskMap] = await Promise.all([
+        loadMap(ctx, STATE_KEYS.issueWorkMap, companyId),
+        loadMap(ctx, STATE_KEYS.issueTaskMap, companyId),
+    ]);
+    if (reverseLookup(workMap, issueId) || reverseLookup(taskMap, issueId))
+        return;
+    const payload = (event.payload ?? {});
+    const title = payload.title ?? issueId;
+    // Must register before await: ACN delivers org.work_created inline.
+    beginOutboundWorkCreate(companyId, issueId, title);
     try {
-        const task = await client.createTask({
-            title: payload.title ?? issueId,
-            description: description || "Task created from Paperclip issue.",
-            reward: "0",
-            deadline_hours: 168,
-            subnet_id: cfg.acnSubnetId ?? null,
-            reward_currency: "credits",
+        const work = await orgApi.createWork(orgId, {
+            title,
         });
-        // Persist the mapping IMMEDIATELY: ACN's `task.created` webhook (which
-        // mirrors ACN-side tasks back into Paperclip) fires synchronously from
-        // `createTask`, so the webhook handler will race this code path. If we
-        // don't have the map in place before the webhook arrives, the handler
-        // sees an unknown task_id and creates a ghost duplicate issue.
-        const fresh = await loadMap(ctx, STATE_KEYS.issueTaskMap, companyId);
-        fresh[task.task_id] = issueId;
-        await saveMap(ctx, STATE_KEYS.issueTaskMap, companyId, fresh);
-        ctx.logger.info("acn-plugin: issue.created → ACN task created", {
+        const fresh = await loadMap(ctx, STATE_KEYS.issueWorkMap, companyId);
+        // Webhook may have already bound work_id → this issue during createWork.
+        if (!fresh[work.work_id]) {
+            fresh[work.work_id] = issueId;
+            await saveMap(ctx, STATE_KEYS.issueWorkMap, companyId, fresh);
+        }
+        noteRecentOutboundWork(work.work_id);
+        ctx.logger.info("acn-plugin: issue.created → Org work created", {
             issue_id: issueId,
-            task_id: task.task_id,
+            org_id: orgId,
+            work_id: work.work_id,
         });
     }
     catch (err) {
-        ctx.logger.error("acn-plugin: failed to create ACN task for issue", {
+        ctx.logger.error("acn-plugin: failed to create Org work for issue", {
             issue_id: issueId,
+            org_id: orgId,
             error: String(err),
         });
     }
+    finally {
+        endOutboundWorkCreate(companyId, issueId);
+    }
 }
 // ── Plugin definition ─────────────────────────────────────────────────────────
 const plugin = definePlugin({
     async setup(ctx) {
         const cfg = (await ctx.config.get());
-        if (!cfg.acnApiKeyRef || !cfg.acnSubnetId) {
-            ctx.logger.warn("acn-plugin: acnApiKeyRef or acnSubnetId not configured — skipping setup");
+        if (!cfg.acnApiKeyRef) {
+            ctx.logger.warn("acn-plugin: acnApiKeyRef not configured — skipping setup");
+            return;
+        }
+        if (!(cfg.acnOrgId ?? "").trim() && !(cfg.acnSubnetId ?? "").trim()) {
+            ctx.logger.warn("acn-plugin: acnOrgId or acnSubnetId required — skipping setup");
             return;
         }
         const apiKey = await resolveSecretOrLiteral(cfg.acnApiKeyRef, ctx.secrets);
         const client = buildClient(cfg, apiKey);
+        const orgApi = new AcnOrgApi(cfg.acnBaseUrl ?? "https://api.acnlabs.dev", apiKey);
         // Resolve the HMAC secret used for X-ACN-Signature verification.
         let harnessSecret = null;
         if (cfg.acnHarnessSecretRef) {
@@ -370,17 +751,27 @@ const plugin = definePlugin({
         else {
             ctx.logger.warn("acn-plugin: acnHarnessSecretRef not configured — inbound webhook signatures will NOT be verified (insecure)");
         }
+        const companies = await ctx.companies.list();
+        if (companies.length > 1) {
+            ctx.logger.warn("acn-plugin: multiple Paperclip companies found — only the first is bound to one ACN Org (multi-company mapping is not supported yet)", { company_count: companies.length, using: companies[0]?.id });
+        }
+        const companyId = companies[0]?.id;
+        const companyName = companies[0]?.name;
+        try {
+            await resolveAcnOrg(ctx, cfg, orgApi, companyId, companyName);
+        }
+        catch (err) {
+            ctx.logger.error("acn-plugin: failed to resolve/create ACN Org — skipping setup", {
+                error: String(err),
+            });
+            return;
+        }
         // Stash for onWebhook()
         _ctx = ctx;
         _cfg = cfg;
         _client = client;
         _harnessSecret = harnessSecret;
-        // Resolve the configured bridge agent's identity. This lets the ACN
-        // webhook handler distinguish events fired for tasks we created
-        // ourselves from events fired for tasks created by other ACN agents,
-        // so we don't mirror plugin-issued tasks back into ghost duplicate
-        // Paperclip issues. Failure is non-fatal: we simply lose the ghost-
-        // mirror guard and fall back to the slower map-based dedup.
+        // Legacy task.* echo guard (inbound Task mirror still active).
         try {
             const me = await client.getMyAgent();
             _selfAgentId = me.agent_id;
@@ -395,11 +786,13 @@ const plugin = definePlugin({
         }
         // ── P0-1  Register harness webhook ────────────────────────────────────────
         const webhookUrl = harnessWebhookUrl(cfg);
-        if (webhookUrl) {
+        const subnetId = (cfg.acnSubnetId ?? "").trim();
+        if (webhookUrl && subnetId) {
             try {
-                await client.registerSubnetHarness(cfg.acnSubnetId, webhookUrl, harnessSecret);
+                await client.registerSubnetHarness(subnetId, webhookUrl, harnessSecret);
                 ctx.logger.info("acn-plugin: registered harness", {
-                    subnet_id: cfg.acnSubnetId,
+                    subnet_id: subnetId,
+                    org_id: cfg.acnOrgId,
                     webhook_url: webhookUrl,
                     signed: harnessSecret !== null,
                 });
@@ -408,13 +801,14 @@ const plugin = definePlugin({
                 ctx.logger.error("acn-plugin: harness registration failed", { error: String(err) });
             }
         }
-        else {
+        else if (!webhookUrl) {
             ctx.logger.warn("acn-plugin: paperclipBaseUrl not set — skipping harness registration");
         }
-        // ── P0-2  Full initial task sync ──────────────────────────────────────────
-        const companies = await ctx.companies.list();
-        const companyId = companies[0]?.id;
-        if (companyId) {
+        else {
+            ctx.logger.warn("acn-plugin: no subnet_id after Org resolve — skipping harness registration");
+        }
+        // ── P0-2  Full initial task sync (legacy inbound) ─────────────────────────
+        if (companyId && subnetId) {
             let taskIssueMap = await loadMap(ctx, STATE_KEYS.issueTaskMap, companyId);
             try {
                 taskIssueMap = await syncTasks(ctx, client, cfg, companyId, taskIssueMap);
@@ -424,13 +818,13 @@ const plugin = definePlugin({
                 ctx.logger.error("acn-plugin: task full sync failed", { error: String(err) });
             }
         }
-        // ── P0-4  Paperclip issue status → ACN review ────────────────────────────
+        // ── P2c-C3 / legacy: issue status → Org work PATCH or Task review ─────────
         ctx.events.on("issue.updated", async (event) => {
-            await handleIssueUpdated(ctx, cfg, client, event);
+            await handleIssueUpdated(ctx, cfg, client, orgApi, event);
         });
-        // ── P0-5  Paperclip issue created → ACN task ──────────────────────────────
+        // ── P2c-C1  Paperclip issue created → Org work ────────────────────────────
         ctx.events.on("issue.created", async (event) => {
-            await handleIssueCreated(ctx, cfg, client, event);
+            await handleIssueCreated(ctx, cfg, orgApi, event);
         });
         // ── Bridge: getData for ACN tab ────────────────────────────────────────────
         ctx.data.register("acn-task-info", async (params) => {
@@ -438,6 +832,21 @@ const plugin = definePlugin({
             const cid = params.companyId;
             if (!issueId || !cid)
                 return null;
+            const workMap = await loadMap(ctx, STATE_KEYS.issueWorkMap, cid);
+            const workId = reverseLookup(workMap, issueId);
+            if (workId && cfg.acnOrgId) {
+                return {
+                    work_id: workId,
+                    org_id: cfg.acnOrgId,
+                    source: "org_work",
+                    task_id: null,
+                    title: null,
+                    status: null,
+                    reward: null,
+                    reward_currency: null,
+                    participations: [],
+                };
+            }
             const map = await loadMap(ctx, STATE_KEYS.issueTaskMap, cid);
             const taskId = reverseLookup(map, issueId);
             if (!taskId)
@@ -453,6 +862,9 @@ const plugin = definePlugin({
                 reward: task.reward,
                 reward_currency: task.reward_currency,
                 participations,
+                source: "task_pool",
+                work_id: null,
+                org_id: cfg.acnOrgId ?? null,
             };
         });
         // ── Bridge: performAction for manual review ────────────────────────────────
@@ -463,7 +875,10 @@ const plugin = definePlugin({
             await client.reviewTask(taskId, approved, feedback);
             return { ok: true };
         });
-        ctx.logger.info("acn-plugin: setup complete", { subnet_id: cfg.acnSubnetId });
+        ctx.logger.info("acn-plugin: setup complete", {
+            org_id: cfg.acnOrgId,
+            subnet_id: cfg.acnSubnetId,
+        });
     },
     async onHealth() {
         return { status: "ok", message: "ACN plugin running" };