@cohortapp/agent-sdk 2.10.0 → 2.11.1

package/scripts/cost/track-claude-usage-pricing.test.mjs

@@ -0,0 +1,183 @@
+/**
+ * track-claude-usage-pricing.test.mjs — an unknown model must not be priced.
+ *
+ * WHAT BROKE
+ *   `estimateUsd()` ended `loadPrices()[model] || DEFAULT_PRICES.sonnet`. An
+ *   unknown model — a third-party backend, a retired catalog id, a typo in a
+ *   spawn flag — was silently priced at Sonnet's rate and written as a real
+ *   `estimated_usd`. lib/cost/ledger-row.mjs#billableUsd then reported
+ *   basis:"estimated", a MEASURED tier, and that laundered number flowed into
+ *   budget-guard's degrade/refuse band, fleet-digest, and the presence beat's
+ *   `machine.spend24h` — which peers and humans read as this seat's REAL spend.
+ *   A guessed price is a fabricated measurement of money.
+ *
+ * WHAT THESE TESTS PIN (end-to-end, through the real CLI)
+ *   1. GROUNDED — a model priced by a REAL source (the local tier table, or a
+ *      lib/model-router/catalog row with its cost_provenance stamp) still bills.
+ *   2. EMPTY — a model no real source prices writes `estimated_usd: null`, an
+ *      `unpriced_reason`, and lands in the UNKNOWN class as basis:"unpriced" —
+ *      the vocabulary lib/cost/ledger-row.mjs already has for exactly this case
+ *      — so it is imputed, not counted as a free session.
+ *
+ * Run: node --test scripts/cost/track-claude-usage-pricing.test.mjs
+ */
+
+"use strict";
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, copyFileSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { billableUsd, classifyRow, summariseRows, UNKNOWN } from "../../lib/cost/ledger-row.mjs";
+
+const CLI = new URL("./track-claude-usage.mjs", import.meta.url).pathname;
+
+/** Run `record` against a throwaway ledger dir and return {stdout, row}. */
+function record(root, args) {
+  const out = execFileSync(process.execPath, [CLI, "record", ...args], {
+    env: { ...process.env, AGENT_ROOT: root },
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  const dir = join(root, "state/cost-tracking");
+  const files = readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
+  const lines = readFileSync(join(dir, files[0]), "utf8").trim().split("\n");
+  return { stdout: JSON.parse(out), row: JSON.parse(lines[lines.length - 1]) };
+}
+
+// ── 1. GROUNDED ─────────────────────────────────────────────────────────────
+
+test("grounded: a tier alias in the local price table still bills", () => {
+  const root = mkdtempSync(join(tmpdir(), "cost-"));
+  const { stdout, row } = record(root, [
+    "--cadence", "inbox", "--model", "sonnet",
+    "--input-tokens", "1000", "--output-tokens", "500", "--exit", "0",
+  ]);
+  assert.equal(stdout.basis, "estimated");
+  assert.ok(row.estimated_usd > 0, "a real price produces a real figure");
+  assert.equal(row.unpriced_reason, undefined);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("grounded: a concrete catalog id is priced from lib/model-router/catalog", () => {
+  const root = mkdtempSync(join(tmpdir(), "cost-"));
+  const { stdout, row } = record(root, [
+    "--cadence", "inbox", "--model", "claude-opus-4-8",
+    "--input-tokens", "1000000", "--output-tokens", "0", "--exit", "0",
+  ]);
+  assert.equal(stdout.basis, "estimated");
+  // anthropic.yaml: claude-opus-4-8 input = $5.00/MTok. This is the catalog's
+  // own figure, not a family guess.
+  assert.equal(row.estimated_usd, 5);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("grounded: the CLI's authoritative total_cost_usd always wins", () => {
+  const root = mkdtempSync(join(tmpdir(), "cost-"));
+  const { stdout } = record(root, [
+    "--cadence", "inbox", "--model", "sonnet",
+    "--input-tokens", "16", "--output-tokens", "10", "--cache-read-tokens", "553181",
+    "--total-cost-usd", "0.533412", "--exit", "0",
+  ]);
+  assert.equal(stdout.basis, "authoritative");
+  assert.equal(stdout.billable_usd, 0.533412);
+  rmSync(root, { recursive: true, force: true });
+});
+
+// ── 2. EMPTY — no real price, no number ─────────────────────────────────────
+
+test("empty: an unknown model is UNPRICED, not silently billed at the Sonnet rate", () => {
+  const root = mkdtempSync(join(tmpdir(), "cost-"));
+  const { stdout, row } = record(root, [
+    "--cadence", "inbox", "--model", "some-vendor-model-v9",
+    "--input-tokens", "1000", "--output-tokens", "500", "--exit", "0",
+  ]);
+
+  assert.equal(row.estimated_usd, null, "no guessed figure is written");
+  assert.equal(row.total_cost_usd, undefined, "and none is invented");
+  assert.match(row.unpriced_reason, /no price for model "some-vendor-model-v9"/);
+
+  // The reader's verdict is the thing that matters downstream.
+  const { usd, basis } = billableUsd(row);
+  assert.equal(usd, null, "spend is UNKNOWN, not zero");
+  assert.equal(basis, "unpriced");
+  assert.equal(classifyRow(row), "measured");
+  assert.equal(billableUsd(row).cls, UNKNOWN, "it falls into the UNKNOWN class");
+  assert.equal(stdout.billable_usd, null);
+  assert.equal(stdout.basis, "unpriced");
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("empty: an unpriced row is counted in `unmeasured` and flagged as a degradation", () => {
+  const root = mkdtempSync(join(tmpdir(), "cost-"));
+  const { row } = record(root, [
+    "--cadence", "inbox", "--model", "some-vendor-model-v9",
+    "--input-tokens", "1000", "--output-tokens", "500", "--exit", "0",
+  ]);
+  const s = summariseRows([row]);
+  assert.equal(s.unmeasured, 1, "imputeUnmeasured's base, not a measured $0");
+  assert.equal(s.measured, 0);
+  assert.equal(s.measuredUsd, 0);
+  assert.ok(s.degradations.some((d) => /NO price/.test(d)), "the reader says pricing is broken");
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("empty: the unpriced row does NOT sneak into a spend total via summarise", () => {
+  const root = mkdtempSync(join(tmpdir(), "cost-"));
+  record(root, ["--cadence", "inbox", "--model", "some-vendor-model-v9", "--input-tokens", "1000", "--output-tokens", "500", "--exit", "0"]);
+  const out = JSON.parse(
+    execFileSync(process.execPath, [CLI, "summarise", "--days", "7"], {
+      env: { ...process.env, AGENT_ROOT: root },
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    }),
+  );
+  assert.equal(out.totals.sessions, 1);
+  assert.equal(out.totals.unmeasured_sessions, 1, "counted as unmeasured");
+  assert.equal(out.totals.unpriced_sessions, 1, "and specifically as unpriced");
+  assert.equal(out.totals.billable_usd, 0, "no null-arithmetic leaked a number in");
+  assert.equal(out.measurement.unmeasured_sessions, 1);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("the tracker still RECORDS when lib/model-router is absent (a lost row is worse)", () => {
+  // The tracker runs as a detached child from an agent repo whose lib/ tree may
+  // not carry the model router. A hard dependency on it would kill `record` on
+  // import and write NOTHING — invisible spend, which is strictly worse than an
+  // unpriced row. Stage a synthetic root with ONLY the billing contract present.
+  const root = mkdtempSync(join(tmpdir(), "cost-norouter-"));
+  mkdirSync(join(root, "scripts/cost"), { recursive: true });
+  mkdirSync(join(root, "lib/cost"), { recursive: true });
+  copyFileSync(new URL("./track-claude-usage.mjs", import.meta.url), join(root, "scripts/cost/track-claude-usage.mjs"));
+  copyFileSync(new URL("../../lib/cost/ledger-row.mjs", import.meta.url), join(root, "lib/cost/ledger-row.mjs"));
+
+  const out = execFileSync(
+    process.execPath,
+    [join(root, "scripts/cost/track-claude-usage.mjs"), "record",
+      "--cadence", "inbox", "--model", "sonnet",
+      "--input-tokens", "1000", "--output-tokens", "500", "--exit", "0"],
+    { env: { ...process.env, AGENT_ROOT: root }, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
+  );
+  const res = JSON.parse(out);
+  assert.equal(res.ok, true, "the row is still written with no model router present");
+  assert.equal(res.basis, "estimated", "the local tier table still prices the tier aliases");
+
+  // …and an unknown model there is still UNPRICED, not guessed.
+  const out2 = execFileSync(
+    process.execPath,
+    [join(root, "scripts/cost/track-claude-usage.mjs"), "record",
+      "--cadence", "inbox", "--model", "claude-opus-4-8",
+      "--input-tokens", "1000", "--output-tokens", "500", "--exit", "0"],
+    { env: { ...process.env, AGENT_ROOT: root }, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
+  );
+  assert.equal(JSON.parse(out2).basis, "unpriced", "no catalog ⇒ a catalog-only id is unpriced, not guessed");
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("the source no longer defaults an unknown model to a known tier's price", () => {
+  const src = readFileSync(new URL("./track-claude-usage.mjs", import.meta.url), "utf8");
+  assert.doesNotMatch(src, /loadPrices\(\)\[model\]\s*\|\|\s*DEFAULT_PRICES/);
+});

package/scripts/cost/track-claude-usage.mjs

@@ -93,19 +93,112 @@ function loadPrices() {
   } catch { return DEFAULT_PRICES; }
 }
 
+/**
+ * Catalog rows, loaded ONCE at startup — OPTIONALLY.
+ *
+ * lib/model-router/catalog.mjs is imported dynamically, not statically, because
+ * this tracker is invoked as a detached child from an agent repo whose lib/ tree
+ * may not carry the model router. A static import would make the whole `record`
+ * command die on import and write NOTHING — and a session that never reaches the
+ * ledger is invisible spend, which is worse than an unpriced row. Degrade to
+ * "fewer models are priceable" instead; an unpriceable model is recorded as
+ * UNPRICED, never guessed.
+ *
+ * @type {object[]}
+ */
+let _catalogRows = [];
+try {
+  const cat = await import("../../lib/model-router/catalog.mjs");
+  const loaded = cat.loadCatalogCached(AGENT_DIR);
+  _catalogRows = cat.listModels(loaded) || [];
+} catch {
+  _catalogRows = [];
+}
+
+/**
+ * Resolve real prices for a model id, or null when nothing can price it.
+ *
+ * WHY NULL AND NOT A DEFAULT
+ *   This used to end in `|| DEFAULT_PRICES.sonnet`: an unknown model — a
+ *   third-party backend, a model retired from the catalog, a typo in a spawn
+ *   flag — was silently priced at Sonnet's rate and written as a real
+ *   `estimated_usd`. lib/cost/ledger-row.mjs#billableUsd then reported
+ *   basis:"estimated", a MEASURED tier, and that laundered number flowed into
+ *   budget-guard's degrade/refuse band, fleet-digest, and the presence beat's
+ *   `machine.spend24h` — which peers and humans read as this seat's real spend.
+ *   A guessed price is a fabricated measurement.
+ *
+ * Sources, in order, all real:
+ *   1. the local table (scripts/cost/pricing.json merged over DEFAULT_PRICES) —
+ *      the coarse tier aliases the spawn paths pass ("opus"/"sonnet"/"haiku");
+ *   2. lib/model-router/catalog/*.yaml — per-row `cost` blocks carrying a
+ *      `cost_provenance` stamp, which is where concrete ids
+ *      ("claude-opus-4-8", "provider/model") are priced.
+ *
+ * Nothing else. No family-prefix guessing: "sonnet-ish id, therefore Sonnet
+ * pricing" is the same fabrication with extra steps.
+ *
+ * @param {string} model
+ * @returns {{input:number, output:number, cacheRead?:number, cacheWrite?:number, source:string}|null}
+ */
+function resolvePrices(model) {
+  const key = typeof model === "string" ? model.trim().toLowerCase() : "";
+  if (!key) return null;
+
+  const local = loadPrices()[key];
+  if (local && Number.isFinite(local.input) && Number.isFinite(local.output)) {
+    return { input: local.input, output: local.output, source: "local-table" };
+  }
+
+  // The catalog is the real per-model price source. An absent/unloadable catalog
+  // is not an error here — it just means fewer models can be priced, and an
+  // unpriceable model is recorded as UNPRICED rather than guessed.
+  const row = _catalogRows.find(
+    (r) => String(r.ref || "").toLowerCase() === key || String(r.id || "").toLowerCase() === key,
+  );
+  const cost = row && row.cost && typeof row.cost === "object" ? row.cost : null;
+  if (cost && Number.isFinite(Number(cost.input)) && Number.isFinite(Number(cost.output))) {
+    return {
+      input: Number(cost.input),
+      output: Number(cost.output),
+      cacheRead: Number.isFinite(Number(cost.cache_read)) ? Number(cost.cache_read) : undefined,
+      cacheWrite: Number.isFinite(Number(cost.cache_write)) ? Number(cost.cache_write) : undefined,
+      source: "catalog",
+    };
+  }
+
+  return null;
+}
+
 /**
  * Price a session from token counts. FALLBACK ONLY — readers prefer the CLI's
  * authoritative total_cost_usd (see lib/cost/ledger-row.mjs). Token semantics
  * follow the Anthropic usage envelope: `input_tokens` is the UNCACHED remainder,
  * with cache reads and cache writes counted separately (not a subset of it).
+ *
+ * Returns NULL when the model cannot be priced from a real source. The caller
+ * writes `estimated_usd: null`, which billableUsd() reports as basis:"unpriced"
+ * / class UNKNOWN — so the row is counted in `unmeasured` and imputed by
+ * lib/cost/ledger-row.mjs#imputeUnmeasured instead of being billed as a guess.
+ *
+ * @returns {number|null}
  */
 function estimateUsd(model, { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens }) {
-  const prices = loadPrices()[model] || DEFAULT_PRICES.sonnet;
+  const prices = resolvePrices(model);
+  if (!prices) return null;
+  // Catalog rows carry real cache rates; the local table does not, so it keeps
+  // the documented multipliers (read 0.1x input, 5m write 1.25x input).
+  const cacheReadRate = Number.isFinite(prices.cacheRead)
+    ? prices.cacheRead
+    : prices.input * CACHE_READ_MULTIPLIER;
+  const cacheWriteRate = Number.isFinite(prices.cacheWrite)
+    ? prices.cacheWrite
+    : prices.input * CACHE_WRITE_MULTIPLIER;
   const usd =
     (inputTokens / MTOK) * prices.input +
     (outputTokens / MTOK) * prices.output +
-    (cacheReadTokens / MTOK) * prices.input * CACHE_READ_MULTIPLIER +
-    (cacheWriteTokens / MTOK) * prices.input * CACHE_WRITE_MULTIPLIER;
+    (cacheReadTokens / MTOK) * cacheReadRate +
+    (cacheWriteTokens / MTOK) * cacheWriteRate;
   return +usd.toFixed(6);
 }
 
@@ -181,12 +274,16 @@ function recordCmd(flags) {
     const cacheWrite = numFlag(flags, "cache-creation-tokens") ?? 0;
     row.cache_read_input_tokens = cacheRead;
     row.cache_creation_input_tokens = cacheWrite;
-    row.estimated_usd = estimateUsd(row.model, {
+    // null when no real source prices this model — the row then lands in the
+    // UNPRICED/UNKNOWN class rather than carrying a guessed figure.
+    const est = estimateUsd(row.model, {
       inputTokens: row.input_tokens,
       outputTokens: row.output_tokens,
       cacheReadTokens: cacheRead,
       cacheWriteTokens: cacheWrite,
     });
+    row.estimated_usd = est;
+    if (est === null) row.unpriced_reason = `no price for model "${row.model}" in pricing.json or the model-router catalog`;
     // The CLI's own figure. Readers bill against THIS when present: it accounts
     // for cache tiers, resolved model and account pricing that no local table
     // tracks. estimated_usd stays alongside it as the reconciliation fallback.
@@ -211,6 +308,13 @@ function recordCmd(flags) {
       `[track-claude-usage] UNMEASURED session recorded (source=${row.source} cadence=${row.cadence} reason=${unmeasuredReason}) — spend for this session is unknown, not zero\n`
     );
   }
+  if (row.unpriced_reason) {
+    // Equally loud, different failure: telemetry worked, PRICING did not. The
+    // row is not free — it is unpriceable, and doctor/budget-guard must see it.
+    process.stderr.write(
+      `[track-claude-usage] UNPRICED session recorded (source=${row.source} cadence=${row.cadence}) — ${row.unpriced_reason}; spend for this session is unknown, not zero\n`
+    );
+  }
   process.stdout.write(JSON.stringify({ ok: true, file, measurement, billable_usd: usd, basis }) + "\n");
 }
 
@@ -246,6 +350,10 @@ function summariseCmd(flags) {
       byCadence[cad] = byCadence[cad] || empty();
       for (const bucket of [totals, byModel[key], byCadence[cad]]) {
         bucket.sessions += 1;
+        // "unpriced" is a session whose cost is UNKNOWN (usage read, nothing
+        // could price it). It must not add `null` into a spend total and be
+        // counted as a measured $0 — that is the same laundering one layer up.
+        if (basis === "unpriced") { bucket.unmeasured_sessions += 1; bucket.unpriced_sessions += 1; continue; }
         if (basis === "unmeasured") { bucket.unmeasured_sessions += 1; continue; }
         bucket.input_tokens += row.input_tokens || 0;
         bucket.output_tokens += row.output_tokens || 0;
@@ -283,6 +391,7 @@ function empty() {
   return {
     sessions: 0,
     unmeasured_sessions: 0,
+    unpriced_sessions: 0,
     estimated_fallback_sessions: 0,
     input_tokens: 0,
     output_tokens: 0,

package/scripts/daemon/agent-daemon.mjs

@@ -69,6 +69,7 @@ import {
   sweepObligations,
   openObligations,
   escalate,
+  closeObligation,
 } from "./assurance.mjs";
 import { recordPoll, recordClassification, recordSession, writeHealthDashboard } from "./health.mjs";
 import { acquireLock, releaseLock, updateLock, scanStaleLocks, acquireThreadLock, claimRequest, hasActiveClaim, sweepStaleItemClaims, sanitiseItemId } from "./session-lock.mjs";
@@ -83,10 +84,14 @@ const RUNG_MECHANISM = Object.fromEntries(RUNGS.map((r) => [r.id, r.mechanism]))
 // work and land it in the org's shared, ACL'd store so the fleet's memory
 // compounds. Fail-open + best-effort — never blocks or throws into the hot path;
 // local SQLite/interaction logs remain the fail-open cache.
-import { isEnabled as orgEnabled, loadOrgConfig } from "../../lib/org/client.mjs";
+import { isEnabled as orgEnabled, loadOrgConfig, configFromAgent, electResponder } from "../../lib/org/client.mjs";
 import { remember as orgRemember } from "../../lib/org/knowledge.mjs";
 import { sweepSessionOutcomes, resultTextFromStdout } from "./session-outcomes.mjs";
-import { recordWorkStep as orgRecordWorkStep } from "../../lib/org/work-ledger.mjs";
+import { recordWorkStep as orgRecordWorkStep, cohortChannelId, cohortMessageId } from "../../lib/org/work-ledger.mjs";
+// Claude CLI liveness (lib/claude-bin.mjs). The ack-before-work fail-safe reads
+// it: a holding "let me look into it" must not go out when the reply itself can
+// never be generated (the storm's other half — a promise the seat cannot keep).
+import { resolveClaudeBin, isSafeExecutable } from "../../lib/claude-bin.mjs";
 import { boardPriority } from "./board-mirror.mjs";
 // Observability spine (WS — diagnostics). mintTraceId + withTrace give each
 // inbound item ONE trace_id that deep callees inherit via AsyncLocalStorage;
@@ -322,7 +327,29 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
 export function enrichItem(item, service) {
   const channelStr = (item.channel || "").toLowerCase();
   const channelId = item.channel_id || "";
-  const isDm = channelStr.startsWith("dm/") || channelId.startsWith("D");
+  // Cohort carries the channel kind explicitly (DM/GROUP_DM/…); its channel ids
+  // are cuids, so the Slack-style "dm/"/"D…" prefix heuristics never fire. When
+  // the kind is known it is AUTHORITATIVE:
+  //   - DM        → a 1:1 DM: is_dm true, so it skips the group election gate.
+  //   - GROUP_DM  → a multi-participant channel: is_dm FALSE, so an UNDIRECTED
+  //                 message goes through the election exactly like any other
+  //                 channel (only ONE seat should answer an ambient group DM).
+  //   - any other explicit kind (PUBLIC/PRIVATE/…) → not a 1:1 DM.
+  // When the kind is ABSENT we do NOT immediately reach for the prefix
+  // heuristics: the DEFAULT (wide) inbound reader — `lib/org/inbound/project.mjs`
+  // toMessageEvent — projects a Cohort 1:1 DM with `is_dm:true`/`channel_type:'dm'`
+  // but does NOT emit `channel_kind`. That boolean survives the whole
+  // eventToInboxItem → writeInboxItem → parseInboxItemYaml chain, so HONOR it
+  // before falling back. Overwriting it with the cuid-blind prefix heuristics
+  // (which never match a Cohort id) is exactly what sent a genuine 1:1 DM through
+  // the group election gate and suppressed it. Precedence: explicit kind →
+  // pre-existing boolean is_dm → Slack-style id/label prefix heuristics.
+  const channelKind = String(item.channel_kind || "").toUpperCase();
+  const isDm = channelKind
+    ? channelKind === "DM"
+    : typeof item.is_dm === "boolean"
+      ? item.is_dm
+      : channelStr.startsWith("dm/") || channelId.startsWith("D");
   const myFirstName = loadAgent().firstName || "Agent";
   const agentThreadRegex = new RegExp(`^${myFirstName}:`, "m");
   const agentInThread = !!(item.thread_context && agentThreadRegex.test(item.thread_context));
@@ -332,6 +359,95 @@ export function enrichItem(item, service) {
   return item;
 }
 
+/**
+ * Is the Claude CLI actually present on this machine, so a spawned reply session
+ * has any chance of running?
+ *
+ * `resolveClaudeBin()` returns an absolute path when the binary is found and the
+ * bare string "claude" as its last-resort fallback when nothing on the search
+ * path exists — so a non-absolute result IS the "not installed" signal. When it
+ * does resolve, the same owner-only safety check the spawn path trusts (M2)
+ * decides availability.
+ *
+ * This is a NECESSARY, not sufficient, liveness test: it catches a missing/
+ * unsafe binary (which would ENOENT every spawn) before we promise a reply, but
+ * it cannot see an API outage or a rate-limit — those still surface as an
+ * onClose failure, where the assurance sweep already owns the compensation.
+ *
+ * @returns {boolean}
+ */
+function claudeAvailable() {
+  try {
+    const bin = resolveClaudeBin();
+    if (!bin || bin === "claude") return false; // bare fallback = nothing found
+    return isSafeExecutable(bin);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Ask hq's election whether THIS seat should respond to an UNDIRECTED message in
+ * a channel. This is the multi-participant deferral: the should-I-respond
+ * decision moves off the daemon and onto hq's `routeResponders`, which elects ONE
+ * responder or NONE for a group and fails safe (no model → quiet). Computed once
+ * per messageId and cached in a durable ledger event server-side, so concurrent
+ * daemons read the same verdict.
+ *
+ * FAIL SAFE — THE INVERSION. Unlike every other org call in this file, whose
+ * failure means "proceed anyway", this one's failure means STAY SILENT: a
+ * disabled org, a missing message/channel id, an unreachable server, a timeout,
+ * a malformed frame, or a verdict that does not name this seat ALL resolve to
+ * `electedMe:false`. A degraded election must never fall back to respond-to-all —
+ * that is the storm this whole change exists to end.
+ *
+ * @param {object} item the (cohort) inbox item
+ * @param {object} [deps] { electResponder, orgCfg } injectable seams for tests
+ * @returns {Promise<{electedMe:boolean, reason:string, election?:string, mode?:string}>}
+ */
+async function electResponderVerdict(item, deps = {}) {
+  const impl = deps.electResponder || electResponder;
+  try {
+    const cfg = deps.orgCfg !== undefined ? deps.orgCfg : daemonOrgCfg();
+    if (!orgEnabled(cfg)) return { electedMe: false, reason: "org-disabled" };
+    const channelId = cohortChannelId(item);
+    const messageId = cohortMessageId(item);
+    if (!channelId || !messageId) return { electedMe: false, reason: "no-message-id" };
+    const conn = configFromAgent(cfg);
+    const res = await impl(
+      { messageId, channelId },
+      { base: conn.base, token: conn.token, orgId: conn.orgId },
+    );
+    if (!res || res.error) {
+      const reason = res && res.error
+        ? `${res.error.code || "error"}: ${res.error.message || ""}`
+        : "no-response";
+      return { electedMe: false, reason: reason.slice(0, 200) };
+    }
+    const out = res.result !== undefined ? res.result : res;
+    const responders = Array.isArray(out && out.responders) ? out.responders : [];
+    // THIS seat's org member slug — the same `me` every directedness join is
+    // relative to (COHORT_AGENT_ID / config org.cohort.agentId). No slug on
+    // record ⇒ cannot match ⇒ stay silent (fail safe), never respond-to-all.
+    const mySlug = String(
+      process.env.COHORT_AGENT_ID ||
+        (cfg && cfg.org && cfg.org.cohort && cfg.org.cohort.agentId) ||
+        "",
+    ).trim().toLowerCase();
+    const electedMe =
+      !!mySlug &&
+      responders.some((r) => String((r && r.slug) || "").trim().toLowerCase() === mySlug);
+    return {
+      electedMe,
+      reason: electedMe ? "elected" : "not-elected",
+      election: out && out.election,
+      mode: out && out.mode,
+    };
+  } catch (err) {
+    return { electedMe: false, reason: `error: ${err && err.message ? err.message : String(err)}`.slice(0, 200) };
+  }
+}
+
 /**
  * The classifier → quick-reply-or-session path. This is UNCHANGED behaviour:
  * it is the body `processItem` used to run inline. It is now a named mechanism
@@ -356,6 +472,13 @@ export async function answerItem(item, service, itemId, trace_id, deps = {}, rou
   const _sendQuickResponse = deps.sendQuickResponse || sendQuickResponse;
   const _sendHoldingMessage = deps.sendHoldingMessage || sendHoldingMessage;
   const _isQuickReply = deps.isQuickReply || isQuickReply;
+  // The multi-participant election + the claude-liveness fail-safe. Both default
+  // to the real implementations; tests stub the hq election call and the
+  // liveness probe through these seams. `deps.electResponder` (the raw client
+  // helper) is threaded into the verdict so a test stubs one hq call.
+  const _electResponderVerdict = deps.electResponderVerdict
+    || ((item2) => electResponderVerdict(item2, { electResponder: deps.electResponder, orgCfg: deps.orgCfg }));
+  const _claudeAvailable = deps.claudeAvailable || claudeAvailable;
 
   try {
     const isDm = item.is_dm === true;
@@ -398,6 +521,44 @@ export async function answerItem(item, service, itemId, trace_id, deps = {}, rou
       return { ok: true, path: "ignored", reason: "classifier_ignore" };
     }
 
+    // ── ELECTION GATE (multi-participant cohort channels) ────────────────────
+    // The SHOULD-I-RESPOND decision for an UNDIRECTED message in a cohort channel
+    // does not belong to the daemon — it belongs to hq's `routeResponders`, which
+    // elects exactly ONE responder or NONE for a group and fails safe (no model →
+    // quiet). This is the fix for the multi-AI storm: without it, every paired
+    // seat in a cohort channel independently classified the same ambient message
+    // and every one of them answered.
+    //
+    // A message that is UNAMBIGUOUSLY for THIS seat — a 1:1 DM, an @mention, a
+    // named address — skips the election entirely (`isDirectedAtAgent` already
+    // decided; an @mention is not a thing to hold an election over) and keeps the
+    // local fast path. Only a cohort CHANNEL message that is NOT directed defers.
+    //
+    // FAIL SAFE, INVERTED. For this ambient-channel path a failed / timed-out /
+    // empty / not-me election means STAY SILENT — never fall back to
+    // respond-to-all. The directed fast path is untouched, so an org outage can
+    // never drop a genuinely-directed DM. Slack keeps its own local gate below,
+    // where no org roster exists to elect against.
+    if (service === "cohort" && !isDm && !isDirectedAtAgent(item)) {
+      const verdict = await _electResponderVerdict(item);
+      if (!verdict.electedMe) {
+        console.log(`[daemon] Election: not elected to respond (${verdict.reason}) — staying silent for ${item.sender} in ${item.channel}`);
+        logEvent("classifications", {
+          item_id: itemId,
+          sender: item.sender,
+          service,
+          skipped: true,
+          reason: `not_elected: ${verdict.reason}`,
+          election: verdict.election || null,
+          mode: verdict.mode || null,
+          summary: classResult.summary,
+        });
+        markProcessed(item, service);
+        return { ok: true, path: "filtered", reason: "not_elected" };
+      }
+      console.log(`[daemon] Election: elected to respond (${verdict.election || "elected"}, mode=${verdict.mode || "?"}) for ${item.sender} in ${item.channel}`);
+    }
+
     // DIRECTED-MESSAGE GATE: In channels and group chats, only respond to
     // messages that are clearly directed at the agent. DMs always pass.
     // This prevents the agent from inserting itself into every conversation.
@@ -559,7 +720,44 @@ export async function answerItem(item, service, itemId, trace_id, deps = {}, rou
         });
         return { ok: true, path: "quick_reply", reason: classResult.model };
       }
-      // If quick reply failed to send or was blocked by validation, fall through to dispatch a full session
+      // PERMANENT SEND FAILURE — NEVER FALL THROUGH. A permanent failure
+      // (FORBIDDEN_SCOPE from the send-gate, NOT_FOUND/BAD_REQUEST from hq) means
+      // retrying changes nothing AND that a spawned session would fail to post the
+      // very same way. Worse, that session runs AUTONOMOUSLY: denied its intended
+      // reply, it improvises and posts UNRELATED work into a channel this seat was
+      // just told it may not write to. So we stop here — open the durable debt so
+      // the ask is not lost, write a needs-attention escalation an operator can
+      // sweep, close the obligation as failed so the assurance sweep does not loop
+      // on an impossible send, and retire the item so the poll lane stops
+      // re-delivering it. The requester is not told (the only channel we had was
+      // the forbidden one); the escalation is the trace that a human must act.
+      if (result.permanent) {
+        const cause = result.code || result.error || "permanent send failure";
+        console.error(`[daemon] Quick reply PERMANENTLY failed for ${item.sender} (${cause}) — NOT spawning a session; opening obligation + escalating`);
+        let obligationKey = itemId;
+        try {
+          const opened = await openAndAcknowledge({
+            item, classResult, service, traceId: trace_id, ack: false,
+          });
+          if (opened && opened.key) obligationKey = opened.key;
+        } catch (err) {
+          console.error(`[daemon] openAndAcknowledge threw for ${itemId} on permanent send failure: ${err.message}`);
+        }
+        escalate(
+          { key: obligationKey, sender: item.sender, service,
+            channel: item.channel_id || item.channel || null,
+            summary: classResult && classResult.summary, openedAt: Date.now(),
+            attempts: 1, sessionId: null, traceId: trace_id, lastError: cause,
+            item: { content: item.content } },
+          { failure: { label: cause }, told: false },
+        );
+        try { closeObligation(obligationKey, { outcome: "failed", note: cause }); } catch { /* best-effort */ }
+        counters.bump("send.permanent_failure", { service, code: result.code || "unknown" });
+        emitEvent({ type: EVENT_TYPES.ERROR, trace_id, attrs: { item_id: itemId, service, stage: "quick_reply_permanent", error: cause } });
+        markProcessed(item, service);
+        return { ok: true, path: "quick_reply_permanent", reason: cause };
+      }
+      // If quick reply failed transiently or was blocked by validation, fall through to dispatch a full session
       const reason = result.blocked ? `validation blocked: ${result.issues?.map(i => i.rule).join(", ")}` : "send failed";
       console.warn(`[daemon] Quick reply not sent (${reason}), falling through to session dispatch`);
     }
@@ -589,7 +787,16 @@ export async function answerItem(item, service, itemId, trace_id, deps = {}, rou
     // the session as a delivered one.
     let holdingDelivered = false;
     let obligationKeyForItem = null;
-    const ackVerdict = shouldAcknowledge({ willSpawnSession: true, item, source: "inbox" });
+    // FAIL-SAFE, the storm's OTHER half: never post a holding "let me look into
+    // it" the seat cannot keep. If the Claude CLI is not even available, the
+    // reply session cannot run, so an ack here would be a promise broken the
+    // instant it is made — a non-elected-looking silence with a lie in front of
+    // it. When generation is unavailable we SUPPRESS the ack (ack:false) while
+    // still opening the durable debt, so the assurance sweep escalates instead of
+    // a human staring at "on it" that never resolves.
+    const ackVerdict = _claudeAvailable()
+      ? shouldAcknowledge({ willSpawnSession: true, item, source: "inbox" })
+      : { ack: false, reason: "claude-unavailable" };
     try {
       // The DEBT is opened whether or not we can speak. Those are two different
       // questions and conflating them is what made a whole class of ask