@axiom-lattice/gateway 4.3.3 → 4.4.1

package/dist/index.mjs

@@ -3,6 +3,10 @@ import {
   getFilenameFromPath,
   sendBufferWithRange
 } from "./chunk-EMYRCJOI.mjs";
+import {
+  PluginToolScopeError,
+  invokePluginTool
+} from "./chunk-73QZQQOT.mjs";
 import {
   buildPreviewTokenScript
 } from "./chunk-2POW27EI.mjs";
@@ -10,9 +14,6 @@ import "./chunk-WKNZ7GBC.mjs";
 import {
   CollectionService
 } from "./chunk-PWHUWFXL.mjs";
-import {
-  registerMcpServerConfigRoutes
-} from "./chunk-QKPZWWHH.mjs";
 import {
   Logger,
   getQrCode,
@@ -41,7 +42,7 @@ import staticPlugin from "@fastify/static";
 import path4 from "path";
 
 // src/routes/index.ts
-import { randomUUID as randomUUID22 } from "crypto";
+import { randomUUID as randomUUID23 } from "crypto";
 import {
   descriptorDataValue as descriptorDataValue3,
   snapshotExactRecord as snapshotExactRecord14,
@@ -2691,7 +2692,15 @@ function serializeSchema(schema) {
 }
 async function getToolConfigs(request, reply) {
   try {
-    const allLattices = toolLatticeManager.getAllLattices();
+    const tenantId = request.user?.tenantId || request.headers["x-tenant-id"] || "default";
+    const byKey = /* @__PURE__ */ new Map();
+    for (const lattice of toolLatticeManager.getAllByTenant("default")) {
+      byKey.set(lattice.key, lattice);
+    }
+    for (const lattice of toolLatticeManager.getAllByTenant(tenantId)) {
+      byKey.set(lattice.key, lattice);
+    }
+    const allLattices = [...byKey.values()];
     const toolConfigs = allLattices.map((lattice) => {
       const config = { ...lattice.config };
       const serializedSchema = config.schema ? serializeSchema(config.schema) : void 0;
@@ -4390,13 +4399,11 @@ async function importApply(request, reply) {
 }
 
 // src/controllers/middleware-types.ts
-import {
-  PluginRegistry as PluginRegistry2,
-  getSandboxPluginCatalog as getSandboxPluginCatalog2,
-  mergePluginSources,
-  serializePluginMeta
-} from "@axiom-lattice/core";
-async function collectMiddlewareMetas(tenantId) {
+import { serializePluginMeta } from "@axiom-lattice/core";
+
+// src/services/plugins/tenantPluginResolver.ts
+import { PluginRegistry as PluginRegistry2, getSandboxPluginCatalog as getSandboxPluginCatalog2, mergePluginSources } from "@axiom-lattice/core";
+async function listTenantPlugins(tenantId) {
   let tenantPlugins = [];
   try {
     tenantPlugins = (await getSandboxPluginCatalog2().ensureLoaded(tenantId)).plugins;
@@ -4404,7 +4411,15 @@ async function collectMiddlewareMetas(tenantId) {
     tenantPlugins = [];
   }
   const globalPlugins = PluginRegistry2.list().map((type) => PluginRegistry2.get(type)).filter((p) => Boolean(p));
-  return mergePluginSources(globalPlugins, tenantPlugins).map(serializePluginMeta);
+  return mergePluginSources(globalPlugins, tenantPlugins);
+}
+async function resolveTenantPluginByType(tenantId, type) {
+  return (await listTenantPlugins(tenantId)).find((p) => p.meta.type === type);
+}
+
+// src/controllers/middleware-types.ts
+async function collectMiddlewareMetas(tenantId) {
+  return (await listTenantPlugins(tenantId)).map(serializePluginMeta);
 }
 function middlewareTypesRoutes(fastify2) {
   fastify2.get("/api/middleware-types", async (request, reply) => {
@@ -7542,7 +7557,7 @@ function registerMetricsServerConfigRoutes(app2) {
 }
 
 // src/controllers/connections.ts
-import { ConnectionRegistry, PluginRegistry as PluginRegistry3, getSandboxPluginCatalog as getSandboxPluginCatalog3, mergePluginSources as mergePluginSources2 } from "@axiom-lattice/core";
+import { ConnectionRegistry } from "@axiom-lattice/core";
 import { z as z2 } from "zod";
 var createBody = z2.object({
   type: z2.string().min(1),
@@ -7563,15 +7578,7 @@ function getTenant(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getTenantPlugin(request, type) {
-  const tenantId = getTenant(request);
-  let tenantPlugins = [];
-  try {
-    tenantPlugins = (await getSandboxPluginCatalog3().ensureLoaded(tenantId)).plugins;
-  } catch {
-    tenantPlugins = [];
-  }
-  const globalPlugins = PluginRegistry3.list().map((t2) => PluginRegistry3.get(t2)).filter((p) => Boolean(p));
-  return mergePluginSources2(globalPlugins, tenantPlugins).find((p) => p.meta.type === type);
+  return resolveTenantPluginByType(getTenant(request), type);
 }
 function maskSecrets(config) {
   const sensitive = /* @__PURE__ */ new Set([
@@ -7710,14 +7717,862 @@ function connectionRoutes(fastify2) {
   });
 }
 
+// src/controllers/mcp-configs.ts
+import {
+  getStoreLattice as getStoreLattice9,
+  mcpManager,
+  McpLatticeManager,
+  convertToConnection
+} from "@axiom-lattice/core";
+import { randomUUID as randomUUID10 } from "crypto";
+function getTenantId10(request) {
+  const userTenantId = request.user?.tenantId;
+  if (userTenantId) {
+    return userTenantId;
+  }
+  return request.headers["x-tenant-id"] || "default";
+}
+async function getMcpServerConfigList(request, reply) {
+  const tenantId = getTenantId10(request);
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const configs = await store.getAllConfigs(tenantId);
+    return {
+      success: true,
+      message: "MCP server configurations retrieved successfully",
+      data: {
+        records: configs,
+        total: configs.length
+      }
+    };
+  } catch (error) {
+    console.error("Failed to get MCP server configs:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve MCP server configurations",
+      data: {
+        records: [],
+        total: 0
+      }
+    };
+  }
+}
+async function getMcpServerConfig(request, reply) {
+  const tenantId = getTenantId10(request);
+  const { key } = request.params;
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const config = await store.getConfigByKey(tenantId, key);
+    if (!config) {
+      return {
+        success: false,
+        message: "MCP server configuration not found"
+      };
+    }
+    return {
+      success: true,
+      message: "MCP server configuration retrieved successfully",
+      data: config
+    };
+  } catch (error) {
+    console.error("Failed to get MCP server config:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve MCP server configuration"
+    };
+  }
+}
+async function createMcpServerConfig(request, reply) {
+  const tenantId = getTenantId10(request);
+  const body = request.body;
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const existing = await store.getConfigByKey(tenantId, body.key);
+    if (existing) {
+      reply.code(409);
+      return {
+        success: false,
+        message: "MCP server configuration with this key already exists"
+      };
+    }
+    const id3 = body.id || randomUUID10();
+    const config = await store.createConfig(tenantId, id3, body);
+    try {
+      await connectAndRegisterTools(config);
+      await store.updateConfig(tenantId, id3, { status: "connected" });
+      config.status = "connected";
+    } catch (error) {
+      console.warn("Failed to auto-connect MCP server:", error);
+      await store.updateConfig(tenantId, id3, { status: "error" });
+      config.status = "error";
+    }
+    reply.code(201);
+    return {
+      success: true,
+      message: "MCP server configuration created successfully",
+      data: config
+    };
+  } catch (error) {
+    console.error("Failed to create MCP server config:", error);
+    return {
+      success: false,
+      message: "Failed to create MCP server configuration"
+    };
+  }
+}
+async function updateMcpServerConfig(request, reply) {
+  const tenantId = getTenantId10(request);
+  const { key } = request.params;
+  const updates = request.body;
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const existing = await store.getConfigByKey(tenantId, key);
+    if (!existing) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "MCP server configuration not found"
+      };
+    }
+    const shouldReconnect = updates.config !== void 0;
+    const updated = await store.updateConfig(tenantId, existing.id, updates);
+    if (!updated) {
+      return {
+        success: false,
+        message: "Failed to update MCP server configuration"
+      };
+    }
+    if (shouldReconnect) {
+      try {
+        const connection = convertToConnection(updated.config);
+        mcpManager.registerServer(tenantId, key, connection, {
+          timeoutMs: updated.config.timeout,
+          maxAttempts: updated.config.retryAttempts
+        });
+        await mcpManager.ensureConnected(tenantId, key);
+        await mcpManager.registerToolsToToolLattice(tenantId, key, updated.selectedTools);
+        await store.updateConfig(tenantId, existing.id, { status: "connected" });
+        updated.status = "connected";
+      } catch (error) {
+        console.warn("Failed to reconnect MCP server:", error);
+        await store.updateConfig(tenantId, existing.id, { status: "error" });
+        updated.status = "error";
+      }
+    }
+    return {
+      success: true,
+      message: "MCP server configuration updated successfully",
+      data: updated
+    };
+  } catch (error) {
+    console.error("Failed to update MCP server config:", error);
+    return {
+      success: false,
+      message: "Failed to update MCP server configuration"
+    };
+  }
+}
+async function deleteMcpServerConfig(request, reply) {
+  const tenantId = getTenantId10(request);
+  const { keyOrId } = request.params;
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    let config = await store.getConfigByKey(tenantId, keyOrId);
+    let configKey = keyOrId;
+    if (!config) {
+      config = await store.getConfigById(tenantId, keyOrId);
+      if (config) {
+        configKey = config.key;
+      }
+    }
+    if (!config) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "MCP server configuration not found"
+      };
+    }
+    try {
+      if (mcpManager.hasServer(tenantId, configKey)) {
+        await mcpManager.removeServer(tenantId, configKey);
+      }
+    } catch (error) {
+      console.warn("Failed to remove from MCP manager:", error);
+    }
+    const deleted = await store.deleteConfig(tenantId, config.id);
+    if (!deleted) {
+      return {
+        success: false,
+        message: "Failed to delete MCP server configuration"
+      };
+    }
+    return {
+      success: true,
+      message: "MCP server configuration deleted successfully"
+    };
+  } catch (error) {
+    console.error("Failed to delete MCP server config:", error);
+    return {
+      success: false,
+      message: "Failed to delete MCP server configuration"
+    };
+  }
+}
+async function testMcpServerConnection(request, reply) {
+  const tenantId = getTenantId10(request);
+  const { key } = request.params;
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const config = await store.getConfigByKey(tenantId, key);
+    if (!config) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "MCP server configuration not found"
+      };
+    }
+    try {
+      const testKey = `__test_${key}_${Date.now()}`;
+      const connection = convertToConnection(config.config);
+      const { latency } = await McpLatticeManager.testConnection(testKey, connection);
+      return {
+        success: true,
+        message: "Connection test successful",
+        data: {
+          connected: true,
+          latency
+        }
+      };
+    } catch (error) {
+      return {
+        success: true,
+        message: "Connection test failed",
+        data: {
+          connected: false,
+          error: error instanceof Error ? error.message : "Unknown error"
+        }
+      };
+    }
+  } catch (error) {
+    console.error("Failed to test MCP server connection:", error);
+    return {
+      success: false,
+      message: "Failed to test MCP server connection",
+      data: {
+        connected: false,
+        error: error instanceof Error ? error.message : "Unknown error"
+      }
+    };
+  }
+}
+async function listMcpServerTools(request, reply) {
+  const tenantId = getTenantId10(request);
+  const { key } = request.params;
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const config = await store.getConfigByKey(tenantId, key);
+    if (!config) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "MCP server configuration not found"
+      };
+    }
+    if (!mcpManager.isServerConnected(tenantId, key)) {
+      await connectAndRegisterTools(config);
+    }
+    if (config.status !== "connected") {
+      await store.updateConfig(tenantId, config.id, { status: "connected" });
+    }
+    const tools = await mcpManager.getServerTools(tenantId, key);
+    return {
+      success: true,
+      message: "Tools retrieved successfully",
+      data: {
+        tools
+      }
+    };
+  } catch (error) {
+    console.error("Failed to list MCP tools:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve tools"
+    };
+  }
+}
+async function connectMcpServer(request, reply) {
+  const tenantId = getTenantId10(request);
+  const { key } = request.params;
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const config = await store.getConfigByKey(tenantId, key);
+    if (!config) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "MCP server configuration not found"
+      };
+    }
+    await connectAndRegisterTools(config);
+    const updated = await store.updateConfig(tenantId, config.id, {
+      status: "connected"
+    });
+    return {
+      success: true,
+      message: "MCP server connected successfully",
+      data: updated || config
+    };
+  } catch (error) {
+    console.error("Failed to connect MCP server:", error);
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const config = await store.getConfigByKey(tenantId, key);
+    if (config) {
+      await store.updateConfig(tenantId, config.id, { status: "error" });
+    }
+    return {
+      success: false,
+      message: `Failed to connect MCP server: ${error instanceof Error ? error.message : "Unknown error"}`
+    };
+  }
+}
+async function disconnectMcpServer(request, reply) {
+  const tenantId = getTenantId10(request);
+  const { key } = request.params;
+  try {
+    const storeLattice = getStoreLattice9("default", "mcp");
+    const store = storeLattice.store;
+    const config = await store.getConfigByKey(tenantId, key);
+    if (!config) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "MCP server configuration not found"
+      };
+    }
+    if (mcpManager.hasServer(tenantId, key)) {
+      await mcpManager.removeServer(tenantId, key);
+    }
+    const updated = await store.updateConfig(tenantId, config.id, {
+      status: "disconnected"
+    });
+    return {
+      success: true,
+      message: "MCP server disconnected successfully",
+      data: updated || config
+    };
+  } catch (error) {
+    console.error("Failed to disconnect MCP server:", error);
+    return {
+      success: false,
+      message: "Failed to disconnect MCP server"
+    };
+  }
+}
+async function testMcpServerTools(request, reply) {
+  const body = request.body;
+  try {
+    if (!body.config) {
+      reply.code(400);
+      return {
+        success: false,
+        message: "config is required"
+      };
+    }
+    const testKey = `__test_${Date.now()}`;
+    const connection = convertToConnection(body.config);
+    const { tools } = await McpLatticeManager.testConnection(testKey, connection);
+    return {
+      success: true,
+      message: "Tools retrieved successfully",
+      data: {
+        tools
+      }
+    };
+  } catch (error) {
+    console.error("Failed to test MCP server tools:", error);
+    return {
+      success: false,
+      message: `Failed to retrieve tools: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+async function connectAndRegisterTools(config) {
+  const connection = convertToConnection(config.config);
+  mcpManager.registerServer(config.tenantId, config.key, connection, {
+    timeoutMs: config.config.timeout,
+    maxAttempts: config.config.retryAttempts,
+    selectedTools: config.selectedTools
+  });
+  await mcpManager.ensureConnected(config.tenantId, config.key);
+  await mcpManager.registerToolsToToolLattice(
+    config.tenantId,
+    config.key,
+    config.selectedTools
+  );
+}
+function registerMcpServerConfigRoutes(app2) {
+  app2.get("/api/mcp-servers", getMcpServerConfigList);
+  app2.get("/api/mcp-servers/:key", getMcpServerConfig);
+  app2.post("/api/mcp-servers", createMcpServerConfig);
+  app2.put("/api/mcp-servers/:key", updateMcpServerConfig);
+  app2.delete("/api/mcp-servers/:keyOrId", deleteMcpServerConfig);
+  app2.post("/api/mcp-servers/:key/test", testMcpServerConnection);
+  app2.get("/api/mcp-servers/:key/tools", listMcpServerTools);
+  app2.post("/api/mcp-servers/:key/connect", connectMcpServer);
+  app2.post("/api/mcp-servers/:key/disconnect", disconnectMcpServer);
+  app2.post("/api/mcp-servers/test-tools", testMcpServerTools);
+}
+
+// src/routes/mcp-apps.ts
+import {
+  parseMcpUiRef
+} from "@axiom-lattice/protocols";
+import {
+  getSandboxPluginCatalog as getSandboxPluginCatalog3,
+  mcpManager as mcpManager2
+} from "@axiom-lattice/core";
+
+// src/services/mcp-ui/UiResourceResolver.ts
+import { createHash as createHash2 } from "crypto";
+var DEFAULT_TTL_MS = 5 * 60 * 1e3;
+function publicFieldsOf(payload) {
+  return {
+    mimeType: payload.mimeType,
+    html: payload.html,
+    ...payload.csp !== void 0 ? { csp: payload.csp } : {},
+    ...payload.permissions !== void 0 ? { permissions: payload.permissions } : {},
+    ...payload.prefersBorder !== void 0 ? { prefersBorder: payload.prefersBorder } : {}
+  };
+}
+var UiResourceResolver = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.inFlight = /* @__PURE__ */ new Map();
+  }
+  keyOf(ref) {
+    return ref.kind === "mcp" ? `mcp\0${ref.serverKey}\0${ref.resourceUri}` : `plugin\0${ref.pluginType}\0${ref.resource}`;
+  }
+  fullKey(tenantId, ref) {
+    return `${tenantId}\0${this.keyOf(ref)}`;
+  }
+  /**
+   * Resolve a UI resource for a tenant.
+   *
+   * @param tenantId Tenant scope.
+   * @param ref The fence ref.
+   * @returns Public UI resource payload (no cache metadata).
+   */
+  async resolve(tenantId, ref) {
+    const key = this.fullKey(tenantId, ref);
+    const ttl = this.deps.ttlMs ?? DEFAULT_TTL_MS;
+    const cached = await this.deps.store.get(key);
+    if (cached && Date.now() - cached.fetchedAt < ttl) return publicFieldsOf(cached);
+    const existing = this.inFlight.get(key);
+    if (existing) return existing;
+    const promise = this.fetchAndCache(tenantId, ref, key, cached);
+    this.inFlight.set(key, promise);
+    try {
+      return await promise;
+    } finally {
+      this.inFlight.delete(key);
+    }
+  }
+  /**
+   * Evict the cached entry for a tenant/ref.
+   *
+   * @param tenantId Tenant scope.
+   * @param ref The fence ref.
+   */
+  async invalidate(tenantId, ref) {
+    await this.deps.store.delete(this.fullKey(tenantId, ref));
+  }
+  async fetchAndCache(tenantId, ref, key, cached) {
+    try {
+      const fresh = ref.kind === "mcp" ? await this.deps.fetchMcp(tenantId, ref.serverKey, ref.resourceUri) : await this.deps.fetchPlugin(tenantId, ref.pluginType, ref.resource);
+      const entry = {
+        ...publicFieldsOf(fresh),
+        hash: createHash2("sha256").update(fresh.html).digest("hex"),
+        fetchedAt: Date.now()
+      };
+      await this.deps.store.set(key, entry);
+      return publicFieldsOf(fresh);
+    } catch (error) {
+      if (cached) return { ...publicFieldsOf(cached), stale: true };
+      throw error;
+    }
+  }
+};
+
+// src/services/mcp-ui/McpUiResourceCacheStore.ts
+var InMemoryMcpUiResourceCacheStore = class {
+  constructor() {
+    this.map = /* @__PURE__ */ new Map();
+  }
+  async get(key) {
+    return this.map.get(key);
+  }
+  async set(key, entry) {
+    this.map.set(key, entry);
+  }
+  async delete(key) {
+    this.map.delete(key);
+  }
+  async deleteByPrefix(prefix) {
+    for (const key of this.map.keys()) {
+      if (key.startsWith(prefix)) this.map.delete(key);
+    }
+  }
+};
+
+// src/services/mcp-ui/buildCsp.ts
+var DEFAULT_CSP = [
+  "default-src 'none'",
+  "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "media-src 'self' data:",
+  // Fonts are restricted to the document origin; declared `resourceDomains`
+  // are the only origins ever added (no `data:` — a base64-embedded font must
+  // be served from a declared origin).
+  "font-src 'self'",
+  "object-src 'none'",
+  "connect-src 'none'",
+  "frame-src 'none'",
+  "base-uri 'self'"
+].join("; ");
+var ORIGIN_PATTERN = /^(https?|wss?):\/\/(\*\.)?[^\s;,'"*]+$/;
+function declaredOrigins(domains) {
+  if (!Array.isArray(domains)) return [];
+  return domains.filter((domain) => typeof domain === "string" && ORIGIN_PATTERN.test(domain));
+}
+function buildCsp(csp) {
+  if (!csp) return DEFAULT_CSP;
+  const resourceOrigins = declaredOrigins(csp.resourceDomains);
+  const resource = resourceOrigins.join(" ");
+  const withResourceOrigins = (base) => resource ? `${base} ${resource}` : base;
+  const img = ["'self'", "data:", ...resourceOrigins].join(" ");
+  const connect = declaredOrigins(csp.connectDomains);
+  const frame = declaredOrigins(csp.frameDomains);
+  const baseUri = declaredOrigins(csp.baseUriDomains);
+  const parts = [
+    "default-src 'none'",
+    withResourceOrigins("script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'"),
+    withResourceOrigins("style-src 'self' 'unsafe-inline'"),
+    `img-src ${img}`,
+    `media-src ${["'self'", "data:", ...resourceOrigins].join(" ")}`,
+    withResourceOrigins("font-src 'self'"),
+    "object-src 'none'",
+    `connect-src ${connect.length ? connect.join(" ") : "'none'"}`,
+    `frame-src ${frame.length ? frame.join(" ") : "'none'"}`,
+    `base-uri ${baseUri.length ? baseUri.join(" ") : "'self'"}`
+  ];
+  return parts.join("; ");
+}
+
+// src/services/mcp-ui/sandboxPage.ts
+var DEFAULT_CSP_LITERAL = JSON.stringify(buildCsp(void 0));
+var SANDBOX_HTML = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>MCP App Sandbox</title>
+    <style>html, body { margin: 0; height: 100%; }</style>
+  </head>
+  <body>
+    <script>
+      (function () {
+        var HOST_READY = "ui/notifications/sandbox-proxy-ready";
+        var RESOURCE_READY = "ui/notifications/sandbox-resource-ready";
+        var CONTROL_PREFIX = "ui/notifications/sandbox-";
+        var DEFAULT_CSP = ${DEFAULT_CSP_LITERAL};
+
+        function withCsp(html, csp) {
+          var policy = typeof csp === "string" && csp.length > 0 ? csp : DEFAULT_CSP;
+          var escaped = policy.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+          var meta = '<meta http-equiv="Content-Security-Policy" content="' + escaped + '">';
+          // Insert at the very start (after an optional doctype) so the parser
+          // places the meta in the implicit head. Never search for a literal
+          // <head>: a resource could hide a decoy inside a comment/string and
+          // slip its real head past the splice.
+          var doctype = /^\\s*<!doctype[^>]*>/i.exec(html);
+          if (doctype) {
+            return html.slice(0, doctype[0].length) + meta + html.slice(doctype[0].length);
+          }
+          return meta + html;
+        }
+
+        // Size reporter injected into every View document. The host renders the
+        // View inside an opaque-origin iframe it cannot measure, so auto-height
+        // only happens when the View posts ui/notifications/size-changed. Most
+        // hand-written plugin apps never do; this script makes every app report
+        // its own content size. It only measures and postMessages \u2014 it never
+        // mutates the app's DOM.
+        var SIZE_REPORTER = [
+          "(function(){",
+          "function send(){",
+          "try{",
+          "var d=document.documentElement,b=document.body;",
+          "var w=Math.ceil(Math.max(d?d.scrollWidth:0,b?b.scrollWidth:0));",
+          "var h=Math.ceil(Math.max(d?d.scrollHeight:0,b?b.scrollHeight:0));",
+          "window.parent.postMessage({jsonrpc:'2.0',method:'ui/notifications/size-changed',params:{width:w,height:h}},'*');",
+          "}catch(e){}",
+          "}",
+          "send();",
+          "window.addEventListener('load',send);",
+          "if(typeof ResizeObserver!=='undefined'){",
+          "var ro=new ResizeObserver(send);",
+          "ro.observe(document.documentElement);",
+          "if(document.body)ro.observe(document.body);",
+          "}else{window.addEventListener('resize',send);}",
+          "})();"
+        ].join("");
+
+        function withSizeReporter(html) {
+          // Split the closing tag so this template literal never contains a
+          // literal script terminator that would end the sandbox page's own
+          // script block during HTML parsing.
+          var tag = "<scr" + "ipt>" + SIZE_REPORTER + "<" + "/scr" + "ipt>";
+          var lower = html.toLowerCase();
+          var bodyEnd = lower.lastIndexOf("</body>");
+          if (bodyEnd >= 0) return html.slice(0, bodyEnd) + tag + html.slice(bodyEnd);
+          return html + tag;
+        }
+
+        var inner = null;
+
+        window.parent.postMessage({ jsonrpc: "2.0", method: HOST_READY, params: {} }, "*");
+
+        window.addEventListener("message", function (event) {
+          if (event.source !== window.parent) return;
+          var data = event.data;
+          if (!data || typeof data !== "object") return;
+
+          if (data.method === RESOURCE_READY) {
+            var params = data.params || {};
+            if (inner && inner.parentNode) inner.parentNode.removeChild(inner);
+            inner = document.createElement("iframe");
+            inner.setAttribute("sandbox", params.sandbox || "allow-scripts");
+            inner.setAttribute("srcdoc", withCsp(withSizeReporter(String(params.html || "")), params.csp));
+            inner.style.cssText = "width:100%;height:100%;border:0;display:block";
+            document.body.appendChild(inner);
+            return;
+          }
+
+          if (typeof data.method === "string" && data.method.indexOf(CONTROL_PREFIX) === 0) return;
+          if (inner && inner.contentWindow) inner.contentWindow.postMessage(data, "*");
+        });
+
+        window.addEventListener("message", function (event) {
+          if (inner && event.source === inner.contentWindow) {
+            var data = event.data;
+            if (data && typeof data === "object" && typeof data.method === "string"
+              && data.method.indexOf(CONTROL_PREFIX) === 0) return;
+            window.parent.postMessage(event.data, "*");
+          }
+        });
+      })();
+    </script>
+  </body>
+</html>
+`;
+
+// src/routes/mcp-apps.ts
+var SANDBOX_HTML_CONTENT_TYPE = "text/html; charset=utf-8";
+var PluginMethodNotSupportedError = class extends Error {
+  /**
+   * @param method - Unsupported JSON-RPC method.
+   */
+  constructor(method) {
+    super(`plugin backend does not support ${method}`);
+    this.name = "PluginMethodNotSupportedError";
+  }
+};
+var ALLOWED_METHODS = /* @__PURE__ */ new Set(["tools/call", "tools/list", "resources/read"]);
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function makeMcpAppHandlers(deps) {
+  return {
+    /**
+     * Resolve the `mcp_app` UI resource for a parsed ref.
+     *
+     * @param tenantId Tenant scope.
+     * @param rawRef Untrusted ref payload.
+     * @returns The resource payload plus a ready-to-use `cspPolicy` string
+     * ({@link buildCsp}, always non-empty), or a 400/502 error envelope.
+     */
+    async resource(tenantId, rawRef) {
+      const ref = parseMcpUiRef(rawRef);
+      if (!ref) return { status: 400, body: { error: "INVALID_REF" } };
+      if (ref.kind === "plugin" && ref.pluginType === "") {
+        return { status: 400, body: { error: "INVALID_REF" } };
+      }
+      try {
+        const payload = await deps.resolveUiResource(tenantId, ref);
+        return { status: 200, body: { ...payload, cspPolicy: buildCsp(payload.csp) } };
+      } catch (error) {
+        console.warn(JSON.stringify({
+          event: "mcp-apps:resource-failed",
+          tenantId,
+          kind: ref.kind,
+          error: error instanceof Error ? error.message : String(error)
+        }));
+        return { status: 502, body: { error: "RESOURCE_UNAVAILABLE" } };
+      }
+    },
+    /**
+     * Proxy an allow-listed JSON-RPC method for a parsed ref.
+     *
+     * @param tenantId Tenant scope.
+     * @param rawRef Untrusted ref payload.
+     * @param method JSON-RPC method name.
+     * @param params JSON-RPC params.
+     * @param context Request-scoped run context forwarded to `tools/call`.
+     * @returns The backend result, or a 400/403/502 error envelope.
+     */
+    async rpc(tenantId, rawRef, method, params, context) {
+      const ref = parseMcpUiRef(rawRef);
+      if (!ref) return { status: 400, body: { error: "INVALID_REF" } };
+      if (!ALLOWED_METHODS.has(method)) return { status: 403, body: { error: "METHOD_NOT_ALLOWED" } };
+      try {
+        if (method === "tools/call") {
+          const name = typeof params.name === "string" ? params.name : "";
+          if (name === "") return { status: 400, body: { error: "INVALID_PARAMS" } };
+          if ("pluginType" in ref && ref.pluginType === "") {
+            return { status: 400, body: { error: "INVALID_REF" } };
+          }
+          return {
+            status: 200,
+            body: await deps.callTool(tenantId, ref, name, asRecord(params.arguments) ?? {}, context)
+          };
+        }
+        if (method === "resources/read") {
+          const uri = typeof params.uri === "string" ? params.uri : "";
+          if (uri === "") return { status: 400, body: { error: "INVALID_PARAMS" } };
+          return { status: 200, body: await deps.readResource(tenantId, ref, uri) };
+        }
+        return { status: 200, body: { tools: await deps.listTools(tenantId, ref) } };
+      } catch (error) {
+        if (error instanceof PluginToolScopeError) {
+          return { status: 403, body: { error: "PLUGIN_TOOL_SCOPE" } };
+        }
+        if (error instanceof PluginMethodNotSupportedError) {
+          return { status: 403, body: { error: "PLUGIN_METHOD_UNSUPPORTED" } };
+        }
+        const context2 = { tenantId, kind: ref.kind, method };
+        if (method === "resources/read") context2.uri = typeof params.uri === "string" ? params.uri : "";
+        if (method === "tools/call") context2.name = typeof params.name === "string" ? params.name : "";
+        console.warn(JSON.stringify({
+          event: "mcp-apps:rpc-failed",
+          ...context2,
+          error: error instanceof Error ? error.message : String(error)
+        }));
+        return { status: 502, body: { error: "RPC_FAILED" } };
+      }
+    }
+  };
+}
+async function fetchPluginUiResource(backend, tenantId, pluginType, resource) {
+  const plugin = await backend.resolvePlugin(tenantId, pluginType);
+  if (!plugin) throw new Error(`plugin "${pluginType}" not found`);
+  const tool = (plugin.meta.tools ?? []).find((t2) => t2.ui?.resource === resource);
+  if (!tool?.ui) throw new Error(`plugin "${pluginType}" has no tool declaring ui resource "${resource}"`);
+  const html = await backend.catalog.readPluginFile(tenantId, pluginType, resource);
+  return {
+    mimeType: "text/html",
+    html,
+    csp: tool.ui.csp,
+    permissions: tool.ui.permissions,
+    prefersBorder: tool.ui.prefersBorder
+  };
+}
+async function callPluginTool(backend, tenantId, ref, name, args, context) {
+  return invokePluginTool(backend, tenantId, ref.pluginType, name, args, context);
+}
+function createDefaultPluginBackend() {
+  return {
+    resolvePlugin: (tenantId, type) => resolveTenantPluginByType(tenantId, type),
+    catalog: {
+      readPluginFile: (tenantId, pluginType, relPath) => getSandboxPluginCatalog3().readPluginFile(tenantId, pluginType, relPath),
+      getValidatedManifest: (tenantId, pluginType) => getSandboxPluginCatalog3().getValidatedManifest(tenantId, pluginType),
+      getExecutor: () => getSandboxPluginCatalog3().getExecutor()
+    }
+  };
+}
+function resolveMcpAppDeps(pluginBackend = createDefaultPluginBackend()) {
+  const uiResourceResolver = new UiResourceResolver({
+    store: new InMemoryMcpUiResourceCacheStore(),
+    fetchMcp: (tenantId, serverKey, resourceUri) => mcpManager2.readUiResource(tenantId, serverKey, resourceUri),
+    fetchPlugin: (tenantId, pluginType, resource) => fetchPluginUiResource(pluginBackend, tenantId, pluginType, resource)
+  });
+  return {
+    resolveUiResource: (tenantId, ref) => uiResourceResolver.resolve(tenantId, ref),
+    callTool: (tenantId, ref, name, args, context) => ref.kind === "mcp" ? mcpManager2.callServerTool(tenantId, ref.serverKey, name, args) : callPluginTool(pluginBackend, tenantId, ref, name, args, context),
+    // Plugin refs reach these only after `tools/call`; the handler treats the
+    // rejection as an unsupported method (403). The branches are live because
+    // the pure handler deliberately delegates method policy to the deps.
+    readResource: (tenantId, ref, uri) => ref.kind === "mcp" ? mcpManager2.readServerResource(tenantId, ref.serverKey, uri) : Promise.reject(new PluginMethodNotSupportedError("resources/read")),
+    listTools: (tenantId, ref) => ref.kind === "mcp" ? mcpManager2.getAvailableTools(tenantId, ref.serverKey) : Promise.reject(new PluginMethodNotSupportedError("tools/list"))
+  };
+}
+function firstHeader(request, name) {
+  const header2 = request.headers[name];
+  return Array.isArray(header2) ? header2[0] : header2;
+}
+function tenantOf(request) {
+  const user = request.user;
+  return user?.tenantId ?? firstHeader(request, "x-tenant-id") ?? "default";
+}
+function runContextOf(request) {
+  return {
+    tenantId: tenantOf(request),
+    workspaceId: firstHeader(request, "x-workspace-id"),
+    projectId: firstHeader(request, "x-project-id")
+  };
+}
+function registerMcpAppRoutes(fastify2) {
+  const handlers = makeMcpAppHandlers(resolveMcpAppDeps());
+  fastify2.get("/mcp-apps/sandbox.html", async (_request, reply) => {
+    return reply.header("content-type", SANDBOX_HTML_CONTENT_TYPE).header("x-content-type-options", "nosniff").header("cache-control", "no-store").send(SANDBOX_HTML);
+  });
+  fastify2.post("/api/mcp-apps/resource", async (request, reply) => {
+    const body = asRecord(request.body) ?? {};
+    const result = await handlers.resource(tenantOf(request), body.ref);
+    return reply.code(result.status).send(result.body);
+  });
+  fastify2.post("/api/mcp-apps/rpc", async (request, reply) => {
+    const body = asRecord(request.body) ?? {};
+    const params = asRecord(body.params) ?? {};
+    const context = runContextOf(request);
+    const result = await handlers.rpc(
+      context.tenantId,
+      body.ref,
+      String(body.method ?? ""),
+      params,
+      context
+    );
+    return reply.code(result.status).send(result.body);
+  });
+}
+
 // src/controllers/eval.ts
-import { getStoreLattice as getStoreLattice10 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice11 } from "@axiom-lattice/core";
 import { v4 as uuidv43 } from "uuid";
 
 // src/services/eval-runner.ts
 import { EventEmitter } from "events";
 import {
-  getStoreLattice as getStoreLattice9,
+  getStoreLattice as getStoreLattice10,
   modelLatticeManager as modelLatticeManager2,
   LatticeEvalProject
 } from "@axiom-lattice/core";
@@ -8047,7 +8902,7 @@ var EvalRunner = class {
     return ctx !== void 0 && !ctx.terminal.workerSettled && (tenantId === void 0 || ctx.tenantId === tenantId);
   }
   getEvalStore() {
-    return getStoreLattice9("default", "eval").store;
+    return getStoreLattice10("default", "eval").store;
   }
   releaseProjectLease(leaseKey, leaseToken) {
     if (this.projectLeases.get(leaseKey) === leaseToken) this.projectLeases.delete(leaseKey);
@@ -8056,7 +8911,7 @@ var EvalRunner = class {
 var evalRunner = new EvalRunner();
 
 // src/controllers/eval.ts
-function getTenantId10(request) {
+function getTenantId11(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -8064,7 +8919,7 @@ function getTenantId10(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 function getEvalStore() {
-  return getStoreLattice10("default", "eval").store;
+  return getStoreLattice11("default", "eval").store;
 }
 async function getOwnedSuite(store, tenantId, projectId, suiteId) {
   const project = await store.getProjectById(tenantId, projectId);
@@ -8080,7 +8935,7 @@ async function getOwnedCase(store, tenantId, projectId, suiteId, caseId) {
 }
 async function createProject(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const id3 = uuidv43();
     const data = request.body;
@@ -8137,7 +8992,7 @@ async function createProject(request, reply) {
 }
 async function listProjects(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     let projects = await store.getProjectsByTenant(tenantId);
     if (projects.length === 0) {
@@ -8171,7 +9026,7 @@ async function listProjects(request, reply) {
 }
 async function getProject(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const project = await store.getProjectById(tenantId, pid);
@@ -8191,7 +9046,7 @@ async function getProject(request, reply) {
 }
 async function updateProject(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const existing = await store.getProjectById(tenantId, pid);
@@ -8235,7 +9090,7 @@ async function updateProject(request, reply) {
 async function deleteProject(request, reply) {
   let releaseDeletion;
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const existing = await store.getProjectById(tenantId, pid);
@@ -8273,7 +9128,7 @@ async function deleteProject(request, reply) {
 }
 async function createSuite(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const project = await store.getProjectById(tenantId, pid);
@@ -8295,7 +9150,7 @@ async function createSuite(request, reply) {
 }
 async function updateSuite(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const existing = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8315,7 +9170,7 @@ async function updateSuite(request, reply) {
 }
 async function deleteSuite(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const existing = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8334,7 +9189,7 @@ async function deleteSuite(request, reply) {
 }
 async function createCase(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const suite = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8364,7 +9219,7 @@ async function createCase(request, reply) {
 }
 async function listCasesForSuite(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const suite = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8384,7 +9239,7 @@ async function listCasesForSuite(request, reply) {
 }
 async function updateCase(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid, sid, cid } = request.params;
     const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
@@ -8404,7 +9259,7 @@ async function updateCase(request, reply) {
 }
 async function deleteCase(request, reply) {
   try {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid, sid, cid } = request.params;
     const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
@@ -8436,7 +9291,7 @@ function registerEvalRoutes(app2) {
   app2.delete("/api/eval/projects/:pid/suites/:sid/cases/:cid", deleteCase);
   app2.post("/api/eval/projects/:pid/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId10(request);
+      const tenantId = getTenantId11(request);
       const { pid } = request.params;
       const body = request.body ?? {};
       const bodyWs = request.headers["x-workspace-id"] || "";
@@ -8455,7 +9310,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId10(request);
+      const tenantId = getTenantId11(request);
       const query = request.query;
       const runs = await getEvalStore().getRunsByTenant(tenantId, { projectId: query.project_id, status: query.status });
       reply.send({ success: true, message: "Ok", data: { records: runs, total: runs.length } });
@@ -8465,7 +9320,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId10(request);
+      const tenantId = getTenantId11(request);
       const { rid } = request.params;
       const run2 = await getEvalStore().getRunById(tenantId, rid);
       if (!run2) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -8476,7 +9331,7 @@ function registerEvalRoutes(app2) {
     }
   });
   app2.get("/api/eval/runs/:rid/stream", async (request, reply) => {
-    const tenantId = getTenantId10(request);
+    const tenantId = getTenantId11(request);
     const { rid } = request.params;
     const store = getEvalStore();
     const ownedRun = await store.getRunById(tenantId, rid);
@@ -8552,7 +9407,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.post("/api/eval/runs/:rid/abort", async (request, reply) => {
     try {
-      const tenantId = getTenantId10(request);
+      const tenantId = getTenantId11(request);
       const { rid } = request.params;
       const run2 = await getEvalStore().getRunById(tenantId, rid);
       if (!run2) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -8565,7 +9420,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.delete("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId10(request);
+      const tenantId = getTenantId11(request);
       const { rid } = request.params;
       const store = getEvalStore();
       const run2 = await store.getRunById(tenantId, rid);
@@ -8582,7 +9437,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.get("/api/eval/reports/projects/:pid", async (request, reply) => {
     try {
-      const tenantId = getTenantId10(request);
+      const tenantId = getTenantId11(request);
       const { pid } = request.params;
       const report = await getEvalStore().getProjectReport(tenantId, pid);
       if (!report) return reply.status(404).send({ success: false, message: "Project not found" });
@@ -8594,11 +9449,11 @@ data: ${JSON.stringify(event.data)}
 }
 
 // src/controllers/users.ts
-import { getStoreLattice as getStoreLattice11 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice12 } from "@axiom-lattice/core";
 import { v4 as uuidv44 } from "uuid";
 var UsersController = class {
   constructor() {
-    this.userStore = getStoreLattice11("default", "user").store;
+    this.userStore = getStoreLattice12("default", "user").store;
   }
   async listUsers(request, reply) {
     const { email } = request.query;
@@ -8676,11 +9531,11 @@ function registerUserRoutes(app2) {
 }
 
 // src/controllers/tenants.ts
-import { getStoreLattice as getStoreLattice12 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice13 } from "@axiom-lattice/core";
 import { v4 as uuidv45 } from "uuid";
 var TenantsController = class {
   constructor() {
-    this.tenantStore = getStoreLattice12("default", "tenant").store;
+    this.tenantStore = getStoreLattice13("default", "tenant").store;
   }
   // ==================== Tenant CRUD ====================
   async listTenants(request, reply) {
@@ -8744,7 +9599,7 @@ function registerTenantRoutes(app2) {
 }
 
 // src/controllers/auth.ts
-import { getStoreLattice as getStoreLattice13 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice14 } from "@axiom-lattice/core";
 import { v4 as uuidv46 } from "uuid";
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 var defaultAuthConfig = {
@@ -8754,9 +9609,9 @@ var defaultAuthConfig = {
 };
 var AuthController = class {
   constructor(config = {}) {
-    this.userStore = getStoreLattice13("default", "user").store;
-    this.tenantStore = getStoreLattice13("default", "tenant").store;
-    this.userTenantLinkStore = getStoreLattice13("default", "userTenantLink").store;
+    this.userStore = getStoreLattice14("default", "user").store;
+    this.tenantStore = getStoreLattice14("default", "tenant").store;
+    this.userTenantLinkStore = getStoreLattice14("default", "userTenantLink").store;
     this.config = { ...defaultAuthConfig, ...config };
   }
   async register(request, reply) {
@@ -8915,7 +9770,7 @@ var AuthController = class {
       const linkMeta = link?.metadata || {};
       let personalAssistant = null;
       if (linkMeta.personalAssistantId) {
-        const assistantStore = getStoreLattice13("default", "assistant").store;
+        const assistantStore = getStoreLattice14("default", "assistant").store;
         const exists = await assistantStore.hasAssistant(tenantId, linkMeta.personalAssistantId);
         if (exists) {
           personalAssistant = {
@@ -9170,7 +10025,7 @@ function isStaleConsoleSessionCredential(authHeader) {
 function bypassesConsoleAuth(request) {
   const path5 = request.url.split("?")[0];
   const method = request.method;
-  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path5) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path5) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/files\/(viewfile|downloadfile)$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/api\/assistants\/[^/]+\/threads\/[^/]+\/sandbox\/(viewfile|downloadfile)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/chat$/.test(path5) || method === "GET" && /^\/embed\/[^/]+$/.test(path5) || (method === "POST" || method === "DELETE") && path5 === "/open/mcp" || method === "POST" && path5 === "/open/session" || (method === "GET" || method === "POST") && path5.startsWith("/open/sandbox/files/")) return true;
+  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path5) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path5) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/files\/(viewfile|downloadfile)$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/api\/assistants\/[^/]+\/threads\/[^/]+\/sandbox\/(viewfile|downloadfile)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/chat$/.test(path5) || method === "GET" && /^\/embed\/[^/]+$/.test(path5) || method === "GET" && path5 === "/mcp-apps/sandbox.html" || (method === "POST" || method === "DELETE") && path5 === "/open/mcp" || method === "POST" && path5 === "/open/session" || (method === "GET" || method === "POST") && path5.startsWith("/open/sandbox/files/")) return true;
   if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path5)) {
     return true;
   }
@@ -9451,6 +10306,44 @@ function decryptLarkPayload(encryptKey, encryptedPayload) {
   ]).toString("utf8");
   return JSON.parse(plaintext);
 }
+function extractVerificationToken(body) {
+  if (typeof body.token === "string") {
+    return body.token;
+  }
+  if (typeof body.header?.token === "string") {
+    return body.header.token;
+  }
+  return void 0;
+}
+function verifyLarkParsedBody(body, config) {
+  if (!config.verificationToken) {
+    return true;
+  }
+  return extractVerificationToken(body) === config.verificationToken;
+}
+function headerValue(request, name) {
+  const value = request.headers[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+function verifyLarkRequestSignature(request, config) {
+  if (!config.encryptKey) {
+    return true;
+  }
+  const timestamp = headerValue(request, "x-lark-request-timestamp");
+  const nonce = headerValue(request, "x-lark-request-nonce");
+  const signature = headerValue(request, "x-lark-signature");
+  if (!timestamp || !nonce || !signature) {
+    return false;
+  }
+  const content = timestamp + nonce + config.encryptKey + JSON.stringify(request.body ?? {});
+  const expected = crypto2.createHash("sha256").update(content).digest("hex");
+  const expectedBuffer = Buffer.from(expected, "utf8");
+  const actualBuffer = Buffer.from(signature, "utf8");
+  if (actualBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return crypto2.timingSafeEqual(actualBuffer, expectedBuffer);
+}
 
 // src/channels/lark/controller.ts
 var logger2 = new Logger({ serviceName: "lattice/gateway/lark" });
@@ -9463,11 +10356,21 @@ function createLarkEventHandler(deps) {
       return;
     }
     const larkInstallation = installation;
-    const body = parseLarkRequestBody(request.body, larkInstallation.config.encryptKey);
+    let body;
+    try {
+      body = parseLarkRequestBody(request.body, larkInstallation.config.encryptKey);
+    } catch {
+      reply.status(400).send({ success: false, message: "Invalid request" });
+      return;
+    }
     if (body.type === "url_verification" && body.challenge) {
       reply.status(200).send({ challenge: body.challenge });
       return;
     }
+    if (!verifyLarkParsedBody(body, larkInstallation.config) || !verifyLarkRequestSignature(request, larkInstallation.config)) {
+      reply.status(403).send({ success: false, message: "Forbidden" });
+      return;
+    }
     const inboundMessage = await larkChannelAdapter.receive(request.body, larkInstallation);
     if (!inboundMessage) {
       reply.status(200).send();
@@ -9559,7 +10462,7 @@ function registerChannelRoutes(app2, dependencies) {
 }
 
 // src/controllers/channel-installations.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import {
   descriptorDataValue
 } from "@axiom-lattice/protocols";
@@ -9569,7 +10472,7 @@ function setChannelControllerDeps(deps) {
   _adapterRegistry = deps.adapterRegistry;
   _router = deps.router;
 }
-function getTenantId11(request) {
+function getTenantId12(request) {
   const userTenantId = request.user?.tenantId;
   if (typeof userTenantId === "string" && userTenantId) {
     return userTenantId;
@@ -9686,8 +10589,8 @@ function snapshotPlainObject(value) {
   }
 }
 async function getInstallationStore() {
-  const { getStoreLattice: getStoreLattice28 } = await import("@axiom-lattice/core");
-  const store = getStoreLattice28("default", "channelInstallation").store;
+  const { getStoreLattice: getStoreLattice29 } = await import("@axiom-lattice/core");
+  const store = getStoreLattice29("default", "channelInstallation").store;
   if (store) return store;
   const { PostgreSQLChannelInstallationStore } = await import("@axiom-lattice/pg-stores");
   const databaseUrl = process.env.DATABASE_URL;
@@ -9699,7 +10602,7 @@ async function getInstallationStore() {
   });
 }
 async function getChannelInstallationList(request) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId12(request);
   const { channel } = request.query;
   try {
     const store = await getInstallationStore();
@@ -9725,7 +10628,7 @@ async function getChannelInstallationList(request) {
   }
 }
 async function getChannelInstallation(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId12(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -9752,7 +10655,7 @@ async function getChannelInstallation(request, reply) {
   }
 }
 async function createChannelInstallation(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId12(request);
   try {
     const body = snapshotPublicCreateRequest(request.body);
     if (!body) {
@@ -9763,7 +10666,7 @@ async function createChannelInstallation(request, reply) {
       };
     }
     const store = await getInstallationStore();
-    const installationId = randomUUID10();
+    const installationId = randomUUID11();
     const createInput = {
       channel: body.channel,
       name: body.name,
@@ -9811,7 +10714,7 @@ async function createChannelInstallation(request, reply) {
   }
 }
 async function updateChannelInstallation(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId12(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -9935,7 +10838,7 @@ async function updateChannelInstallation(request, reply) {
   }
 }
 async function deleteChannelInstallation(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId12(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -10006,8 +10909,8 @@ import {
   DuplicateChannelBindingSubjectError,
   descriptorDataValue as descriptorDataValue2
 } from "@axiom-lattice/protocols";
-import { getBindingRegistry, getStoreLattice as getStoreLattice14 } from "@axiom-lattice/core";
-function getTenantId12(request) {
+import { getBindingRegistry, getStoreLattice as getStoreLattice15 } from "@axiom-lattice/core";
+function getTenantId13(request) {
   const userTenantId = request.user?.tenantId;
   if (typeof userTenantId === "string" && userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10064,7 +10967,7 @@ function snapshotPublicUpdate(value) {
   return body;
 }
 function getInstallationStore2() {
-  return getStoreLattice14("default", "channelInstallation").store;
+  return getStoreLattice15("default", "channelInstallation").store;
 }
 async function isValidPublicInstallation(tenantId, channelInstallationId, channel) {
   const installation = await getInstallationStore2().getInstallationById(channelInstallationId);
@@ -10080,7 +10983,7 @@ function invalidCreateRequest(reply) {
 }
 async function getBindingList(request, _reply) {
   void _reply;
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId13(request);
   const { channel, agentId, channelInstallationId, limit, offset } = request.query;
   try {
     const registry = getBindingRegistry();
@@ -10100,7 +11003,7 @@ async function getBindingList(request, _reply) {
   }
 }
 async function getBinding(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getBindingRegistry();
     const binding = await registry.findById(tenantId, request.params.id);
@@ -10115,7 +11018,7 @@ async function getBinding(request, reply) {
   }
 }
 async function createBinding(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId13(request);
   try {
     const input = snapshotPublicCreate(request.body);
     if (!input) return invalidCreateRequest(reply);
@@ -10140,7 +11043,7 @@ async function createBinding(request, reply) {
 }
 async function updateBinding(request, reply) {
   try {
-    const tenantId = getTenantId12(request);
+    const tenantId = getTenantId13(request);
     const registry = getBindingRegistry();
     const existing = await registry.findById(tenantId, request.params.id);
     if (!existing || isInternalBinding(existing)) {
@@ -10167,7 +11070,7 @@ async function updateBinding(request, reply) {
 }
 async function deleteBinding(request, reply) {
   try {
-    const tenantId = getTenantId12(request);
+    const tenantId = getTenantId13(request);
     const registry = getBindingRegistry();
     const existing = await registry.findById(tenantId, request.params.id);
     if (!existing || isInternalBinding(existing)) {
@@ -10184,7 +11087,7 @@ async function deleteBinding(request, reply) {
 }
 async function resolveBinding(request, _reply) {
   void _reply;
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId13(request);
   const { channel, senderId, channelInstallationId } = request.query;
   if (channel === "room") {
     return { success: false, message: "No binding found", data: null };
@@ -10214,7 +11117,7 @@ function registerChannelBindingRoutes(app2) {
 
 // src/controllers/menu-items.ts
 import { getMenuRegistry } from "@axiom-lattice/core";
-function getTenantId13(request) {
+function getTenantId14(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10223,7 +11126,7 @@ function errorMessage(err) {
   return err instanceof Error ? err.message : "Unexpected error";
 }
 async function getMenuItemList(request, _reply) {
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId14(request);
   try {
     const registry = getMenuRegistry();
     const items = await registry.list({ tenantId, menuTarget: request.query.menuTarget });
@@ -10235,7 +11138,7 @@ async function getMenuItemList(request, _reply) {
   }
 }
 async function getMenuItem(request, reply) {
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId14(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.getById(request.params.id);
@@ -10252,7 +11155,7 @@ async function getMenuItem(request, reply) {
   }
 }
 async function createMenuItem(request, reply) {
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId14(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.create({ ...request.body, tenantId });
@@ -10267,7 +11170,7 @@ async function createMenuItem(request, reply) {
 }
 async function updateMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId14(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -10285,7 +11188,7 @@ async function updateMenuItem(request, reply) {
 }
 async function deleteMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId14(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -10564,11 +11467,11 @@ var registerSTTRoutes = (app2) => {
 };
 
 // src/controllers/local-a2a.ts
-import { getStoreLattice as getStoreLattice15 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice16 } from "@axiom-lattice/core";
 import {
   AgentType as AgentType2
 } from "@axiom-lattice/protocols";
-function getTenantId14(request) {
+function getTenantId15(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10580,7 +11483,7 @@ function getLocalRuntime(assistant) {
   return graphDefinition.localRuntime;
 }
 async function getLocalA2AAssistants(tenantId) {
-  const storeLattice = getStoreLattice15("default", "assistant");
+  const storeLattice = getStoreLattice16("default", "assistant");
   const assistants = await storeLattice.store.getAllAssistants(tenantId);
   const results = [];
   for (const assistant of assistants) {
@@ -10592,7 +11495,7 @@ async function getLocalA2AAssistants(tenantId) {
   return results;
 }
 async function getLocalA2AAssistant(tenantId, assistantId) {
-  const storeLattice = getStoreLattice15("default", "assistant");
+  const storeLattice = getStoreLattice16("default", "assistant");
   const assistant = await storeLattice.store.getAssistantById(tenantId, assistantId);
   if (!assistant) return null;
   const runtime = getLocalRuntime(assistant);
@@ -10605,7 +11508,7 @@ async function requireManagedAssistant(request, reply) {
     reply.status(400).send({ success: false, error: "assistantId is required" });
     return null;
   }
-  const registered = await getLocalA2AAssistant(getTenantId14(request), assistantId);
+  const registered = await getLocalA2AAssistant(getTenantId15(request), assistantId);
   if (!registered) {
     reply.status(404).send({
       success: false,
@@ -10616,7 +11519,7 @@ async function requireManagedAssistant(request, reply) {
   return { assistantId, localRuntime: registered.localRuntime };
 }
 async function getLocalA2AStatus(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId15(request);
   const managed = await getLocalA2AAssistants(tenantId);
   const states = await Promise.all(
     managed.map(
@@ -10723,7 +11626,7 @@ async function getLocalA2ATemplates(_request, reply) {
 }
 
 // src/routes/a2a-test-connection.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 function describeTestConnectionError(error, agentCardUrl) {
   if (!(error instanceof Error)) {
     return `Failed to fetch agent card from ${agentCardUrl}: ${String(error)}`;
@@ -10763,7 +11666,7 @@ async function ensureLocalRuntimeForConnectionTest(localRuntime, agentCardUrl) {
     return { error: portValidation.error };
   }
   const state = await localA2AService.startProvider(
-    `test-${randomUUID11()}`,
+    `test-${randomUUID12()}`,
     testRuntime
   );
   if (state.status === "running") return { runtimeId: state.runtimeId };
@@ -10830,7 +11733,6 @@ function registerTaskRoutes(app2, controller) {
   app2.delete("/api/tasks/:id", controller.remove);
   app2.patch("/api/tasks/:id/complete", controller.complete);
   app2.get("/api/tasks/:id/work-items", controller.workItems);
-  app2.post("/api/projects/:projectId/tasks/:id/reassign", controller.reassign);
 }
 
 // src/routes/index.ts
@@ -10840,20 +11742,22 @@ import {
   createProjectTaskReassignmentAuthorizer,
   createTaskLifecycleService,
   createTrustedAgentMessageDispatcher,
-  getStoreLattice as getStoreLattice16,
+  executionAuthorityRegistry,
+  getStoreLattice as getStoreLattice17,
+  ManagedTaskStartError,
   modelLatticeManager as modelLatticeManager3,
   ProjectTaskOwnerPolicy,
+  ProjectTaskOwnerPolicyError as ProjectTaskOwnerPolicyError2,
   projectMutationMutex as projectMutationMutex2,
-  projectTaskAdmissionNotifier as projectTaskAdmissionNotifier2,
+  projectTaskAdmissionNotifier,
   taskLifecycleNotifier as taskLifecycleNotifier2
 } from "@axiom-lattice/core";
 
 // src/controllers/tasks.ts
 import { snapshotExactRecord as snapshotExactRecord3 } from "@axiom-lattice/protocols";
-import { ProjectTaskOwnerPolicyError, projectTaskAdmissionNotifier } from "@axiom-lattice/core";
+import { ProjectTaskOwnerPolicyError } from "@axiom-lattice/core";
 
 // src/services/collaboration/ProjectTaskThreadService.ts
-import { isProjectLifecycleTask } from "@axiom-lattice/core";
 import {
   snapshotExactRecord as snapshotExactRecord2
 } from "@axiom-lattice/protocols";
@@ -11060,6 +11964,12 @@ function isTaskFileRef(value) {
   return !!row && typeof row.uri === "string" && !!row.uri && (row.name === void 0 || typeof row.name === "string") && (row.mimeType === void 0 || typeof row.mimeType === "string") && (row.addedBy === void 0 || row.addedBy === "user" || row.addedBy === "agent");
 }
 
+// src/services/collaboration/projectTaskScope.ts
+function isProjectLifecycleTask(task) {
+  const source = task.context?.source;
+  return typeof task.workspaceId === "string" && task.workspaceId.length > 0 && typeof task.projectId === "string" && task.projectId.length > 0 && (source === "project_room" || source === "project_task");
+}
+
 // src/services/collaboration/ProjectTaskThreadService.ts
 var ProjectTaskThreadError = class extends Error {
   /**
@@ -11236,20 +12146,7 @@ var protectedLifecycleKeys = /* @__PURE__ */ new Set([
   "status",
   "interruptedAt"
 ]);
-function notifyProjectTaskAdmission(task) {
-  try {
-    void projectTaskAdmissionNotifier.publish({
-      tenantId: task.tenantId,
-      workspaceId: task.workspaceId,
-      projectId: task.projectId,
-      taskId: task.id,
-      ownerId: task.ownerId,
-      updatedAt: Date.prototype.toISOString.call(task.updatedAt)
-    }).catch(() => void 0);
-  } catch {
-  }
-}
-function getTenantId15(request) {
+function getTenantId16(request) {
   const user = request.user;
   const value = user?.tenantId ?? request.headers["x-tenant-id"] ?? "default";
   if (typeof value !== "string" || !value) throw new HttpTaskError(400, "INVALID_TASK_INPUT");
@@ -11358,13 +12255,6 @@ function snapshotComplete(value) {
   if (row.result !== void 0 && typeof row.result !== "string") throw new HttpTaskError(400, "INVALID_TASK_INPUT");
   return row;
 }
-function snapshotReassign(value) {
-  const row = exactObject(value, ["ownerId", "expectedThreadId"], ["ownerId"]);
-  if (typeof row.ownerId !== "string" || !row.ownerId || row.expectedThreadId !== void 0 && (typeof row.expectedThreadId !== "string" || !row.expectedThreadId)) {
-    throw new HttpTaskError(400, "INVALID_TASK_INPUT");
-  }
-  return row;
-}
 function containsLifecycleField(value) {
   if (!value || typeof value !== "object") return false;
   if (Array.isArray(value)) return value.some(containsLifecycleField);
@@ -11379,18 +12269,6 @@ function governedCreate(body) {
   }
   return void 0;
 }
-function governedUpdate(task, body) {
-  const has = (key) => Object.prototype.hasOwnProperty.call(body, key);
-  if (has("ownerType") && body.ownerType !== task.ownerType || has("ownerId") && body.ownerId !== task.ownerId) {
-    return "TASK_OWNERSHIP_IMMUTABLE";
-  }
-  return void 0;
-}
-function lifecycleStatus(code) {
-  if (code === "TASK_NOT_FOUND") return 404;
-  if (code === "PROJECT_TASK_REASSIGNMENT_UNAUTHORIZED") return 403;
-  return code.endsWith("_FAILED") ? 500 : 409;
-}
 function notFound() {
   return new HttpTaskError(404, "TASK_NOT_FOUND", "TASK_NOT_FOUND");
 }
@@ -11490,7 +12368,7 @@ async function validateReferences(store, task, parentId, dependencies) {
 function createTaskController(deps) {
   const mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   const authorize = async (request, projectId, capability2) => deps.access.requireProjectAccess({
-    tenantId: getTenantId15(request),
+    tenantId: getTenantId16(request),
     userId: getUserId4(request),
     projectId,
     capability: capability2
@@ -11507,7 +12385,7 @@ function createTaskController(deps) {
     });
   };
   const list = withErrors(async (request) => {
-    const tenantId = getTenantId15(request);
+    const tenantId = getTenantId16(request);
     const userId = getUserId4(request);
     const query = exactObject(request.query, ["projectId", "status", "priority", "limit", "offset", "ownerType", "ownerId", "parentId", "metadata"]);
     const projectId = typeof query.projectId === "string" ? query.projectId : void 0;
@@ -11579,14 +12457,14 @@ function createTaskController(deps) {
   });
   const get = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeRead(request, current, authorize);
     return { success: true, data: current };
   });
   const create = withErrors(async (request, reply) => {
     const body = snapshotCreate(request.body);
-    const tenantId = getTenantId15(request);
+    const tenantId = getTenantId16(request);
     const userId = getUserId4(request);
     const governed = governedCreate(body);
     if (governed) return reply.code(409).send({ success: false, code: governed });
@@ -11619,6 +12497,8 @@ function createTaskController(deps) {
         ownerType = "agent";
         ownerId = body.ownerId ?? "";
       }
+      const requestedSource = body.context?.source;
+      const source = typeof requestedSource === "string" && requestedSource.length > 0 && requestedSource !== "project_room" && requestedSource !== "project_task" ? requestedSource : "project_room";
       const created = await deps.tasks.create({
         ...body,
         tenantId,
@@ -11630,21 +12510,18 @@ function createTaskController(deps) {
         result: void 0,
         failureReason: void 0,
         requireReview: false,
-        context: { ...body.context ?? {}, source: "project_room" }
+        context: { ...body.context ?? {}, source }
       });
-      if (ownerType === "agent") notifyProjectTaskAdmission(created);
       return reply.code(201).send({ success: true, data: created });
     });
   });
   const update = withErrors(async (request, reply) => {
     const body = snapshotUpdate(request.body);
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
-      const governed = governedUpdate(locked, body);
-      if (governed) return reply.code(409).send({ success: false, code: governed });
       if (body.projectId !== void 0 && body.projectId !== locked.projectId || body.workspaceId !== void 0 && body.workspaceId !== locked.workspaceId) throw notFound();
       await validateReferences(deps.tasks, locked, body.parentId, body.dependencies);
       const updates = { ...body };
@@ -11657,7 +12534,7 @@ function createTaskController(deps) {
   });
   const remove = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
@@ -11671,7 +12548,7 @@ function createTaskController(deps) {
   const complete = withErrors(async (request, reply) => {
     const body = snapshotComplete(request.body);
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
@@ -11688,7 +12565,7 @@ function createTaskController(deps) {
   });
   const workItems = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeRead(request, current, authorize);
     const query = exactObject(request.query, ["action", "limit", "offset"]);
@@ -11704,66 +12581,7 @@ function createTaskController(deps) {
     });
     return reply.send({ success: true, data: rows });
   });
-  const reassign = withErrors(async (request, reply) => {
-    const body = snapshotReassign(request.body);
-    const pathProject = request.params.projectId;
-    const access = await authorize(request, pathProject, "manage");
-    const snapshot = await deps.tasks.getById(getTenantId15(request), request.params.id);
-    if (!snapshot || snapshot.projectId !== access.project.id || snapshot.workspaceId !== access.project.workspaceId || snapshot.ownerType !== "agent") throw notFound();
-    const projectId = snapshot.projectId;
-    return deps.executionMutex.runExclusive({
-      tenantId: snapshot.tenantId,
-      assistantId: snapshot.ownerId,
-      projectId
-    }, async () => {
-      const machineTask = await deps.tasks.getById(snapshot.tenantId, snapshot.id);
-      if (!machineTask || machineTask.tenantId !== snapshot.tenantId || machineTask.projectId !== snapshot.projectId || machineTask.workspaceId !== snapshot.workspaceId || machineTask.ownerType !== "agent" || machineTask.ownerId !== snapshot.ownerId || machineTask.status !== snapshot.status || machineTask.updatedAt.getTime() !== snapshot.updatedAt.getTime()) {
-        throw new HttpTaskError(409, "TASK_STATUS_CONFLICT");
-      }
-      return mutationMutex.runExclusive({ tenantId: snapshot.tenantId, projectId }, async () => {
-        const lockedAccess = await authorize(request, pathProject, "manage");
-        if (lockedAccess.project.id !== access.project.id || lockedAccess.project.workspaceId !== access.project.workspaceId) {
-          throw new ProjectCollaborationError("PROJECT_ACCESS_DENIED", 403, "Project access denied");
-        }
-        const current = await deps.tasks.getById(snapshot.tenantId, snapshot.id);
-        if (!current || current.tenantId !== snapshot.tenantId || current.projectId !== snapshot.projectId || current.workspaceId !== snapshot.workspaceId || current.ownerType !== "agent" || current.ownerId !== snapshot.ownerId || current.status !== snapshot.status || current.updatedAt.getTime() !== snapshot.updatedAt.getTime()) {
-          throw new HttpTaskError(409, "TASK_STATUS_CONFLICT");
-        }
-        const room = await deps.rooms.getMainRoom(current.tenantId, current.projectId);
-        const target = await deps.bots.findByAssistant(current.tenantId, current.projectId, body.ownerId);
-        if (!room || !target || target.status !== "active" || target.roomId !== room.id || target.workspaceId !== current.workspaceId) {
-          return reply.code(409).send({ success: false, code: "PROJECT_TASK_OWNER_INACTIVE" });
-        }
-        const caller = await deps.bots.findByAssistant(current.tenantId, current.projectId, current.ownerId);
-        if (!caller || caller.status !== "active" || caller.roomId !== room.id || caller.workspaceId !== current.workspaceId) {
-          return reply.code(409).send({ success: false, code: "PROJECT_TASK_CALLER_INACTIVE" });
-        }
-        const ensured = await deps.threadService.ensure({ task: current, room, membership: target, mode: "reassignment" });
-        const authorization = await deps.reassignmentAuthorizer.authorize({
-          tenantId: current.tenantId,
-          workspaceId: current.workspaceId,
-          projectId: current.projectId,
-          roomId: room.id,
-          taskId: current.id,
-          callerMembershipId: caller.id,
-          callerAssistantId: caller.assistantId,
-          targetMembershipId: target.id,
-          targetAssistantId: target.assistantId,
-          ...body.expectedThreadId === void 0 ? {} : { expectedThreadId: body.expectedThreadId },
-          newThreadId: ensured.thread.id
-        });
-        const result = await deps.lifecycle.reassignProjectTask({
-          tenantId: current.tenantId,
-          taskId: current.id,
-          authorization,
-          actor: `user:${getUserId4(request)}`
-        });
-        if (!result.success) return reply.code(lifecycleStatus(result.code)).send(result);
-        return reply.send({ success: true, data: result.task, orphanCandidate: false });
-      });
-    });
-  });
-  return { list, get, create, update, remove, complete, workItems, reassign };
+  return { list, get, create, update, remove, complete, workItems };
 }
 function parseMetadata(value) {
   let parsed = value;
@@ -12082,7 +12900,7 @@ import { createHmac as createHmac3 } from "crypto";
 import { z as z5, ZodError as ZodError2 } from "zod";
 
 // src/services/agent-web-app/AgentWebAppRuntimeService.ts
-import { createHash as createHash2, randomUUID as randomUUID12 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID13 } from "crypto";
 import { MessageChunkTypes as MessageChunkTypes3, parseAgentWebAppGenUIBlock } from "@axiom-lattice/protocols";
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -12276,10 +13094,10 @@ ${formatFileRefsSection(refs)}` : input.content;
     const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
     this.requireNamedFeature(runtime.webApp.features.attachments, "Attachments are disabled");
     if (!this.deps.saveProjectFile || !this.deps.attachmentRefs) this.fail("INTERNAL_ERROR", 500, "Attachment service is unavailable");
-    const userDigest = createHash2("sha256").update(userId, "utf8").digest("hex");
-    const contentDigest = createHash2("sha256").update(file.bytes).digest("hex");
+    const userDigest = createHash3("sha256").update(userId, "utf8").digest("hex");
+    const contentDigest = createHash3("sha256").update(file.bytes).digest("hex");
     const displayName = file.name;
-    const physicalName = `${randomUUID12()}-${sanitizePhysicalFilename(file.name)}`;
+    const physicalName = `${randomUUID13()}-${sanitizePhysicalFilename(file.name)}`;
     const saved = await this.deps.saveProjectFile({
       tenantId: runtime.webApp.tenantId,
       workspaceId: runtime.project.workspaceId,
@@ -12431,7 +13249,7 @@ ${formatFileRefsSection(refs)}` : input.content;
     const thread = await this.deps.threadStore.createThread(
       runtime.webApp.tenantId,
       runtime.webApp.assistantId,
-      randomUUID12(),
+      randomUUID13(),
       { metadata: this.metadata(runtime, userId, normalizeLabel(rawLabel)) }
     );
     return toRuntimeThread(thread);
@@ -12483,7 +13301,7 @@ function implicitThreadId(runtime, userId) {
     userId,
     runtime.project.id
   ]);
-  const bytes = createHash2("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
+  const bytes = createHash3("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 128;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = bytes.toString("hex");
@@ -13251,7 +14069,7 @@ function registerAgentWebAppEmbedRoutes(app2, deps = {}) {
 }
 
 // src/services/agent-web-app/AgentWebAppAttachmentRef.ts
-import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
 var TTL_MS = 15 * 6e4;
 function resolveAgentWebAppAttachmentSecret(consoleSecret) {
   return process.env.WEB_APP_ATTACHMENT_SECRET || process.env.AUTH_TOKEN_SECRET || process.env.JWT_SECRET || consoleSecret;
@@ -13260,7 +14078,7 @@ var AgentWebAppAttachmentRefService = class {
   constructor(secret, now = Date.now) {
     this.now = now;
     if (!secret) throw new Error("Attachment signing secret is required");
-    this.key = createHash3("sha256").update(secret, "utf8").digest();
+    this.key = createHash4("sha256").update(secret, "utf8").digest();
   }
   sign(input) {
     const payload = {
@@ -13322,7 +14140,7 @@ function decodeCanonical(value, expectedBytes) {
   return decoded;
 }
 function digestUser(userId) {
-  return createHash3("sha256").update(userId, "utf8").digest("hex");
+  return createHash4("sha256").update(userId, "utf8").digest("hex");
 }
 function isAttachmentPayload(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -13682,12 +14500,12 @@ function registerCapabilityBundleRoutes(app2, controller) {
 }
 
 // src/services/collaboration/ProjectRoomService.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 var ProjectRoomService = class {
   /** Creates a project room service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID13;
+    this.idFactory = deps.idFactory ?? randomUUID14;
   }
   /**
    * Authorizes read access and ensures the project's main room.
@@ -13747,7 +14565,7 @@ var ProjectRoomService = class {
 };
 
 // src/services/collaboration/ProjectMembershipService.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 var ProjectMembershipServiceError = class extends Error {
   constructor(code, statusCode, message) {
     super(message);
@@ -13763,7 +14581,7 @@ function isMembershipConflict(error) {
 var ProjectMembershipService = class {
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID14;
+    this.idFactory = deps.idFactory ?? randomUUID15;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   async list(actor3) {
@@ -13897,7 +14715,7 @@ var ProjectMembershipService = class {
 };
 
 // src/services/collaboration/ProjectRosterService.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 var ProjectRosterServiceError = class extends Error {
   /** Creates a stable roster service error. */
   constructor(code, statusCode, message) {
@@ -13916,7 +14734,7 @@ var ProjectRosterService = class {
   /** Creates a roster service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID15;
+    this.idFactory = deps.idFactory ?? randomUUID16;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   /** Lists all bot memberships visible to a project reader. */
@@ -14150,7 +14968,7 @@ var ProjectRosterService = class {
 };
 
 // src/services/collaboration/RoomMessageService.ts
-import { createHash as createHash4, randomUUID as randomUUID16 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID17 } from "crypto";
 
 // src/services/collaboration/ProjectBotMembershipSnapshot.ts
 import { snapshotExactRecord as snapshotExactRecord4 } from "@axiom-lattice/protocols";
@@ -14239,7 +15057,7 @@ var RoomMessageService = class {
   constructor(deps, options = {}) {
     this.deps = deps;
     this.idempotentOutcomes = /* @__PURE__ */ new Map();
-    this.idFactory = deps.idFactory ?? randomUUID16;
+    this.idFactory = deps.idFactory ?? randomUUID17;
     const limit = options.idempotentOutcomeLimit ?? 1e3;
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("idempotentOutcomeLimit must be a positive safe integer");
     this.idempotentOutcomeLimit = limit;
@@ -14420,7 +15238,7 @@ var RoomMessageService = class {
     let idempotencyKey;
     if (value.requestIdempotencyKey !== void 0) {
       if (typeof value.requestIdempotencyKey !== "string" || !/^[\x21-\x7e]{1,200}$/.test(value.requestIdempotencyKey.trim())) throw new RoomMessageServiceError("INVALID_MESSAGE", 400, "Invalid idempotency key");
-      idempotencyKey = `room-human:${actor3.userId}:${createHash4("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
+      idempotencyKey = `room-human:${actor3.userId}:${createHash5("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
     }
     return { text, mentions, botIds, ...value.replyToMessageId === void 0 ? {} : { replyToMessageId: value.replyToMessageId }, ...idempotencyKey === void 0 ? {} : { idempotencyKey } };
   }
@@ -14477,7 +15295,7 @@ function cloneRoomMessage(message) {
   };
 }
 function fingerprintRequest(input) {
-  return createHash4("sha256").update(JSON.stringify({
+  return createHash5("sha256").update(JSON.stringify({
     text: input.text,
     mentions: input.mentions,
     replyToMessageId: input.replyToMessageId ?? null
@@ -14492,7 +15310,7 @@ import { ZodError as ZodError3 } from "zod";
 import { toProjectRoomPublicMessage } from "@axiom-lattice/protocols";
 
 // src/services/collaboration/RoomInterruptService.ts
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 
 // src/router/roomInterrupt.ts
 var CLARIFY_FENCE = /^```clarify\n([\s\S]*?)\n```$/;
@@ -14540,7 +15358,7 @@ var RoomInterruptService = class {
   /** Creates the service from explicitly injected stores and dispatcher. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID17;
+    this.idFactory = deps.idFactory ?? randomUUID18;
   }
   /** Resolves a pending clarify interrupt with no answers. */
   async skip(input) {
@@ -14588,6 +15406,7 @@ var RoomInterruptService = class {
             inputMessageId,
             role: membership.role,
             title: membership.title,
+            source: "project_room",
             ...membership.responsibility === void 0 ? {} : { responsibility: membership.responsibility }
           }
         }
@@ -14795,7 +15614,7 @@ async function execute(reply, operation) {
 }
 
 // src/routes/cospace.ts
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 import { ZodError as ZodError5 } from "zod";
 import {
   generateDirectHumanProjectId,
@@ -14829,7 +15648,7 @@ async function computeUnread(deps, tenantId, userId, roomId, lastMessage) {
   });
 }
 function registerCoSpaceRoutes(app2, deps) {
-  const idFactory = deps.idFactory ?? (() => randomUUID18());
+  const idFactory = deps.idFactory ?? (() => randomUUID19());
   app2.get(
     "/api/workspaces/:workspaceId/rooms",
     async (request, reply) => {
@@ -15713,6 +16532,7 @@ var RoomDispatchService = class {
               inputMessageId: "pending-router-input",
               role: membership.role,
               title: membership.title,
+              source: "project_room",
               ...membership.responsibility === void 0 ? {} : { responsibility: membership.responsibility }
             } }
           }
@@ -15784,8 +16604,7 @@ function exactValues(value, required, optional = []) {
 }
 
 // src/services/collaboration/CoordinatorWakeNotifier.ts
-import { randomUUID as randomUUID19 } from "crypto";
-import { isProjectLifecycleTask as isProjectLifecycleTask2 } from "@axiom-lattice/core";
+import { randomUUID as randomUUID20 } from "crypto";
 import {
   snapshotExactRecord as snapshotExactRecord6
 } from "@axiom-lattice/protocols";
@@ -15801,7 +16620,7 @@ var CoordinatorWakeNotifier = class {
     this.accepted = /* @__PURE__ */ new Set();
     this.maxPending = deps.maxPending ?? 1024;
     if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-    this.idFactory = deps.idFactory ?? randomUUID19;
+    this.idFactory = deps.idFactory ?? randomUUID20;
   }
   /** Admits one notification without awaiting any store or dispatch operation. */
   handle(value, anchorMessageId) {
@@ -15873,7 +16692,7 @@ var CoordinatorWakeNotifier = class {
     try {
       const task = snapshotTaskItem(await this.deps.tasks.getById(notification.tenantId, notification.taskId));
       if (this.closed) return;
-      if (!task || !isProjectLifecycleTask2(task) || task.tenantId !== notification.tenantId || task.workspaceId !== notification.workspaceId || task.projectId !== notification.projectId || task.status !== notification.status || task.updatedAt.toISOString() !== notification.updatedAt || notification.threadId !== void 0 && task.context?.thread_id !== notification.threadId) {
+      if (!task || !isProjectLifecycleTask(task) || task.tenantId !== notification.tenantId || task.workspaceId !== notification.workspaceId || task.projectId !== notification.projectId || task.status !== notification.status || task.updatedAt.toISOString() !== notification.updatedAt || notification.threadId !== void 0 && task.context?.thread_id !== notification.threadId) {
         this.warn("project-room:coordinator-wake-stale", { taskId: safeId(notification.taskId), eventKey: safeId(notification.eventKey) });
         return;
       }
@@ -16156,10 +16975,10 @@ var ProjectTaskExecutionMutex = class {
 };
 
 // src/services/collaboration/ProjectTaskExecutionService.ts
-import { randomUUID as randomUUID20 } from "crypto";
+import { randomUUID as randomUUID21 } from "crypto";
 import {
+  createTaskRunBridge,
   ThreadStatus as ThreadStatus3,
-  isProjectLifecycleTask as isProjectLifecycleTask3,
   parseExternalDependency
 } from "@axiom-lattice/core";
 import {
@@ -16193,6 +17012,7 @@ var ProjectTaskExecutionService = class {
     if (!Number.isFinite(options.lifecycleSettlementTimeoutMs) || options.lifecycleSettlementTimeoutMs <= 0) {
       throw new Error("Project task lifecycle settlement timeout must be positive");
     }
+    this.runBridge = createTaskRunBridge({ lifecycle: this.deps.lifecycle });
   }
   /** Validates, atomically starts, dispatches, and settles a pending Project Task. */
   async start(input, signal) {
@@ -16200,24 +17020,24 @@ var ProjectTaskExecutionService = class {
     this.throwIfCancelled(signal);
     const ensured = await this.deps.threads.ensure({ ...validated, mode: "current_owner" });
     this.throwIfCancelled(signal);
-    const started = await this.deps.lifecycle.startTask({
+    const begun = await this.runBridge.beginRun({
       tenantId: input.tenantId,
-      taskId: input.taskId,
+      task: validated.task,
       actor: SYSTEM_ACTOR,
       threadId: ensured.thread.id
     });
-    if (!started.success) throw new ProjectTaskExecutionError(started.code, started.error);
-    if (signal?.aborted && (!started.transitioned || !started.mutated)) this.throwIfCancelled(signal);
-    if (!started.transitioned || !started.mutated) {
+    if (!begun.success) throw new ProjectTaskExecutionError(begun.code, begun.error);
+    if (signal?.aborted && (!begun.transitioned || !begun.mutated)) this.throwIfCancelled(signal);
+    if (!begun.transitioned || !begun.mutated) {
       throw new ProjectTaskExecutionError("PROJECT_TASK_START_CONFLICT", "Another caller already started this task");
     }
     if (signal?.aborted) return this.compensateCancellation(
-      started.task,
+      begun.task,
       ensured.thread,
-      `project-task:${started.task.id}:${ensured.thread.id}:start`,
+      `project-task:${begun.task.id}:${ensured.thread.id}:start`,
       false
     );
-    const current = await this.requireCurrentThread(started.task, ensured.thread);
+    const current = await this.requireCurrentThread(begun.task, ensured.thread);
     if (signal?.aborted) return this.compensateCancellation(
       current,
       ensured.thread,
@@ -16360,7 +17180,7 @@ var ProjectTaskExecutionService = class {
   }
   async requireTask(input) {
     const value = snapshotTaskItem(await this.deps.tasks.getById(input.tenantId, input.taskId));
-    if (!value || value.tenantId !== input.tenantId || value.id !== input.taskId || !isProjectLifecycleTask3(value)) {
+    if (!value || value.tenantId !== input.tenantId || value.id !== input.taskId || !isProjectLifecycleTask(value)) {
       throw new ProjectTaskExecutionError("PROJECT_TASK_NOT_READY", "Project task does not exist or is out of scope");
     }
     return value;
@@ -16424,7 +17244,7 @@ var ProjectTaskExecutionService = class {
     return current;
   }
   async dispatchRun(task, thread, mode, signal) {
-    const messageId = (this.options.idFactory ?? randomUUID20)();
+    const messageId = (this.options.idFactory ?? randomUUID21)();
     if (signal?.aborted) return this.compensateCancellation(task, thread, messageId, false);
     const settlement = this.armSettlement(task, thread, messageId);
     try {
@@ -16618,13 +17438,12 @@ var ProjectTaskExecutionService = class {
     const summary = clarify.questions.find(
       (question) => typeof question.question === "string" && question.question.trim().length > 0
     )?.question.trim() ?? "Waiting for clarification from the room";
-    const result = await this.withLifecycleTimeout(this.deps.lifecycle.interruptTask({
+    const result = await this.withLifecycleTimeout(this.runBridge.settleRun({
       tenantId: task.tenantId,
-      taskId: task.id,
-      type: "missing_input",
-      summary,
+      task,
       actor: SYSTEM_ACTOR,
-      threadId: thread.id
+      threadId: thread.id,
+      outcome: { kind: "interrupted", summary }
     }), void 0);
     if (!result || !result.success) return void 0;
     return result.task ?? await this.reloadTask(task);
@@ -16686,12 +17505,12 @@ var ProjectTaskExecutionService = class {
     }
     let failed;
     try {
-      failed = await this.deps.lifecycle.failTask({
+      failed = await this.runBridge.settleRun({
         tenantId: task.tenantId,
-        taskId: task.id,
-        failureReason: error,
+        task,
         actor: SYSTEM_ACTOR,
-        threadId: thread.id
+        threadId: thread.id,
+        outcome: { kind: "failed", lifecycleHandled: false, error }
       });
     } catch {
       return { kind: "failed", task: current, thread, messageId, error, cause, lifecycleHandled: false };
@@ -16752,7 +17571,8 @@ function buildTrustedTaskContext(task, thread, inputMessageId) {
     assistantId: task.ownerId,
     taskId: task.id,
     threadId: thread.id,
-    inputMessageId
+    inputMessageId,
+    source: "project_task"
   };
 }
 function taskThreadMetadata(thread) {
@@ -16806,9 +17626,9 @@ function validRecoveryRow(row, task, thread) {
 }
 
 // src/services/collaboration/ProjectTaskObserver.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import {
-  isProjectLifecycleTask as isProjectLifecycleTask4,
+  createTaskRunBridge as createTaskRunBridge2,
   parseExternalDependency as parseExternalDependency2
 } from "@axiom-lattice/core";
 import {
@@ -16816,7 +17636,6 @@ import {
 } from "@axiom-lattice/protocols";
 var SYSTEM_ACTOR2 = "system";
 var TERMINAL_ACTIONS = ["completed", "failed", "interrupted", "cancelled"];
-var MAX_LEARNING_ROUND_ANCESTORS = 8;
 var ProjectTaskObserver = class {
   /** @param deps Durable stores and Project Task runtime services. @param options Positive bounded scan limits. */
   constructor(deps, options) {
@@ -16835,6 +17654,7 @@ var ProjectTaskObserver = class {
         throw new Error(`Invalid Project task observer bound: ${name}`);
       }
     }
+    this.runBridge = createTaskRunBridge2({ lifecycle: this.deps.lifecycle });
   }
   /** Fire-and-forget notifier adapter that never waits for observer work or machine acquisition. */
   async listener(event) {
@@ -16890,15 +17710,15 @@ var ProjectTaskObserver = class {
       if (signal?.aborted) continue;
       const eventTime = Date.parse(hint.event.updatedAt);
       if (task && task.status === "pending" && task.ownerType === "agent" && task.workspaceId === hint.event.workspaceId && task.projectId === hint.event.projectId && task.ownerId === hint.event.ownerId && task.updatedAt.getTime() >= eventTime) {
-        await this.reconcileTask(task, signal);
+        await this.reconcileTask(task, signal, "dispatch");
       }
     }
   }
   /** Awaits one notification for tests, startup repair, or other non-notifier callers. */
   async notify(event) {
     const task = snapshotTaskItem(await this.deps.tasks.getById(event.tenantId, event.taskId));
+    if (!task || !isProjectLifecycleTask(task) || task.workspaceId !== event.workspaceId || task.projectId !== event.projectId) return;
     const item = await this.deps.workItems.findByEventKey(event.tenantId, event.taskId, event.eventKey);
-    if (!task || task.workspaceId !== event.workspaceId || task.projectId !== event.projectId) return;
     const matches = item !== null && item !== void 0 && item.eventKey === event.eventKey && item.action === event.action && item.taskId === event.taskId && item.tenantId === event.tenantId && item.workspaceId === event.workspaceId && item.projectId === event.projectId && item.threadId === event.threadId;
     let anchorMessageId;
     if (matches && task.status === event.status && task.updatedAt.toISOString() === event.updatedAt && (event.threadId === void 0 || task.context?.thread_id === event.threadId)) {
@@ -16956,7 +17776,11 @@ var ProjectTaskObserver = class {
           return result;
         }
         result.taskTruncated || (result.taskTruncated = pass.truncated);
-        if (pass.truncated) this.deps.log.warn("Project task startup scan truncated", { tenantId: tenant2.id, status });
+        if (pass.truncated) this.deps.log.warn("Project task startup scan truncated", {
+          code: "PROJECT_TASK_STARTUP_SCAN_TRUNCATED",
+          tenantId: tenant2.id,
+          status
+        });
         for (const scope of pass.scopes) discovered.set(scopeKey(scope), scope);
         for (const id3 of pass.ids) {
           if (signal?.aborted || this.disposed) {
@@ -16978,16 +17802,43 @@ var ProjectTaskObserver = class {
       return result;
     }
     await this.repairProjects(selected, discovered, result, signal);
+    if (result.taskTruncated || result.projectEnumerationTruncated || result.projectionTruncated) {
+      this.deps.log.warn("Project task startup reconciliation truncated", {
+        code: "PROJECT_TASK_STARTUP_RECONCILIATION_TRUNCATED",
+        taskTruncated: result.taskTruncated,
+        projectEnumerationTruncated: result.projectEnumerationTruncated,
+        projectionTruncated: result.projectionTruncated
+      });
+    }
     return result;
   }
-  /** Reconciles one persisted Agent-owned Project Task according to its current lifecycle status. */
-  async reconcileTask(task, signal) {
+  /** Reconciles one persisted Agent-owned Project Task under an explicit intent. */
+  async reconcileTask(task, signal, intent = "converge") {
     signal ?? (signal = this.deps.signal);
     if (signal?.aborted || this.disposed) return;
-    if (!isProjectLifecycleTask4(task) || task.ownerType !== "agent") return;
-    if (await this.belongsToLearningRound(task)) return;
+    if (!isProjectLifecycleTask(task) || task.ownerType !== "agent") return;
     if (task.status === "pending") {
-      if (await this.isReady(task) && !signal?.aborted && !this.disposed) await this.runStart(task, signal);
+      if (signal?.aborted || this.disposed) return;
+      const dependencies = await this.dependencyState(task);
+      if (signal?.aborted || this.disposed) return;
+      if (dependencies === "unmet") {
+        await this.convergeDependencyUnmet(task);
+        return;
+      }
+      if (dependencies === "wait" && await this.hasDependencyCycle(task)) {
+        await this.convergeDependencyCycle(task);
+        return;
+      }
+      if (dependencies !== "ready") return;
+      try {
+        await this.requireActiveOwner(task);
+      } catch (error) {
+        await this.convergeInterrupted(task, `No active executor: ${errorMessage3(error)}`);
+        return;
+      }
+      if (intent === "dispatch" && await this.isReady(task) && !signal?.aborted && !this.disposed) {
+        await this.runStart(task, signal);
+      }
       return;
     }
     if (task.status === "in_progress") {
@@ -17009,7 +17860,6 @@ var ProjectTaskObserver = class {
     const createdBy = readCreatedBy(task.context?.created_by);
     if (!createdBy || task.ownerType !== "agent" || createdBy.assistantId === task.ownerId) return;
     try {
-      if (await this.belongsToLearningRound(task)) return;
       const room = await this.exactMainRoom(task);
       const from = await this.deps.bots.findById(task.tenantId, createdBy.membershipId) ?? await this.deps.bots.findByAssistant(task.tenantId, task.projectId, createdBy.assistantId);
       const to = await this.deps.bots.findByAssistant(task.tenantId, task.projectId, task.ownerId);
@@ -17026,22 +17876,6 @@ var ProjectTaskObserver = class {
       await this.safeWarning(task, "delegation", error);
     }
   }
-  // SCOPE-COMPAT: learning rounds (metadata.trainingRound) and their subtrees execute in the
-  // architect's builder thread (canvas CopilotPanel), not the Project Room runtime. Exempting
-  // them here keeps admission hints, startup reconciliation, and dependent re-evaluation from
-  // claiming these tasks — no roster warnings, no restart noise, and no double execution if
-  // the architect later joins the room roster.
-  async belongsToLearningRound(task) {
-    let current = task;
-    for (let depth = 0; current && depth < MAX_LEARNING_ROUND_ANCESTORS; depth += 1) {
-      if (current.metadata?.trainingRound === true) return true;
-      if (!current.parentId) return false;
-      const parent = snapshotTaskItem(await this.deps.tasks.getById(current.tenantId, current.parentId));
-      if (!parent || parent.id !== current.parentId || parent.tenantId !== current.tenantId) return false;
-      current = parent;
-    }
-    return false;
-  }
   /** Collects every bounded dependent ID before re-reading or scheduling any dependent. */
   async reevaluateDependents(task) {
     const { ids } = await this.collectDependentIds(task);
@@ -17099,20 +17933,13 @@ var ProjectTaskObserver = class {
         const classification = await this.deps.execution.classifyRecovery(current, ensured.thread);
         if (signal?.aborted || this.disposed) return;
         if (classification.kind === "invalid") {
-          await this.safeWarning(current, "queue", classification.reason);
+          await this.convergeInterrupted(
+            current,
+            `Task execution state is not recoverable: ${classification.reason}`
+          );
           return;
         }
         if (classification.kind === "missing") {
-          const exact2 = snapshotTaskItem(await this.deps.tasks.getById(current.tenantId, current.id));
-          if (!exact2 || exact2.status !== "in_progress" || exact2.context?.thread_id !== ensured.thread.id) return;
-          const failed = await this.deps.lifecycle.failTask({
-            tenantId: current.tenantId,
-            taskId: current.id,
-            actor: SYSTEM_ACTOR2,
-            threadId: ensured.thread.id,
-            failureReason: "Task execution queue state was not recoverable"
-          });
-          await this.checkLifecycle(current, "queue-fail", failed);
           return;
         }
         const recovery = {
@@ -17147,7 +17974,6 @@ var ProjectTaskObserver = class {
   }
   async wakeParent(child) {
     if (!child.parentId) return;
-    if (await this.belongsToLearningRound(child)) return;
     const parent = snapshotTaskItem(await this.deps.tasks.getById(child.tenantId, child.parentId));
     if (!parent || parent.id !== child.parentId || child.parentId !== parent.id || parent.ownerType !== "agent" || parent.workspaceId !== child.workspaceId || parent.projectId !== child.projectId || parent.status !== "interrupted" || !parent.dependencies?.includes(child.id)) return;
     const interruption = parseExternalDependency2(parent.context?.interruption);
@@ -17185,46 +18011,45 @@ var ProjectTaskObserver = class {
     if (!current || current.ownerId !== outcome.thread.assistantId || current.context?.thread_id !== outcome.thread.id) return;
     if (isTerminal(current.status) || current.status === "review") return;
     if (outcome.kind === "completed") {
-      const result2 = await this.deps.lifecycle.failTask({
+      const result2 = await this.runBridge.settleRun({
         tenantId: current.tenantId,
-        taskId: current.id,
+        task: current,
         actor: SYSTEM_ACTOR2,
         threadId: outcome.thread.id,
-        failureReason: "Agent execution ended without a task lifecycle transition"
+        outcome: { kind: "completed" }
       });
       await this.checkLifecycle(current, "outcome-completed", result2);
       return;
     }
     if (outcome.kind === "cancelled") {
-      const result2 = await this.deps.lifecycle.cancelTask({
+      const result2 = await this.runBridge.settleRun({
         tenantId: current.tenantId,
-        taskId: current.id,
+        task: current,
         actor: SYSTEM_ACTOR2,
         threadId: outcome.thread.id,
-        summary: "Task execution cancelled"
+        outcome: { kind: "cancelled" }
       });
       await this.checkLifecycle(current, "outcome-cancelled", result2);
       return;
     }
     if (outcome.kind === "failed" && outcome.lifecycleHandled) return;
     if (outcome.kind === "interrupted") {
-      const result2 = await this.deps.lifecycle.interruptTask({
+      const result2 = await this.runBridge.settleRun({
         tenantId: current.tenantId,
-        taskId: current.id,
+        task: current,
         actor: SYSTEM_ACTOR2,
         threadId: outcome.thread.id,
-        type: "missing_input",
-        summary: "Task execution interrupted"
+        outcome: { kind: "interrupted" }
       });
       await this.checkLifecycle(current, "outcome-interrupted", result2);
       return;
     }
-    const result = await this.deps.lifecycle.failTask({
+    const result = await this.runBridge.settleRun({
       tenantId: current.tenantId,
-      taskId: current.id,
+      task: current,
       actor: SYSTEM_ACTOR2,
       threadId: outcome.thread.id,
-      failureReason: outcome.error
+      outcome: { kind: "failed", lifecycleHandled: false, error: outcome.error }
     });
     await this.checkLifecycle(current, `outcome-${outcome.cause}`, result);
   }
@@ -17271,7 +18096,7 @@ var ProjectTaskObserver = class {
       });
       for (const value of batch) {
         if (!rows.has(value.id)) rows.set(value.id, { id: value.id, createdAt: requireDate(value.createdAt) });
-        if (isProjectLifecycleTask4(value)) {
+        if (isProjectLifecycleTask(value)) {
           const scope = { tenantId: value.tenantId, workspaceId: value.workspaceId, projectId: value.projectId };
           scopes.set(scopeKey(scope), scope);
         }
@@ -17388,7 +18213,7 @@ var ProjectTaskObserver = class {
       action: "activity",
       summary: "Project task recovery warning",
       detail: { type: "project_task_recovery_warning", phase, message },
-      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${createHash5("sha256").update(message).digest("hex")}`
+      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${createHash6("sha256").update(message).digest("hex")}`
     });
   }
   async safeWarning(task, phase, error) {
@@ -17402,6 +18227,134 @@ var ProjectTaskObserver = class {
       });
     }
   }
+  /**
+   * Converges an unexecutable task to a durable interruption.
+   *
+   * @param task Exact task snapshot that cannot make progress through automation.
+   * @param summary Human-readable reason recorded with the interruption.
+   * @remarks Never leaves a task silently pending behind a warning; an `in_progress`
+   * task with no dispatched queue rows is intentionally left untouched by recovery.
+   * The interruption is visible and resumable once an executor is available.
+   */
+  async convergeInterrupted(task, summary) {
+    if (this.disposed) return;
+    try {
+      const result = await this.runBridge.settleRun({
+        tenantId: task.tenantId,
+        task,
+        actor: SYSTEM_ACTOR2,
+        outcome: { kind: "interrupted", summary }
+      });
+      if (!result.success && result.code !== "TASK_STATUS_CONFLICT") {
+        await this.safeWarning(task, "converge", `${result.code ?? "LIFECYCLE_REJECTED"}: ${result.error ?? summary}`);
+      }
+    } catch (error) {
+      await this.safeWarning(task, "converge", error);
+    }
+  }
+  /**
+   * Classifies a task's dependencies as ready, still waiting, or permanently unmet.
+   *
+   * @param task Exact task snapshot whose dependencies are inspected.
+   * @returns `ready` when every dependency is completed, `unmet` when a
+   *   dependency is terminal but not completed (failed/cancelled/missing),
+   *   otherwise `wait`.
+   */
+  async dependencyState(task) {
+    for (const dependencyId of task.dependencies ?? []) {
+      let dependency;
+      try {
+        dependency = snapshotTaskItem(await this.deps.tasks.getById(task.tenantId, dependencyId));
+      } catch {
+        return "wait";
+      }
+      if (!dependency || dependency.id !== dependencyId || dependency.workspaceId !== task.workspaceId || dependency.projectId !== task.projectId) return "unmet";
+      if (dependency.status === "completed") continue;
+      if (dependency.status === "failed" || dependency.status === "cancelled") return "unmet";
+      return "wait";
+    }
+    return "ready";
+  }
+  /**
+   * Converges a task whose dependencies can never be met to a durable failure.
+   *
+   * @param task Exact task snapshot with terminal non-completed dependencies.
+   */
+  async convergeDependencyUnmet(task) {
+    if (this.disposed) return;
+    try {
+      const result = await this.runBridge.settleRun({
+        tenantId: task.tenantId,
+        task,
+        actor: SYSTEM_ACTOR2,
+        outcome: {
+          kind: "failed",
+          lifecycleHandled: false,
+          error: `Dependency unmet: ${(task.dependencies ?? []).join(", ")}`
+        }
+      });
+      if (!result.success && result.code !== "TASK_STATUS_CONFLICT") {
+        await this.safeWarning(task, "dependency", `${result.code ?? "LIFECYCLE_REJECTED"}: ${result.error ?? "dependency unmet"}`);
+      }
+    } catch (error) {
+      await this.safeWarning(task, "dependency", error);
+    }
+  }
+  /**
+   * Detects whether a still-waiting task sits on a dependency cycle.
+   *
+   * @param task Exact pending task snapshot.
+   * @returns True when following `dependencies` edges reaches the task again.
+   * @remarks Bounded; unrelated cycles are ignored by the visited set.
+   */
+  async hasDependencyCycle(task) {
+    const MAX_READS = 1e3;
+    const visited = /* @__PURE__ */ new Set();
+    const stack = [...task.dependencies ?? []];
+    let reads = 0;
+    while (stack.length > 0) {
+      const currentId = stack.pop();
+      if (currentId === task.id) return true;
+      if (visited.has(currentId)) continue;
+      if (reads >= MAX_READS) return false;
+      visited.add(currentId);
+      reads += 1;
+      let dependency;
+      try {
+        dependency = snapshotTaskItem(await this.deps.tasks.getById(task.tenantId, currentId));
+      } catch {
+        return false;
+      }
+      if (!dependency) continue;
+      for (const next of dependency.dependencies ?? []) stack.push(next);
+    }
+    return false;
+  }
+  /**
+   * Converges a task stuck on a dependency cycle to a durable failure.
+   *
+   * @param task Exact pending task snapshot on the cycle.
+   */
+  async convergeDependencyCycle(task) {
+    if (this.disposed) return;
+    try {
+      const result = await this.runBridge.settleRun({
+        tenantId: task.tenantId,
+        task,
+        actor: SYSTEM_ACTOR2,
+        outcome: {
+          kind: "failed",
+          lifecycleHandled: false,
+          error: `Dependency cycle: ${(task.dependencies ?? []).join(", ")}`
+        }
+      });
+      if (!result.success && result.code !== "TASK_STATUS_CONFLICT") {
+        await this.safeWarning(task, "dependency-cycle", `${result.code ?? "LIFECYCLE_REJECTED"}: ${result.error ?? "dependency cycle"}`);
+      }
+    } catch (error) {
+      await this.safeWarning(task, "dependency-cycle", error);
+    }
+  }
   async checkLifecycle(task, phase, result) {
     if (result.success) return;
     await this.safeWarning(task, phase, `${result.code ?? "LIFECYCLE_REJECTED"}: ${result.error ?? "Lifecycle rejected"}`);
@@ -17446,16 +18399,25 @@ var ProjectTaskObserver = class {
   async runOverflowReconciliations() {
     while (!this.disposed && this.overflowScopes.size > 0) {
       const entries = [...this.overflowScopes.entries()];
-      for (const [, { event }] of entries) await this.persistOverflowWarning(event);
+      const applicable = [];
+      for (const [key, scope] of entries) {
+        const task = snapshotTaskItem(await this.deps.tasks.getById(scope.event.tenantId, scope.event.taskId));
+        if (!task || !isProjectLifecycleTask(task) || task.workspaceId !== scope.event.workspaceId || task.projectId !== scope.event.projectId) {
+          if (this.overflowScopes.get(key)?.generation === scope.generation) this.overflowScopes.delete(key);
+          continue;
+        }
+        applicable.push([key, scope]);
+      }
+      for (const [, { event }] of applicable) await this.persistOverflowWarning(event);
       while (this.notificationTails.size > 0) await Promise.allSettled([...this.notificationTails.values()]);
-      for (const [key, { event, generation }] of entries) {
+      for (const [key, { event, generation }] of applicable) {
         await this.reconcileOverflowScope(event);
         if (this.overflowScopes.get(key)?.generation === generation) this.overflowScopes.delete(key);
       }
     }
   }
   async persistOverflowWarning(event) {
-    const scopeDigest = createHash5("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
+    const scopeDigest = createHash6("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
     try {
       await this.deps.workItems.createIfAbsentByEventKey({
         tenantId: event.tenantId,
@@ -17514,7 +18476,7 @@ var ProjectTaskObserver = class {
   }
 };
 function machineScope(task) {
-  if (!task.projectId || task.projectId === "default" || task.ownerType !== "agent") {
+  if (!task.projectId || task.ownerType !== "agent") {
     throw new Error("Invalid Project task machine scope");
   }
   return { tenantId: task.tenantId, assistantId: task.ownerId, projectId: task.projectId };
@@ -17564,8 +18526,7 @@ function combineSignals(left, right) {
 }
 
 // src/services/collaboration/RoomProjectionService.ts
-import { createHash as createHash6 } from "crypto";
-import { isProjectLifecycleTask as isProjectLifecycleTask5 } from "@axiom-lattice/core";
+import { createHash as createHash7 } from "crypto";
 import {
   PROJECT_ROOM_TASK_DELEGATED_LABEL,
   PROJECT_ROOM_TASK_DELEGATED_SEPARATOR,
@@ -17715,7 +18676,7 @@ var RoomProjectionService = class {
           await this.warning("INVALID_PROJECTABLE_EVENT", { taskId: row.taskId, eventKey: row.eventKey }, input);
           continue;
         }
-        if (task.ownerType !== "agent" || !isProjectLifecycleTask5(task)) {
+        if (task.ownerType !== "agent" || !isProjectLifecycleTask(task)) {
           result.skipped += 1;
           continue;
         }
@@ -17760,7 +18721,7 @@ var RoomProjectionService = class {
 };
 function snapshotProjectTask(value) {
   const task = snapshotTaskItem(value);
-  return task && task.ownerType === "agent" && isProjectLifecycleTask5(task) ? task : void 0;
+  return task && task.ownerType === "agent" && isProjectLifecycleTask(task) ? task : void 0;
 }
 function ownEnumerableString(value, key) {
   try {
@@ -17786,7 +18747,7 @@ function safeRepairIdentity(value, scope) {
   return taskId && eventKey && tenantId === scope.tenantId && workspaceId === scope.workspaceId && projectId === scope.projectId ? { taskId, eventKey } : void 0;
 }
 function tupleKey(prefix, values) {
-  const digest = createHash6("sha256").update(JSON.stringify(values)).digest("hex");
+  const digest = createHash7("sha256").update(JSON.stringify(values)).digest("hex");
   return `${prefix}:${digest}`;
 }
 function parseProjectionInput(taskValue, itemValue) {
@@ -17956,7 +18917,7 @@ function isRecord3(value) {
 import { taskLifecycleNotifier } from "@axiom-lattice/core";
 
 // src/services/collaboration/ProjectRoomEventBroker.ts
-import { randomUUID as randomUUID21 } from "crypto";
+import { randomUUID as randomUUID22 } from "crypto";
 import {
   parseProjectRoomEventId,
   ProjectRoomBrokerCapacityError,
@@ -17985,7 +18946,7 @@ var ProjectRoomEventBroker = class {
     this.subscriberCount = 0;
     this.usageClock = 0;
     this.closed = false;
-    this.epoch = options.epoch ?? randomUUID21();
+    this.epoch = options.epoch ?? randomUUID22();
     if (!UUID_PATTERN.test(this.epoch)) {
       throw new TypeError("Project Room event epoch must be a lowercase canonical UUID");
     }
@@ -18303,7 +19264,7 @@ function snapshotJson(value, ancestors = /* @__PURE__ */ new Set()) {
 }
 
 // src/services/collaboration/ProjectRoomRealtimePublisher.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import {
   projectRoomUserEventScope,
   snapshotExactRecord as snapshotExactRecord11,
@@ -18425,7 +19386,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     try {
       event = build();
       if (!event) throw new Error("Invalid Project Room realtime projection");
-      const dedupeKey = createHash7("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
+      const dedupeKey = createHash8("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
       if (this.sourceKeys.has(dedupeKey)) return;
       this.deps.broker.publish(event.scope, event.draft);
       this.sourceKeys.set(dedupeKey, true);
@@ -18479,7 +19440,6 @@ function safeErrorCode(error) {
 }
 
 // src/services/collaboration/ProjectRoomTaskEventSubscriber.ts
-import { isProjectLifecycleTask as isProjectLifecycleTask6 } from "@axiom-lattice/core";
 import { snapshotExactRecord as snapshotExactRecord12 } from "@axiom-lattice/protocols";
 var ProjectRoomTaskEventSubscriber = class {
   /** Creates a bounded Project task lifecycle observer. */
@@ -18562,8 +19522,8 @@ var ProjectRoomTaskEventSubscriber = class {
     try {
       const taskValue = await this.deps.tasks.getById(event.tenantId, event.taskId);
       const task = taskValue === null ? void 0 : snapshotTaskItem(taskValue);
-      if (this.closed) return;
-      if (!task || !isProjectLifecycleTask6(task) || task.tenantId !== event.tenantId || task.workspaceId !== event.workspaceId || task.projectId !== event.projectId || task.status !== event.status || task.updatedAt.toISOString() !== event.updatedAt || event.threadId !== void 0 && task.context?.thread_id !== event.threadId) {
+      if (this.closed || !task || !isProjectLifecycleTask(task)) return;
+      if (task.tenantId !== event.tenantId || task.workspaceId !== event.workspaceId || task.projectId !== event.projectId || task.status !== event.status || task.updatedAt.toISOString() !== event.updatedAt || event.threadId !== void 0 && task.context?.thread_id !== event.threadId) {
         this.warn("project-room:task-event-stale", { taskId: safeId3(event.taskId), eventKey: safeId3(event.eventKey) });
         return;
       }
@@ -19372,20 +20332,163 @@ async function validateReassignmentThread(threads, input) {
     throw new ProjectTaskThreadError("PROJECT_TASK_THREAD_METADATA_INVALID", "Invalid reassignment Task Thread metadata");
   }
 }
+function hookErrorMessage(error) {
+  if (error instanceof Error && error.message) return error.message;
+  return "Managed dispatch transfer failed.";
+}
+function wrapReassignmentThreadError(error) {
+  if (error instanceof ProjectTaskThreadError) {
+    if (error.code === "PROJECT_TASK_THREAD_SCOPE_INVALID") {
+      return new ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", error.message, {
+        hint: "Project task, room, or roster scope changed; re-read the task and retry."
+      });
+    }
+    if (error.code === "PROJECT_TASK_THREAD_OWNER_INVALID") {
+      return new ManagedTaskStartError("TASK_REASSIGN_NO_CHANGE", error.message, {
+        hint: "The target already owns this task; re-read before dispatching."
+      });
+    }
+    return new ManagedTaskStartError("TASK_THREAD_CONFLICT", error.message, {
+      hint: "Task Thread changed concurrently; re-read the task and retry."
+    });
+  }
+  return new ManagedTaskStartError("TASK_EXECUTION_ENQUEUE_FAILED", hookErrorMessage(error), {
+    hint: "Re-read the task and retry the dispatch."
+  });
+}
+function wrapReassignmentAuthorizationError(error) {
+  if (error instanceof ProjectTaskOwnerPolicyError2) {
+    if (error.code === "PROJECT_TASK_CALLER_INACTIVE") {
+      return new ManagedTaskStartError("PROJECT_TASK_CALLER_INACTIVE", error.message, {
+        hint: "Dispatch from an active Project Room member bot."
+      });
+    }
+    return new ManagedTaskStartError("PROJECT_TASK_OWNER_INACTIVE", error.message, {
+      hint: "Dispatch to an active bot in this Project's roster."
+    });
+  }
+  return new ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", hookErrorMessage(error), {
+    hint: "Re-read the task and roster, then retry the dispatch."
+  });
+}
+function reassignmentFailureHint(code) {
+  if (code === "TASK_THREAD_CONFLICT") {
+    return "Task Thread changed concurrently; re-read the task and retry.";
+  }
+  if (code === "TASK_REASSIGN_NO_CHANGE") {
+    return "The target already owns this task; re-read before dispatching.";
+  }
+  if (code === "TASK_STATUS_CONFLICT") {
+    return "Task changed concurrently; re-read the task and retry.";
+  }
+  if (code === "TASK_TERMINAL") {
+    return "Terminal tasks are immutable; create a new task for this work.";
+  }
+  if (code === "REVIEW_APPROVAL_REQUIRED") {
+    return "Resolve the review decision (approve/reject) before dispatching.";
+  }
+  if (code === "TASK_REASSIGN_INTERRUPT_REQUIRED") {
+    return "Resume or cancel the running task before dispatching.";
+  }
+  return "Re-read the task and retry the dispatch.";
+}
+async function transferGovernedDispatchOwner(task, options, deps) {
+  const agentId = options?.agentId;
+  if (!agentId || agentId === task.ownerId) return void 0;
+  if (!task.workspaceId || !task.projectId) {
+    throw new ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Task is not governed by a Project lifecycle.", {
+      hint: "Dispatch governed tasks from a trusted Project run; ordinary tasks execute immediately."
+    });
+  }
+  return deps.mutex.runExclusive({ tenantId: task.tenantId, projectId: task.projectId }, async () => {
+    const current = await deps.tasks.getById(task.tenantId, task.id);
+    if (!current || !isProjectLifecycleTask(current) || current.workspaceId !== task.workspaceId || current.projectId !== task.projectId) {
+      throw new ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Task is no longer a Project lifecycle task.", {
+        hint: "Re-read the task and confirm it still belongs to this Project before dispatching."
+      });
+    }
+    if (current.ownerType !== "agent") {
+      throw new ManagedTaskStartError("AGENT_TASK_REQUIRED", "Project task owner must be an Agent.", {
+        hint: "Assign the task to an Agent before dispatching."
+      });
+    }
+    if (current.status !== "pending") {
+      throw new ManagedTaskStartError("TASK_NOT_DISPATCHABLE", "Only a `pending` Project task can be dispatched.", {
+        hint: `This task is '${current.status}'. Resolve it or create a new task before dispatching.`
+      });
+    }
+    if (agentId === current.ownerId) return current;
+    const room = await deps.rooms.getMainRoom(current.tenantId, current.projectId);
+    if (!room || room.tenantId !== current.tenantId || room.workspaceId !== current.workspaceId || room.projectId !== current.projectId || room.type !== "main") {
+      throw new ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Project main room is unavailable.", {
+        hint: "Open or repair the Project Room before dispatching."
+      });
+    }
+    const target = await deps.botMemberships.findByAssistant(current.tenantId, current.projectId, agentId);
+    if (!target || target.status !== "active" || target.tenantId !== current.tenantId || target.workspaceId !== current.workspaceId || target.projectId !== current.projectId || target.assistantId !== agentId || target.roomId !== room.id) {
+      throw new ManagedTaskStartError("PROJECT_TASK_OWNER_INACTIVE", "Target Project task owner is not active in the exact roster.", {
+        hint: "Dispatch to an active bot in this Project's roster."
+      });
+    }
+    const caller = options?.callerMembershipId ? await deps.botMemberships.findById(current.tenantId, options.callerMembershipId) : null;
+    if (!caller || !options?.callerAssistantId || caller.id !== options.callerMembershipId || caller.assistantId !== options.callerAssistantId || caller.status !== "active" || caller.tenantId !== current.tenantId || caller.workspaceId !== current.workspaceId || caller.projectId !== current.projectId || caller.roomId !== room.id) {
+      throw new ManagedTaskStartError("PROJECT_TASK_CALLER_INACTIVE", "Current Project task caller is not active in the exact roster.", {
+        hint: "Dispatch from an active Project Room member bot."
+      });
+    }
+    let ensured;
+    try {
+      ensured = await deps.threads.ensure({ task: current, room, membership: target, mode: "reassignment" });
+    } catch (error) {
+      throw wrapReassignmentThreadError(error);
+    }
+    let authorization;
+    try {
+      authorization = await deps.reassignmentAuthorizer.authorize({
+        tenantId: current.tenantId,
+        workspaceId: current.workspaceId,
+        projectId: current.projectId,
+        roomId: room.id,
+        taskId: current.id,
+        callerMembershipId: caller.id,
+        callerAssistantId: caller.assistantId,
+        targetMembershipId: target.id,
+        targetAssistantId: target.assistantId,
+        ...typeof current.context?.thread_id === "string" ? { expectedThreadId: current.context.thread_id } : {},
+        newThreadId: ensured.thread.id
+      });
+    } catch (error) {
+      throw wrapReassignmentAuthorizationError(error);
+    }
+    const result = await deps.lifecycle.reassignProjectTask({
+      tenantId: current.tenantId,
+      taskId: current.id,
+      authorization,
+      actor: `agent:${caller.assistantId}`
+    });
+    if (!result.success) {
+      throw new ManagedTaskStartError(result.code, result.error, {
+        hint: result.hint ?? reassignmentFailureHint(result.code),
+        ...result.retryable !== void 0 ? { retryable: result.retryable } : {}
+      });
+    }
+    return result.task;
+  });
+}
 var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
-  const webAppStore = getStoreLattice16("default", "agentWebApp").store;
-  const assistantStore = getStoreLattice16("default", "assistant").store;
-  const projectStore = getStoreLattice16("default", "project").store;
-  const projectMembershipStore = getStoreLattice16("default", "projectMembership").store;
-  const userTenantLinkStore = getStoreLattice16("default", "userTenantLink").store;
-  const projectRoomStore = getStoreLattice16("default", "projectRoom").store;
-  const projectBotMembershipStore = getStoreLattice16("default", "projectBotMembership").store;
-  const projectRoomMessageStore = getStoreLattice16("default", "projectRoomMessage").store;
-  const projectRoomReadStateStore = getStoreLattice16("default", "projectRoomReadState").store;
-  const userPushSubscriptionStore = getStoreLattice16("default", "userPushSubscription").store;
-  const threadStore = getStoreLattice16("default", "thread").store;
-  const taskStore = getStoreLattice16("default", "task").store;
-  const taskWorkItemStore = getStoreLattice16("default", "taskWorkItem").store;
+  const webAppStore = getStoreLattice17("default", "agentWebApp").store;
+  const assistantStore = getStoreLattice17("default", "assistant").store;
+  const projectStore = getStoreLattice17("default", "project").store;
+  const projectMembershipStore = getStoreLattice17("default", "projectMembership").store;
+  const userTenantLinkStore = getStoreLattice17("default", "userTenantLink").store;
+  const projectRoomStore = getStoreLattice17("default", "projectRoom").store;
+  const projectBotMembershipStore = getStoreLattice17("default", "projectBotMembership").store;
+  const projectRoomMessageStore = getStoreLattice17("default", "projectRoomMessage").store;
+  const projectRoomReadStateStore = getStoreLattice17("default", "projectRoomReadState").store;
+  const userPushSubscriptionStore = getStoreLattice17("default", "userPushSubscription").store;
+  const threadStore = getStoreLattice17("default", "thread").store;
+  const taskStore = getStoreLattice17("default", "task").store;
+  const taskWorkItemStore = getStoreLattice17("default", "taskWorkItem").store;
   const projectTaskEnabled = options.projectTaskEnabled ?? process.env.AXIOM_PROJECT_TASK_EXECUTION_ENABLED !== "false";
   const accessService = new ProjectAccessService({ projectStore, membershipStore: projectMembershipStore, userTenantLinkStore });
   const realtimeMode = resolveProjectRoomRealtimeMode();
@@ -19451,7 +20554,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     updateAssistant: assistantStore.updateAssistant.bind(assistantStore)
   });
   const resolveCoordinatorMentionName = async (tenantId) => {
-    const tenant2 = await getStoreLattice16("default", "tenant").store.getTenantById(tenantId);
+    const tenant2 = await getStoreLattice17("default", "tenant").store.getTenantById(tenantId);
     const value = tenant2?.metadata?.coordinatorMentionName;
     return typeof value === "string" && value.length > 0 ? value : void 0;
   };
@@ -19542,7 +20645,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     });
   }
   if (projectTaskComposition) app2.addHook("onClose", async () => projectTaskComposition.lease.release());
-  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID22 });
+  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID23 });
   const taskLifecycle = projectTaskComposition?.lease.runtime.lifecycle ?? createTaskLifecycleService({ taskStore, workItemStore: taskWorkItemStore });
   const reassignmentAuthorizer = createProjectTaskReassignmentAuthorizer(
     new ProjectTaskOwnerPolicy(projectBotMembershipStore),
@@ -19578,7 +20681,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     readStateService,
     interruptService: roomInterruptService,
     userDirectory: {
-      getUserById: (id3) => getStoreLattice16("default", "user").store.getUserById(id3).then((u) => u ? { name: u.name } : null)
+      getUserById: (id3) => getStoreLattice17("default", "user").store.getUserById(id3).then((u) => u ? { name: u.name } : null)
     }
   });
   registerProjectRosterRoutes(app2, { service: rosterService });
@@ -19589,7 +20692,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       createProject: projectStore.createProject.bind(projectStore)
     },
     workspaceStore: {
-      getWorkspaceById: (tenantId, id3) => getStoreLattice16("default", "workspace").store.getWorkspaceById(tenantId, id3)
+      getWorkspaceById: (tenantId, id3) => getStoreLattice17("default", "workspace").store.getWorkspaceById(tenantId, id3)
     },
     membershipStore: {
       list: projectMembershipStore.list.bind(projectMembershipStore),
@@ -19612,7 +20715,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       getUsersByTenant: userTenantLinkStore.getUsersByTenant.bind(userTenantLinkStore)
     },
     userStore: {
-      getUserById: (id3) => getStoreLattice16("default", "user").store.getUserById(id3).then((u) => u ? { id: u.id, name: u.name, email: u.email } : null)
+      getUserById: (id3) => getStoreLattice17("default", "user").store.getUserById(id3).then((u) => u ? { id: u.id, name: u.name, email: u.email } : null)
     },
     assistantStore: {
       getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
@@ -19634,7 +20737,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     }
   });
   registerCapabilityBundleRoutes(app2, new CapabilityBundleController({
-    bundleStore: getStoreLattice16("default", "capabilityBundle").store,
+    bundleStore: getStoreLattice17("default", "capabilityBundle").store,
     projectStore
   }, { authRequired: process.env.AUTH_REQUIRED === "true" }));
   registerAgentWebAppRoutes(app2, {
@@ -19682,19 +20785,11 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       },
       tasks: taskStore,
       workItems: taskWorkItemStore,
-      bots: projectBotMembershipStore,
-      rooms: projectRoomStore,
-      threadService: taskThreadService,
-      reassignmentAuthorizer,
-      lifecycle: taskLifecycle,
-      projectMutationMutex: projectMutationMutex2,
-      executionMutex: projectTaskComposition?.mutex ?? {
-        runExclusive: (_scope, operation) => operation()
-      }
+      projectMutationMutex: projectMutationMutex2
     }),
     service: new AgentWebAppRuntimeService({
       webAppStore,
-      threadStore: getStoreLattice16("default", "thread").store,
+      threadStore: getStoreLattice17("default", "thread").store,
       projectStore,
       assistantResolver: {
         resolve: async (tenantId, assistantId) => {
@@ -19795,19 +20890,45 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
   app2.post("/api/personal-assistant", createPersonalAssistant);
   app2.get("/api/personal-assistant", getPersonalAssistant);
   app2.delete("/api/personal-assistant", deletePersonalAssistant);
+  executionAuthorityRegistry.register({
+    id: "project-lifecycle",
+    matches: isProjectLifecycleTask,
+    code: "PROJECT_TASK_EXECUTION_MANAGED",
+    message: "Project tasks are executed by the durable Project queue runtime",
+    onManagedStart: async (task, options2) => {
+      if (!projectTaskComposition && options2?.agentId && options2.agentId !== task.ownerId) {
+        throw new ManagedTaskStartError(
+          "PROJECT_TASK_RUNTIME_UNAVAILABLE",
+          "Project task ownership transfer requires the Project task runtime.",
+          { hint: "Project task execution is disabled; enable the Project task runtime or dispatch to the current owner." }
+        );
+      }
+      const transferred = projectTaskComposition ? await transferGovernedDispatchOwner(task, options2, {
+        tasks: taskStore,
+        rooms: projectRoomStore,
+        botMemberships: projectBotMembershipStore,
+        threads: taskThreadService,
+        reassignmentAuthorizer,
+        lifecycle: taskLifecycle,
+        mutex: projectMutationMutex2
+      }) : void 0;
+      const admitted = transferred ?? task;
+      if (!admitted.workspaceId || !admitted.projectId) return;
+      void projectTaskAdmissionNotifier.publish({
+        tenantId: admitted.tenantId,
+        workspaceId: admitted.workspaceId,
+        projectId: admitted.projectId,
+        taskId: admitted.id,
+        ownerId: admitted.ownerId,
+        updatedAt: admitted.updatedAt.toISOString()
+      });
+    }
+  });
   registerTaskRoutes(app2, createTaskController({
     access: accessService,
     tasks: taskStore,
     workItems: taskWorkItemStore,
-    bots: projectBotMembershipStore,
-    rooms: projectRoomStore,
-    threadService: taskThreadService,
-    reassignmentAuthorizer,
-    lifecycle: taskLifecycle,
     projectMutationMutex: projectMutationMutex2,
-    executionMutex: projectTaskComposition?.mutex ?? {
-      runExclusive: (_scope, operation) => operation()
-    },
     readableProjects: async ({ tenantId, userId, workspaceId }) => {
       const projects = await projectStore.getProjectsByWorkspace(tenantId, workspaceId);
       const readable = [];
@@ -19931,6 +21052,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     executeDataQuery
   );
   registerMcpServerConfigRoutes(app2);
+  registerMcpAppRoutes(app2);
   registerPushNotificationRoutes(app2, {
     subscriptionStore: userPushSubscriptionStore,
     vapidPublicKey: process.env.VAPID_PUBLIC_KEY || null
@@ -20087,9 +21209,9 @@ function tryCreateProjectTaskRuntime(input) {
   let stores;
   try {
     stores = {
-      tenants: getStoreLattice16("default", "tenant").store,
-      workspaces: getStoreLattice16("default", "workspace").store,
-      queue: getStoreLattice16("default", "threadMessageQueue").store
+      tenants: getStoreLattice17("default", "tenant").store,
+      workspaces: getStoreLattice17("default", "workspace").store,
+      queue: getStoreLattice17("default", "threadMessageQueue").store
     };
     const missing = missingRuntimeMethod(input, stores);
     if (missing) return { reason: missing };
@@ -20120,7 +21242,7 @@ function tryCreateProjectTaskRuntime(input) {
 function createRuntime(input, stores, log2) {
   const controller = new AbortController();
   const mutex = new ProjectTaskExecutionMutex();
-  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID22 });
+  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID23 });
   const lifecycle = createTaskLifecycleService({ taskStore: input.taskStore, workItemStore: input.taskWorkItemStore });
   const projection = new RoomProjectionService({
     messages: input.projectRoomMessageStore,
@@ -20129,7 +21251,7 @@ function createRuntime(input, stores, log2) {
     warnings: input.taskWorkItemStore,
     log: log2,
     realtime: input.realtime,
-    idFactory: randomUUID22
+    idFactory: randomUUID23
   });
   const agentFor = (task, thread) => agentInstanceManager6.getAgent({
     tenant_id: task.tenantId,
@@ -20173,7 +21295,7 @@ function createRuntime(input, stores, log2) {
     void observer.listener(event);
   });
   const unsubscribe = taskLifecycleNotifier2.subscribe(taskLifecycleListener);
-  const unsubscribeAdmission = projectTaskAdmissionNotifier2.subscribe((event, signal) => {
+  const unsubscribeAdmission = projectTaskAdmissionNotifier.subscribe((event, signal) => {
     observer.admit(event, signal);
   });
   let reconciliationWork;
@@ -20466,9 +21588,9 @@ var skillRegistration = {
 };
 
 // src/export_registrations/agent.registration.ts
-import { getStoreLattice as getStoreLattice17 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice18 } from "@axiom-lattice/core";
 function getStore2() {
-  return getStoreLattice17("default", "assistant").store;
+  return getStoreLattice18("default", "assistant").store;
 }
 var agentRegistration = {
   entityType: "agent",
@@ -20548,9 +21670,9 @@ var agentRegistration = {
 };
 
 // src/export_registrations/database-config.registration.ts
-import { getStoreLattice as getStoreLattice18 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
 function getStore3() {
-  return getStoreLattice18("default", "database").store;
+  return getStoreLattice19("default", "database").store;
 }
 var databaseConfigRegistration = {
   entityType: "database_config",
@@ -20630,9 +21752,9 @@ var databaseConfigRegistration = {
 };
 
 // src/export_registrations/metrics-config.registration.ts
-import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice20 } from "@axiom-lattice/core";
 function getStore4() {
-  return getStoreLattice19("default", "metrics").store;
+  return getStoreLattice20("default", "metrics").store;
 }
 var metricsConfigRegistration = {
   entityType: "metrics_config",
@@ -20712,9 +21834,9 @@ var metricsConfigRegistration = {
 };
 
 // src/export_registrations/mcp-config.registration.ts
-import { getStoreLattice as getStoreLattice20 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice21 } from "@axiom-lattice/core";
 function getStore5() {
-  return getStoreLattice20("default", "mcp").store;
+  return getStoreLattice21("default", "mcp").store;
 }
 var mcpConfigRegistration = {
   entityType: "mcp_config",
@@ -20797,9 +21919,9 @@ var mcpConfigRegistration = {
 };
 
 // src/export_registrations/connection.registration.ts
-import { getStoreLattice as getStoreLattice21 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice22 } from "@axiom-lattice/core";
 function getStore6() {
-  return getStoreLattice21("default", "connection").store;
+  return getStoreLattice22("default", "connection").store;
 }
 async function listAllConnections(tenantId) {
   const store = getStore6();
@@ -20881,9 +22003,9 @@ var connectionRegistration = {
 };
 
 // src/export_registrations/collection.registration.ts
-import { getStoreLattice as getStoreLattice22 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
 function getStore7() {
-  return getStoreLattice22("default", "collection").store;
+  return getStoreLattice23("default", "collection").store;
 }
 var collectionRegistration = {
   entityType: "collection",
@@ -20954,8 +22076,8 @@ var collectionRegistration = {
 };
 
 // src/export_registrations/channel-installation.registration.ts
-import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID23 } from "crypto";
+import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
+import { randomUUID as randomUUID24 } from "crypto";
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var PUBLIC_CHANNELS = /* @__PURE__ */ new Set(["lark", "email", "slack", "wechat"]);
 function isPublicChannel(channel) {
@@ -20988,7 +22110,7 @@ function validateImportData(data) {
   };
 }
 function getStore8() {
-  return getStoreLattice23("default", "channelInstallation").store;
+  return getStoreLattice24("default", "channelInstallation").store;
 }
 function getOverwriteError(tenantId, incomingChannel, existing) {
   if (!existing) return "Channel installation overwrite target must exist";
@@ -21114,7 +22236,7 @@ var channelInstallationRegistration = {
       }
       id3 = sourceId;
     } else {
-      id3 = randomUUID23();
+      id3 = randomUUID24();
     }
     await store.createInstallation(tenantId, id3, createInput);
     return { newId: id3 };
@@ -21122,9 +22244,9 @@ var channelInstallationRegistration = {
 };
 
 // src/export_registrations/menu.registration.ts
-import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice25 } from "@axiom-lattice/core";
 function getStore9() {
-  return getStoreLattice24("default", "menu").store;
+  return getStoreLattice25("default", "menu").store;
 }
 var menuRegistration = {
   entityType: "menu",
@@ -21202,9 +22324,9 @@ var menuRegistration = {
 };
 
 // src/export_registrations/eval.registration.ts
-import { getStoreLattice as getStoreLattice25 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice26 } from "@axiom-lattice/core";
 function getStore10() {
-  return getStoreLattice25("default", "eval").store;
+  return getStoreLattice26("default", "eval").store;
 }
 var evalRegistration = {
   entityType: "eval",
@@ -21982,11 +23104,12 @@ import {
   getLoggerLattice,
   loggerLatticeManager,
   sandboxLatticeManager as sandboxLatticeManager2,
-  getStoreLattice as getStoreLattice27,
+  getStoreLattice as getStoreLattice28,
   agentInstanceManager as agentInstanceManager9,
   createSandboxProvider,
   TokenCache,
-  mcpManager,
+  mcpManager as mcpManager3,
+  convertToConnection as convertToConnection2,
   createTrustedAgentMessageDispatcher as createTrustedAgentMessageDispatcher2
 } from "@axiom-lattice/core";
 
@@ -21995,14 +23118,14 @@ import { RoomAgentMessageService } from "@axiom-lattice/core";
 
 // src/router/MessageRouter.ts
 import {
-  getStoreLattice as getStoreLattice26,
+  getStoreLattice as getStoreLattice27,
   agentInstanceManager as agentInstanceManager8
 } from "@axiom-lattice/core";
 import {
   snapshotExactArray as snapshotExactArray3,
   snapshotExactRecord as snapshotExactRecord15
 } from "@axiom-lattice/protocols";
-import { randomUUID as randomUUID24 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 var BindingNotFoundError = class extends Error {
   constructor(message) {
     super(message);
@@ -22095,7 +23218,7 @@ function validateRoomTrustedDispatch(message, options, binding, agentId) {
     "inputMessageId",
     "role",
     "title"
-  ], ["responsibility"]);
+  ], ["responsibility", "source"]);
   if (!binding || !targetEnvelope || !target || !context || !authority || typeof authority.expectedRoomThreadId !== "string" || authority.expectedRoomThreadId.length === 0 || trusted?.executionMode !== "followup") return false;
   const expectedSender = `room:${context.roomId}:membership:${context.membershipId}`;
   return targetEnvelope.adapterChannel === "room" && targetEnvelope.channelInstallationId === message.channelInstallationId && target.sourceRoomMessageId === context.sourceRoomMessageId && target.targetMembershipId === context.membershipId && target.inputMessageId === context.inputMessageId && message.tenantId === context.tenantId && message.sender.id === expectedSender && message.conversation?.id === context.roomId && message.conversation?.type === "group" && binding.tenantId === context.tenantId && binding.channel === "room" && binding.channelInstallationId === message.channelInstallationId && binding.senderId === expectedSender && binding.agentId === context.assistantId && binding.workspaceId === context.workspaceId && binding.projectId === context.projectId && binding.threadId === authority.expectedRoomThreadId && binding.threadMode === "fixed" && agentId === context.assistantId;
@@ -22286,7 +23409,7 @@ var MessageRouter = class {
             channel: message.channel,
             adapterChannel: adapter.channel
           }, "Thread resolved by adapter strategy");
-          const threadStore = getStoreLattice26("default", "thread").store;
+          const threadStore = getStoreLattice27("default", "thread").store;
           try {
             await threadStore.createThread(
               tenantId,
@@ -22323,8 +23446,8 @@ var MessageRouter = class {
           }
         }
         if (!threadId) {
-          const threadStore = getStoreLattice26("default", "thread").store;
-          const newThreadId = randomUUID24();
+          const threadStore = getStoreLattice27("default", "thread").store;
+          const newThreadId = randomUUID25();
           console.log({
             event: "dispatch:thread:create",
             agentId,
@@ -22370,7 +23493,7 @@ var MessageRouter = class {
           workspace_id: binding?.workspaceId || "",
           project_id: binding?.projectId || ""
         });
-        const inputMessageId = randomUUID24();
+        const inputMessageId = randomUUID25();
         const replyTarget = internalRoom ? correlatedRoomReplyTarget(message.replyTarget, inputMessageId) : message.replyTarget;
         const replyAdapter = replyTarget ? this.adapterRegistry.get(replyTarget.adapterChannel) : void 0;
         if (options.trustedMessageOptions && (!this.trustedDispatcher || !replyTarget || !replyAdapter)) {
@@ -22406,9 +23529,13 @@ var MessageRouter = class {
             });
           }
         }
+        const metadata = message.content.metadata;
         const queueMessage = {
           input: { id: inputMessageId, message: message.content.text },
-          custom_run_config: message.content.metadata,
+          custom_run_config: {
+            ...metadata && typeof metadata === "object" && !Array.isArray(metadata) ? metadata : {},
+            channelRun: true
+          },
           ...resumeCommand ? { command: resumeCommand } : {}
         };
         let cleanupReplySubscription;
@@ -22786,35 +23913,49 @@ function getConfiguredSandboxProvider() {
 }
 async function restoreMcpConnections() {
   try {
-    const storeLattice = getStoreLattice27("default", "mcp");
+    const storeLattice = getStoreLattice28("default", "mcp");
     const store = storeLattice.store;
     if (!store) {
       logger5.info("MCP store not configured, skipping connection restoration");
       return;
     }
-    const configs = await store.getAllConfigs("default");
-    const connectedConfigs = configs.filter((c2) => c2.status === "connected");
-    if (connectedConfigs.length === 0) return;
-    logger5.info(`Restoring ${connectedConfigs.length} MCP server connections...`);
-    const { convertToConnection } = await import("./mcp-configs-WCY5EXCW.mjs");
-    for (const config of connectedConfigs) {
+    const configs = (await store.getAllConfigsWithoutTenant()).filter(
+      (c2) => c2.status === "connected"
+    );
+    if (configs.length === 0) return;
+    logger5.info(`Restoring ${configs.length} MCP server connections...`);
+    for (const config of configs) {
       try {
-        const connection = convertToConnection(config.config);
-        mcpManager.addServer(config.key, connection);
+        const connection = convertToConnection2(config.config);
+        mcpManager3.registerServer(config.tenantId, config.key, connection, {
+          timeoutMs: config.config.timeout,
+          maxAttempts: config.config.retryAttempts,
+          selectedTools: config.selectedTools
+        });
       } catch (err) {
-        logger5.warn(`Failed to prepare MCP server "${config.key}" for restoration`, { error: err });
+        logger5.warn(`Failed to prepare MCP server "${config.tenantId}/${config.key}"`, { error: err });
       }
     }
-    await mcpManager.connect();
-    for (const config of connectedConfigs) {
-      try {
-        await mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
-        logger5.info(`MCP server "${config.key}" restored with ${config.selectedTools.length} tools`);
-      } catch (err) {
-        logger5.warn(`Failed to register tools for MCP server "${config.key}"`, { error: err });
+    await mcpManager3.connectAll();
+    const results = await Promise.allSettled(
+      configs.map(
+        (config) => mcpManager3.registerToolsToToolLattice(
+          config.tenantId,
+          config.key,
+          config.selectedTools
+        )
+      )
+    );
+    results.forEach((result, index) => {
+      if (result.status === "rejected") {
+        const config = configs[index];
+        logger5.warn(
+          `Failed to register tools for MCP server "${config.tenantId}/${config.key}"`,
+          { error: result.reason }
+        );
       }
-    }
-    logger5.info(`MCP connection restoration complete: ${connectedConfigs.length} servers`);
+    });
+    logger5.info(`MCP connection restoration complete: ${configs.length} servers`);
   } catch (err) {
     logger5.error("MCP connection restoration failed", { error: err });
   }
@@ -22836,9 +23977,9 @@ var start = async (config) => {
     let projectRoomRealtimeRuntime;
     if (projectRoomRealtimeMode === "single-gateway") {
       projectRoomRealtimeRuntime = createProjectRoomRealtimeRuntime({
-        tasks: getStoreLattice27("default", "task").store,
-        rooms: getStoreLattice27("default", "projectRoom").store,
-        memberships: getStoreLattice27("default", "projectBotMembership").store,
+        tasks: getStoreLattice28("default", "task").store,
+        rooms: getStoreLattice28("default", "projectRoom").store,
+        memberships: getStoreLattice28("default", "projectBotMembership").store,
         log: { warn: (message, context) => logger5.warn(message, context) }
       });
     }
@@ -22881,7 +24022,7 @@ var start = async (config) => {
     }
     setEvalRunService(evalRunner);
     try {
-      const menuStore = getStoreLattice27("default", "menu").store;
+      const menuStore = getStoreLattice28("default", "menu").store;
       setMenuRegistry(menuStore);
       logger5.info("Menu registry initialized");
     } catch {
@@ -22897,12 +24038,12 @@ var start = async (config) => {
     });
     try {
       const { A2AAuthService, parseEnvKeys } = await import("./A2AAuthService-7UGQ7GMW.mjs");
-      const { registerA2AStandardRoutes } = await import("./a2a-standard-ALXWP7V6.mjs");
+      const { registerA2AStandardRoutes } = await import("./a2a-standard-RWR5JTMH.mjs");
       const a2a = await import("./a2a-FGYX2HH3.mjs");
-      const a2aKeyStore = getStoreLattice27("default", "a2aApiKey").store;
-      const assistantStore = getStoreLattice27("default", "assistant").store;
-      const projectStore = getStoreLattice27("default", "project").store;
-      const taskStore = getStoreLattice27("default", "task").store;
+      const a2aKeyStore = getStoreLattice28("default", "a2aApiKey").store;
+      const assistantStore = getStoreLattice28("default", "assistant").store;
+      const projectStore = getStoreLattice28("default", "project").store;
+      const taskStore = getStoreLattice28("default", "task").store;
       const authService = new A2AAuthService({
         keyStore: a2aKeyStore,
         assistantStore,
@@ -22927,22 +24068,22 @@ var start = async (config) => {
       });
     }
     try {
-      const { registerOpenRoutes } = await import("./open-HH7RKGML.mjs");
-      const { registerOpenSessionRoutes } = await import("./open-session-3VN65PRR.mjs");
-      const { registerOpenCatalogRoutes } = await import("./open-catalog-WYS2AENM.mjs");
-      const { registerOpenFilesRoutes } = await import("./open-files-GVRMK5PL.mjs");
+      const { registerOpenRoutes } = await import("./open-AMEMJOFJ.mjs");
+      const { registerOpenSessionRoutes } = await import("./open-session-LBTCU3AE.mjs");
+      const { registerOpenCatalogRoutes } = await import("./open-catalog-SZQ435AY.mjs");
+      const { registerOpenFilesRoutes } = await import("./open-files-EJ6O2SGX.mjs");
       const { registerOpenAuditRoutes } = await import("./open-audit-UJ3NXCGW.mjs");
-      const { registerOpenExposureRoutes } = await import("./open-exposure-FK4G6O6L.mjs");
-      const { openLattice } = await import("./openLattice-GAAGQJST.mjs");
+      const { registerOpenExposureRoutes } = await import("./open-exposure-I44Q4M3T.mjs");
+      const { openLattice } = await import("./openLattice-Q6M5S6CY.mjs");
       const { createKbProvider } = await import("./kbProvider-2D6DZ34N.mjs");
       const { createOpenSandboxProvider } = await import("./sandboxProvider-I3P66VXT.mjs");
       const { createAgentProvider } = await import("./agentProvider-X4FVQPKW.mjs");
-      const { registerExposedPluginTools } = await import("./registerExposedPlugins-ZBOEHJYH.mjs");
+      const { registerExposedPluginTools } = await import("./registerExposedPlugins-6GCOE64C.mjs");
       const { CollectionService: CollectionService2 } = await import("./collection_service-RTRJEQFL.mjs");
       openLattice.register(createKbProvider(new CollectionService2()));
       openLattice.register(createOpenSandboxProvider());
-      const threadStore = getStoreLattice27("default", "thread").store;
-      const assistantStore = getStoreLattice27("default", "assistant").store;
+      const threadStore = getStoreLattice28("default", "thread").store;
+      const assistantStore = getStoreLattice28("default", "assistant").store;
       openLattice.register(
         createAgentProvider({
           threadStore,
@@ -22970,8 +24111,8 @@ var start = async (config) => {
       logger5.info("Registered sandbox manager from env configuration");
     }
     try {
-      const { ResourceController } = await import("./resources-JFKAPS45.mjs");
-      const sharedResourceStore = getStoreLattice27("default", "sharedResource").store;
+      const { ResourceController } = await import("./resources-DXPXAXEZ.mjs");
+      const sharedResourceStore = getStoreLattice28("default", "sharedResource").store;
       const cache = new TokenCache();
       const resourceController = new ResourceController({
         store: sharedResourceStore,