@app-vitals/agent-admin 1.2.7 → 1.4.0

package/prisma/client/models.ts

@@ -14,6 +14,7 @@ export type * from './models/SessionFollow.ts'
 export type * from './models/SessionAlertState.ts'
 export type * from './models/Agent.ts'
 export type * from './models/AgentEnv.ts'
+export type * from './models/GitHubEnterpriseApp.ts'
 export type * from './models/AgentCronJob.ts'
 export type * from './models/AgentTool.ts'
 export type * from './models/AgentToken.ts'
@@ -34,4 +35,5 @@ export type * from './models/AgentGitHubInstallationsSnapshot.ts'
 export type * from './models/PushSubscription.ts'
 export type * from './models/ChatThreadWatch.ts'
 export type * from './models/UserNotificationPrefs.ts'
+export type * from './models/AgentMarketplace.ts'
 export type * from './commonInputTypes.ts'

package/prisma/migrations/20261101000000_add_agent_marketplace/migration.sql

@@ -0,0 +1,19 @@
+-- PMK-1.1: AgentMarketplace table for per-agent plugin marketplaces (additive only).
+-- CreateTable
+CREATE TABLE "AgentMarketplace" (
+    "id" TEXT NOT NULL,
+    "agentId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "source" TEXT NOT NULL,
+    "ref" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "AgentMarketplace_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AgentMarketplace_agentId_name_key" ON "AgentMarketplace"("agentId", "name");
+
+-- AddForeignKey
+ALTER TABLE "AgentMarketplace" ADD CONSTRAINT "AgentMarketplace_agentId_fkey" FOREIGN KEY ("agentId") REFERENCES "Agent"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261109000000_add_github_enterprise_app/migration.sql

@@ -0,0 +1,16 @@
+-- GHE-1.1: optional admin-level GitHub Apps (installer / lookup). Additive only: new table.
+-- CreateTable
+CREATE TABLE "GitHubEnterpriseApp" (
+    "role" TEXT NOT NULL,
+    "appId" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "enterpriseSlug" TEXT,
+    "privateKeyEncrypted" TEXT NOT NULL,
+    "lastValidationStatus" TEXT,
+    "lastValidatedAt" TIMESTAMP(3),
+    "lastValidationError" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "GitHubEnterpriseApp_pkey" PRIMARY KEY ("role")
+);

package/prisma/schema/schema.prisma

@@ -1,5 +1,6 @@
 // Shipwright — Admin Service Schema
 // Owns: Agent, AgentEnv, AgentCronJob, AgentTool, AgentToken, AgentPlugin,
+// AgentMarketplace,
 // plus the coding-owned models in coding.prisma (AgentWorkQueueSnapshot,
 // AgentPhaseMethodology, SessionFollow, SessionAlertState).
 // Agent is a first-class model (standalone, not embedded in a User model).
@@ -88,6 +89,7 @@ model Agent {
   tools            AgentTool[]
   tokens           AgentToken[]
   plugins          AgentPlugin[]
+  marketplaces     AgentMarketplace[]
   members          AgentMember[]
   chatTokenUsage   AgentChatTokenUsageDailyByModel[]
   workQueueSnapshot AgentWorkQueueSnapshot?
@@ -114,6 +116,24 @@ model AgentEnv {
   @@unique([agentId, key])
 }
 
+// ─── GitHub Enterprise Apps ───────────────────────────────────────────────────
+// Optional admin-level GitHub Apps, one per role ('installer' | 'lookup'), at most
+// two rows per deployment; no rows means the feature is off. Deliberately NOT in
+// AgentEnv so the private key can never reach the agent config bundle.
+
+model GitHubEnterpriseApp {
+  role                  String    @id // 'installer' | 'lookup'
+  appId                 String
+  slug                  String
+  enterpriseSlug        String?   // installer only
+  privateKeyEncrypted   String    // AES-256-GCM (iv:ciphertext:authTag); never returned by any read path
+  lastValidationStatus  String?
+  lastValidatedAt       DateTime?
+  lastValidationError   String?
+  createdAt             DateTime  @default(now())
+  updatedAt             DateTime  @updatedAt
+}
+
 // ─── Agent Cron Jobs ──────────────────────────────────────────────────────────
 // Scheduled prompts per agent.
 // Delivery target is either a Slack channel ID or a Slack user ID (DM).
@@ -569,3 +589,20 @@ model UserNotificationPrefs {
   updatedAt          DateTime  @updatedAt
 }
 
+
+// ─── AgentMarketplace ─────────────────────────────────────────────────────────
+// Plugin marketplaces registered per agent. `name` is the marketplace name that
+// AgentPlugin specs reference after the `@` (e.g. "plugin@<name>").
+
+model AgentMarketplace {
+  id        String   @id @default(cuid())
+  agentId   String
+  agent     Agent    @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  name      String
+  source    String
+  ref       String?
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@unique([agentId, name])
+}

package/src/agent-account-assignment.ts

@@ -31,6 +31,18 @@ export function reconcileAgentAfterAccountChange(
   return reconcileAgentWorkload(provisioner, agent, "account updated");
 }
 
+/**
+ * SAL-1.2: reconciles the workload after the agent's specialty changed, so the
+ * pod is recreated on the image mapped to the new specialty (the target
+ * carries `agent.specialty`, which must be the post-update value).
+ */
+export function reconcileAgentAfterSpecialtyChange(
+  provisioner: Pick<AgentProvisioner, "reconcile">,
+  agent: ReconcilableAgent,
+): Promise<string | undefined> {
+  return reconcileAgentWorkload(provisioner, agent, "specialty updated");
+}
+
 /**
  * COS-49.1: reconciles the workload after podServiceAccountName changed.
  * `previous` is the column value before the update; the provisioner uses it to

package/src/agent-account-assignment.unit.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, it } from "bun:test";
-import { reconcileAgentAfterAccountChange } from "./agent-account-assignment.ts";
+import {
+  reconcileAgentAfterAccountChange,
+  reconcileAgentAfterSpecialtyChange,
+} from "./agent-account-assignment.ts";
 
 interface Result {
   recreated: string[];
@@ -97,3 +100,34 @@ describe("reconcileAgentAfterAccountChange", () => {
     expect(await reconcileAgentAfterAccountChange(p, agent)).toContain("boom");
   });
 });
+
+describe("reconcileAgentAfterSpecialtyChange", () => {
+  it("reconciles the workload with the new specialty", async () => {
+    const p = makeProvisioner();
+    expect(
+      await reconcileAgentAfterSpecialtyChange(p, {
+        ...agent,
+        specialty: "specialist",
+      }),
+    ).toBeUndefined();
+    expect(p.calls[0]?.[0]).toMatchObject({
+      id: "a1",
+      specialty: "specialist",
+    });
+  });
+
+  it("skips self-hosted agents", async () => {
+    const p = makeProvisioner();
+    await reconcileAgentAfterSpecialtyChange(p, { ...agent, selfHosted: true });
+    expect(p.calls).toEqual([]);
+  });
+
+  it("returns a warning when the reconcile throws", async () => {
+    const p = makeProvisioner(async () => {
+      throw new Error("boom");
+    });
+    expect(await reconcileAgentAfterSpecialtyChange(p, agent)).toContain(
+      "specialty updated",
+    );
+  });
+});

package/src/agent-marketplaces.integration.test.ts

@@ -0,0 +1,82 @@
+/**
+ * admin/src/agent-marketplaces.integration.test.ts
+ * Integration tests for the AgentMarketplace model against a real PostgreSQL DB.
+ *
+ * Requires DATABASE_URL_ADMIN_TEST to be set; skips otherwise.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { createAdminPrismaClient } from "./prisma-client.ts";
+
+const TEST_DB = process.env.DATABASE_URL_ADMIN_TEST;
+
+const describeOrSkip = TEST_DB ? describe : describe.skip;
+
+describeOrSkip("AgentMarketplace (integration)", () => {
+  let prisma: PrismaClient;
+
+  beforeEach(async () => {
+    prisma = createAdminPrismaClient(TEST_DB as string);
+    await prisma.agentMarketplace.deleteMany();
+    await prisma.agentPlugin.deleteMany();
+    await prisma.agentToken.deleteMany();
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agentTool.deleteMany();
+    await prisma.agentEnv.deleteMany();
+    await prisma.agent.deleteMany();
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  async function createAgent(): Promise<string> {
+    return (await prisma.agent.create({ data: { name: "Test Agent" } })).id;
+  }
+
+  it("inserts a row and reads it back", async () => {
+    const agentId = await createAgent();
+    const created = await prisma.agentMarketplace.create({
+      data: {
+        agentId,
+        name: "shipwright",
+        source: "github:app-vitals/shipwright",
+      },
+    });
+    const found = await prisma.agentMarketplace.findUnique({
+      where: { id: created.id },
+    });
+    expect(found?.agentId).toBe(agentId);
+    expect(found?.name).toBe("shipwright");
+    expect(found?.source).toBe("github:app-vitals/shipwright");
+    expect(found?.ref).toBeNull();
+    expect(found?.createdAt).toBeInstanceOf(Date);
+    expect(found?.updatedAt).toBeInstanceOf(Date);
+  });
+
+  it("rejects a duplicate (agentId, name)", async () => {
+    const agentId = await createAgent();
+    await prisma.agentMarketplace.create({
+      data: { agentId, name: "dup", source: "a" },
+    });
+    await expect(
+      (async () =>
+        prisma.agentMarketplace.create({
+          data: { agentId, name: "dup", source: "b", ref: "main" },
+        }))(),
+    ).rejects.toThrow();
+  });
+
+  it("cascades when the agent is deleted", async () => {
+    const agentId = await createAgent();
+    await prisma.agentMarketplace.create({
+      data: { agentId, name: "m1", source: "a" },
+    });
+    await prisma.agentMarketplace.create({
+      data: { agentId, name: "m2", source: "b", ref: "v1" },
+    });
+    await prisma.agent.delete({ where: { id: agentId } });
+    expect(await prisma.agentMarketplace.count({ where: { agentId } })).toBe(0);
+  });
+});

package/src/agents-api.smoke.test.ts

@@ -6287,3 +6287,201 @@ describe("chat-credentials routes", () => {
     expect(minted).toEqual([]);
   });
 });
+
+// ─── SAL-1.2: PATCH /agents/:id specialty ────────────────────────────────────
+
+describe("admin API — PATCH /agents/:id specialty (SAL-1.2)", () => {
+  const patch = (
+    app: ReturnType<typeof createAdminApp>,
+    body: unknown,
+    headers: Record<string, string>,
+  ) =>
+    app.request(`/agents/${AGENT_ID}`, {
+      method: "PATCH",
+      body: JSON.stringify(body),
+      headers: { "Content-Type": "application/json", ...headers },
+    });
+
+  function depsFor(opts: {
+    provisioner: RecordingProvisioner;
+    events: string[];
+    failCrons?: boolean;
+  }): AdminDeps {
+    const base = makeMockDeps();
+    return {
+      ...base,
+      provisioner: opts.provisioner,
+      specialtyRegistry: fakeSpecialtyTypes({
+        coding: CODING_TYPE,
+        specialist: CODING_TYPE,
+      }),
+      agentService: {
+        ...base.agentService,
+        updateSelfHosted: async (id, input) => {
+          opts.events.push("write");
+          return {
+            ...(await base.agentService.updateSelfHosted(id, input)),
+            specialty: (input as { specialty?: string }).specialty ?? "coding",
+          };
+        },
+      },
+      agentCronJobService: {
+        ...base.agentCronJobService,
+        reconcileSystemCrons: async () => {
+          opts.events.push("crons");
+          if (opts.failCrons) throw new Error("cron boom");
+          return { created: 0, updated: 0, deleted: 0 };
+        },
+      },
+    };
+  }
+
+  it("platform admin changes specialty: write, then crons, then workload reconcile", async () => {
+    const events: string[] = [];
+    const provisioner = new RecordingProvisioner();
+    const origReconcile = provisioner.reconcile.bind(provisioner);
+    provisioner.reconcile = async (agents, o) => {
+      events.push("workload");
+      return origReconcile(agents, o);
+    };
+    const app = createAdminApp(depsFor({ provisioner, events }));
+    const cookie = await makeSessionCookie();
+    const infos: string[] = [];
+    const origInfo = console.info;
+    console.info = (...a: unknown[]) => {
+      infos.push(a.join(" "));
+    };
+    let res: Response;
+    try {
+      res = await patch(
+        app,
+        { specialty: "specialist" },
+        { Cookie: `admin_session=${cookie}` },
+      );
+    } finally {
+      console.info = origInfo;
+    }
+    expect(res.status).toBe(200);
+    expect((await res.json()).specialty).toBe("specialist");
+    expect(events).toEqual(["write", "crons", "workload"]);
+    expect(provisioner.reconciled.map((r) => r.specialty)).toEqual([
+      "specialist",
+    ]);
+    const audit = infos.filter((l) => l.includes("specialty changed"));
+    expect(audit).toHaveLength(1);
+    expect(audit[0]).toContain(AGENT_ID);
+    expect(audit[0]).toContain("old=coding");
+    expect(audit[0]).toContain("new=specialist");
+    expect(audit[0]).toContain("caller=");
+  });
+
+  it("returns 403 for a non-admin session member and changes nothing", async () => {
+    const events: string[] = [];
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp({
+      ...depsFor({ provisioner, events }),
+      callerScopeResolver: async () => ({
+        kind: "scoped",
+        accountId: "acct-a",
+        agentIds: [AGENT_ID],
+      }),
+    });
+    const cookie = await sign(
+      {
+        isAdmin: false,
+        userId: "user-acct",
+        email: "owner@acct-a.example.com",
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      },
+      SESSION_SECRET,
+      "HS256",
+    );
+    const res = await patch(
+      app,
+      { specialty: "specialist" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(403);
+    expect(events).toEqual([]);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+
+  it("returns 422 for an unknown specialty and changes nothing", async () => {
+    const events: string[] = [];
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(depsFor({ provisioner, events }));
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { specialty: "no-such-type" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(422);
+    expect(events).toEqual([]);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+
+  it("is a no-op for the current specialty: 200, no reconcile, no log", async () => {
+    const events: string[] = [];
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(depsFor({ provisioner, events }));
+    const cookie = await makeSessionCookie();
+    const infos: string[] = [];
+    const origInfo = console.info;
+    console.info = (...a: unknown[]) => {
+      infos.push(a.join(" "));
+    };
+    let res: Response;
+    try {
+      res = await patch(
+        app,
+        { specialty: "coding" },
+        { Cookie: `admin_session=${cookie}` },
+      );
+    } finally {
+      console.info = origInfo;
+    }
+    expect(res.status).toBe(200);
+    expect(events).not.toContain("crons");
+    expect(provisioner.reconciled).toEqual([]);
+    expect(infos.filter((l) => l.includes("specialty changed"))).toEqual([]);
+  });
+
+  it("returns a reconcile failure in `warning` instead of a 5xx", async () => {
+    const events: string[] = [];
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(depsFor({ provisioner, events }));
+    const cookie = await makeSessionCookie();
+    provisioner.reconcileResult = {
+      ...provisioner.reconcileResult,
+      failed: [{ agentId: AGENT_ID, error: "k8s down" }],
+    };
+    const res = await patch(
+      app,
+      { specialty: "specialist" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(200);
+    expect((await res.json()).warning).toContain("k8s down");
+  });
+
+  it("returns a cron reconcile failure in `warning` and still reconciles the workload", async () => {
+    const events: string[] = [];
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(
+      depsFor({ provisioner, events, failCrons: true }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { specialty: "specialist" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(200);
+    expect((await res.json()).warning).toContain("cron boom");
+    expect(provisioner.reconciled.map((r) => r.specialty)).toEqual([
+      "specialist",
+    ]);
+  });
+});

package/src/agents-api.specialty.integration.test.ts

@@ -0,0 +1,217 @@
+/**
+ * admin/src/agents-api.specialty.integration.test.ts
+ * SAL-1.2: PATCH /agents/:id { specialty } against a real PostgreSQL DB.
+ *
+ * Requires DATABASE_URL_ADMIN_TEST to be set; skips otherwise.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { sign } from "hono/jwt";
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { AgentChatTokenService } from "./agent-chat-tokens.ts";
+import { AgentCronJobService } from "./agent-cron-jobs.ts";
+import { AgentCronRunStatsService } from "./agent-cron-run-stats.ts";
+import { AgentCronRunService } from "./agent-cron-runs.ts";
+import { AgentEnvService } from "./agent-envs.ts";
+import { AgentGitHubInstallationsService } from "./agent-github-installations.ts";
+import { AgentMemberService } from "./agent-members.ts";
+import { AgentPluginService } from "./agent-plugins.ts";
+import type {
+  AgentProvisioner,
+  ReconcileResult,
+  ReconcileTarget,
+} from "./agent-provisioner.ts";
+import { NoopAgentProvisioner } from "./agent-provisioner.ts";
+import { AgentTokenService } from "./agent-tokens.ts";
+import { AgentToolService } from "./agent-tools.ts";
+import { AgentService } from "./agents.ts";
+import type { AdminDeps } from "./agents-api.ts";
+import { createAdminApp } from "./agents-api.ts";
+import { NoopChatServiceProvisioningClient } from "./chat-service-provisioning-client.ts";
+import { createAdminPrismaClient } from "./prisma-client.ts";
+import { SpecialtyTypes } from "./specialty-types.ts";
+import { makeTokenCrypto } from "./token-crypto.ts";
+
+const TEST_DB = process.env.DATABASE_URL_ADMIN_TEST;
+const describeOrSkip = TEST_DB ? describe : describe.skip;
+
+const SESSION_SECRET = "test-admin-session-secret-32-bytes!";
+const REAL_KEY =
+  "0000000000000000000000000000000000000000000000000000000000000001";
+
+async function makeSessionCookie(): Promise<string> {
+  return sign(
+    {
+      isAdmin: true,
+      userId: "user-123",
+      email: "admin@example.com",
+      name: "Admin User",
+      iat: Math.floor(Date.now() / 1000),
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    },
+    SESSION_SECRET,
+    "HS256",
+  );
+}
+
+/** Injected provisioner double that records every reconcile target. */
+class RecordingProvisioner extends NoopAgentProvisioner {
+  readonly reconciled: ReconcileTarget[] = [];
+  override async reconcile(
+    agents: ReconcileTarget[],
+  ): Promise<ReconcileResult> {
+    this.reconciled.push(...agents);
+    return {
+      recreated: [],
+      migrated: [],
+      noOwner: [],
+      dryRun: false,
+      updated: [],
+      orphans: [],
+      failed: [],
+    };
+  }
+}
+
+function makeDeps(
+  prisma: PrismaClient,
+  provisioner: AgentProvisioner,
+): AdminDeps {
+  const saved = process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+  process.env.SHIPWRIGHT_ENCRYPTION_KEY = REAL_KEY;
+  const crypto = makeTokenCrypto();
+  if (saved === undefined) delete process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+  else process.env.SHIPWRIGHT_ENCRYPTION_KEY = saved;
+  const specialtyRegistry = new SpecialtyTypes();
+  return {
+    agentService: new AgentService(prisma),
+    agentEnvService: new AgentEnvService(prisma, crypto),
+    agentCronJobService: new AgentCronJobService(
+      prisma,
+      undefined,
+      specialtyRegistry,
+    ),
+    agentCronRunService: new AgentCronRunService(prisma),
+    agentCronRunStatsService: new AgentCronRunStatsService(prisma),
+    agentToolService: new AgentToolService(prisma),
+    agentTokenService: new AgentTokenService(prisma),
+    agentPluginService: new AgentPluginService(prisma),
+    agentMemberService: new AgentMemberService(prisma),
+    specialtyRegistry,
+    agentChatTokenService: new AgentChatTokenService(prisma),
+    agentGitHubInstallationsService: new AgentGitHubInstallationsService(
+      prisma,
+    ),
+    prisma,
+    provisioner,
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: async () => [],
+        revokeToken: async () => {},
+      },
+    ],
+    chatService: new NoopChatServiceProvisioningClient(),
+    slack: { deleteApp: async () => {} },
+    decrypt: (value: string) => crypto.decrypt(value),
+    sessionSecret: SESSION_SECRET,
+  };
+}
+
+describeOrSkip("PATCH /agents/:id specialty (integration)", () => {
+  let prisma: PrismaClient;
+
+  beforeEach(async () => {
+    prisma = createAdminPrismaClient(TEST_DB as string);
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agent.deleteMany();
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("flips Agent.specialty and reconciles a Saul-shaped cron set against the specialist type", async () => {
+    const agent = await prisma.agent.create({
+      data: { name: "Saul", specialty: "saul" },
+    });
+    const systemNames = [
+      "shipwright-dev-loop",
+      "shipwright-dev-task",
+      "shipwright-review",
+      "shipwright-patch",
+      "shipwright-deploy",
+      "shipwright-entropy-scan",
+      "shipwright-security-scan",
+      "shipwright-error-scan",
+      "shipwright-learn-dream-sys",
+    ];
+    for (const name of systemNames) {
+      await prisma.agentCronJob.create({
+        data: {
+          agentId: agent.id,
+          name,
+          system: true,
+          schedule: "0 * * * *",
+          prompt: `/${name}`,
+          enabled: false,
+        },
+      });
+    }
+    const userCron = await prisma.agentCronJob.create({
+      data: {
+        agentId: agent.id,
+        name: "learn-dream",
+        system: false,
+        schedule: "0 3 * * *",
+        prompt: "/learn-dream",
+        enabled: true,
+      },
+    });
+    for (let i = 0; i < 2; i++) {
+      await prisma.agentCronRun.create({
+        data: {
+          cronId: userCron.id,
+          agentId: agent.id,
+          startedAt: new Date(Date.now() - i * 60_000),
+        },
+      });
+    }
+
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(makeDeps(prisma, provisioner));
+    const cookie = await makeSessionCookie();
+    const res = await app.request(`/agents/${agent.id}`, {
+      method: "PATCH",
+      body: JSON.stringify({ specialty: "specialist" }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+
+    expect(res.status).toBe(200);
+    expect((await res.json()).specialty).toBe("specialist");
+    const row = await prisma.agent.findUniqueOrThrow({
+      where: { id: agent.id },
+    });
+    expect(row.specialty).toBe("specialist");
+    expect(
+      await prisma.agentCronJob.count({
+        where: { agentId: agent.id, system: true },
+      }),
+    ).toBe(0);
+    const survivors = await prisma.agentCronJob.findMany({
+      where: { agentId: agent.id },
+    });
+    expect(survivors.map((c) => c.id)).toEqual([userCron.id]);
+    expect(survivors[0]?.system).toBe(false);
+    expect(
+      await prisma.agentCronRun.count({ where: { cronId: userCron.id } }),
+    ).toBe(2);
+    // selfHosted defaults false, so the workload reconcile ran once.
+    expect(provisioner.reconciled).toHaveLength(1);
+    expect(provisioner.reconciled[0]?.id).toBe(agent.id);
+    expect(provisioner.reconciled[0]?.specialty).toBe("specialist");
+  });
+});