@coreplane/switchboard 1.240.0 → 1.241.0

package/dist/assets/config/config.example.yaml

@@ -327,13 +327,20 @@ workspaceDir: ./workspaces
 #                     # a finding at or above it sends the round into a fix step instead of merge-ready.
 #                     # Per channel/user: config set … --ship.addressSeverity; per run: severity:<level>.
 
-# `harness` is a retired key (docs/reference/specs/harness-pi.md item 1). It
-# moved the presets onto pi one at a time; every preset runs on pi now — the pi
-# coding agent started inside the run's own execution container (or as a child
-# of the bot for a preset without a workspace) with the run's model-proxy
-# bearer as its only key — and there is no other loop. A block written during
-# the series still loads when every value is `pi`; `native` names the deleted
-# loop and fails the load by name, as does an unknown preset. Remove the block.
+# Which harness each preset's runs are driven by (docs/reference/specs/harness.md
+# item 8): a mapping of preset to a harness's name. Two exist — `pi` (the pi
+# coding agent, the default for every preset) and `opencode` (OpenCode's server,
+# `opencode serve`) — each started inside the run's own execution container (or
+# as a child of the bot for a preset without a workspace) with the run's
+# model-proxy bearer as its only key, every tool call decided in the bot, every
+# event on the run's record. A preset the block does not name runs on pi;
+# nothing defaults to OpenCode. A run keeps the harness it started on, so
+# changing a word moves the next run, never one in flight. Any other word
+# (`native`, the deleted loop; `codex`) fails the load naming the two, as does
+# an unknown preset. How-to: docs/how-to/put-a-preset-on-opencode.md.
+# harness:
+#   coding: opencode   # coding runs on OpenCode
+#   review: pi         # the default, written out
 
 # What the harness writes into pi's per-run settings for every run on pi
 # (docs/reference/specs/harness-pi.md item 4): pi's compaction thresholds, in
@@ -349,6 +356,18 @@ workspaceDir: ./workspaces
 #     reserveTokens: 150000
 #     keepRecentTokens: 8000
 
+# What the harness writes into OpenCode's per-run configuration for every run
+# on OpenCode (docs/reference/specs/harness.md item 8): OpenCode's compaction
+# thresholds, in tokens, under OpenCode's own names — `buffer`, the tokens kept
+# free of the model's window before a compaction runs; `keepTokens`, how much
+# of the newest turns it keeps. Unset, OpenCode's defaults stand and the file
+# names no compaction. The OpenCode twin of the `pi` block above; positive
+# integers only, any other shape or key fails the load by name.
+# opencode:
+#   compaction:
+#     buffer: 20000
+#     keepTokens: 8000
+
 # The fan-out cap a spawning run meets (docs/reference/specs/agent-conductor.md).
 # `agent:conductor` starts child runs as the person who asked — each an
 # ordinary run in a thread of its own, under that person's permissions — and

package/dist/assets/deploy/cloudflare/worker.ts

@@ -17,8 +17,11 @@ import {
   createInstanceResponse,
   instanceStatusResponse,
   isInstanceNotFound,
+  parseInstanceEventPath,
   parseInstanceStatusPath,
   parseCreateInstanceRequest,
+  parseSendEventRequest,
+  sendEventResponse,
   parseSubjectAuthorization,
   type CreateInstanceOutcome,
 } from "../../src/core/coordinator/instancesRoute.ts";
@@ -87,6 +90,7 @@ export interface Env {
   DASHBOARD_TOKEN?: string; // dashboard auth `token` strategy: the bearer (the default env name; config may name another)
   SWITCHBOARD_INGRESS_TOKENS?: string; // enables HTTP /ingress + MCP /mcp (JSON token→identity map); the `cron` entry is what scheduled runs present; an entry whose `http:<subject>` actor holds `deploy:write` in the bot's config may POST /admin/restart
   BRAVE_SEARCH_API_KEY?: string; // web_search backend (Brave); web_fetch works without it
+  GITHUB_WEBHOOK_SECRET?: string; // check-run intake: signs POST /webhooks/github; absent, the intake answers 503 disabled
   CF_ANALYTICS_TOKEN?: string; // costs dash: Cloudflare API token, Account Analytics:Read only
   ANTHROPIC_ADMIN_KEY?: string; // costs dash (optional): Anthropic Admin API key for the LLM cost report
   MEMORY_TOKEN?: string; // durable memory + friction ledger + schedule firings + MCP registry: bearer for the state Worker
@@ -125,6 +129,7 @@ const FORWARDED_OPTIONAL = [
   "ANTHROPIC_ADMIN_KEY",
   "SWITCHBOARD_INGRESS_TOKENS",
   "BRAVE_SEARCH_API_KEY",
+  "GITHUB_WEBHOOK_SECRET",
   "MEMORY_TOKEN",
   "MCP_CREDENTIAL_KEY",
   "MCP_ACCESS_CLIENT_ID",
@@ -407,6 +412,57 @@ async function handleCoordinatorInstanceStatus(request: Request, env: Env, id: s
   return json(res.status, res.body);
 }
 
+/** `POST /admin/coordinator/instances/<id>/events` — the shim's event relay
+ *  (docs/reference/specs/http-ingress.md item 12): the bot's check-run intake
+ *  holds no Workflow binding, so its `checks-settled-<head>` send crosses here
+ *  and this Worker's own `SHIP_COORDINATOR` binding delivers it. The same door
+ *  as the create and the status: the bearer in the map, the bot's `authorize`
+ *  answer. The engine's `instance.not_found` is 404; any other refusal (an
+ *  instance that already ended) is 502 by reason — the sender treats both as a
+ *  failed send and the driver's bounded wait is the fallback. */
+async function handleCoordinatorInstanceEvent(request: Request, env: Env, id: string): Promise<Response> {
+  const json = (status: number, body: Record<string, unknown>) =>
+    new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+  if (request.method !== "POST")
+    return json(405, {
+      ok: false,
+      error: `method not allowed: ${request.method} — ${COORDINATOR_INSTANCES_PATH}/<id>/events answers POST only`,
+    });
+  const authorization = request.headers.get("authorization") ?? undefined;
+  const authn = authenticateIngressBearer(authorization, env.SWITCHBOARD_INGRESS_TOKENS, "coordinator");
+  if (!authn.ok) {
+    console.warn(`[coordinator] instance event ${authn.status} — ${authn.reason}`);
+    return json(authn.status, { ok: false, error: authn.reason });
+  }
+  let answer: Response;
+  try {
+    answer = await getContainer(env.SWITCHBOARD, INSTANCE).fetch(
+      new Request(`${INTERNAL}${COORDINATOR_AUTHORIZE_PATH}`, {
+        method: "POST",
+        headers: { authorization: authorization ?? "" },
+      }),
+    );
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return json(503, { ok: false, error: `coordinator disabled: the bot could not be asked (${reason})` });
+  }
+  const auth = parseSubjectAuthorization(answer.status, await answer.text().catch(() => ""));
+  if (!auth.ok) return json(auth.status, { ok: false, error: auth.reason });
+  const parsed = parseSendEventRequest(await request.text().catch(() => ""));
+  if (!parsed.ok) return json(400, { ok: false, error: parsed.reason });
+  let outcome: Parameters<typeof sendEventResponse>[0];
+  try {
+    await (await env.SHIP_COORDINATOR.get(id)).sendEvent({ type: parsed.type, payload: parsed.payload });
+    outcome = { kind: "sent", id };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    outcome = isInstanceNotFound(reason) ? { kind: "absent", id } : { kind: "failed", id, reason };
+  }
+  const res = sendEventResponse(outcome);
+  console.log(`[coordinator] ${auth.subject} → instance ${id} event ${parsed.type}: ${outcome.kind}`);
+  return json(res.status, res.body);
+}
+
 /** Record a firing on the state Worker's ScheduleDO (the /runs Scheduled panel
  *  reads it). Best-effort: a failure here is a log line — the run itself (if
  *  any) already happened and is its own record. */
@@ -440,29 +496,32 @@ export default {
       // The routes the Worker answers itself — the restart, the coordinator's
       // instance creation and an instance's status, all over bindings only this
       // Worker holds; everything else is the container's.
-      const statusId = parseInstanceStatusPath(pathname);
+      const eventsId = parseInstanceEventPath(pathname);
+      const statusId = eventsId === undefined ? parseInstanceStatusPath(pathname) : undefined;
       const res =
         pathname === "/admin/restart"
           ? await handleAdminRestart(forwarded, env)
           : pathname === COORDINATOR_INSTANCES_PATH
             ? await handleCoordinatorInstances(forwarded, env)
-            : statusId !== undefined
-              ? await handleCoordinatorInstanceStatus(forwarded, env, statusId)
-              : pathname === COPY_PATH
-                ? // The artifact copy (artifactsCopy.ts): the R2 binding and the Slack
-                  // token are this Worker's; the bot only asks, with its copy bearer.
-                  // `forwarded`, never `inbound`: `withTraceContext` rebuilt the request
-                  // with `new Request(inbound, …)`, which takes the body stream with it —
-                  // `inbound.text()` is empty afterwards and the route read "not JSON" live.
-                  await handleArtifactsCopy(forwarded, {
-                    bucket: env.ARTIFACTS,
-                    bucketName: env.ARTIFACTS_BUCKET_NAME,
-                    copyToken: env.ARTIFACTS_COPY_TOKEN,
-                    slackToken: env.SLACK_BOT_TOKEN,
-                    fetch: (input, init) => fetch(input, init),
-                    lengthPipe: (size) => new FixedLengthStream(size),
-                  })
-                : withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded));
+            : eventsId !== undefined
+              ? await handleCoordinatorInstanceEvent(forwarded, env, eventsId)
+              : statusId !== undefined
+                ? await handleCoordinatorInstanceStatus(forwarded, env, statusId)
+                : pathname === COPY_PATH
+                  ? // The artifact copy (artifactsCopy.ts): the R2 binding and the Slack
+                    // token are this Worker's; the bot only asks, with its copy bearer.
+                    // `forwarded`, never `inbound`: `withTraceContext` rebuilt the request
+                    // with `new Request(inbound, …)`, which takes the body stream with it —
+                    // `inbound.text()` is empty afterwards and the route read "not JSON" live.
+                    await handleArtifactsCopy(forwarded, {
+                      bucket: env.ARTIFACTS,
+                      bucketName: env.ARTIFACTS_BUCKET_NAME,
+                      copyToken: env.ARTIFACTS_COPY_TOKEN,
+                      slackToken: env.SLACK_BOT_TOKEN,
+                      fetch: (input, init) => fetch(input, init),
+                      lengthPipe: (size) => new FixedLengthStream(size),
+                    })
+                  : withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded));
       root.end(res.status >= 500 ? "error" : "ok", { httpStatus: res.status });
       return res;
     } catch (err) {

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -7067,6 +7067,7 @@ export class ResidentDO extends Sandbox<Env> {
       LIFECYCLE_KEY,
       REFRESH_INSTANCE_KEY,
       RUNTIME_UNREACHABLE_KEY,
+      AUTO_REBUILDS_KEY,
     ]);
     const facts = map.get(FACTS_KEY) as RepoFacts | undefined;
     const snap = map.get(SNAPSHOT_KEY) as SnapshotRecord | undefined;

package/dist/assets/deploy/secrets.manifest.json

@@ -40,6 +40,12 @@
       "optional": true,
       "note": "JSON bearer→identity map for POST /ingress and POST /mcp: `{ subject, channel?, email? }` per entry. Self-minted (openssl rand -hex 32 per entry). Optional: without it /ingress and /mcp are disabled and `deploy restart` has no bearer. The `cron` entry fires schedules; a `coordinator` entry (granted `coordinator:step`) is the ship coordinator's, rotated apart from cron. An `email` binds the token to a person: their runs, their grants untouched (authorization.md item 15)."
     },
+    {
+      "name": "GITHUB_WEBHOOK_SECRET",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "GitHub webhook signing secret for POST /webhooks/github (the check-run intake). Set the same value on the repo's webhook. Optional: without it the intake answers 503 disabled and the merge wait falls back to its bounded timeout."
+    },
     {
       "name": "SANDBOX_TOKEN",
       "workers": ["bot", "sandbox"],

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.240.0",
+  "version": "1.241.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.240.0",
+      "version": "1.241.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.240.0",
+      "version": "1.241.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.240.0",
+  "version": "1.241.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.240.0",
-  "commit": "dd69a6edcfaa523c998ff1059f47b8ef1675ebe9",
-  "builtAt": "2026-09-17T00:22:24.645Z"
+  "version": "1.241.0",
+  "commit": "645b2a6d20ac39178acdb7c412a6a72f6013771c",
+  "builtAt": "2026-09-17T01:34:41.433Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -133,6 +133,23 @@ export interface AgentDef {
 // and rendered against the head sha at render time, so a repush is a
 // re-render by Switchboard — the agent only resubmits when the CONTENT (line
 // numbers included) changed.
+/** The status-card rule every tool-running preset carries (docs/reference/specs/run-visibility.md
+ *  item 2). One sentence in one place: the card shows the command running right
+ *  now beside the checklist, so the checklist's markers must be facts — ✱ from
+ *  the item's first command, ✓ only once its result has been read — or the two
+ *  contradict each other on the card. `examples` are the preset's own outcome
+ *  phrasings; the rule itself never varies by preset. */
+export function statusCardRule(examples = '"Implement the fix", "Run the test suite"'): string {
+  return (
+    "Maintain the user-facing status card with the update_status tool. Post your plan as a checklist (○ pending) as soon as you have it, " +
+    "then keep it truthful at every moment: the markers are facts, not intentions. Mark an item ✱ when you issue the first command that does it, " +
+    "and ✓ only after you have read the result that proves it happened — never in the same turn as the command, never because you intend to run it next, " +
+    "never for a reporting or posting step you have not done. The order is: mark the item ✱, run its commands, read the result, then mark it ✓ and the next item ✱. " +
+    "The card shows the command running right now beside your checklist, so a ✓ item whose command is still running reads as a lie. " +
+    `Items are short outcomes (${examples}), never commands. This is the only progress the user sees while you work.`
+  );
+}
+
 const PR_DESCRIPTION_TEMPLATE = `PR description — submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate — \`npm run check:pr-title -- "<title>"\` — and submit only a title it accepts; the same gate refuses the PR in CI. Content contract per field (each renders as its own section): prose is unwrapped — no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation — state exactly what you ran and the real result. Keep each field concise, not padded.
 EVERY PR includes one that already exists when you push — opened by a person, by dependabot, or by an earlier run. After EVERY push to such a PR: read its current title and body (\`github_issue_get\` with the PR number works for pull requests; \`gh pr view\` where gh exists), judge them against the change as it now stands at the pushed head, and submit the object that describes the PR as it is NOW — carry forward what the existing body says that is still true (a dependency bump's release notes belong in whatWhy), add what you changed, and anchor the Tour at the new head. Switchboard replaces the PR's title and body with your rendering. A description that describes an earlier state of its branch is a bug; "it is someone else's PR" is never a reason to leave it.
 - **title**: the PR title — one line naming the change, specific enough to pick out of a PR list.
@@ -237,7 +254,7 @@ ${SHOW_FILES}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Clone repo and read the diff", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
+${statusCardRule('"Clone repo and read the diff", "Run the test suite"')}
 
 If the request doesn't name a repository and you can't infer it, ask for it instead of guessing.
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
@@ -280,7 +297,7 @@ ${SHOW_FILES}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
+${statusCardRule()}
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
 ${FENCED_CONTENT_RULE}
@@ -319,7 +336,7 @@ ${SHOW_FILES}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
+${statusCardRule()}
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
 ${FENCED_CONTENT_RULE}
@@ -384,7 +401,7 @@ ${REVIEW_VERDICT_INSTRUCTION}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending), update as items start (✱) and finish (✓ — only after they actually happened; never pre-mark reporting steps). Items are short outcomes, never commands.
+${statusCardRule('"Gather the diff and the files", "Analyze the change", "Post the verdict"')}
 
 ${FENCED_CONTENT_RULE}
 Your final message is posted to Slack. Lead with a one-line verdict, then the findings.`;
@@ -417,7 +434,7 @@ ${REVIEW_VERDICT_INSTRUCTION}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending), update as items start (✱) and finish (✓ — only after they actually happened; never pre-mark reporting steps). Items are short outcomes, never commands.
+${statusCardRule('"Gather the diff and the files", "Analyze the change", "Post the verdict"')}
 
 ${FENCED_CONTENT_RULE}
 Your final message is posted to Slack. Lead with a one-line verdict, then the findings.`;
@@ -451,7 +468,7 @@ ${REVIEW_VERDICT_INSTRUCTION}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending), update as items start (✱) and finish (✓ — only after they actually happened; never pre-mark reporting steps). Items are short outcomes, never commands.
+${statusCardRule('"Gather the diff and the files", "Analyze the change", "Post the verdict"')}
 
 ${FENCED_CONTENT_RULE}
 Your final message is posted to Slack. Lead with a one-line verdict, then the findings.`;
@@ -469,7 +486,7 @@ How to work:
 2. Prefer primary sources; corroborate a surprising claim with a second source.
 3. Answer concisely and cite the URLs (or repo paths) you used. If sources conflict or you couldn't verify something, say so plainly. If web search is unconfigured, use web_fetch / the GitHub tools on what you have and say search was unavailable.
 
-Maintain the user-facing status card with the update_status tool: post a short checklist (○ pending) after you plan, and update items as they start (✱) and finish (✓ — only once they actually happened).
+${statusCardRule('"Search the sources", "Write the answer"')}
 
 ${FENCED_CONTENT_RULE}
 Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks). Your final message is posted to Slack — lead with the answer, then supporting detail and sources.`;
@@ -485,6 +502,8 @@ Answer directly and concisely. Use Slack-friendly formatting (no markdown header
 
 Your tools work without a workspace: the GitHub tools — \`github_repos\` (the org repositories you can reach), \`github_tree\` / \`github_file\` / \`github_search_code\` (browse, read, search their code and docs, private repos included), \`github_issue_list\` / \`github_issue_get\` (read issues), \`github_issue_create\` / \`github_issue_update\` / \`github_issue_comment\` / \`github_issue_delete\` (act on issues) — and \`web_fetch\` (read a public URL). Use them: when the user names a repo loosely ("the switchboard app"), resolve it with github_repos (or the thread) rather than asking; when asked about one of our repos, read it before answering. Report exactly what a tool did (issue number + URL) — never claim an action you did not perform, and never fabricate file contents, URLs, or command output.
 
+${statusCardRule('"Read the issue and its thread", "Post the comment"')} A one-step answer needs no checklist; post one when the request has steps the person would wait on.
+
 You cannot run commands, clone repositories, edit code, or review pull requests, and you cannot search the web. Other Switchboard agents can: for code changes or PRs tell the user to re-send with \`agent:coding\`; for a PR review, \`agent:review\`; for a web-research question, \`agent:research\` (e.g. "\`agent:coding fix the failing login test in acme/api\`", "\`agent:research compare X and Y\`"). Delete an issue only when the user explicitly asked to delete it (closing is an update).`;
 
 // The explore agent (docs/reference/specs/agent-explore.md): a long, read-only
@@ -512,7 +531,7 @@ READ-ONLY: NEVER open a pull request, and never commit or push — no branch, no
 
 You cannot attach or post files: your whole answer is text. Never say a file is attached or below — name its path in the workspace and describe it (what it shows, its size) instead; a person who needs the file itself asks \`agent:coding\`, which can attach.
 
-Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending) once you have it, and update items as they start (✱) and finish (✓ — only after they actually happened). Items are short outcomes ("Clone and install", "Time the full suite"), never commands.
+${statusCardRule('"Clone and install", "Time the full suite"')}
 
 ${NOTEPAD}
 

package/dist/assets/src/core/authz/actor.ts

@@ -100,6 +100,11 @@ const CHAT_SURFACES: Readonly<Record<string, ActorSurface>> = {
   mcp: "mcp",
   cli: "cli",
   schedule: "schedule",
+  // The web chat (record 0043): a browser session speaks as text, so its
+  // `access:<sub>` is a chat credential too — the browser actor, its baseline
+  // and its entry. A service token never reaches the chat (the dashboard gate
+  // serves it `/api/*` only), so `access:svc:` is no chat surface.
+  access: "access-browser",
 };
 
 /** A chat message's `userId` is already namespaced by its adapter (`slack:U…`,

package/dist/assets/src/core/authz/grants.ts

@@ -62,10 +62,20 @@ export const CHAT_OPEN_ACTIONS: readonly string[] = [
   "mcp:write",
 ];
 
-/** What an Access browser session holds implicitly: every registered
- *  group's read — never a write, never an exec. */
-export function browserReadActions(commandGroups: readonly string[]): Set<string> {
-  return new Set(commandGroups.map((g) => `${g}:read`));
+/** The two writes a browser session holds beside its reads (record 0043): the
+ *  same personal writes every Slack user holds (`CHAT_OPEN_ACTIONS`), because
+ *  the web chat makes a browser session a chat user — `memory remember` and
+ *  `mcp add` for its own tier. The tier rows still decide the target: a shared
+ *  tier needs the grant it always needed. */
+export const BROWSER_WRITE_ACTIONS: readonly string[] = ["memory:write", "mcp:write"];
+
+/** What an Access browser session holds implicitly: every registered group's
+ *  read plus the two personal chat writes — never another write, never an exec.
+ *  No groups known (a process that registered no commands) → nothing at all,
+ *  fail-closed: the writes ride with the catalogue they belong to. */
+export function browserActions(commandGroups: readonly string[]): Set<string> {
+  if (commandGroups.length === 0) return new Set();
+  return new Set([...commandGroups.map((g) => `${g}:read`), ...BROWSER_WRITE_ACTIONS]);
 }
 
 // ---- the native `grants` block ----------------------------------------------
@@ -243,8 +253,9 @@ export interface GrantsTable {
   surfaces: Map<string, Grants>;
   /** What every `slack:` user holds, listed or not: the open chat commands and `agent:run:<name>` for every unrestricted agent. */
   everyone: Grants;
-  /** What every Access browser session (`access:<sub>`, never `access:svc:`) holds: each registered group's read. */
-  browserReads: Grants;
+  /** What every Access browser session (`access:<sub>`, never `access:svc:`) holds:
+   *  each registered group's read and the two personal chat writes. */
+  browser: Grants;
   restrict: Restriction;
 }
 
@@ -253,9 +264,9 @@ export interface GrantsTable {
  *  `<group>:read`. Every other namespace (`schedule:`, `access:svc:`, `http:`,
  *  `mcp:`) is a credential or a job that holds exactly what names it — an
  *  unlisted one is `NO_GRANTS` (fail-closed). */
-export function namespaceBaseline(actorId: string, table: Pick<GrantsTable, "everyone" | "browserReads">): Grants {
+export function namespaceBaseline(actorId: string, table: Pick<GrantsTable, "everyone" | "browser">): Grants {
   if (actorId.startsWith("slack:")) return table.everyone;
-  if (actorId.startsWith("access:") && !actorId.startsWith("access:svc:")) return table.browserReads;
+  if (actorId.startsWith("access:") && !actorId.startsWith("access:svc:")) return table.browser;
   return NO_GRANTS;
 }
 
@@ -271,7 +282,7 @@ export function grantsTable(source: GrantsSource): GrantsTable {
   const openAgents = (source.agentNames ?? []).filter((a) => !restrict.agents.has(a)).map(agentRunAction);
   const baselines = {
     everyone: { ...NO_GRANTS, actions: new Set([...CHAT_OPEN_ACTIONS, ...openAgents]) },
-    browserReads: { ...NO_GRANTS, actions: browserReadActions(source.commandGroups ?? []) },
+    browser: { ...NO_GRANTS, actions: browserActions(source.commandGroups ?? []) },
   };
   const grants = new Map<string, Grants>();
   const surfaces = new Map<string, Grants>();

package/dist/assets/src/core/coordinator/contract.ts

@@ -80,6 +80,22 @@ export function runFinishedEventType(runId: string): string {
   return `${RUN_FINISHED_EVENT_PREFIX}${runId}`;
 }
 
+/** The event the bot's GitHub check-run intake sends a merge-waiting parent:
+ *  the type carries the head sha (hex — inside the platform's alphabet), so a
+ *  driver waiting at that head matches its own event and any other head's is
+ *  buffered harmlessly. */
+export const CHECKS_SETTLED_EVENT_PREFIX = "checks-settled-";
+export function checksSettledEventType(headSha: string): string {
+  return `${CHECKS_SETTLED_EVENT_PREFIX}${headSha}`;
+}
+
+/** What the checks-settled event carries — the head and a clock; the parent
+ *  re-asks the merge door before it acts, so nothing more rides here. */
+export interface ChecksSettledPayload {
+  headSha: string;
+  settledAt: number;
+}
+
 /** What the event carries — ids, a status and a clock; the parent confirms
  *  through `read-record` before it acts, so nothing more rides here. */
 export interface RunFinishedPayload {
@@ -310,6 +326,27 @@ export type RunFinishedSend =
   | { kind: "no-binding"; instance: string }
   | { kind: "failed"; instance: string; type: string; reason: string };
 
+/** The one send per settled head (http-ingress.md item 12): best effort like
+ *  `sendRunFinished` — a refusal is answered, never thrown, and the parent's
+ *  bounded merge wait times out on its own. */
+export async function sendChecksSettled(
+  workflow: WorkflowSender | undefined,
+  instance: string,
+  headSha: string,
+  settledAt: number,
+): Promise<RunFinishedSend> {
+  if (!workflow) return { kind: "no-binding", instance };
+  const type = checksSettledEventType(headSha);
+  const payload: ChecksSettledPayload = { headSha, settledAt };
+  try {
+    const handle = await workflow.get(instance);
+    await handle.sendEvent({ type, payload });
+    return { kind: "sent", instance, type };
+  } catch (err) {
+    return { kind: "failed", instance, type, reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 /** The one send per committed terminal record (run-history item 47). */
 export async function sendRunFinished(
   workflow: WorkflowSender | undefined,

package/dist/assets/src/core/coordinator/driver.ts

@@ -57,7 +57,7 @@ import {
   type UnitPipelineInput,
   type UnitPipelineState,
 } from "../ship/coordinator.js";
-import { isCoordinatorUnit, runFinishedEventType, type CoordinatorUnit } from "./contract.js";
+import { checksSettledEventType, isCoordinatorUnit, runFinishedEventType, type CoordinatorUnit } from "./contract.js";
 
 const MIN = 60_000;
 
@@ -429,6 +429,22 @@ async function perform(
     case "sleep":
       await step.sleep(action.step, action.ms);
       return { type: "sleep", step: action.step };
+    case "wait-checks": {
+      // The intake's checks-settled event at the approved head (http-ingress.md
+      // item 12), with the machine's bounded timeout as the fallback: either
+      // way the machine re-asks the merge door, which is the guard.
+      let outcome: "event" | "timeout";
+      try {
+        await step.waitForEvent(action.step, {
+          type: checksSettledEventType(action.headSha),
+          timeout: action.timeoutMs,
+        });
+        outcome = "event";
+      } catch {
+        outcome = "timeout";
+      }
+      return { type: "wait-checks", step: action.step, outcome };
+    }
     case "merge":
       return mergeReturn(
         action.step,

package/dist/assets/src/core/coordinator/instancesRoute.ts

@@ -131,6 +131,78 @@ export function parseInstanceStatusPath(pathname: string): string | undefined {
   return INSTANCE_ID_PATTERN.test(id) ? id : undefined;
 }
 
+/** `POST /admin/coordinator/instances/<id>/events` — the shim's event relay
+ *  (docs/reference/specs/http-ingress.md item 12): the bot holds no Workflow
+ *  binding, so the check-run intake sends `checks-settled-<head>` through this
+ *  route and the shim's own `SHIP_COORDINATOR.get(id).sendEvent` delivers it. */
+export const COORDINATOR_INSTANCE_EVENTS_SUFFIX = "/events";
+
+/** The instance id an event path names, or undefined for any other path. */
+export function parseInstanceEventPath(pathname: string): string | undefined {
+  if (!pathname.startsWith(COORDINATOR_INSTANCE_STATUS_PREFIX)) return undefined;
+  if (!pathname.endsWith(COORDINATOR_INSTANCE_EVENTS_SUFFIX)) return undefined;
+  const id = pathname.slice(
+    COORDINATOR_INSTANCE_STATUS_PREFIX.length,
+    pathname.length - COORDINATOR_INSTANCE_EVENTS_SUFFIX.length,
+  );
+  return INSTANCE_ID_PATTERN.test(id) ? id : undefined;
+}
+
+export type ParsedSendEvent = { ok: true; type: string; payload: unknown } | { ok: false; reason: string };
+
+/** The Workflow event alphabet — what the engine's `sendEvent` accepts as a type. */
+const EVENT_TYPE_PATTERN = /^[A-Za-z0-9_-]{1,100}$/;
+
+/** The body: `{ type, payload? }` — the typed event the instance's `waitForEvent` waits on. */
+export function parseSendEventRequest(text: string): ParsedSendEvent {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { ok: false, reason: "body is not valid JSON" };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+    return { ok: false, reason: "body must be a JSON object" };
+  const b = parsed as Record<string, unknown>;
+  if (typeof b.type !== "string" || !EVENT_TYPE_PATTERN.test(b.type))
+    return { ok: false, reason: "`type` must be a Workflow event type: letters, digits, `_` and `-`, at most 100" };
+  return { ok: true, type: b.type, payload: b.payload };
+}
+
+/** How the send ended on the shim: delivered, no such instance (the engine's
+ *  own `instance.not_found`), or the engine refusing by reason (an instance
+ *  that already ended is a refusal, not an absence). */
+export type SendEventOutcome =
+  { kind: "sent"; id: string } | { kind: "absent"; id: string } | { kind: "failed"; id: string; reason: string };
+
+export function sendEventResponse(outcome: SendEventOutcome): { status: number; body: Record<string, unknown> } {
+  switch (outcome.kind) {
+    case "sent":
+      return { status: 200, body: { ok: true, id: outcome.id, sent: true } };
+    case "absent":
+      return { status: 404, body: { ok: false, error: "no_instance", id: outcome.id } };
+    case "failed":
+      return { status: 502, body: { ok: false, error: "send_failed", id: outcome.id, message: outcome.reason } };
+  }
+}
+
+/** The send answer as the bot reads it back: sent, absent, or unanswered by reason. */
+export type SendEventAnswer = { kind: "sent" } | { kind: "absent" } | { kind: "unanswered"; reason: string };
+
+export function readSendEventAnswer(status: number, text: string): SendEventAnswer {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = undefined;
+  }
+  const body = typeof parsed === "object" && parsed !== null ? (parsed as Record<string, unknown>) : undefined;
+  if (status === 200 && body?.ok === true && body.sent === true) return { kind: "sent" };
+  if (status === 404 && body?.error === "no_instance") return { kind: "absent" };
+  const detail = typeof body?.error === "string" ? body.error : text.slice(0, 200);
+  return { kind: "unanswered", reason: `HTTP ${status} — ${detail}` };
+}
+
 /** How the status read ended on the shim: the platform's status word, no such
  *  instance, or the engine failing by reason. */
 export type InstanceStatusOutcome =

package/dist/assets/src/core/costs.ts

@@ -762,10 +762,15 @@ export function anthropicTokensCostUsd(modelId: string, t: AnthropicTokens): num
 // ---- range ----------------------------------------------------------------------------
 
 const DEFAULT_DAYS = 30;
-/** The widest range the page offers — and the window a costs snapshot is read for. */
-export const MAX_DAYS = 90;
-
-/** `?days=N` → a UTC date range ending today. Garbage → default; clamped 1..90. */
+/** The widest range the page offers — and the window a costs snapshot is read for.
+ *  Cloudflare's analytics on a Workers account answer no range wider than 4w4d
+ *  (32 days) and hold no data older than that (`cannot request a time range
+ *  wider than 4w4d`, `cannot request data older than 4w4d` — measured live), so
+ *  a wider window is a refused read, not more history: 31 UTC days is the most
+ *  a take can ask for. */
+export const MAX_DAYS = 31;
+
+/** `?days=N` → a UTC date range ending today. Garbage → default; clamped 1..31. */
 export function resolveRange(daysParam: string | null, now: Date = new Date(systemClock())): DateRange {
   const parsed = daysParam === null ? NaN : Number(daysParam);
   const days = Number.isInteger(parsed) ? Math.min(MAX_DAYS, Math.max(1, parsed)) : DEFAULT_DAYS;
@@ -1070,7 +1075,7 @@ export class AnthropicCostReportSource implements LlmCostSource {
     if (range.from >= endExclusive) return { rows, closedThrough };
     let page: string | null = null;
     for (let i = 0; ; i++) {
-      // Like the non-USD check: refuse rather than mis-sum. A ≤90-day range at
+      // Like the non-USD check: refuse rather than mis-sum. A ≤31-day range at
       // limit=31 is at most 3 pages, so hitting the cap means the API changed.
       if (i >= MAX_COST_PAGES)
         throw new Error(