@coreplane/switchboard 1.212.0 → 1.214.0

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.212.0",
+  "version": "1.214.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.212.0",
+      "version": "1.214.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21,6 +21,7 @@
       "dependencies": {
         "@anthropic-ai/sdk": "^0.124.0",
         "@slack/bolt": "^5.1.0",
+        "aws4fetch": "^1.0.20",
         "e2b": "^2.46.1",
         "mdast-util-from-markdown": "^2.0.3",
         "undici": "^8.10.2",
@@ -18999,11 +19000,12 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.212.0",
+      "version": "1.214.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.124.0",
         "@slack/bolt": "^5.1.0",
+        "aws4fetch": "^1.0.20",
         "e2b": "^2.46.1",
         "mdast-util-from-markdown": "^2.0.3",
         "undici": "^8.10.2",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.212.0",
+  "version": "1.214.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -81,6 +81,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.124.0",
     "@slack/bolt": "^5.1.0",
+    "aws4fetch": "^1.0.20",
     "e2b": "^2.46.1",
     "mdast-util-from-markdown": "^2.0.3",
     "undici": "^8.10.2",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.212.0",
-  "commit": "c3e94f963fc37fc7c8308cb34268f868413b76b3",
-  "builtAt": "2026-09-14T06:44:27.746Z"
+  "version": "1.214.0",
+  "commit": "5f594682c5b0a24cb11929a33cd6ef28a085634c",
+  "builtAt": "2026-09-14T19:50:00.483Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -42,6 +42,15 @@ export function machineNeedsRepo(machine: MachineClass): boolean {
 export const IDENTITIES = ["none", "read", "write"] as const;
 export type Identity = (typeof IDENTITIES)[number];
 
+/** The loops a preset's runs can be driven by (docs/reference/specs/harness-pi.md
+ *  item 1): `native`, the in-process turn loop (`src/runner.ts`), or `pi`, the
+ *  pi coding agent in the run's own execution container, driven over its RPC
+ *  protocol and bridged onto the run's events. A deployment's `harness:` block
+ *  overrides a preset's own declaration (`effectiveHarness`,
+ *  src/core/harness/select.ts). */
+export const HARNESSES = ["native", "pi"] as const;
+export type Harness = (typeof HARNESSES)[number];
+
 /** The pace that marks a run as looping rather than working: a model turn
  *  every ten seconds, sustained for the whole wall clock. A busy run takes
  *  20–40 s a turn (a model think plus a tool call), so a run that averages six
@@ -110,6 +119,11 @@ export interface AgentDef {
    *  discovery, no gh CLI. Selected by the dispatcher AFTER executor
    *  resolution via RunOptions.system; the shared AgentDef is never mutated. */
   residentSystem?: string;
+  /** Which loop drives the preset's runs (`HARNESSES`): the native loop
+   *  unless declared, and whatever a deployment's `harness.<preset>` says
+   *  over that. Only a preset with a workspace can run on pi — pi is a process
+   *  in the run's execution container. */
+  harness?: Harness;
 }
 
 // Every PR the coding agent ships carries a rich description by default —
@@ -184,6 +198,8 @@ const RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus
 // the sandbox and resident variants cannot drift on it.
 const SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording — it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
 SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request — commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too — unless the request names one destination. Never attach a subset and link the rest.
+Whole files: up to 1 GiB where the artifact store is configured (a recording, a large PDF), 10 MiB otherwise — the tool's result says which applies; over the limit, link to the file.
+Files the person dropped on the thread that were too large to show you inline are already in ./attachments/ in your workspace when the turn's text names them (a video for ffmpeg, a large PDF, a zip); read them from there — never ask for a re-upload.
 Text stays in your message; do not attach what you can say.`;
 
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
@@ -412,34 +428,73 @@ Report outcomes faithfully: a check you could not run is "could not check", neve
 // preset. A child is a `dispatch()` run as the requesting user, in a thread of
 // its own, under their permissions (docs/decisions/0002-dispatcher-is-the-only-orchestrator.md,
 // docs/decisions/0007-authorization-policy-table.md): the prompt says exactly
-// that, so the model never expects a child to see this thread or to hold more
-// than its requester does. Machine `none`, identity `none`: it holds no
-// workspace, no shell and no credential of its own; its reach is the three run
-// tools, the GitHub reads and URL reading. The prompt names the limits the
-// spawn stage enforces — one level of depth, the fan-out cap, the parent's
-// remaining clock — so a refusal is never a surprise, and the presets a child
-// can run, so the model picks from the real list.
-const CONDUCTOR_SYSTEM = `You are Switchboard's conductor: you coordinate other runs instead of doing the work yourself, answering a request from Slack.
+// that, so the model never expects a child to hold more than its requester
+// does. A child is a reader of this conversation: it starts from the text so
+// far plus the prompt, and the prompt says so. Machine `none`, identity
+// `none`: it holds no workspace, no shell and no credential of its own; its
+// reach is the run tools, the GitHub reads and URL reading. The prompt names
+// the limits the spawn stage enforces — one level of depth, the fan-out cap,
+// the parent's remaining clock — so a refusal is never a surprise, and renders
+// the presets a child can run from the registry the way `help` renders its
+// rows: every sibling whose identity is not `write`, with its own description,
+// so the model picks from the real list and a preset that crosses the identity
+// line moves the day its def does; the write presets are named as what a child
+// never is, with the refusal's name.
+function conductorSystem(siblings: readonly AgentDef[]): string {
+  const readers = siblings.filter((a) => a.identity !== "write");
+  const writers = siblings.filter((a) => a.identity === "write");
+  const rows = readers.map(
+    (a) => `- \`${a.name}\`${machineNeedsRepo(a.machine) ? " (needs the repository)" : ""}: ${a.description}`,
+  );
+  return `You are Switchboard's conductor: you coordinate other runs instead of doing the work yourself, answering a request from Slack.
 
 You have no workspace and no shell. Your tools: \`spawn_run\` (start a child run), \`send_to_run\` (steer a live child: your text reaches it as a follow-up at its next step), \`await_runs\` (wait for your children to end and get each end — its status and final reply — back as data), \`list_runs\` (the runs you may see — your own children by default), \`get_run_status\` (one run: whether it is running, what it is doing, and its final reply once it finished), the GitHub reads — \`github_repos\`, \`github_tree\` / \`github_file\` (browse and read our repositories), \`github_search_code\`, \`github_issue_list\` / \`github_issue_get\` — \`web_fetch\` (read a public URL), and \`update_status\`.
 
 WHAT A CHILD IS. A child is an ordinary Switchboard run started as the person who asked you — exactly the run they could start by hand with \`agent:<preset>\` — in a thread of its own in this channel, visible to everyone there, with its own status card and run page, and under their permissions: a preset they may not run, a repository they may not use, or a profile a boundary caps is refused in the child's thread, and the refusal comes back to you as the tool result naming the gate. Children cannot spawn children. You may have a few live at once (the deployment's \`spawn.maxChildren\`, three by default); a spawn past the cap is refused until one finishes. A child's wall clock is capped by what is left of yours.
 
-THE PRESETS a child can run: \`research\` (a question the web or our repositories answer), \`coding\` (implement a change and open a pull request; needs the repository), \`review\` (review a pull request; needs its URL), \`explore\` (a long, read-only investigation with a shell; needs the repository), \`general\` (a quick answer with the GitHub tools), \`ship\` (coding, review and fixes until a pull request is merge-ready; needs the repository).
+THE PRESETS a child can run — a child reads, so only a preset whose identity is \`none\` or \`read\`:
+${rows.join("\n")}
+
+A preset that writes — ${writers.map((a) => `\`${a.name}\``).join(", ")} — is refused by name (\`spawn_identity\`): a spawned child never holds a write credential, so pushing a branch or opening a pull request is the requester's to start by hand with \`agent:<preset>\`; say so in your answer instead of spawning it.
 
 ROUTED COMPOUNDS. A request may arrive already split: the router found independent parts, and the message ends with the line "Routed as a compound request: N independent parts" followed by a numbered list, one part per line as \`<preset>\`: <text>. Spawn exactly those children — one \`spawn_run\` per line, the preset as listed, the line's text as the child's prompt (it already stands alone; add the repository where the preset needs one) — then \`await_runs\` them all and compile. Never merge, drop or add a part; a part whose spawn is refused is reported as refused, by the gate's name.
 
-HOW TO WORK. Fan out, await, compile. Read the request and split it into children only where the parts are independent; a request one preset answers is one child. Spawn each child with a self-contained prompt — everything it needs, since it sees none of this thread — and the repository where the preset needs one. Then call \`await_runs\` once with every child's id: it returns when all of them have ended, or earlier — at the edge of your own budget, at a stop, or when a follow-up lands in this thread — and \`ended\` says which; a child still running at the cut keeps running (name it in your answer, or await again after a follow-up). Steer a child with \`send_to_run\` when the request changes or a child is heading the wrong way. A child that ended — finished, failed, interrupted by a restart — is reported as it ended and never restarted; spawn a new child if the work still matters. Then compile: one answer from the write-ups \`await_runs\` returned. Never do a child's job yourself, and never claim a child finished or found something you did not read from \`await_runs\` or \`get_run_status\`.
+HOW TO WORK. Fan out, await, compile. Read the request and split it into children only where the parts are independent; a request one preset answers is one child. Spawn each child with a prompt that says what it should do, and the repository where the preset needs one: a child starts from this conversation's text so far — every user and assistant turn before your call, never your tool calls, their results or your thinking — and your prompt is its one new turn, so tell it what to do rather than repeat what was said. Then call \`await_runs\` once with every child's id: it returns when all of them have ended, or earlier — at the edge of your own budget, at a stop, or when a follow-up lands in this thread — and \`ended\` says which; a child still running at the cut keeps running (name it in your answer, or await again after a follow-up). Steer a child with \`send_to_run\` when the request changes or a child is heading the wrong way. A child that ended — finished, failed, interrupted by a restart — is reported as it ended and never restarted; spawn a new child if the work still matters. Then compile: one answer from the write-ups \`await_runs\` returned. Never do a child's job yourself, and never claim a child finished or found something you did not read from \`await_runs\` or \`get_run_status\`.
 
 Maintain the user-facing status card with the update_status tool: one item per child (○ pending, ✱ running, ✓ finished — only once await_runs or get_run_status said so).
 
 Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks). Your final message is posted to Slack: lead with the outcome, then one line per child — its preset, its thread, its status and its result in a sentence — and what is still running, if anything.`;
+}
 
-export const AGENTS: Record<string, AgentDef> = {
+/** The compound answer's preset — the one preset absent from the router's
+ *  table that a plain message still reaches: a message with two or more
+ *  independent asks routes to it with the parts named
+ *  (docs/reference/specs/routing-and-config.md item 21). Its def below opts
+ *  out of the table (`routable: false`); the router names it only in the
+ *  compound form. */
+export const COMPOUND_PRESET = "conductor";
+
+/** How a plain message reaches a preset (docs/reference/specs/routing-and-config.md
+ *  item 21), read off its def: `routed` — a row of the router's table, picked
+ *  for a single ask; `compound` — the compound form alone, a message with
+ *  several independent asks; `directive` — never picked, only `agent:<name>`.
+ *  `help` renders its lines from this, so its words follow the registry. */
+export type PresetDoor = "routed" | "compound" | "directive";
+
+export function presetDoor(def: AgentDef): PresetDoor {
+  if (def.routable !== false) return "routed";
+  return def.name === COMPOUND_PRESET ? "compound" : "directive";
+}
+
+/** Every preset that does the work: the ones a conductor's children are drawn
+ *  from (those that read) and the ones it names as refused (those that write).
+ *  The conductor is built from this list below, so its prompt renders its
+ *  siblings and never itself. */
+const WORK_PRESETS = {
   general: {
     name: "general",
     description:
-      "Default assistant on the configured model: answers directly, reads the org's repos and manages their issues over GitHub, reads URLs. No workspace or shell.",
+      "Default assistant: answers directly, reads URLs, manages issues; the preset for any question the org's GitHub answers. No workspace or shell.",
     system: GENERAL_SYSTEM,
     toolset: "assistant",
     // The GitHub tools are REST in the bot process, so a general ask never
@@ -466,6 +521,9 @@ export const AGENTS: Record<string, AgentDef> = {
     // `config set channel efforts.coding=…`, or `effort:` per request).
     machine: "repo-resident",
     identity: "write", // pushes branches and opens pull requests
+    // The native loop until the pi series moves this preset; a deployment
+    // flips it early with `harness: { coding: pi }` (docs/reference/specs/harness-pi.md).
+    harness: "native",
   },
   review: {
     name: "review",
@@ -510,7 +568,7 @@ export const AGENTS: Record<string, AgentDef> = {
   research: {
     name: "research",
     description:
-      "Answers questions with web search, URL reading, and read access to the org's repos and issues over GitHub. No workspace.",
+      "Answers questions that need the web (search, URL reading); GitHub for context, not for a question GitHub alone answers. No workspace.",
     system: RESEARCH_SYSTEM,
     toolset: "web",
     machine: "none", // web I/O only; no workspace is provisioned
@@ -536,11 +594,15 @@ export const AGENTS: Record<string, AgentDef> = {
     cacheTtl: "1h",
     // No built-in effort: the deployment decides, as for coding.
   },
+} satisfies Record<string, AgentDef>;
+
+export const AGENTS: Record<string, AgentDef> = {
+  ...WORK_PRESETS,
   conductor: {
     name: "conductor",
     description:
       "Coordinates other runs: spawns child runs as the requester — each in a thread of its own, under their permissions — follows them, and reports. No workspace or shell.",
-    system: CONDUCTOR_SYSTEM,
+    system: conductorSystem(Object.values(WORK_PRESETS)),
     toolset: "conductor",
     // Nothing is provisioned and no credential minted: the run tools call the
     // dispatcher, the GitHub reads are REST in the bot process.

package/dist/assets/src/config/profile.ts

@@ -2,9 +2,9 @@
 // the machine class its tools execute on, the identity it acts as, and the
 // minutes it may run. A preset declares one; the run's EFFECTIVE profile is
 // what the pipeline hands the factory, the ledger and the runner — never the
-// preset's fields read again downstream. Pure and leaf: type-only imports, so
-// the node-free record contract and the state Worker can name the shape.
-import type { AgentDef, Identity, MachineClass } from "../agents/registry.js";
+// preset's fields read again downstream. Pure and near-leaf: the only value
+// import is the registry's `runawayTurnCap`, itself pure.
+import { runawayTurnCap, type AgentDef, type Identity, type MachineClass } from "../agents/registry.js";
 
 export type { Identity, MachineClass };
 
@@ -63,9 +63,12 @@ export function declaredProfile(preset: Pick<AgentDef, "machine" | "identity" |
 /** The preset with its budget replaced by the effective profile's — the def
  *  the runner is handed, since its deadline, wrap-up warning and budget label
  *  read `maxMinutes` (the same clipped copy the ship pipeline hands its child
- *  rounds). Always a copy: the shared `AgentDef` is never mutated. */
+ *  rounds). `maxTurns` is re-derived from the clipped minutes with the
+ *  registry's own `runawayTurnCap`, so the six-per-minute runaway guard holds
+ *  for the budget the run actually has, not the preset's declared one.
+ *  Always a copy: the shared `AgentDef` is never mutated. */
 export function budgetedAgent(agent: AgentDef, profile: RunProfile): AgentDef {
-  return { ...agent, maxMinutes: profile.minutes };
+  return { ...agent, maxMinutes: profile.minutes, maxTurns: runawayTurnCap(profile.minutes) };
 }
 
 // ---- boundaries: a scope caps, never grants -----------------------------------

package/dist/assets/src/core/redact.ts

@@ -46,6 +46,14 @@ const REDACT: Array<{ re: RegExp; replace: string }> = [
 const SECRET_COMPONENT =
   /^(secret|token|password|passwd|pwd|credential|credentials|key|apikey|auth|session|sessionid|cookie)$/i;
 
+// An identifier component that marks the whole identifier as an ERROR CODE, not
+// a secret name: `github-token-mint-failed: HTTP 422 …` names a failure about a
+// token, and the word after the colon is diagnosis, never a credential. Without
+// this guard the assignment pass redacted `HTTP` out of that message
+// (`github-token-mint-failed: «redacted» 422 …`), garbling the one line that
+// tells an operator what went wrong.
+const ERROR_CODE_COMPONENT = /^(failed|failure|error|err|refused|denied|invalid|missing|expired|unset|mismatch)$/i;
+
 /** Redact the VALUE of any `<name> = value` / `<name>: value` where the name has
  *  a secret-marking component. Handles quoted values (with spaces) and unquoted,
  *  and a quoted NAME (`"password": "…"` in pasted JSON — the closing quote sits
@@ -64,7 +72,9 @@ function redactNamedAssignments(text: string): string {
     // decides whether it names a secret (`_SECRET` → ["", "SECRET"]).
     /(?<![A-Za-z0-9_-])([A-Za-z0-9_-]+)("?)(\s*[=:]\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s]{4,})/g,
     (whole, id: string, close: string, sep: string, val: string) => {
-      if (!id.split(/[_-]/).some((p) => SECRET_COMPONENT.test(p))) return whole;
+      const parts = id.split(/[_-]/);
+      if (!parts.some((p) => SECRET_COMPONENT.test(p))) return whole;
+      if (parts.some((p) => ERROR_CODE_COMPONENT.test(p))) return whole;
       const quote = val[0] === '"' || val[0] === "'" ? val[0] : "";
       return `${id}${close}${sep}${quote}«redacted»${quote}`;
     },

package/dist/assets/src/core/runEvents.ts

@@ -118,7 +118,27 @@ export type RunNoteKind =
    *  post-step beside the thread's Slack-only note, so the record says the
    *  verdict is Slack-only and a coordinator reading it never asks GitHub
    *  for a review that was never sent. */
-  | "review_not_posted";
+  | "review_not_posted"
+  /** A pi run's context was compacted (docs/reference/specs/harness-pi.md item
+   *  6): pi summarized its older turns into one entry and the model reads the
+   *  summary from here on; the transcript keeps the originals, so the record
+   *  is a superset of the model's context. The summary names the token counts
+   *  before and after. Published by the pi bridge. */
+  | "compacted"
+  /** The pi harness itself failed in a way the run must show (harness-pi.md
+   *  item 6): the extension threw, pi asked a dialog no one answers (answered
+   *  cancelled), or pi emitted an event kind this build's bridge does not
+   *  know — named, so a pi bump is visible in the first run's record. Published
+   *  by the pi bridge. */
+  | "harness_error"
+  /** The harness's gate refused a tool call the model asked for (harness-pi.md
+   *  item 7): the summary names the tool and the rule; the model read the same
+   *  reason as the tool's result. Published by the bot's authorize route. */
+  | "tool_refused"
+  /** The stuck-loop guard fired (docs/reference/specs/run-loop.md item 18):
+   *  the same tool call failed identically six times in a row, so the run is
+   *  forced into its write-up instead of looping to the wall clock. */
+  | "stuck_loop";
 
 /** Every `RunNoteKind`, as a value (a reader that filters notes by kind uses
  *  this; adding a kind to the union without adding it here is a type error). */
@@ -139,6 +159,10 @@ export const RUN_NOTE_KINDS = [
   "cold_sandbox",
   "pr_not_opened",
   "review_not_posted",
+  "compacted",
+  "harness_error",
+  "tool_refused",
+  "stuck_loop",
 ] as const satisfies readonly RunNoteKind[];
 type _EveryKindListed = [RunNoteKind] extends [(typeof RUN_NOTE_KINDS)[number]] ? true : never;
 const _everyKindListed: _EveryKindListed = true;
@@ -383,6 +407,27 @@ export type RunEvent =
       seq?: number;
       at?: number;
     }
+  /** A file moved through the artifact store (docs/reference/specs/execution.md item 20,
+   *  record 0033): one the run received from its thread (`in`, staged before
+   *  the turn) or one it sent (`out`, `attach_file`). The record keeps the
+   *  store KEY and the facts a page needs to list the file — never a URL: the
+   *  run page's proxy route (`/runs/:id/artifacts/<key>`, live-view.md item 26)
+   *  mints a signed GET per request, so a stored record never carries a
+   *  credential that expires or leaks, and the parser refuses a payload that
+   *  tries. A side fact beside the tool pair that moved the file (like
+   *  `skill_use`), never a step; the friction analyzer ignores it. */
+  | {
+      type: "artifact";
+      direction: "in" | "out";
+      /** The store key (`src/artifacts/keys.ts`): `runs/<runId>/out/<seq>-<basename>` or `threads/<thread>/in/<ts>/<i>-<basename>`. */
+      key: string;
+      /** The file's name as the person sees it (the Slack filename, the tool's `name`). */
+      name: string;
+      size: number;
+      contentType: string;
+      seq?: number;
+      at?: number;
+    }
   /** A skill was loaded into the model's context (docs/reference/specs/skills.md). Emitted
    *  by the `use_skill` tool on a successful load — alongside, not instead of,
    *  its `tool_call`/`tool_result` pair — so skill use is a first-class fact in

package/dist/assets/src/core/runFriction.ts

@@ -254,6 +254,13 @@ function unionMs(intervals: ReadonlyArray<{ start: number; end: number }>): numb
   return total;
 }
 
+/** One tool call's identity for retry/streak accounting: the tool name plus
+ *  the call's one-line summary (which carries the arguments — a bash command,
+ *  a path, a url). Shared with the runner's stuck-loop guard
+ *  (docs/reference/specs/run-loop.md item 18), so both count "the same call"
+ *  identically. */
+export const callSignature = (tool: string, summary: string): string => `${tool} ${summary}`;
+
 /** Analyze a run's event stream. Pure and deterministic; never mutates `events`. */
 export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOptions = {}): FrictionDiagnosis {
   const slowToolMs = opts.slowToolMs ?? DEFAULT_SLOW_TOOL_MS;
@@ -384,12 +391,14 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
       return;
     }
     // Side facts about the run, not steps: skill_use rides beside a use_skill
-    // call that already produced its own tool pair; review_artifact,
-    // pr_description, pr_opened, review_posted, the ship_round boundaries and
-    // the router's route are published by the dispatcher/pipeline outside the
-    // model loop entirely. Counting any of them would distort the story.
+    // call that already produced its own tool pair, and artifact beside the
+    // attach_file call (or the dispatcher's staging) that moved the file;
+    // review_artifact, pr_description, pr_opened, review_posted, the ship_round
+    // boundaries and the router's route are published by the dispatcher/pipeline
+    // outside the model loop entirely. Counting any of them would distort the story.
     if (
       ev.type === "skill_use" ||
+      ev.type === "artifact" ||
       ev.type === "review_artifact" ||
       ev.type === "pr_description" ||
       ev.type === "pr_opened" ||
@@ -403,7 +412,7 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
 
     if (ev.type === "tool_call") {
       toolCalls++;
-      if (failedCalls.has(`${ev.tool} ${ev.summary}`)) {
+      if (failedCalls.has(callSignature(ev.tool, ev.summary))) {
         findings.push({
           category: "retry",
           severity: "low",
@@ -430,7 +439,7 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
           ? { interval: { start: span.startedAt, end: span.startedAt + durationMs } }
           : {};
 
-      if (!ev.ok) failedCalls.add(`${ev.tool} ${callSummary}`);
+      if (!ev.ok) failedCalls.add(callSignature(ev.tool, callSummary));
 
       if (ev.infra) {
         // An infra-level failure is the sandbox, not the command: classify once,

package/dist/assets/src/core/runLedger/types.ts

@@ -7,6 +7,7 @@ import type { ChatMessage, ToolDef } from "../../providers/types.js";
 import type { ChannelVisibility } from "../authz/types.js";
 import type { RunProfile } from "../../config/profile.js";
 import type { RunEvent } from "../runEvents.js";
+import type { RunSeed } from "../runRecord.js";
 
 /** How long a generation's claim on a run lasts without a heartbeat. */
 export const LEASE_MS = 30_000;
@@ -69,6 +70,9 @@ export interface LiveRunMeta {
    *  still sends the parent its event and a retried spawn finds its run. */
   parentInstanceId?: string;
   idempotencyKey?: string;
+  /** Where the run's conversation started (item 52), so a reclaimed run's
+   *  record still says so: `parent` for a spawned child, `channel` otherwise. */
+  seed?: RunSeed;
   /** Which executor the run attached: what `makeExecutor` chose. */
   selection?: "resident" | "sandbox" | "local" | "none";
   /** The worktree path the system prompt names. */

package/dist/assets/src/core/runRecord.ts

@@ -145,8 +145,18 @@ export interface RunRecord {
    *  item 48), stored at the claim so a retried spawn finds its run. Present
    *  exactly when `parentInstanceId` is — both or neither, never one alone. */
   idempotencyKey?: string;
+  /** Where the run's conversation started (item 52): `channel` — its own
+   *  thread's history, as for every run a person, a schedule or a coordinator
+   *  started — or `parent` — a spawned child seeded from its parent's text
+   *  turns at the spawn (`DispatchOptions.seed`). Absent on records written
+   *  before it existed. */
+  seed?: RunSeed;
 }
 
+/** The two places a run's conversation can start (item 52). */
+export const RUN_SEEDS = ["channel", "parent"] as const;
+export type RunSeed = (typeof RUN_SEEDS)[number];
+
 /** The profile as the record stores it: the run's effective profile plus the preset it came from. */
 export type RunProfileRecord = RunProfile & { preset: string };
 
@@ -515,6 +525,8 @@ export function isRunRecord(v: unknown): v is RunRecord {
   // A parent is named by a run id (item 46): the same shape as the record's own.
   if (r.parentRunId !== undefined && (typeof r.parentRunId !== "string" || !RUN_ID_PATTERN.test(r.parentRunId)))
     return false;
+  // Where the conversation started (item 52): one of the two words, or absent.
+  if (r.seed !== undefined && !RUN_SEEDS.includes(r.seed as RunSeed)) return false;
   // A coordinator's child (item 48): the instance id in the platform's alphabet
   // and the key `<instance>:<step>` — both or neither; one alone is no tag.
   if ((r.parentInstanceId === undefined) !== (r.idempotencyKey === undefined)) return false;

package/dist/assets/src/core/trace/workerTrace.ts

@@ -52,9 +52,15 @@ export function shimRoute(pathname: string): string | undefined {
   if (pathname === "/costs" || pathname.startsWith("/costs/")) return "costs";
   if (pathname.startsWith("/api/")) return "api";
   if (pathname.startsWith("/admin/")) return "admin";
+  // The artifact copy (deploy/cloudflare/artifactsCopy.ts): the shim's own route, a 1 GB stream.
+  if (pathname === "/artifacts/copy") return "artifacts";
   // The model proxy's two routes (docs/reference/specs/model-proxy.md): a bounded
   // request per model call, forwarded to the container like everything else.
   if (pathname === "/v1/messages" || pathname === "/v1/chat/completions") return "model-proxy";
+  // The pi harness's three routes (docs/reference/specs/harness-pi.md item 7): a
+  // run's extension asking for its tools, a verdict, a relayed tool's result.
+  if (pathname === "/harness/tools" || pathname === "/harness/authorize" || pathname === "/harness/tool")
+    return "harness";
   if (pathname === "/docs" || pathname.startsWith("/docs/")) return "docs";
   if (pathname === "/" || pathname === "/index.html") return "page";
   return "other";

package/dist/assets/src/deploy/profile.ts

@@ -89,6 +89,17 @@ export const profileSchema = z.object({
   /** The Cloudflare Access application in front of the bot's dashboards, when
    *  there is one: the team domain the JWT is issued by and the app's AUD. */
   access: z.object({ teamDomain: hostname, aud: z.string().regex(/^[0-9a-f]{64}$/) }).optional(),
+  /** The artifact store's bucket (docs/reference/specs/execution.md item 20), when the installation
+   *  has one: the bot Worker's template binds it as `ARTIFACTS` and `deploy` creates it before the
+   *  upload. The bot's runtime config (`artifacts.r2.bucket`) must name the same bucket — the two
+   *  are held equal by `artifacts check`, not by the profile. R2's own bucket-name rules. */
+  artifacts: z
+    .object({
+      bucket: z
+        .string()
+        .regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/, "an R2 bucket name: 3–63 lowercase letters, digits and hyphens"),
+    })
+    .optional(),
 });
 
 export type DeploymentProfile = z.infer<typeof profileSchema>;